Latest revision as of 22:53, 4 February 2020

Text

Technical Specification Bases Manual
	ML16334A265
Person / Time
Site:	Susquehanna
Issue date:	11/17/2016
From:	Gerlach R; Susquehanna, Talen Energy
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML16334A265 (713)
	v • d • e

l'JUV * .J.1 1 L.U..l.0 Page 1 of 16

MANUAL HARD COPY DISTRIBUTION.

DOCUMENT TRANSMITTAL 2016-38382 USER INFORMATION:

GERLACH*ROSEY M EMPL#:028401 CA#: 0363 Address: NUCSA2 Phone#: 542-3194 TRANSMITTAL INFORMATION:

TO: GERLACH*ROSEY M 11/17/2016 LOCATION: USNRC FROM: NUCLEAR RECORDS DOCUMENT CONTROL CENTER (NUCSA-2)

THE FOLLOWING CHANGES HAVE OCCURRED TO THE HARDCOPY OR ELECTRONIC MANUAL ASSIGNED TO YOU. HARDCOPY USERS MUST ENSURE THE DOCUMENTS PROVIDED MATCH THE INFORMATION ON THIS TRANSMITTAL. WHEN REPLACING THIS MATERIAL IN YOUR HARDCOPY MANUAL, ENSURE THE UPDATE DOCUMENT ID IS THE SAME DOCUMENT ID YOU'RE REMOVING FROM YOUR MANUAL. TOOLS OM THE HUMAN PERFORMANCE TOOL BAG SHOULD BE UTILIZED TO ELIMINATE THE CHANCE OF

RORS.

ATTENTION: "REPLACE" directions do not affect the Table of Contents, Therefore no TOC will be issued with the updated material.

TSB2 - TECHNICAL SPECIFICATIONS BASES UNIT 2 MANUAL REMOVE MANUAL TABLE OF CONTENTS DATE: 02/02/2016 ADD MANUAL TABLE OF ~ONTENTS DATE: 11/16/2016 CATEGORY: DOCUMENTS TYPE: TSB2

J."UV. .LI I ~U.LO Page 2 of

ID: TEXT 3.1.3 ADD: REV: 3 REMOVE: REV:2 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.1.4 REMOVE: REV: 4 ADD: REV: 5 CATEGORY: DOCUMENTS TYPE: TSB2 ID : TEXT 3 . 1. 5 REMOVE: REV: 1 ADD: REV: 2 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3 .1.6

~MOVE: REV:3 ADD: REV: 4 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.1.7 REMOVE: REV: 3 ADD: REV: 4 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.1.8 ADD: REV: 4

.L'IUV * .L/ 1 L.U.LO Page 3 of 16

REMOVE: REV:3 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.10.2 ADD: REV: 1 REMOVE: REV:O

.CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.10.3 REMOVE: REV:O ADD: REV: 1 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.10.4 ADD: REV: 1 REMOVE: REV:O

.TEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.10.5 ADD: REV: 1 REMOVE: REV:O CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.10.6 ADD: REV: 1 REMOVE: REV:O CATEGORY: DOCUMENTS TYPE: TSB2

l'lUV . .L/ 1 ~U.LO Page 4 of 16

ID: TEXT 3.10.8 REMOVE: REV: 2 ADD: REV: 3 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.2.l ADD: REV: 5 REMOVE: REV:4 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.2.2 ADD: REV: 4 REMOVE: REV:3 CATEGORY: DOCUMENTS *TYPE: TSB2 ID: TEXT 3.2.3

~MOVE: REV:2 ADD: REV: 3 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.3.1.1 REMOVE: REV: 5 ADD: REV: 6 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.3.1.2 REMOVE: REV:2

l.'IUV * .J. 1 1 L:.U..LO Page 5 of 16

ADD: REV: 3 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.3.2.1 REMOVE: REV:3 ADD: REV: 4 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.3.2.2 ADD: REV: 3 REMOVE: REV:2 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.3.3.1 REMOVE: REV:8 ADD: REV: 9

.TEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.3.3.2 ADD: REV: 2 REMOVE: REV:l CATEGORY: DOCUMENTS TYPE: TSB2 ,

i ID: TEXT 3.3.4.1 ADD: REV: 2 REMOVE: REV:l CATEGORY: DOCUMENTS TYPE: TSB2

l.'\IUV * .L/ 1 L.U.J.O Page 6 of 16

ID: TEXT 3.3.4.2 REMOVE: REV: 0 ADD: REV: 1 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.3.5.1 REMOVE: REV:5 ADD: REV: 6 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.3.5.2 ADD: REV: 1 REMOVE: REV:O CATEGORY: DOC~ENTS TYPE: TSB2 ID: TEXT 3.3.6.1 REV: 8

.D: _)

REMOVE:* REV:7 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.3.6.2 REMOVE: REV:4 ADD: REV: 5 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.3.7.1 REMOVE: REV:2

(

1'\IUV * .J...1 1 ~U.J...O Page 7 of 16

ADD: REV: 3 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.3.8.1 REMOVE: REV: 3 ADD: REV: 4 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.3.8.2 ADD: REV: 1 REMOVE: REV:O CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.4.1 ADD: REV: 5 REMOVE: REV:4

~TEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.4.10 REMOVE : REV: 4 ADD: REV: 5 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.4.11 REMOVE : REV: 0 ADD: REV: 1 CATEGORY: DOCUMENTS TYPE: TSB2

l\IUV * .LI 1 L.U..1.0 Page 8 of 16

ID: TEXT 3.4.2 REMOVE : REV: 3 ADD: REV: 4 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.4.4 ADD: REV: 1 REMOVE: REV:O CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.4.6 REMOVE : REV: 4 ADD: REV: 5 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.4.7 REV: 3 REMOVE: REV:2 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.4.8 REMOVE: . REV:2 ADD: REV: 3 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.4.9 REMOVE: REV:l

l'IUV * .LI 1 £.U.LO Page 9 of 16

ADD: REV: 2 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.5.1 ADD: REV: 5 REMOVE: REV:4 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.5.2 ADD: REV: 3 REMOVE: REV:2 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.5.3 REMOVE: REV:3 ADD: REV: 4

.TEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.1.1 ADD: REV: 6 REMOVE: REV:5 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.1.2 ADD: REV: 2 REMOVE: REV:l CATEGORY: DOCUMENTS TYPE: TSB2

1'\IUV * ..L/ 1 L.U.LO Page 10 of 16

ID: TEXT 3.6.1.3 REMOVE : REV: 14 ADD: REV: 15 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.1.4 ADD: REV: 2 REMOVE: REV:l CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.1.5 ADD: REV: 2 REMOVE: REV:l CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.1.6 REV: 1 REMOVE: REV:O CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.2.1 REMOVE : REV: 2 ADD: REV: 3 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.2.2 REMOVE: REV:O

l'IUV * .J... I 1 .GU.J.O Page 11 of 16

ADD: REV: 1 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.2.3 REMOVE : REV: 1 ADD: REV: 2 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.2.4 ADD: REV: 1 REMOVE: REV:O CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.3.2 ADD: REV: 2 REMOVE: REV:l

.TEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.3.3 ADD: REV: 2 REMOVE: REV:l CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.4.l ADD: REV: 13 REMOVE: REV:l2 CATEGORY: DOCUMENTS TYPE: TSB2

l'llUV .. J.. J 1 ~U.LO Page 12 of 16

ID: TEXT 3.6.4.2 ADD: REV: 11 REMOVE: REV:lO CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.6.4.3 ADD: REV: 5 REMOVE: REV:4 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.7.1 ADD: REV: 6 REMOVE: REV:S CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.7.2

.MOVE: REV: 2 ADD: REV: 3 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.7.3 REMOVE : REV: 1 ADD: REV: 2 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.7.4 REMOVE: REV:O

.L'.IUV * ..L/1 .GU.1.0 Page 13 of 16

ADD: REV: 1 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.7.5 REMOVE : REV: 1 ADD: REV: 2 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.7.6 REMOVE : REV: 3 ADD: REV: 4 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.7.7 ADD: REV: 2 REMOVE : REV: 1

~TEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.7.8 REMOVE : REV: 0 ADD: REV: 1 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.8.1 ADD: REV: 10 REMOVE: REV:9 CATEGORY: DOCUMENTS TYPE: TSB2

l'IUV * .l.. I I L:.U.LO Page 14 of 16

ID: TEXT 3.8.3 REMOVE: REV: 4 ADD: REV: 5 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.8.4 REMOVE: REV: 3 ADD: REV: 4 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.8.6 REMOVE: REV: 1 ADD: REV: 2 CATEGORY: DOCUMENTS TYPE: TSB2

.D:

ID: TEXT 3.8.7 REMOVE:

REV: 5 REV:4 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.8.8 REMOVE : REV: 0 ADD: REV: 1 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.9.1 ADD: REV: 1

l.~UV * .LI 1 ~U.LO Page 15 of

REMOVE: REV:O CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.9.2 REMOVE : REV: 1 ADD: REV: 2 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.9.3 REMOVE : REV: 0 ADD: REV: 1 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.9.5 ADD: REV: 1 REMOVE: REV:O

~TEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.9.6 ADD: REV: 2 REMOVE : REV: 1 CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT 3.9.7 ADD: REV: 1 REMOVE: REV:O CATEGORY: DOCUMENTS TYPE: TSB2

J.'llUV. J.1 1 L.UJ.O Page 16 of 16

ID:

ADD:

TEXT 3.9.8 REV: 1 REMOVE: REV:O CATEGORY: DOCUMENTS TYPE: TSB2 ID: TEXT LOES REMOVE: REV:126 ADD: REV: 127 ANY DISCREPANCIES WITH THE MATERIAL PROVIDED, CONTACT DCS @ X3107 OR X3136 FOR ASSISTANCE. UPDATES FOR HARDCOPY MANUALS WILL BE DISTRIBUTED WITHIN 3 DAYS IN ACCORDANCE WITH DEPARTMENT PROCEDURES. PLEASE MAKE ALL CHANGES AND ACKNOWLEDGE COMPLETE IN YOUR NIMS INBOX UPON COMPLETION OF UPDATES. FOR ELECTRONIC MANUAL USERS, ELECTRONICALLY REVIEW THE APPROPRIATE DOCUMENTS AND ACKNOWLEDGE COMPLETE IN YOUR NIMS INBOX .

SSES MANUAL Manual Name: TSB2

~anual

Title:

TECHNICAL SPECIFICATIONS BASES UNIT 2 MANUAL Table Of Contents Issue Date: 11/16/2016 Procedure Name Rev Issue Date Change ID Change Number TEXT LOEB 127 11/16/2016

Title:

LIST OF EFFECTIVE SECTIONS TEXT TOC 22 07/02/2014

Title:

TABLE OF CONTENTS TEXT 2.1 . 1 5 01/22/2015

Title:

SAFETY LIMITS (SLS) REACTOR CORE SLS TEXT 2.1.2 1 10/04/2007

Title:

SAFETY LIMITS (SLS) REACTOR COOLANT SYSTEM (RCS) PRESSURE SL TEXT 3.0 3 08/20/2009

- Titl e : LIMITING CONDITION FOR OPERATION (LCO) APPL I CABILITY TEXT 3 . 1.1 1 03/24/2005

Title:

REACTIVITY CONTROL SYSTEMS SHUTDOWN MARGIN (SDM)

TEXT 3 . 1.2 0 11/18/2002

Title:

REACTIVITY CONTROL SYSTEMS REACTIVITY ANOMALIES TEXT 3.1.3 3 11/16/2016

Title:

REACTIVITY CONTROL SYSTEMS CONTROL ROD OPERABILITY TEXT 3.1.4 5 11/16/2016

Title:

REACTIVITY CONTROL SYSTEMS CONTROL ROD SCRAM TIMES TEXT 3 . 1.5 2 11/16/2016

Title:

REACTIVITY CONTROL SYSTEMS CONTROL ROD SCRAM ACCUMULATORS TEXT 3.1.6 4 11/16/2016

Title:

REACTIVITY CONTROL SYSTEMS ROD PATTERN CONTROL Page 1 of 8 Report Date: 11/16/16

SSES MANUAL Manual Name: TSB2

~nual

Title:

TECHNICAL SPECIFICATIONS BASES UNIT 2 MANUAL TEXT 3 . 1 . 7 4 11/16/2016

Title:

REACTIVITY CONTROL SYSTEMS STANDBY LIQUID CONTROL (SLC) SYSTEM TEXT 3 . 1.8 4 11/16/2016 Title : REACTIVITY CONTROL SYSTEMS SCRAM DISCHARGE VOLUME (SDV) VENT AND DRAIN VALVES TEXT 3 . 2 . l 5 11/16/2016

Title:

POWER DISTRIBUTION LIMITS AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)

TEXT 3.2 . 2 4 11/ 1 6/2016

Title:

POWER DISTRIBUTION LIMITS MINIMUM CRITICAL POWER RATIO (MCPR)

TEXT 3.2 . 3 3 11/16/2016

Title:

POWER DISTRIBUTION LIMITS LINEAR HEAT GENERATION RATE LHGR

i::Wi EXT 3. 3 .1.1 6 11/16/2016

Title:

INSTRUMENTATION REACTOR PROTECTION SYSTEM (RPS)

TEXT 3.3.1.2 3 11/16/2 01 6 INSTRUMENTATION

Title:

INSTRUMENTATION SOURCE RANGE MONITOR (SRM) INSTRUMENTATION TEXT 3.3.2. 1 4 11/16/2016

Title:

INSTRUMENTATION CONTROL ROD BLOCK INSTRUMENTATION TEXT 3.3.2.2 3 11/16/2016

Title:

INSTRUMENTATION FEEDWATER - MAIN TURBINE HIGH WATER LEVEL TRIP INSTRUMENTATION TEXT 3.3.3.1 9 11/16/2016

Title:

I NSTRUMENTATION POST ACCIDENT MONITORING (PAM) INSTRUMENTATION TEXT 3.3 . 3 .2 2 11/16/2016

Title:

INSTRUMENTATION REMOTE SHUTDOWN SYSTEM TEXT 3.3. 4 . 1 2 11/16/201 6

Title:

INSTRUMENTATION END OF CYCLE RECIRCULATION PUMP TRIP (EOC -RPT) INSTRUMENTATION

Page 2 of 8 Report Date : 11/16/16

SSES MANUAL Manual Name: TSB2

~Janual

Title:

TECHNICAL SPECIFICATIONS BASES UNIT 2 MANUAL TEXT 3.3.4.2 1 11/16/2016

Title:

INSTRUMENTATION ANTICIPATED TRANSIENT WITHOUT SCRAM RECIRCULATION PUMP TRIP (ATWS-RPT) INSTRUMENTATION TEXT 3.3.5.1 6 11/16/2016

Title:

INSTRUMENTATION EMERGENCY CORE COOLING SYSTEM (ECCS) INSTRUMENTATION TEXT 3.3.5.2 1 11/16/2016

Title:

INSTRUMENTATION REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM INSTRUMENTATION TEXT 3.3.6.l 8 11/16/2016

Title:

INSTRUMENTATION PRIMARY CONTAINMENT ISOLATION INSTRUMENTATION TEXT 3.3.6.2 5 11/16/2016

Title:

INSTRUMENTATION SECONDARY CONTAINMENT ISOLATION INSTRUMENTATION

~.EXT 3. 3. 7 .1 3 11/16/2016

Title:

INSTRUMENTATION CONTROL ROOM EMERGENCY OUTSIDE AIR SUPPLY (CREOAS) SYSTEM INSTRUMENTATION TEXT 3.3.8.1 4 11/16/2016

Title:

INSTRUMENTATION LOSS OF POWER (LOP) INSTRUMENTATION TEXT 3.3.8.2 1 11/16/2016

Title:

INSTRUMENTATION REACTOR PROTECTION SYSTEM (RPS) ELECTRIC POWER MONITORING TEXT 3.4.l 5 11/16/2016

Title:

REACTOR COOLANT SYSTEM (RCS) RECIRCULATION LOOPS OPERATING TEXT 3.4.2 4 11/16/2016

Title:

REACTOR COOLANT SYSTEM (RCS) JET PUMPS TEXT 3.4.3 3 01/13/2012

Title:

REACTOR COOLANT SYSTEM (RCS) SAFETY/RELIEF VALVES (S/RVS)

TEXT 3.4.4 1 11/16/2016 Page 3

Title:

REACTOR COOLANT SYSTEM (RCS) RCS OPERATIONAL LEAKAGE of 8 Report Date: 11/16/16

SSES MANUAL Manual Name: TSB2

~* ~~anual

Title:

TECHNICAL SPECIFICATIONS BASES UNIT 2 MANUAL TEXT 3.4.5 3 03/10/2010

Title:

REACTOR COOLANT SYSTEM (RCS) RCS PRESSURE ISOLATION VALVE (PIV) LEAKAGE TEXT 3.4.6 5 11/16/2016

Title:

REACTOR COOLANT SYSTEM (RCS) RCS LEAKAGE DETECTION INSTRUMENTATION TEXT 3.4.7 3 11/16/2016

Title:

REACTOR COOLANT SYSTEM (RCS) RCS SPECIFIC ACTIVITY TEXT 3.4.8 3 11/16/2016

Title:

REACTOR COOLANT SYSTEM (RCS) RESIDUAL HEAT REMOVAL (RHR) SHUTDOWN COOLING SYSTEM

- HOT SHUTDOWN TEXT 3.4.9 2 11/16/2016

Title:

REACTOR COOLANT SYSTEM (RCS) RESIDUAL HEAT REMOVAL (RHR) SHUTDOWN COOLING SYS'l'EM

- COLD SHUTDOWN

- "EXT 3.4.10 5 11/16/2016

Title:

REACTOR COOLANT SYSTEM (RCS) RCS PRESSURE AND TEMPERATURE (P/T) LIMITS TEXT 3.4.11 1 11/16/2016

Title:

REACTOR COOLANT SYSTEM (RCS) REACTOR STEAM DOME PRESSURE TEXT 3.5.1 5 11/16/2016

Title:

EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC)

SYSTEM ECCS - OPERATING TEXT 3.5.2 3 11/16/2016

Title:

EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC)

SYSTEM ECCS - SHUTDOWN TEXT 3.5.3 4 11/16/2016

Title:

EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC)

SYSTEM RCIC SYSTEM TEXT 3.6.1.1 6 11/16/2016

Title:

PRIMARY CONTAINMENT TEXT 3.6.1.2 2 11/16/2016

Title:

CONTAINMENT SYSTEMS PRIMARY CONTAINMENT AIR LOCK Page 4 of 8 Report Date: 11/16/16

SSES MANUAL Manual Name: TSB2

~<anual

Title:

TECHNICAL SPECIFICATIONS BASES UNIT 2 MANUAL TEXT 3.6.1.3 15 11/16/2016

Title:

CONTAINMENT SYSTEMS PRIMARY CONTAINMENT ISOLATION VALVES (PCIVS)

TEXT 3.6.1.4 2 11/16/2016

Title:

CONTAINMENT SYSTEMS CONTAINMENT PRESSURE TEXT 3.6.1.5 2 11/16/2016

Title:

CONTAINMENT SYSTEMS DRYWELL AIR TEMPERATURE TEXT 3.6.1.6 1 11/16/2,016

Title:

CONTAINMENT SYSTEMS SUPPRESSION CHAMBER-TO-DRYWELL VACUUM BREAKERS TEXT 3.6.2.l 3 11/16/2016

Title:

CONTAINMENT SYSTEMS SUPPRESSION POOL AVERAGE TEMPERATURE

.,:EXT 3.6.2.2 1 11/16/2016

Title:

CONTAINMENT SYSTEMS SUPPRESSION POOL WATER LEVEL TEXT 3.6.2.3 2 11/16/2016

Title:

CONTAINMENT SYSTEMS RESIDUAL HEAT REMOVAL (RHR) SUPPRESSION POOL COOLING TEXT 3.6.2.4 1 11/16/2016

Title:

CONTAINMENT SYSTEMS RESIDUAL HEAT REMOVAL (RHR) SUPPRESSION POOL SPRAY TEXT 3.6.3.l 2 06/13/2006

Title:

CONTAINMENT SYSTEMS PRIMARY CONTAINMENT HYDROGEN RECOMBINERS TEXT 3.6.3.2 2 11/16/2016

Title:

CONTAINMENT SYSTEMS DRYWELL AIR FLOW SYSTEM TEXT 3.6.3.3 2 11/16/2016

Title:

CONTAINMENT SYSTEMS PRIMARY CONTAINMENT OXYGEN CONCENTRATION TEXT 3 6 4 1 13 11/16/2016

~ Tit~e: ~ONTAINMENT SYSTEMS SECONDARY CONTAINMENT Page 5 of 8 Report Date: 11/16/16

f-SSES MANUAL Manual Name:

TSB2

. 'anual

Title:

TECHNICAL SPECIFICATIONS BASES UNIT 2 MANUAL TEXT 3.6.4.2 11 11/16/2016

Title:

CONTAINMENT SYSTEMS SECONDARY CONTAINMENT ISOLATION VALVES (SCIVS)

TEXT 3.6.4.3 5 11/16/2016

Title:

CONTAINMENT SYSTEMS STANDBY GAS TREATMENT (SGT) SYSTEM TEXT 3.7.1 6 11/16/2016

Title:

PLANT SYSTEMS RESIDUAL HEAT REMOVAL SERVICE WATER (RHRSW) SYSTEM AND THE ULTIMATE HEAT SINK (UHS)

TEXT 3.7.2 3 11/16/2016

Title:

PLANT SYSTEMS EMERGENCY SERVICE WATER (ESW) SYSTEM TEXT 3.7.3 2 11/16/2016

Title:

PLANT SYSTEMS CONTROL ROOM EMERGENCY OUTSIDE AIR SUPPLY (CREOAS) SYSTEM

- - - 'EXT 3 . 7 . 4 1 11/16/2016

Title:

PLANT SYSTEMS CONTROL ROOM FLOOR COOLING SYSTEM TEXT 3.7.5 2 11/16/2016

Title:

PLANT SYSTEMS MAIN CONDENSER OFFGAS TEXT 3.7.6 4 11/16/2016

Title:

PLANT SYSTEMS MAIN TURBINE BYPASS SYSTEM TEXT 3.7.7 2 11/16/2016

Title:

PLANT SYSTEMS SPENT FUEL STORAGE POOL WATER LEVEL TEX'!' 3 . 7 . 8 1 11/16/2016

Title:

MAINE TURBINE PRESSURE REGULATION SYSTEM TEXT 3.8.1 10 11/16/2016

Title:

ELECTRICAL POWER SYSTEMS AC SOURCES - OPERATING TEXT 3.8.2 0 11/18/2002

Title:

ELECTRICAL POWER SYSTEMS AC SOURCES - SHUTDOWN Page 6 of 8 Report Date: 11/16/16

SSES MANUAL Manual Name: TSB2

~~anual

Title:

TECHNICAL SPECIFICATIONS BASES UNIT 2 MANUAL TEXT 3.8.3 5 11/16/2016

Title:

ELECTRICAL POWER SYSTEMS DIESEL FUEL OIL LUBE OIL AND STARTING AIR TEXT 3.8.4 4 11/16/2016

Title:

ELECTRICAL POWER SYSTEMS DC SOURCES - OPERATING TEXT 3.8.5 1 12/14/2006

Title:

ELECTRICAL POWER SYSTEMS DC SOURCES - SHUTDOWN TEXT 3.8.6 2 11/16/2016

Title:

ELECTRICAL POWER SYSTEMS BATTERY CELL PARAMETERS TEXT 3.8.7 5 11/16/2016

Title:

ELECTRICAL POWER SYSTEMS DISTRIBUTION SYSTEMS - OPERATING

~{EXT 3.8.8 1 11/16/2016

Title:

ELECTRICAL POWER SYSTEMS DISTRIBUTION SYSTEMS - SHUTDOWN TEXT 3.9.l 1 11/16/2016

Title:

REFUELING OPERATIONS REFUELING EQUIPMENT INTERLOCKS TEXT 3. 9.. 2 2 11/16/2016

Title:

REFUELING OPERATIONS REFUEL POSITION ONE-ROD-OUT INTERLOCK TEXT 3.9.3 1 11/16/2016

Title:

REFUELING OPERATIONS CONTROL ROD POSITION TEXT 3.9.4 0 11/18/2002

Title:

REFUELING OPERATIONS CONTROL ROD POSITION INDICATION TEXT 3.9.5 1 11/16/2016

Title:

REFUELING OPERATIONS CONTROL ROD OPERABILITY - REFUELING TEXT 3.9.6 2 11/16/2016

~o

Title:

REFUELING OPERATIONS REACTOR PRESSURE VESSEL (RPV) WATER LEVEL Page 7 of 8 Report Date: 11/16/16

SSES MANUAL Manual Name: TSB2

-~anual

Title:

TECHNICAL SPECIFICATIONS* BASES UNIT 2 MANUAL TEXT 3.9.7 1 11/16/2016

Title:

REFUELING OPERATIONS RESIDUAL HEAT REMOVAL (RHR) - HIGH WATER LEVEL TEXT 3.9.8 1 11/16/2016

Title:

REFUELING OPERATIONS RESIDUAL HEAT REMOVAL (RHR) - LOW WATER LEVEL TEXT 3.10.1 1 01/23/2008

Title:

SPECIAL OPERATIONS INSERVICE LEAK AND HYDROSTATIC TESTING OPERATION TEXT 3.10.2 1 11/16/2016

Title:

SPECIAL OPERATIONS REACTOR MODE SWITCH INTERLOCK TESTING TEXT 3.10.3 1 11/16/2016

Title:

SPECIAL OPERATIONS SINGLE CONTROL ROD WITHDRAWAL - HOT SHUTDOWN

. , 'EXT 3.10.4 1 11/16/2016

Title:

SPECIAL OPERATIONS SINGLE CONTROL ROD WITHDRAWAL - COLD SHUTDOWN TEXT 3.10.5 1 11/16/2016

Title:

SPECIAL OPERATIONS SINGLE CONTROL ROD DRIVE (CRD) REMOVAL - REFUELING TEXT 3.10.6 1 11/16/2016

Title:

SPECIAL OPERATIONS MULTIPLE CONTROL ROD WITHDRAWAL - REFUELING TEXT 3.10.7 1 03/24/2005

Title:

SPECIAL OPERATIONS CONTROL ROD TESTING - OPERATING TEXT 3.10.8 3 11/16/2016

Title:

SPECIAL OPERATIONS SHUTDOWN MARGIN ( SDM) TEST - REFUELING Page 8 of 8 Report Date: 11/16/16

SUSQUEHANNA STEAM ELECTRIC STATION

LIST OF EFFECTIVE SECTIONS (TECHNICAL SPECIFICATIONS BASES)

Section TOC B 2.0 Title Revision Table of Contents ..............................................................................................22 SAFETY LIMITS (SLs) 82.1.1 Reactor Core SLs ............................................................................................... 5 82.1.2 Reactor Coolant System (RCS) Pressure SL ...................................................... 1 B 3.0 LCO AND SR APPLICABILITY BASES .............................................................. 3 8 3.1 REACTIVITY CONTROL SYSTEMS B3.1.1 Shutdown Margin (SOM) ..................................................................................... 2 B3.1.2 Reactivity Anomalies .......................................................................................... 1 B3.1.3 Control Rod OPERABILITY .......... : ..................................................................... 3 83.1.4 Control Rod Scram Times ................................................................................... 5 83.1.5 Control Rod Scram Accumulators ................................... , ................................... 2 83.1.6 Rod Pattern Control ............................................................................................ 4 B3.1.7 Standby Liquid Control (SLC) System ................................................................. 3 B3.1.8 Scram Discharge Volume (SDV) Vent and Drain Valves ..................................... 4 8 3.2 POWER DISTRIBUTION LIMITS B3.2.1 Average Planar Linear Heat Generation Rate (APLHGR) ................................... 5 B3.2.2 Minimum Critical Power Ratio (MCPR) ...............................................................4 83.2.3 Linear Heat Generation Rate (LHGR) ................................................................. 3 B 3.3 INSTRUMENTATION 83.3.1.1 Reactor Protection System (RPS) Instrumentation ............................................. 6 83.3.1.2 Source Range Monitor (SRM) Instrumentation ................... ~ ............................... 3 B3.3.2.1 Control Rod Block Instrumentation ..................................................................... 4 B3.3.2.2 Feedwater - Main Turbine High Water Level Trip Instrumentation ..................... 3 83.3.3.1 Post Accident Monitoring (PAM) Instrumentation ................................................ 9 83.3.3.2 Remote Shutdown System ................................................................................. 2 83.3.4.1 End of Cycle Recirculation Pump Trip (EOC-RPT) Instrumentation ................... 2 83.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip (ATVVS-RPT) lnstrumentation ............................................................ 1 83.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation .................................. 6 83.3.5.2 Reactor Core Isolation Cooling (RCIC) System Instrumentation ........................ 1 83.3.6.1 Primary Containment Isolation Instrumentation ................................................... 8 83.3.6.2 Secondary Containment Isolation Instrumentation .............................................. 5 83.3.7.1 Control Room Emergency Outside Air Supply (CREOAS)

System Instrumentation ...................................................................................... 3 83.3.8.1 Loss of Power (LOP) Instrumentation ................................................................. 4 B3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring .............................. 1

SUSQUEHANNA - UNIT 2 TS I B LOES-1 Revision 127

SUSQUEHANNA STEAM ELECTRIC STATION

UST OF EFFECTIVE SECTIONS (TECHNICAL SPECIFICATIONS BASES)

Section 8 3.4 Title REACTOR COOLANT SYSTEM (RCS)

Revision 83.4.1 Recirculation Loops Operating ............................................................................ 5 83.4.2 Jet Pumps ....................................................................................................... 4 83.4.3 Safety/Relief Valves (S/RVs) .............................................................................. 4 83.4.4 RCS Operational LEAKAGE ............................................................................... 1 83.4.5 RCS Pressure Isolation Valve (PIV) Leakage ..................................................... 4 83.4.6 RCS Leakage Detection Instrumentation ............................................................ 5 83.4.7 RCS Specific Activity .......................................................................................... 3 83.4.8 Residual Heat Removal (RHR) Shutdown Cooling System - Hot Shutdown ..................................................................................... 3 83.4.9 Residual Heat Removal (RHR) Shutdown Cooling System - Cold Shutdown .................................................................................... 2 83.4.10 RCS Pressure and Temperature (PIT) Limits ...................................................... 5 83.4.11 Reactor Steam Dome Pressure .......................................................................... 1 8 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM 83.5.1 ECCS - Operating .............................................................................................. 5 83.5.2 ECCS - Shutdown .............................................................................................. 3

83.5.3 8 3.6 83.6.1.1 83.6.1.2 RCIC System ...................................................................................................... 3 CONTAINMENT SYSTEMS Primary Containment ..... ~ .................................................................................... 6 Primary Containment Air Lock ............................................................................ 2 83.6.1.3 Primary Containment Isolation Valves (PCIVs) .................................................. 15 83.6.1.4 Containment Pressure ................................................ :....................................... 2 83.6.1.5 Drywell Air Temperature ..................................................................................... 2 83.6.1.6 Suppression Chamber-to-Drywell Vacuum Breakers .......................................... 1 83.6.2.1 Suppression Pool Average Temperature ............................................................ 3 83.6.2.2 Suppression Pool Water Level.. .......................................................................... 1 83.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling .................................. 2 83.6.2.4 Residual Heat Removal (RHR) Suppression Pool Spray ............... .' .................... 1 83.6.3.1 Not Used ....................................................................................................... 2 83.6.3.2 Drywell Air Flow System ..................................................................................... 2 83.6.3.3 Primary Containment Oxygen Concentration ...................................................... 2 83.6.4.1 Secondary Containment ........................................, ........................................... 13 83.6.4.2 Secondary Containment Isolation Valves (SC IVs) ............................................. 11 83.6.4.3 Standby Gas Treatment (SGT) System 5

SUSQUEHANNA - UNIT 2 TS I 8 LOES-2 Revision 127

SUSQUEHANNA STEAM ELECTRIC STATION

LIST OF EFFECTIVE SECTIONS (TECHNICAL SPECIFICATIONS BASES)

Section 8 3.7 83.7.1 Title PLANT SYSTEMS Residual Heat Removal Service Water (RHRSW) System Revision and the Ultimate Heat Sink (UHS) ...................................................................... 6 83.7.2 Emergency Service Water (ESW) System .......................................................... 3 83.7.3 Control Room Emergency Outside Air Supply (CREOAS) System ............................................................................................. 2 83.7.4 Control Room Floor Cooling System ................................................................... 1 83.7.5 Main Condenser Offgas ...................................................................................... 2 83.7.6 Main Turbine Bypass System ............................................................................. 4 83.7.7 Spent Fuel Storage Pool Water Level. ................................................................ 2 83.7.8 Main Turbine Pressure Regulation System ......................................................... 1 8 3.8 ELECTRICAL POWER SYSTEM 83.8.1 AC Sources - Operating .................................................................................... 10 83.8.2 AC Sources-Shutdown ..................................................................................... O 83.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air ........................................................... 5 83.8.4 DC Sources - Operating ..................................................................................... 4 83.8.5 DC Sources - Shutdown..................................................................................... 1 83.8.6 Battery Cell Parameters ...................................................................................... 2 83.8.7 Distribution Systems - Operating ........................................................................ 5

83.8.8 83.9 83.9.1 83.9.2 Distribution Systems - Shutdown ....................................................................... 1 REFUELING OPERATIONS Refueling Equipment Interlocks .......................................................................... 1 Refuel Position One-Rod-Out Interlock ............................................................... 1 83.9.3 Control Rod Position ........................................................................................... 1 83.9.4 Control Rod Position Indication ........................................................................... O 83.9.5 Control Rod OPERABILITY - Refueling ............................................................. 1 83.9.6 Reactor Pressure Vessel (RPV) Water Level ...................................................... 2 83.9.7 Residual Heat Removal (RHR) - High Water Level ............................................ 1 83.9.8 Residual Heat Removal (RHR) - Low Water Level.. ........................................... 1 8 3.10 SPECIAL OPERATIONS 83.10.1 lnservice Leak and Hydrostatic Testing Operation .............................................. 1 83.10.2 Reactor Mode Switch Interlock Testing ............................................................... 1 83.10.3 Single Control Rod Withdrawal - Hot Shutdown ................................................. 1 83.10.4 Single Control Rod Withdrawal-Cold Shutdown ............................................... 1 83.10.5 Single Control Rod Drive (CRD) Removal - Refueling ........................................ 1 83.10.6 Multiple Control Rod Withdrawal - Refueling ...................................................... 1 83.10.7 8ontrol Rod Testing - Operating ........................................................................ 1 83.10.8 SHUTDOWN MARGIN (SOM) Test- Refueling .................................................. 3

SUSQUEHANNA - UNIT 2 TS/ B LOES-3 Revision 127

Rev. 3 Control Rod OPERABILITY B 3.1.3 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.3 Control Rod OPERABILITY BASES BACKGROUND Control rods are components of the control rod drive (CRD) System, which is the primary reactivity control system for the reactor. In conjunction with the Reactor Protection System, the CRD System provides the means for the reliable control of reactivity changes to ensure under conditions of normal operation, including anticipated operational occurrences, that specified acceptable fuel design limits are not exceeded. In addition, the control rods provide the capability to hold the reactor core subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the CRD System. The CRD System is designed to satisfy the requirements of GDC 26, GDC 27, GDC 28, and GDC 29 (Ref. 1).

The CRD System consists of 185 locking piston control rod drive mechanisms (CRDMs) and a hydraulic control unit for each drive mechanism. The locking piston type CRDM is a double acting hydraulic piston, which uses condensate water as the operating fluid. Accumulators provide additional energy for scram. An index tube and piston, coupled to the control rod, are locked at fixed increments by a collet mechanism. The collet fingers engage notches in the index tube to prevent unintentional withdrawal of the control rod, but without restricting insertion.

This Specification, along with LCO 3.1.4, "Control Rod Scram Times," and LCO 3.1.5, "Control Rod Scram Accumulators," ensure that the performance of the control rods in the event of a Design Basis Accident (DBA) or transient meets the assumptions used in the safety analyses of References 2, 3, and 4 ..

APPLICABLE: The analytical methods and assumptions used in the evaluations involving SAFETY control rods are presented in References 2, 3, and 4. The control rods ANALYSES provide the primary means for rapid reactivity control (reactor scram), for maintaining the reactor subcritical and for limiting the potential effects of reactivity insertion events caused by malfunctions in the CRD System.

(continued)

SUSQUEHANNA - UNIT 2 TS/83.1-13 Revision O

Rev. 3 Control Rod OPERABILITY

B3.1.3 BASES APPLICABLE The capability to insert the control rods provides assurance that the SAFETY assumptions for scram reactivity in the OBA and transient analyses are ANALYSES not violated. Since the SOM ensures the reactor will be subcritical with the (continued) highest worth control rod withdrawn (assumed single failure), the additional failure of a second control rod to insert, if required, could invalidate the demonstrated SOM and potentially limit the ability of the CRD System to hold the reactor subcritical. If the control rod is stuck at an inserted position and becomes decoupled from the CRD, a control rod drop accident (CROA) can possibly occur. Therefore, the requirement that all control rods be OPERABLE ensures the CRO System can perform its intended function.

The control rods also protect the fuel from damage which could result in release. of radioactivity. The limits protected are the MCPR Safety Limit (SL) (see Bases for SL 2.1.1, "Reactor Core SLs," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), the 1 % cladding plastic strain fuel design limit (see Bases for LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)," and LCO 3.2.4, "Average Power Range Monitor (APRM) Gain and Setpoints"), and the fuel damage limit (see Bases for LCO 3.1.6, "Rod Pattern Control") during reactivity insertion events.

The negative reactivity insertion (scram) provided by the CRD System provides the analytical basis for determination of plant thermal limits and provides protection against fuel damage limits during a CRDA. The Bases for LCO 3.1.4, LCO 3.1.5, and LCO 3.1.6 discuss in more detail how the SLs are protected by the CRD System.

Control rod OPERABILITY satisfies Criterion 3 of the NRG Policy Statement (Ref. 5).

LCO The OPERABILITY of an individual control rod is based on a combination of factors, primarily, the scram insertion times, the control rod coupling integrity, and the ability to determine the control rod position. Accumulator OPERABILITY is addressed by LCO 3~ 1.5. The associated scram accumulator status for a control rod only affects the scram insertion times; therefore, an inoperable accumulator does not immediately require declaring a control rod inoperable. Although not all control rods are required to be OPERABLE to (continued)

SUSQUEHANNA - UNIT 2 TS/B3.1-14 Revision 1

Rev. 3 Control Rod OPERABILITY

BASES B 3.1.3 LCO satisfy the intended reactivity control requirements, strict control over the (continued) number and distribution of inoperable control rods is required to satisfy the assumptions of the DBA and transient analyses.

APPLICABILITY In MODES 1 and 2, the control rods are assumed to function during a OBA or transient and are therefore required to be OPERABLE in these MODES. In MODES 3 and 4, control rods are not able to be withdrawn (except as permitted by LCO 3.10.3 and LCO 3.10.4) since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod OPERABILITY during these conditions. Control rod requirements in MODE 5 are located in LCO 3.9.5, "Control Rod OPERABILITY-Refueling."

ACTIONS The ACTIONS Table is modified by a Note indicating that a separate Condition entry is allowed for each control rod. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable control rod. Complying with the Required Actions may allow for continued operation, and subsequent inoperable control rods are governed by subsequent Condition entry and application of associated Required Actions.

A.1, A.2, A.3 and A.4 A control rod is considered stuck if it will not insert by either CRD drive water or scram pressure. With a fully inserted control rod stuck, no actions are required as long as the control rod remains fully inserted. The Required Actions are modified by a Note, which allows the rod worth minimizer (RWM) to be bypassed if required to allow continued operation.

LCO 3.3.2.1, "Control Rod Block Instrumentation," provides additional requirements when the RWM is bypassed to ensure compliance with the CRDA analysis. With one withdrawn control rod stuck, the local scram reactivity rate assumptions may not be met if the stuck control rod separation criteria are not met. This separation criteria stipulates that a stuck control rod is equivalent to a "slow" control rod for purposes of separation requirements between "slow" control rods.

SUSQUEHANNA - UNIT 2 TS I B 3.1-15 (continued)

Revision 0

Rev. 3 Control Rod OPERABILITY B 3.1.3 BASES ACTIONS A.1. A.2. A.3 and A.4 (continued)

Therefore, a verification that the separation criteria are met must be performed immediately. The separation criteria are not met if a) the stuck control rod occupies a position adjacent to two "slow" control rods, b) the stuck control rod occupies a position adjacent to one "slow" control rod and the one "slow" control rod is also adjacent to another "slow" control rod, or, c) if the stuck control rod occupies a location adjacent to one "slow" control rod when there is another pair of "slow" control rods adjacent to one another. Adjacent control rods include control rods that are either face or diagonally adjacent. The description of "slow" control rods is provided in LCO 3.1.4, "Control Rod Scram Times." In addition, the associated control rod drive must be disarmed in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The allowed Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is acceptable, considering the reactor can still be shut down, assuming no additional control rods fail to insert, and provides a reasonable time to perform the Required Action in an orderly manner. Isolating the control rod from scram prevents damage to the CROM. The control rod can be isolated from scram and normal insert and withdraw pressure, yet still maintain cooling water to the CRO .

Monitoring of the insertion capability of each withdrawn control rod must also be performed within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from discovery of Condition A concurrent with THERMAL POWER greater than the low power setpoint (LPSP) of the RWM. SR 3.1.3.3 performs periodic tests of the control rod insertion capability of withdrawn control rods. Testing each withdrawn control rod ensures that a generic problem does not exist. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." The Required Action A.3 Completion Time only begins upon discovery of Condition A concurrent with THERMAL POWER greater than the actual LPSP of the RWM, since the notch insertions may not be compatible with the requirements of rod pattern control (LCO 3.1.6) and the RWM (LCO 3.3.2.1). The allowed Completion Time provides a reasonable time to test the control rods, considering the potential for a need to reduce power to perform the tests. To allow continued operation with a withdrawn control rod stuck, an evaluation of adequate SOM is also required within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Should a OBA or transient require a shutdown, to preserve the single failure criterion, an additional control rod would have to be assumed to fail to insert when (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-16 Revision 1

Rev.3 Control Rod OPERABILITY

BASES B 3.1.3 ACTIONS A.1. A.2. A.3 and A.4 (continued) required. Therefore, the original SOM demonstration may not be valid.

The SOM must therefore be evaluated (by measurement or analysis) with the stuck control rod at its stuck position and the highest worth OPERABLE control rod assumed to be fully withdrawn.

The allowed Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to verify SOM is adequate, considering that with a single control rod stuck in a withdrawn position, the remaining OPERABLE control rods are capable of providing the required scram and shutdown reactivity. Failure to reach MODE 4 is only likely if an additional control rod adjacent to the stuck control rod also fails to insert during a required scram. Even with the postulated additional single failure of an adjacent control rod to insert, sufficient reactivity control remains to reach and maintain MODE 3 conditions.

With two or more withdrawn control rods stuck, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The occurrence of more than one control rod stuck at a withdrawn position increases the probability that the reactor cannot be shut down if required. Insertion of all insertable control rods eliminates the possibility of an additional failure of a control rod to insert.

The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 With one or more control rods inoperable for reasons other than being stuck in the withdrawn position, operation may continue, provided the control rods are fully inserted

I (continued)

SUSQUEHANNA - UNIT 2 TS/83.1-17 Revision O

Rev. 3 Control Rod OPERABILITY

BASES B 3.1.3 ACTIONS C.1 and C.2 (continued) within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months and disarmed (electrically or hydraulically) within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

Inserting a control rod ensures the shutdown and scram capabilities are not adversely affected. The control rod is disarmed to prevent inadvertent withdrawal during subsequent operations. The control rods can be hydraulically disarmed by closing the drive water and exhaust water isolation valves. The control rods can be electrically disarmed by disconnecting power from all four directional control valve solenoids.

Required Action C.1 is modified by a Note, which allows the RWM to be bypassed if required to allow insertion of the inoperable control rods and continued operation. LCO 3.3.2.1 provides additional requirements when the RWM is bypassed to ensure compliance with the CRDA analysis.

The allowed Completion Times are reasonable, considering the small number of allowed inoperable control rods, and provide time to insert and disarm the control rods in an orderly manner and without challenging plant systems .

D.1 and D.2 Out of sequence control rods may increase the potential reactivity worth of a dropped control rod during a CRDA. At s 10% RTP, the generic banked position withdrawal sequence (BPWS) analysis requires inserted control rods not in compliance with BPWS to be separated by at least two OPERABLE control rods in all directions, including the diagonal.

Therefore, if two or more inoperable control rods are not in compliance with BPWS and not separated by at least two OPERABLE control rods, action must be taken to restore compliance with BPWS or restore the control rods to OPERABLE status. Condition D is modified by a Note indicating that the Condition is not applicable when> 10% RTP, since the BPWS is not required to be followed under these conditions, as described in the Bases for LCO 3.1.6. The allowed Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is acceptable, considering the low probability of a CRDA occurring.

(continued)

SUSQUEHANNA - UNIT 2 TS/B3.1-18 Revision 0

Rev. 3 Control Rod OPERABILITY

BASES B 3.1.3 ACTIONS E.1 (continued)

In addition to the separation requirements for inoperable control rods, a BPWS assumption requires that no more than three inoperable control rods are allowed in any one BPWS group.

Therefore, with one or more BPWS groups having four or more inoperable control rods, control rods must be restored to OPERABLE status so that no BPWS group has four or more inoperable control rods. Required Action E.1 is modified by a Note indicating that the Condition is not applicable when THERMAL POWER is > 10% RTP since the BPWS is not required to be followed under these conditions, as described in the Bases for LCO 3.1.6. The allowed Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is acceptable, considering the low probability of a CRDA occurring.

If any Required Action and associated Completion Time of Condition A, C, D, or E are not met, or there are nine or more inoperable control rods, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

This ensures all insertable control rods are inserted and places the reactor in a condition that does not require the active function (i.e., scram) of the control rods. The number of control rods permitted to be inoperable when operating above 10% RTP (e.g., no CRDA considerations) could be more than the value specified, but the occurrence of a large number of inoperable control rods could be indicative of a generic problem, and investigation and resolution of the potential problem should be undertaken. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.3.1 REQUIREMENTS The position of each control rod must be determined to ensure adequate information on control rod position is available to the operator for determining CRD OPERABILITY and controlling rod patterns. Control rod position may be (continued)

SUSQUEHANNA - UNIT 2 TS/83.1-19 Revision O

Rev. 3 Control Rod OPERABILITY

BASES B 3.1.3 SURVEILLANCE SR 3.1.3.1 (continued)

REQUIREMENTS determined by the use of.OPERABLE position indicators, by moving control rods to a position with an OPERABLE indicator, or by the use of other appropriate methods. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1.3.2 NOT USED SR 3.1.3.3 Control rod insertion capability is demonstrated by inserting each partially or fully withdrawn control rod at least one notch and observing that the control rod moves. The control rod may then be returned to its original position. This ensures the control rod is not stuck and is free to insert on a scram signal. These Surveillances are not required when THERMAL POWER is less than or equal to the actual LPSP of the RWM, since the notch insertions may not be compatible with the requirements of the Banked Position Withdrawal Sequence (BPWS) (LCO 3.1.6) and the RWM (LCO 3.3.2.1). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1.3.4 Verifying that the scram time for each control rod to notch position 05 is

7 seconds provides reasonable assurance that the control rod will insert when required during a OBA or transient, thereby completing its shutdown function. This SR is performed in conjunction with the control rod scram time testing of SR 3.1.4.1, SR 3.1.4.2, SR 3.1.4.3, and SR 3.1.4.4. The LOGIC SYSTEM FUNCTIONAL TEST in

SUSQUEHANNA - UNIT 2 TS I B 3.1-20 (continued)

Revision 2

Rev. 3 Control Rod OPERABILITY B 3.1.3 BASES SURVEILLANCE SR 3.1.3.4 (contjnued)

REQUIREMENTS LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," and the functional testing of SDV vent and drain valves in LCO 3.1.8, "Scram Discharge Volume (SDV) Vent and Drain Valves," overlap this Surveillance to provide complete testing of the assumed safety function.

The associated Frequencies are acceptable, considering the more frequent testing performed to demonstrate other aspects of control rod OPERABILITY and operating experience, which shows scram times do not significantly change over an operating cycle.

SR 3.1.3.5

. Coupling verification is performed to ensure the control rod is connected to the CROM and will perform its intended function when necessary. The Surveillance requires verifying a control rod does not go to the withdrawn overtravel position. The overtravel position feature provides a positive check on the coupling integrity since only an uncoupled CRD can reach the overtravel position. The verification is required to be performed any time a control rod is withdrawn to the "full out" position (notch position 48) or prior to declaring the control rod OPERABLE after work on the control rod or CRD System that could affect coupling. This includes control rods inserted one notch and then returned to the "full out" position during the performance of SR 3.1.3.3. This Frequency is acceptable, considering a

the low probability that control rod will become uncoupled when it is not being moved and operating experience related to uncoupling events.

REFERENCES 1. 10 CFR 50, Appendix A GDC 26, GDC 27, GDC 28, and GDC 29.

2. FSAR, Section 4.3.2

3. FSAR, Section 4.6

4. FSAR, Section 15.

5. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.1-21 Revision 1

Rev. 5 Control Rod Scram Times

B 3.1 B 3.1.4 REACTIVITY CONTROL SYSTEMS Control Rod Scram Times B 3.1.4 BASES BACKGROUND The scram function of the Control Rod Drive (CRD) System controls reactivity changes during abnormal operational transients to ensure that specified acceptable fuel design limits are not exceeded (Ref. 1). The control rods are scrammed by positive means using hydraulic pressure exerted on the CRD piston.

When a scram signal is initiated, control air is vented from the scram valves, allowing them to open by spring action. Opening the exhaust valve reduces the pressure above the main drive piston to atmospheric pressure, and opening the inlet valve applies the accumulator or reactor pressure to the bottom of the piston. Since the notches in the index tube are tapered on the lower edge, the collet fingers are forced open by cam action, allowing the index tube to move upward without restriction because of the high differential pressure across the piston. As the drive moves upward and the accumulator pressure reduces below the reactor pressure, a ball check valve opens, letting the reactor pressure complete the scram action. If the reactor pressure is low, such as during startup, the accumulator will fully insert the control rod in the required time without assistance from reactor pressure.

APPLICABLE The analytical methods and assumptions used in evaluating the control SAFETY rod scram function are presented in References 2, 3, and 4. The Design ANALYSES Basis Accident (OBA) and transient analyses assume that all of the control rods scram at a specified insertion rate. The resulting negative scram reactivity forms the basis for the determination of plant thermal limits (e.g.,

the MCPR). Other distributions of scram times (e.g., several control rods scramming slower than the average time with several control rods scramming faster than the average time) can also provide sufficient scram.

reactivity. Surveillance of each individual control rod's scram time ensures the scram reactivity assumed in the OBA and transient analyses can be met.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-22 Revision O

Rev. 5 Control Rod Scram Times

BASES B 3.1.4 APPLICABLE The scram function of the CRD System protects the MCPR Safety Limit SAFETY (SL) (see Bases for SL 2.1.1, "Reactor Core SLs," and LCO 3.2.2, ANALYSES "MINIMUM CRITICAL POWER RATIO (MCPR)") and the 1% cladding (continued) plastic strain fuel design limit (see Bases for LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)" and LCO 3.2.4, "Average Power Range Monitor (APRM) Gain and Setpoints"), which ensure that no fuel damage will occur if these limits are not exceeded. Above 800 psig, the scram.

function is designed to insert negative reactivity at a rate fast enough to prevent the actual MCPR from becoming less than the MCPR SL, during the analyzed limiting power transient Below 800 psig, the scram function is assumed to perform during the control rod drop accident and, therefore, also provides protection against violating fuel damage limits during reactivity insertion accidents (Ref. 5) (see Bases for LCO 3.1.6, "Rod Pattern Control"). For the reactor vessel overpressure protection analysis, the scram function, along with the safety/relief valves, ensure that the peak vessel pressure is maintained within the applicable ASME Code limits .

LCO Control rod scram times satisfy Criterion 3 of the NRG Policy Statement (Ref. 6).

The scram times specified in Table 3.1.4-1 (in the accompanying LCO) are required to ensure that the scram reactivity assumed in the DBA and transient analysis is met (Ref. 7). To account for single failures and "slow" scramming control rods, the scram times specified in Table 3.1.4-1 are faster than those assumed in the design basis analysis. The scram times have a margin that allows up to approximately 7% of the control rods (e.g.,

185x7%:::::13) to have scram times exceeding the specified limits (i.e.,

"slow" control rods) including a single stuck control rod (as allowed by ,

LCO 3.1.3, "Control Rod OPERABILITY") and an additional control rod _

failing to scram per the single failure criterion. The scram times are specified as a function of reactor steam dome pressure to account' for the pressure dependence of the scram times. The scram times are specified relative to measurements based on reed switch positions, which provide the control rod position indication. The reed switch closes ("pickup") when the index tube passes a specific location and then opens ("dropout") as the index tube travels upward. Verification of the specified.scram times in Table 3.1.4-1 is (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-23 1

Revision 1

Rev. 5 Control Rod Scram Times

BASES B 3.1.4 LCO accomplished through measurement of the "dropout" times. To ensure (continued) that local scram reactivity rates are maintained within acceptable limits, no more than one "slow" control rod may occupy a face or diagonally adjacent location to any other "slow" or stuck control rod.

Table 3.1.4-1 is modified by two Notes which state that control rods with scram times not within the limits of the table are considered "slow" and that control rods with scram times > 7 seconds are considered inoperable as required by SR 3.1.3.4.

This LCO applies only to OPERABLE control rods since inoperable control rods will be inserted and disarmed (LCO 3.1.3). Slow scramming control rods may be conservatively declared inoperable and not accounted for as "slow" control rods.

APPLICABILITY In MODES 1 and 2, a scram is assumed to function during transients and accidents analyzed for these plant conditions. These events are assumed to occur during startup and power operation; therefore, the scram function of the control rods is required during these MODES. In MODES 3 and 4, the control rods are not able to be withdrawn (except as permitted by LCO 3.10.3 and LCO 3.10.4) since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod scram capability during these conditions. Scram requirements in MODE 5 are contained in LCO 3.9.5, "Control Rod OPERABILITY-Refueling."

ACTIONS A.1 When the requirements of this LCO are not met, the rate of negative reactivity insertion during a scram may not be within the assumptions of the safety analyses. Therefore, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

SUSQUEHANNA - UNIT 2 TS/83.1-24 Revision O

Rev. 5 Control Rod Scram Times

BASES (continued)

B 3.1.4 SURVEILLANCE The four SRs of this LCO are modified by a Note stating that during a REQUIREMENTS single control rod scram time surveillance, the CRD pumps shall be isolated from the associated scram accumulator. With the CRD pump isolated, (i.e., charging valve closed) the influence of the CRD pump head does not affect the single control rod scram times. During a full core scram, the CRD pump head would be seen by all control rods and would have a negligible effect on the scram insertion times.

SR 3.1.4.1 The scram reactivity used in OBA and transient analyses is based on an assumed control rod scram time. Measurement of the scram times with reactor steam dome pressure ~ 800 psig demonstrates acceptable scram times for the transients analyzed in References 3 and 4.

Maximum scram insertion times occur at a reactor steam dome pressure of approximately 800 psig because of the competing effects of reactor steam dome pressure and stored accumulator energy. Therefore, demonstration of adequate scram times at reactor steam dome pressure

~ 800 psig ensures that the measured scram times will be within the specified limits at higher pressures. Limits are specified as a function of reactor pressure to account for the sensitivity of the scram insertion times with pressure and to allow a range of pressures over which scram time testing can be performed. To ensure that scram time testing is performed within a reasonable time following a shutdown~ 120 days or longer, control rods are required to be tested before exceeding 40% RTP following the shutdown. This Frequency is acceptable considering the additional surveillances performed for control rod OPERABILITY, the frequent verification of adequate accumulator pressure, and the required testing of control rods affected by fuel movement within the associated core cell and by work on control rods or the CRD System.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-25 Revision 1

Rev.5 Control Rod Scram Times B 3.1.4 BASES SURVEILLANCE SR 3.1.4.2 REQUIREMENTS (continued) Additional testing of a sample of control rods is required to verify the continued performance of the scram function during the cycle. A representative sample contains at least 10% of the control rods. The sample remains representative if no more than 7.5% of the control rods in the sample tested are determined to be "slow." With more than 7.5% of the sample declared to be "slow" per the criteria in Table 3.1.4-1, additional control rods are tested until this 7.5% criterion (e.g., 7.5% of the entire sample size) is satisfied, or until the total number of "slow" control rods (throughout the core, from all surveillances) exceeds the LCO limit.

For planned testing, the control rods selected for the sample should be different for each test. Data from inadvertent scrams should be used whenever possible to avoid unnecessary testing at power, even if the control rods with data may have been previously tested in a sample. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SR 3.1.4.3 When work that could affect the scram insertion time is performed on a control rod or the CRD System, testing must be done to demonstrate that each affected control rod retains adequate scram performance over the range of applicable reactor pressures from zero to the maximum permissible pressure. The scram testing must be performed once before declaring the control rod OPERABLE. The required scram time testing must demonstrate the affected control rod is still within acceptable limits.

The limits for reactor pressures < 800 psig are established based on a high probability of meeting the acceptance criteria at reactor pressures ;::::

800 psig. Limits for;:::: 800 psig are found in Table 3.1.4-1. If testing demonstrates the affected control rod does not meet these limits, but is within the 7-second limit of Table 3.1.4-1, Note 2, the control rod can be declared OPERABLE and "slow."

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-26 Revision 2

Rev.5 Control Rod Scram Times

BASES B 3.1.4 SURVEILLANCE SR 3.1.4.3 (continued)

REQUIREMENTS Specific examples of work that could affect the scram times are (but are not limited to) the following: removal of any CRD for maintenance or modification; replacement of a control rod; and maintenance or modification of a scram solenoid pilot valve, scram valve, accumulator, isolation valve or check valve in the piping required for scram.

The Frequency of once prior to declaring the affected control rod OPERABLE is acceptable because of the capability to test the control rod over a range of operating conditions and the more frequent surveillances on other aspects of control rod OPERABILITY.

SR 3.1.4.4 When work that could affect the scram insertion time is performed on a control rod or CRD System, or when fuel movement within the affected core cell occurs, testing must be done to demonstrate each affected control rod is still within the limits of Table 3.1.4-1 with the reactor steam dome pressure ~ 800 psig. Where work has been performed at high reactor pressure, the requirements of SR 3.1.4.3 and SR 3.1.4.4 can be satisfied with one test. For a control rod affected by work performed while shut down, however, a zero pressure and high pressure test may be required. This testing ensures that, prior to withdrawing the control rod for continued operation, the control rod scram performance is acceptable for operating reactor pressure conditions. Alternatively, a control rod scram test during hydrostatic pressure testing could also satisfy both criteria.

When fuel movement within the reactor pressure vessel occurs, only those control rods associated with the core cells affected by the fuel movement are required to be scram time tested. During a routine refueling outage, it is expected that all control rods will be affected.

The Frequency of once prior to exceeding 40% RTP is acceptable because of the capability to test the control rod over a range of operating conditions and the more frequent surveillances on other aspects of control rod OPERABILITY.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10.

2. FSAR, Section 4.3.2.

3. FSAR, Section 4.6.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-27 Revision 1

Rev.5 Control Rod Scram Times

BASES B 3.

1.4 REFERENCES

4. FSAR, Section 15.0 (continued)

5. FSAR, Section 15.4.9.

6. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132).

7. Letter from R. F. Janecek (BWROG) to R.W. Starostecki (NRC),

"BWR Owners Group Revised Reactivity Control System Technical Specifications," BWROG-8754, September 17, 1987.

SUSQUEHANNA - UNIT 2 TS I B 3.1-28 Revision 2

Rev.2 Control Rod Scram Accumulators

B 3.1 B 3.1.5 REACTIVITY CONTROL SYSTEMS Control Rod Scram Accumulators B 3.1.5 BASES BACKGROUND The control rod scram accumulators are part of the Control Rod Drive (CRD) System and are provided to ensure that the control rods scram under varying reactor conditions. The control rod scram acc1,.1mulators store sufficient energy to fully insert a control rod at any reactor vessel pressure. The accumulator is a hydraulic cylinder with a free floating piston. The piston separates the water used to scram the control rods from the nitrogen, which provides the required energy. The scram accumulators are necessary to scram the control rods within the required insertion times of LCO 3.1.4, "Control Rod Scram Times."

APPLICABLE The analytical methods and assumptions used in evaluating the control SAFETY rod scram function are presented in References 1, 2, and 3. The Design ANALYSES Basis Accident (OBA) and transient analyses assume that all of the control rods scram at a specified insertion rate. OPERABILITY of each individual control rod scram accumulator, along with LCO 3.1.3, "Control Rod OPERABILITY," and LCO 3.1.4, ensures that the scram reactivity assumed in the OBA and transient analyses can be met. The existence of an inoperable accumulator may invalidate prior scram time measurements for the associated control rod.

The scram function of the CRD System, and therefore the OPERABILITY of the accumulators, protects the MCPR Safety Limit (see Bases for SL 2.1.1, "Reactor Core SLs," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and 1% cladding plastic strain fuel design limit LCO 3.2.3 "LINEAR HEAT GENERATION RATE (LHGR)" and LCO 3.2.4, "Average Power Range Monitor (APRM) Gain and Setpoints"),

which ensure that no fuel damage will occur if these limits are not exceeded (see Bases for LCO 3.1.4). In addition, the scram function at low reactor vessel pressure 0.e., startup conditions) provides protection against violating fuel design limits during reactivity insertion accidents (see Bases for LCO 3.1.6, "Rod Pattern Control").

Control rod scram accumulators satisfy Criterion 3 of the NRC Policy Statement (Ref. 4).

SUSQUEHANNA - UNIT 2 TS I B 3.1-29 (continued)

Revision 1

Rev.2 Control Rod Scram Accumulators

BASES (continued) 8 3.1.5 LCO The OPERABILITY of the control rod scram accumulators is required to ensure that adequate scram insertion capability exists when needed over the entire range of reactor pressures. The OPERABILITY of the scram accumulators is based on maintaining adequate accumulator pressure.

APPLICABILITY In MODES 1 and 2, the scram function is required for mitigation of DBAs and transients, and therefore the scram accumulators must be OPERABLE to support the scram function. In MODES 3 and 4, control rods can not be withdrawn (except as permitted by LCO 3.10.3 and LCO 3.10.4) since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod scram accumulator OPERABILITY during these conditions.

Requirements for scram accumulators in MODE 5 are contained in LCO 3.9.5, "Control Rod OPERABILITY-Refueling."

ACTIONS The ACTIONS table is modified by a Note indicating that a separate Condition entry is allowed for each control rod scram accumulator. This is acceptable since the Required Actions for each Condition provide appropriate compensatory actions for each affected accumulator.

Complying with the Required Actions may allow for continued operation and subsequent affected accumulators governed by subsequent Condition entry and application of associated Required Actions.

A.1 and A.2 With one control rod scram accumulator inoperable and the reactor steam dome pressure~ 900 psig, the control rod may be declared "slow,"

since the control rod will still scram at the reactor operating pressure but may not satisfy the required scram times in Table 3.1.4-1.

Required Action A.1 is modified by a Note indicating that declaring the control rod "slow" only applies if the associated control scram time was within the limits of Table 3.1.4-1 during the last scram time test.

Otherwise, the control rod would already be considered "slow" and the further degradation of scram performance with an inoperabl~

SUSQUEHANNA - UNIT 2 TS I B 3.1-30 (continued)

Revision O

Rev.2 Control Rod Scram Accumulators

BASES B 3.1.5 ACTIONS A.1 and A.2 (continued) accumulator could result in excessive scram times. In this event, the associated control rod is declared inoperable (Required Action A.2) and LCO 3.1.3 is entered. This would result in requiring the affected control rod to be fully inserted and disarmed; thereby satisfying its intended function, in accordance with ACTIONS of LCO 3.1.3.

The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is reasonable, based on the large number of control rods available to provide the scram function and the ability of the affected control rod to scram only with reactor vessel at high reactor pressures.

B.1. B.2.1, and B.2.2 With two or more control rod scram accumulators inoperable and reactor steam dome pressure ;::: 900 psig, adequate pressure must be supplied to the charging water header. With inadequate charging water pressure, all of the accumulators could become inoperable, resulting in a potentially severe degradation of the scram performance. Therefore, within 20 minutes from discovery of charging water header pressure < 940 psig concurrent with Condition B, adequate charging water header pressure must be restored. The.allowed Completion Time of 20 minutes is reasonable, to place a CRD pump into service to restore the charging header pressure, if required. This Completion Time is based on the ability of the reactor pressure alone to fully insert all control rods.

The control rod may be declared "slow," since the control rod will still scram using only reactor pressure, but may not satisfy the times in Table 3.1.4-1. Required Action B.2.1 is modified by a Note indicating that declaring the control rod "slow" only applies if the associated control scram time is within the limits of Table 3.1.4-1 during the last scram time test. Otherwise, the control rod would already be considered "slow" and the further degradation of scram performance with an inoperable

accumulator could result in excessive scram times. In this event, the associated control rod is declared inoperable (Required Action B.2.2) and

!,.CO 3.1.3 entered. This would result in requiring the affected control rod to be fully

SUSQUEHANNA - UNIT 2 TS I B 3.1-31 (continued}

Revision O

Rev.2 Control Rod Scram Accumulators

BASES B 3.1.5 ACTIONS B.1. B.2.1, and B.2.2 (continued) inserted and disarmed, thereby satisfying its intended function in accordance with ACTIONS of LCO 3.1.3.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the ability of only the reactor pressure to scram the control rods and the low probability of a OBA or transient occurring while the affected accumulators are inoperable.

C.1 and C.2 With one or more control rod scram accumulators inoperable and the reactor steam dome pressure < 900 psig, the pressure supplied to the charging water header must be adequate to ensure that accumulators remain charged. With the reactor steam dome pressure < 900 psig, the function of the accumulators in providing the scram force becomes much more important since the scram function could become severely degraded during a depressurization event or at low reactor pressures.

Therefore, immediately upon discovery of charging water header pressure < 940 psig, concurrent with Condition C, all control rods associated with inoperable accumulators must be verified to be fully inserted. Withdrawn control rods with inoperable accumulators may fail to scram under these low pressure conditions. The associated control rods must also be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable for Required Action C.2, considering the low probability of a OBA or transient occurring during the time that the accumulator is inoperable.

The reactor mode switch must be immediately placed in the shutdown position if either Required Action and associated Completion Time associated with loss of the CRD charging pump (Required Actions B.1 and C.1) cannot be met. This ensures that all insertable control rods are inserted and that the reactor is in a condition that does not require the active function (i.e., scram) of the control rods. This Required Action is modified by a Note stating that the action is not applicable if all control rods associated with (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-32 Revision O

Rev.2 Control Rod Scram Accumulators

BASES B 3.1.5 ACTIONS D.1 (continued) the inoperable scram accumulators are fully inserted, since the function of the control rods has been performed.

SURVEILLANCE SR 3.1.5.1 REQUIREMENTS SR 3.1.5.1 requires that the accumulator nitrogen pressure be checked periodically to ensure adequate accumulator pressure exists to provide sufficient scram force. The primary indicator of accumulator OPERABILITY is the accumulator nitrogen pressure.* A minimum accumulator nitrogen pressure is specified, below which the capability of the accumulator to perform its intended function becomes degraded and the accumulator is considered inoperable. The minimum accumulator nitrogen pressure of 940 psig is well below the expected pressure of approximately 1100 psig (Ref. 1). Declaring the accumulator inoperable when the minimum pressure is not maintained e'nsures that significant degradation in scram times does not occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 4.3.2.

2. FSAR, Section 4.6.

3. FSAR, Section 15.

4. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.1-33 Revision 1

Rev.4 Rod Pattern Control B 3.1.6 8 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.6 Rod Pattern Control BASES BACKGROUND Control rod patterns during startup conditions are controlled by the operator and the rod worth minimizer (RWM) (LCO 3.3.2.1, "Control Rod Block Instrumentation"), so that only specified control rod sequences and relative positions are allowed over the operating range of all control rods inserted to 10% RTP. The sequences limit the potential amount of reactivity addition that could occur in the event of a Control Rod Drop Accident (CRDA).

This Specification assures that the control rod patterns are consistent with the assumptions of the CRDA analyses of References 1 and 2.

APPLICABLE The analytical methods and assumptions used in evaluating the CRDA SAFETY are sµmmarized in References 1 and 2. CRDA analyses assume that the ANALYSES reactor operator follows prescribed withdrawal sequences. These

sequences define the potential initial conditions for the CRDA analysis .

The RWM (LCO 3.3.2.1) provides backup to operator control of the withdrawal sequences to ensure that the initial conditions of the CRDA analysis are not violated.

Prevention or mitigation of positive reactivity insertion events is necessary to limit the energy deposition in the fuel, thereby preventing significant fuel damage which could result in the undue release of radioactivity. Since the failure consequences for U02 have been shown to be insignificant below fuel energy depositions of 300 cal/gm (Ref. 3), the fuel damage limit of 280 cal/gm provides a margin of safety from significant core damage which would result in release of radioactivity (Refs. 4 and 5). Generic evaluations (Ref. 1 & 6) of a design basis CRDA have shown that the maximum reactor pressure will be less than the required ASME Code Hmits (Ref. 7). The offsite doses are calculated each cycle using the methodology in reference 1 to demonstrate that the calculated offsite doses will be well within the required limits (Ref. 5). Control rod patterns analyzed in Reference 1 follow the banked position withdrawal sequence (BPWS). The BPWS is applicable from the condition of all control rods fully inserted to 10% RTP (Ref. 2). For the BPWS, the control rods are required to be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions

SUSQUEHANNA - UNIT 2 TS I B 3.1-34 (continued)

Revision 1

Rev.4 Rod Pattern Control

BASES APPLICABLE (e.g., between notches 08 and 12). The banked positions are established B 3.1.6 SAFETY to minimize the maximum incremental control rod worth without being ANALYSES overly restrictive during normal plant operation. For each reload cycle the (continued) CRDA is analyzed to demonstrate that the 280 cal/gm fuel damage limit will not be violated during a CRDA while following the BPWS mode of operation for control rod patterns. These analyses consider the effects of fully inserted inoperable and OPERABLE control rods not withdrawn in the normal sequence of BPWS, but are still in compliance with the BPWS requirements regarding out of sequence control rods. These requirements allow a limited number (i.e., eight) and distribution of fully inserted inoperable control rods.

When performing a shutdown of the plant, an optional BPWS control rod sequence (Ref. 9) may be used provided that all withdrawn control rods have been confirmed to be coupled prior to reaching THERMAL POWER of ::;10% RTP. The rods may be inserted without the need to stop at intermediate positions since the possibility of a CRDA is eliminated by the confirmation that withdrawn control rods are coupled. When using the Reference 9 control rod sequence for shutdown, the RWM may be reprogrammed to enforce the requirements of the improved BPWS control rod insertion, or may be bypassed and the improved BPWS shutdown sequence implemented under LCO 3.3.2.1, Condition D controls.

In order to use the Reference 9 BPWS shutdown process, an extra check is required in order to consider a control rod to be "confirmed" to be coupled. This extra check ensures that no Single Operator Error can result in an incorrect coupling check. For purposes of this shutdown process, the method for confirming that control rods are coupled varies depending on the position of the control rod in the core. Details on this coupling confirmation requirement are provided in Reference 9, which requires that any partially inserted control rods, which have not been confirmed to be coupled since their last withdrawal, be fully inserted prior to reaching THERMAL POWER of ::;10% RTP. If a control rod has been checked for coupling at notch 48 and the rod has since only been moved inward, this rod is in contact with it's drive and is not required to be fully inserted prior to reaching THERMAL POWER of ::;10% RTP. However, if it cannot be confirmed that the control rod has been moved inward, then that rod shall be fully inserted prior to reaching the THERMAL POWER of

10% RTP. This extra check may be performed as an administrative check, by examining logs, previous

SUSQUEHANNA - UNIT 2 TS I B 3.1-35 (continued)

Revision 1

Rev. 4 Rod Pattern Control

BASES APPLICABLE surveillance's or other information. If the requirements for use of the B 3.1.6 SAFETY BPWS control rod insertion process contained in Reference 9 are ANALYSES followed, the plant is considered to be in compliance with the BPWS (continued) requirements, as required by LOG 3.1.6.

Rod pattern control satisfies Criterion 3 of the NRG Policy Statement (Ref. 8).

LCO Compliance with the prescribed control rod sequences minimizes the

potential consequences of a CRDA by limiting the initial conditions to those consistent with the BPWS. This LCO only applies to OPERABLE control rods. For inoperable control rods required to be inserted, separate requirements are specified in LCO 3.1.3, "Control Rod.OPERABILITY,"

consistent with the allowances for inoperable control rods in the BPWS.

APPLICABILITY In MODES 1 and 2, when THERMAL POWER is s 10% RTP, the CRDA is a Design Basis Accident and, therefore, compliance with the assumptions of the safety analysis is required. When THERMAL POWER is

> 10% RTP, there is no credible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA (Ref. 2). In MODES 3, 4, and 5, since the reactor is shut down and only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SOM ensures that the consequences of a CRDA are acceptable, since the reactor will remain subcritical with a single control rod withdrawn.

ACTIONS A.1 and A.2 With one or more OPERABLE control rods not in compliance with the prescribed control rod sequence, actions may be taken to either correct the control rod pattern or declare the associated control rods inoperable within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Noncompliance with the prescribed sequence may be the result of "double notching," drifting from a control rod drive cooling water transient, leaking scram valves, or a power reduction to s 10% RTP before establishing the correct control rod pattern. The number of OPERABLE control rods not in compliance with the prescribed sequence is limited to eight, to prevent the operator from attempting to correct a control rod pattern that significantly deviates from the prescribed sequence. When the control

SUSQUEHANNA - UNIT 2 TS I B 3.1-36 (continued)

Revision 1

Rev.4 Rod Pattern Control

BASES ACTIONS A.1 and A.2 (continued)

B 3.1.6 rod pattern is not in compliance with the prescribed sequence, all control rod movement should be stopped except for moves needed to correct the rod pattern, or scram if warranted.

Required Action A.1 is modified by a Note which allows the RWM to be bypassed to allow the affected control rods to be returned to their correct position. LCO 3.3.2.1 requires verification of control rod movement by a qualified member of the technical staff. This ensures that the control rods will be moved to the correct position. A control rod not in compliance with the prescribed sequence is not considered inoperable except as required by Required Action A.2. OPERABILITY of control rods is determined by compliance with LCO 3.1.3, "Control Rod OPERABILITY," LCO 3.1.4, "Control Rod Scram Times," and LCO 3.1.5, "Control Rod Scram .

Accumulators." The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is reasonable, considering the restrictions on the number of allowed out of sequence control rods and the low probability of a CRDA occurring during the time the control rods are out of sequence .

B.1 and B.2 If nine or more OPERABLE control rods are out of sequence, the control rod pattern significantly deviates from the prescribed sequence. Control rod withdrawal should be suspended immediately to prevent the potential for further deviation from the prescribed sequence. Control rod insertion to correct control rods withdrawn beyond their allowed position is allowed since, in general, insertion of control rods has less impact on control rod worth than withdrawals have. Required Action B.1 is modified by a Note which allows the RWM to be bypassed to allow the affected control rods to be returned to their correct position. LCO 3.3.2.1 requires verification of control rod movement by a qualified member of the technical staff.

When nine or more OPERABLE control rods are not in compliance with BPWS, the reactor mode switch must be placed in the shutdown position within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . With the mode switch in shutdown, the reactor is shut down, and as such, does not meet the applicability requirements of this LCO. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable to allow _

insertion of control rods to restore compliance, and is appropriate relative to the low probability of a CRDA occurring with the control rods out of sequence.

SUSQUEHANNA - UNIT 2 TS I B 3.1-37 (continued)

Revision 2

Rev. 4 Rod Pattern Control

BASES (continued)

SURVEILLANCE SR 3.1.6.1 B 3.1.6 REQUIREMENTS The control rod pattern is periodically verified to be in compliance with the BPWS to ensure the assumptions of the CRDA analyses are met. The Surveillance Frequency is controlled under tlie Surveillance Frequency Control Program. The RWM provides control rod blocks to enforce the required sequence and is required to be OPERABLE when operating at

~ 10% RTP.

REFERENCES 1. XN-N F-80-19(P)(A) Volume 1 and Supplements 1 and 2, "Exxon Nuclear Methodology for Boiling Water Reactors," Exxon Nuclear Company, March 1983.

2. "Modifications to the Requirements for Control Rod Drop Accident Mitigating System," BWR Owners Group, July 1986.

3. NUREG-0979, Section 4.2.1.3.2, April 1983.

4.

5.

6.

NUREG-0800, Section 15.4.9, Revision 2, July 1981 .

10CFR100.11.

NED0-21778-A, "Transient Pressure Rises Affected Fracture Toughness Requirements for Boiling Water Reactors,"

December 1978.

7. ASME, Boiler and Pressure Vessel Code.

8.

Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132).

9. NEDO 33091-A, Revision 2, "Improved BPWS Control Rod Insertion Process," July 2004 .

SUSQUEHANNA - UNIT 2 TS I B 3.1-38 Revision 4

Rev. 4 SLC System

B 3.1 B 3.1.7 REACTIVITY CONTROL SYSTEMS Standby Liquid Control (SLC) System B 3.1.7 BASES BACKGROUND The SLC System is designed to provide the capability of bringing the reactor, at any time in a fuel cycle, from full power and minimum control rod inventory to a subcritical condition with the reactor in the most reactive, xenon free state without taking credit for control rod movement.

Additionally, the SLC System is designed to provide sufficient buffering agent to maintain the suppression pool pH at or above 7.0 following a DBA LOCA involving fuel damage. Maintaining the suppression pool pH at or above 7.0 will mitigate the re-evolution of iodine from the suppression pool water following a OBA LOCA. The SLC System satisfies the requirements of 10 CFR 50.62 (Ref. 1) for anticipated transient without scram.

The SLC System consists of a sodium pentaborate solution storage tank, two positive displacement pumps, two explosive valves that are provided in parallel for redundancy, and associated piping and valves used to transfer borated water from the storage tank to the reactor pressure vessel (RPV). The borated solution is discharged near the bottom of the core shroud, where it then mixes with the cooling water rising through the core. A smaller tank containing demineralized water is provided for testing purposes.

The SLC System is manually initiated from the main control room, as APPLICABLE directed by the emergency operating procedures, if the operator believes SAFETY the reactor cannot be shut down, or kept shut down, with the control rods ANALYSES

or if fuel damage occurs post-LOCA. The SLC System is used in the event that enough control rods cannot be inserted to accomplish shutdown and cooldown in the normal manner or if fuel damage occurs post-LOCA. The SLC System injects borated water into the reactor core to add negative reactivity to compensate for all of the various reactivity effects that could occur during plant operations. To meet this objective, it is necessary to inject a quantity of enriched sodium pentaborate, which produces a concentration equivalent to 660 ppm of natural boron, in the reactor coolant at 68°F. To allow for potential leakage and imperfect mixing in the reactor system, an amount of boron equal to 25% of the amount cited above is added (Ref. 2). The volume versus concentration limits in Figure 3.1.7-1 and the temperature versus concentration limits in Figure 3.1.7-2 are calculated such that the required concentration is achieved accounting for dilution in the RPV with normal water level and including the water volume in the residual heat

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-39 Revision 2

Rev.4 SLC System

BASES APPLICABLE B 3.1.7 removal shutdown cooling piping and in the recirculation loop piping. This quantity of borated solution is the amount that is above the pump suction SAFETY shutoff level in the boron solution storage tank. No credit is taken for the ANALYSES portion of the tank volume that cannot be injected. The minimum (continued) concentration ensures compliance with the requirements of 10 CFR 50.62 (Ref. 1).

The SLC System is also used to control suppression pool pH in the event of a OBA LOCA by injecting sodium pentaborate into the reactor vessel.

The sodium pentaborate is then transported to the suppression pool and mixed by ECCS flow recirculation through the reactor, out of the break and into the suppression chamber. The amount of sodium pentaborate solution that must be available for injection following a DBA LOCA is determined as part of the DBA LOCA radiological analysis. This quantity is maintained in the storage tank as specified in the Technical Specification.

The SLC System satisfies the requirements of the NRC Policy Statement (Ref. 3) because operating experience and probabilistic risk assessments have shown the SLC System to be important to public health and safety.

Thus, it is retained in the Technical Specifications .

LCO The OPERABILITY of the SLC System provides backup capability for reactivity control independent of normal reactivity control provisions provided by the control rods and provides sufficient buffering agent to maintain the suppression pool pH at or above 7.0 following a DBA LOCA involving fuel damage. The OPERABILITY of the SLC System is based on the conditions of the borated solution in the storage tank and the availability of a flow path to the RPV, including the OPERABILITY of the pumps and valves. Two SLC subsystems are required to be OPERABLE; each contains an OPERABLE pump, an explosive valve, and associated piping, valves, and instruments and controls to ensure an OPERABLE flow path.

APPLICABILITY In MODES 1 and 2, shutdown capability is required. In MODES 3 and 4, control rods are not able to be withdrawn (except as permitted by LCO 3.10.3 and LCO 3.10.4) since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate controls to ensure that the reactor remains subcritical. In MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies.

Demonstration of adequate SOM (LCO 3.1.1, "SHUTDOWN MARGIN (SOM)") ensures that the reactor will not become critical. Therefore, the SLC System is not required to be OPERABLE when only a single control rod can be withdrawn.

SUSQUEHANNA - UNIT 2 TS/ B 3.1-40 (continued)

Revision 2

Rev:4 SLC System B 3.1.7 BASES APPLICABILITY A OBA LOCA that results in the release of radioactive material is possible (continued) in MODES 1, 2 and 3; therefore, capability to buffer the suppression pool pH is required. In MODES 4 and 5, a OBA LOCA with a radioactive release need not be postulated .

SUSQUEHANNA - UNIT 2 TS I B 3.1-40a (continued)

Revision 0

Rev. 4 SLC System

BASES (continued)

B 3.1.7 ACTIONS A.1 If the boron solution concentration is not within the limits in Figure 3.1.7-1, the operability of both SLC subsystems is impacted and the concentration must be restored to within limits within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is considered acceptable given the low probability of an event occurring concurrent with the failure of the control rods to shut down the reactor.

If the boron solution concentration is> 12 weight-percent with the tank volume 2: 1350 gallons, both SLC subsystems are operable as long as the temperature for the boron solution concentration is within the acceptable region of Figure 3.1.7-2. If the temperature requirements are not met, operability of both SLC subsystems is impacted and the concentration or solution temperature must be restored within limits within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . *

If one SLC subsystem is inoperable for reasons other than Condition A, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE subsystem is adequate to perform the (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-41 Revision 1

Rev. 4 SLC System

BASES B 3.1.7 ACTIONS B.1 (continued) shutdown function and provide adequate buffering agent to the suppression I pool. However, the overall reliability is reduced because a single failure in the remaining OPERABLE subsystem could result in reduced SLC System shutdown capability. The 7 day Completion Time is based on the availability of an OPERABLE subsystem capable of performing the intended SLC System functions and the low probability of an event occurring requiring SLC injection.

If both SLC subsystems are inoperable for reasons other than Condition A, at least one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is considered acceptable given the low probability of an event occurring requiring SLC injection. I (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-42 Revision 2

Rev. 4 SLC System

BASES B 3.1.7 ACTIONS

D.1 (continued)

If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.7.1, SR 3.1.7.2. and SR 3.1.7.3 REQUIREMENTS SR 3.1. 7.1 through SR 3.1. 7.3 are 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Surveillances verifying certain characteristics of the SLC System (e.g., the volume and temperature of the borated solution in the storage tank), thereby ensuring SLC System OPERABILITY without disturbing normal plant operation. These Surveillances ensure that the proper borated solution volume and temperature, including the temperature of the pump suction piping, are maintained. Maintaining a minimum specified borated solution temperature is important in ensuring that the sodium pentaborate remains in solution and does not precipitate out in the storage tank or in the pump suction piping.

The temperature versus concentration curve of Figure 3.1. 7-2 ensures that a 10°F margin will be maintained above the saturation temperature. An alternate method of performing SR 3.1. 7.3 is to verify the OPERABILITY of the SLC heat trace system. This verifies the continuity of the heat trace lines and ensures proper heat trace operation, which ensure that the SLC

. suction piping temperature is maintained. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1.7.4 and SR 3.1.7.6 SR 3.1.7.4 verifies the continuity of the explosive charges in the injection valves to ensure that proper operation will occur if required. Other administrative controls, such as those that limit the shelf life of the explosive charges, must be followed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

I (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-43 Revision 2

Rev.4 SLC System B 3.1.7 BASES SURVEILLANCE SR 3.1.7.4 and SR 3.1.7.6 (continued)

REQUIREMENTS SR 3.1.7.6 verifies that each valve in the system is in its correct position, but does not apply to the squib (i.e., explosive) valves. Verifying the correct alignment for manual and power operated valves in the SLC System flow path provides assurance that the proper flow paths will exist for system operation. A valve is also allowed to be in the nonaccident position provided it can be aligned to the accident position from the control room, or locally by a dedicated operator at the valve control. This is acceptable since the SLC System is a manually initiated system. This Surveillance also does not apply to valves that are locked, sealed, or otherwise secured in position since they are verified to be in the correct position prior to locking, sealing, or securing. This verification of valve alignment does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The Surveillance Frequency is controlled under the Surveillance

Frequency Control Program.

SR 3.1.7.5 This Surveillance requires an examination of the sodium pentaborate solution by using chemical analysis to ensure that the proper concentration of sodium pen ta borate exists in the storage tank. SR 3.1. 7 .5 must be performed anytime sodium pentaborate or water is added to the storage tank solution to determine that the sodium pentaborate solution concentration is within the specified limits. SR 3.1.7.5 must also be performed anytime the temperature is restored to within the limits of Figure 3.1. 7-2, to ensure that no significant sodium pentaborate precipitation occurred. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-44 Revision 1

Rev.4 SLC System

BASES SURVEILLANCE 3177 B 3.1.7 REQUIREMENTS SR * * *

(continued) Demonstrating that each SLC System pump develops a flow rate 2: 40.0 gpm at a discharge pressure 2: 1250 psig without actuating the pump's relief valve ensures that pump performance has not degraded during the fuel cycle. Testing at 1250 psig assures that the functional capability of the SLC System meets the A TWS Rule (1 O CFR 50.62) (Ref. 1) requirements. This minimum pump flow rate requirement ensures that, when combined with the sodium pentaborate solution concentration requirements, the rate of negative reactivity insertion from the SLC System will adequately compensate for the positive reactivity effects encountered during power reduction, cooldown of the moderator, and xenon decay.

Additionally, the minimum pump flow rate requirement ensures that adequate buffering agent will reach the suppression pool to maintain pH above 7.0. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this Surveillance is in accordance with the lnservice Testing Program .

SR 3.1.7.8 and SR 3.1.7.9 These Surveillances ensure that there is a functioning flow path from the boron solution storage tank to the RPV, including the firing of an explosive valve. The replacement charge for the explosive valve shall be from the same manufactured batch as the one fired or from another batch that has been certified by having one of that batch successfully fired. The pump and explosive valve tested should be alternated such that both complete flow paths are tested every 48 months at alternating 24 month intervals. The Surveillance may be performed in separate steps to prevent injecting solution into the RPV. An acceptable method for verifying flow from the pump to the RPV is to pump demineralized water from a test tank through one SLC subsystem and into the RPV. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Demonstrating that all heat traced piping between the boron solution storage tank and the suction inlet to the injection

SUSQUEHANNA- UNIT 2 TS I B 3.1-45 (continued)

Revision 4

Rev. 4 SLC System

BASES B 3.1.7 SURVEILLANCE SR 3.1.7.8andSR 3.1.7.9 (continued)

REQUIREMENT s

pumps is unblocked ensures that there is a functioning flow path for injecting the sodium pentaborate solution. An acceptable method for verifying that the suction piping is unblocked is to pump from the storage tank to the test tank.

This test can be performed by any series of overlapping or total flow path test so that the entire flow path is included. The Surveillance Frequency is I controlled under the Surveillance Frequency Control Program. This is especially true in light of the temperature verification of this piping required by SR 3.1. 7.3. However, if, in performing SR 3.1. 7.3, it is determined that the temperature of this piping has fallen below the specified minimum or the heat trace was not properly energized and building temperature was below the temperature at which the SLC solution would precipitate out, SR 3.1. 7.9 must be performed once within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the piping temperature is restored to within the limits of Figure 3.1. 7-2.

SR 3.1.7.10

Enriched sodium pentaborate solution is made by mixing granular, enriched sodium pentaborate with water. Verification of the actual B-10 enrichment must be performed prior to addition to the SLC tank in order to ensure that the proper B-10 atom percentage is being used. This verification may be based on independent isotopic analysis or a manufacturer certificate of compliance.

REFERENCES 1. 10 CFR 50.62.

2. FSAR, Section 9.3.5.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.1-46 Revision 2

Rev.4 SDV Vent and Drain Valves

B 3.1 B 3.1.8 REACTIVITY CONTROL SYSTEMS Scram Discharge Volume (SDV) Vent and Drain Valves B 3.1.8 BASES BACKGROUND The SDV vent and drain valves are normally open and discharge any accumulated water in the SDV to ensure that sufficient volume is available at all times to allow a complete scram. During a scram, the SDV vent and drain valves close to contain reactor water. The SDV is a volume of header piping that connects to each hydraulic control unit (HCU) and drains into an instrument volume. There are two SDVs (headers) and two instrument volumes, each receiving approximately one half of the control rod drive (CRD) discharges. The two instrument volumes are connected to a common drain line with two valves in series. Each header is connected to a common vent line with two valves in series. The header piping is sized to receive and contain all the water discharged by the CRDs during a scram. The design and functions of the SDV are described in Reference 1.

APPLICABLE SAFETY ANALYSES The Design Basis Accident and transient analyses assume all of the control rods are capable of scramming. The acceptance criteria for the SDV vent and drain valves are that they operate automatically to:

a. Close during scram to limit the amount of reactor coolant discharged so that adequate core cooling is maintained and offsite and control room doses remain within regulatory limits; and

b. Open on scram reset to maintain the SDV vent and drain path open so that there is sufficient volume to accept the reactor coolant discharged during a scram.

Isolation of the SDV can also be accomplished by manual closure of the SDV valves. Additionally, the discharge of reactor coolant to the SDV can be terminated by scram reset or closure of the HCU manual isolation valves. For a bounding leakage case, the offsite and control room doses are well within regulatory limits, and adequate core cooling is maintained (Ref. 3). The SDV vent and drain valves allow continuous drainage of the SDV during normal plant operation (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-47 Revision 1

Rev.4 SDV Vent and Drain Valves

BASES B 3.1.8 APPLICABLE to ensure that the SDV has sufficient capacity to contain the reactor SAFETY coolant discharge during a full core scram. To automatically ensure this ANALYSES capacity, a reactor scram (LCO 3.3.1.1, "Reactor Protection System (RPS)

(continued) Instrumentation") is initiated if the SDV water level in the instrument volume exceeds a specified setpoint. The setpoint is chosen so that all control rods are inserted before the SDV has insufficient volume to accept a full scram.

SDV vent and drain valves satisfy Criterion 3 of the NRC Policy Statement (Ref. 4).

LCO The OPERABILITY of all SDV vent and drain valves ensures that the SDV vent and drain valves will close during a scram to contain reactor water discharged to the SDV piping. The SDV vent and drain valves are required to be open to ensure the SDV is drained. Since the vent and drain lines are provided with two valves in series, the single failure of one valve in the open position will not impair the isolation function of the system. Additionally, the valves are required to open on scram reset to ensure that a path is available for the SDV piping to drain freely at other times.

APPLICABILITY In MODES 1 and 2, scram may be required; therefore, the SDV vent and drain valves must be OPERABLE. In MODES 3 and 4, control rods are not able to be withdrawn (except as permitted by LCO 3.10.3 and LCO 3.10.4) since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate controls to ensure that only a single control rod can be withdrawn. Also, during MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies.

Therefore, the SDV vent and drain valves are not required to be OPERABLE in these MODES since the reactor is subcritical and only one rod may be withdrawn and subject to scram.,

ACTIONS The ACTIONS table is modified by Note 1 indicating that a separate Condition entry is allowed for the SDV vent line and the SDV drain line.

This is acceptable, since the (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-48 Revision 1

Rev. 4 SDV Vent and Drain Valves

BASES B 3.1.8 ACTIONS Required Actions for each Condition provide appropriate compensatory (continued) actions for each inoperable SDV line. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SDV lines are governed by subsequent Condition entry and application of associated Required Actions.

The ACTIONS table is modified by a second note stating that a isolated line may be unisolated under administrative control to allow draining and venting of the SDV. When a line is isolated, the potential for an inadvertent scram due to high SDV level is increased. During these periods, the line may be unisolated under administrative control. This allows any accumulated water in the line to be drained, to preclude a reactor scram on high SDV level. This is acceptable since administrative controls ensure the valve can be closed quickly, if a scram occurs with the valve open.

When one SDV vent or drain valve is inoperable in one or more lines, the associated line must be isolated to contain the reactor coolant during a scram. The 7 day Completion Time is reasonable, given the level of redundancy in the lines and the low probability of a scram occurring while the valve(s) are inoperable and the line is not isolated. The SDV is still isolable since the redundant valve in the affected line is OPERABLE.

During these periods, the single failure criterion is not preserved, and a higher risk exists to allow reactor water out of the primary system during a scram.

If both valves in a line are inoperable, the line must be isolated to contain the reactor coolant during a scram.

The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time to isolate the line is based on the low probability of a scram occurring while the line is not isolated and unlikelihood of significant CRD seal leakage.

If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO (continued)

SUSQUEHANNA- UNIT 2 TS I B 3.1-49 Revision 1

Rev.4 SDV Vent and Drain Valves B 3.1.8 BASES ACTIONS C.1 (continued) does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.8.1 REQUIREMENTS During normal operation, the SDV vent and drain valves should be in the open position (except when performing SR 3.1.8.2) to allow for drainage of the SDV piping. Verifying that each valve is in the open position ensures that the SDV vent and drain valves will perform their intended functions during normal operation. This SR does not require any testing or valve manipulation; rather, it involves verification that the valves are in the correct position .

The Surveillance Frequency is controlled under the Surveillance F:requency Control Program.

SR 3.1.8.2 During a scram, the SDV vent and drain valves should close to contain the reactor water discharged to the SDV piping. Cycling each valve through its complete range of motion (closed and open) ensures that the valve will.

function properly during a scram. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1.8.3 SR 3.1.8.3 is an integrated test of the SDV vent and drain valves to verify total system performance. After receipt of a simulated or actual scram signal, the closure of the SDV vent and drain valves is verified. The closure time of (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.1-50 Revision 1

Rev.4 SDV Vent and Drain Valves B 3.1.8 BASES SURVEILLANCE SR 3.1.8.3 (continued)

REQUIREMENTS 30 seconds after receipt of a scram signal is based on the bounding leakage case evaluated in the accident analysis based on the requirements of Reference 2. Similarly, after receipt of a simulated or actual scram reset signal, the opening of the SDV vent and drain valves is verified. The LOGIC SYSTEM FUNCTIONAL JEST in LCO 3.3.1.1 and the scram time testing of control rods in LCO 3.1.3 overlap this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 4.6.

2. 10 CFR 50.67

3. NUREG-0803, "Generic Safety Evaluation Report Regarding Integrity

4.

5.

of BWR Scram System Piping," August 1981 .

Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132).

TSTF-404-A, Rev. 0.

SUSQUEHANNA- UNIT 2 TS/ B 3.1-51 Revision 4

Rev. 5 APLHGR

B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)

B 3.2.1 BASES BACKGROUND The APLHGR is a measure of the average LHGR of all the fuel rods in a fuel assembly at any axial location. Limits on the APLHGR are specified to ensure that limits specified in 10 CFR 50.46 are not exceeded during the postulated design basis loss of coolant accident (LOCA).

APPLICABLE SPC performed LOCA calculations for the SPC ATRIUM'-10 fuel SAFETY ANALYSES design. The analytical methods and assumptions used in evaluating the fuel design limits from 1 O CFR 50.46 are presented in References 3, 4, 5, and 6 for the SPC analysis. The analytical methods and assumptions used in evaluating Design Basis Accidents (DBAs) that determine the APLHGR Limits are presented in References 3 through 9.

LOCA analyses are performed to ensure that the APLHGR limits are adequate to meet the Peak Cladding Temperature (PCD, maximum cladding oxidation, and maximum hydrogen generation limits of 10 CFR 50.46. The analyses are performed using calculational models that are consistent with the requirements of 10 CFR 50, Appendix K.

A complete discussion of the analysis codes are provided in References 3, 4, 5, and 6 for the SPC analysis. The PCT following a postulated LOCA is a function of the average heat generation rate of all the rods of a fuel assembly at any axial location and is not strongly influenced by the rod to rod power distribution within the assembly.

APLHGR limits are developed as a function of fue!Jrpe and exposure.

The SPC analysis is valid for full cores of ATRIUM -10 fuel. The SPC LOCA analyses also consider several alternate operating modes in the development of the APLHGR limits (e.g., Maximum Extended Load Line Limit Analysis (MELLLA), Suppression Pool Cooling Mode, and Single Loop Operation (SLO)). LOCA analyses were performed for the regions of the power/ flow map bounded by the rod line that runs through 100% RTP and maximum core flow and the upper boundary of the MELLLA region. The MELLLA region is analyzed to determine whether an APLHGR multiplier as a function of core flow is required.

The results of the analysis demonstrate the PCTs are within the 10 CFR 50.46 limit, and that APLHGR multipliers as a function of core flow are not required.

SUSQUEHANNA - UNIT 2 TS I B 3.2-1 (continued)

Revision 2

Rev.5 APLHGR

BASES APPLICABLE SAFETY ANALYSES The SPC LOCA analyses consider the delay ii') Low Pressure Coolant Injection (LPCI) availability when the unit is operating in the B 3.2.1 (continued) Suppression Pool Cooling Mode. The delay in LPCI availability is due to the time required to realign valves from the Suppression Pool Cooling Mode to the LPCI mode. The results of the analyses demonstrate that the PCTs are within the 10 CFR 50.46 limit.

Finally, the SPC LOCA analyses were performed for Single-Loop Operation. The results of the SPC analysis for ATRIUM'-10 fuel shows that an APLHGR limit which is 0.8 times the two-loop APLHGR limit meets the 10 CFR 50.46 acceptance criteria, and that the PCT is less than the limiting two-loop PCT.

The APLHGR satisfies Criterion 2 of the NRC Policy Statement (Ref.

10).

LCO The APLHGR limits specified in the COLR are the result of the DBA analyses .

APPLICABILITY The APLHGR limits are primarily derived from LOCA analyses that are assumed to occur at high power levels. Design calculations and ,

operating experience have shown that as power is reduced, the margin to the required APLHGR limits increases. At THERMAL POWER levels< 23% RTP, the reactor is operating with substantial margin to the APLHGR limits; thus, this LCO is not required.

ACTIONS If any APLHGR exceeds the required limits, an assumption regarding an initial condition of the OBA may not be met. Therefore, prompt action should be taken to restore the APLHGR(s) to within the required limits such that the plant operates within analyzed conditions. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is sufficient to restore the APLHGR(s) to within its limits and is acceptable based on the low probability of a OBA occurring simultaneously with the APLHGR out of specification.

SUSQUE:HANNA- UNIT 2 TS I B 3.2-2 (continued)

Revision 2

Rev.5 APLHGR

B 3.2.1 BASES ACTIONS (continued)

If the APLHGR cannot be restored to within its required limits within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 23% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 23% RTP in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.2.1.1 REQUIREMENTS APLHGRs are required to be initially calculated within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after THERMAL POWER is ~ 23% RTP and periodicaJly thereafter.

Additionally, APLHGRs must be calculated prior to exceeding 44%

RTP unless performed in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . APLHGRs are compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance after THERMAL POWER~ 23% RTP is achieved is acceptable given the large inherent margin to operating limits at low power levels and because the APLHGRs must be calculated prior to exceeding 44% RTP. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Not Used

2. Not Used

3. EMF-2361 (P)(A), "EXEM BWR-2000 ECCS Evaluation Model,"

Framatome ANP.

4. EMF-2292(P)(A) Revision 0, "ATRIUM'-10:

Appendix K Spray Heat Transfer Coefficients."

5. XN-CC-33(P)(A) Revision 1, "HUXY: A Generalized Multirod Heatup Code with 10CFR50 Appendix K Heatup Option Users Manual," November 1975.

SUSQUEHANNA - UNIT 2 TS I B 3.2-3 (continued)

Revision 5

Rev. 5 APLHGR

B 3.2.1 BASES REFERENCES 6. XN-NF-80-19(P)(A), Volumes 2, 2A, 28, and 2C "Exxon (continued) Nuclear Methodology for Boiling Water Reactors: EXEM BWR ECCS Evaluation Model," September 1982.

7. FSAR, Chapter 4.

8. FSAR, Chapter 6.

9. FSAR, Chapter 15.

10. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.2-4 Revision 1

Rev.4 MCPR

B 3.2 POWER DISTRIBUTION LIMITS B 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR)

B 3.2.2 BASES BACKGROUND MCPR. is a ratio of the fuel assembly power that would result in the onset of boiling transition to the actual fuel assembly power. The MCPR Safety Limit (SL) is set such that 99.9% of the fuel rods avoid boiling transition if the limit is not violated (refer to the Bases for SL 2.1.1.2). The operating limit MCPR is established to ensure that no fuel damage results during anticipated operational occurrences (AOOs). Although fuel damage does not necessarily occur if a fuel rod actually experienced boiling transition (Ref. 1), the critical power at which boiling transition is calculated to occur has been adopted as a fuel design criterion.

The onset of transition boiling is a phenomenon that is readily detected during the testing of various fuel bundle designs. Based on these experimental data, correlations have been developed to predict critical bundle power (i.e., the bundle power level at the onset of transition boiling) for a given set of plant parameters (e.g., reactor vessel pressure, flow, and subcooling). Because plant operating conditions and bundle power levels are monitored and determined relatively easily, monitoring the MCPR is a convenient way of ensuring that fuel failures due to inadequate cooling do not occur.

APPLICABLE The analytical methods and assumptions used in evaluating the AOOs SAFETY ANALYSES to establish the operating limit MCPR are presented in References 2 through 10. To ensure that the MCPR SL is not exceeded during any transient event that occurs with moderate frequency, limiting transients have been analyzed to determine the largest reduction in critical power ratio (CPR). The types of transients evaluated are loss of flow, increase in pressure and power, positive reactivity insertion, and coolant temperature decrease. The limiting transient yields the largest change in CPR (bCPR). When the largest LiCPR is added to the MCPR SL, the required operating limit MCPR is obtained.

The MCPR operating limits derived from the transient analysis are dependent on the operating core flow and power state to ensure adherence to fuel design limits during the worst transient that occurs with moderate frequency These analyses may also consider other

- SUSQUEHANNA - UNIT 2 TS I B 3.2-5 (continued)

Revision 3

Rev.4 MCPR

BASES APPLICABLE SAFETY ANALYSES (continued) combinations of plant conditions (i.e., control rod scram speed, bypass valve performance, EOC-.RPT, cycle exposure, etc.). Flow B 3.2.2 dependent MCPR limits are determined by analysis of slow flow runout transients.

The MCPR satisfies Criterion 2 of the NRG Policy Statement (Ref. 11).

LCO The MCPR operating limits specified in the COLR are the result of the Design Basis Accident (OBA) and transient analysis. The operating limit MCPR is determined by the larger of the flow dependent MCPR and power dependent MCPR limits.

APPLICABILITY The MCPR operating limits are primarily derived from transient analyses that are assumed to occur at high power levels. Below 23% RTP, the reactor is operating at a minimum recirculation pump speed and the moderator void ratio is small. Surveillance of thermal limits below 23% RTP is unnecessary due to the large inherent margin that ensures that the MCPR SL is not exceeded even if a limiting transient occurs. Studies of the variation of limiting transient behavior have been performed over the range of power and flow conditions .

These studies encompass the range of key actual plant parameter values important to typically limiting transients. The results of these studies demonstrate that a margin is expected between performance and the MCPR requirements, and that margins increase as power is reduced to 23% RTP. This trend is expected to continue to the 5% to 15% power range when entry into MODE 2 occurs. When in MODE 2, the intermediate range monitor provides rapid scram initiation for any significant power increase transient, which effectively eliminates any MCPR compliance concern. Therefore, at THERMAL POWER levels

< 23% RTP, the reactor is operating with substantial margin to the MCPR limits and this LCO is not required.

ACTIONS If any MCPR is outside the required limits, an assumption regarding an initial condition of the design basis transient analyses may not be met.

Therefore, prompt action should be taken to restore the MCPR(s) to within the required limits such that the plant remains operating within

SUSQUEHANNA - UNIT 2 TS/ B 3.2-6

\,I (continued)

Revision 4

Rev.4 MCPR

BASES ACTIONS A.1 (continued) analyzed conditions. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is normally B 3.2.2 sufficient to restore the MCPR(s) to within its limits and is acceptable based on the low probability of a transient or DBA occurring simultaneously with the MCPR out of specification.

If the MCPR cannot be restored to within its required limits within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 23% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 23% RTP in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.2.2.1 REQUIREMENTS The MCPR is required to be initially calculated within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after THERMAL POWER is:::::: 23% RTP and periodically thereafter.

Additionally, MCPR must be calculated prior to exceeding 44% RTP unless performed in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . MCPR is compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance after THERMAL POWER

~ 23% RTP is achieved is acceptable given the large inherent margin to operating limits at low power levels and because the MCPR must be calculated prior to exceeding 44% RTP.

SR 3.2.2.2 Because the transient analysis takes credit for conservatism in the scram time performance, it must be demonstrated that the specific scram time is consistent with those used in the transient analysis.

SR 3.2.2.2 compares the average measured scram times to the assumed scram times documented in the COLR. The COLR contains a table of scram times based on the LCO 3.1.4, "Control Rod Scram Times" and the realistic scram times, both of which are used in the transient analysis. If the average measured scram times are greater than the realistic scram times then the MCPR operating limits corresponding to the Maximum Allowable Average Scram Insertion Time must be implemented .

SUSQUEHANNA - UNIT 2 TS/ B 3.2-7 (continued)

Revision 4

Rev.4 MCPR

BASES SURVEILLANCE REQUIREMENTS SR 3.2.2.2 (continued)

Determining MCPR operating limits based on interpolation between B 3.2.2 scram insertion times is not permitted. The average measured scram times and corresponding MCPR operating limit must be determined once within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after each set of scram time tests required by SR 3.1.4.1, SR 3.1.4.2, SR 3.1.4.3 and SR 3.1.4.4 because the effective scram times may change during the cycle. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is acceptable due to the relatively minor changes in average measured scram times expected during the fuel cycle.

REFERENCES 1. NUREG-0562, June 1979.

2. XN-NF-80-19(P)(A) Volume 1 and Supplements 1 and 2, "Exxon Nuclear Methodology for Boiling Water Reactors,"

Exxon Nuclear Company, March 1983.

3. . XN-NF-80-19(P)(A) Volume 3, Revision 2, "Exxon Nuclear Methodology for Boiling Water Reactors, THERMEX: Thermal Limits Methodology Summary Description," Exxon Nuclear Company, January 1987.

4. ANF-913(P)(A) Volume 1, Revision 1 and Volume 1 Supplements 2, 3, and 4, "COTRANSA2: A Computer Program for Boiling Water Reactor Transient Analyses," Advanced Nuclear Fuels Corporation, August 1990.

5. XN-NF-80-19 (P)(A), Volume 4, Revision 1, "Exxon Nuclear Methodology for Boiling Water Reactors: Application of the ENC Methodology to BWR Reloads," Exxon Nuclear Company, June 1986.

6. NE-092-001, Revision 1, "Susquehanna Steam Electric Station Units 1 & 2: Licensing Topical Report for Power Uprate with Increased Core Flow," December 1992, and NRG Approval Letter: Letter from T. E. Murley (NRG) to R. G. Byram (PP&L),

"Licensing Topical Report for Power Uprate With Increased Core Flow, Revision 0, Susquehanna Steam Electric Station, Units 1 and 2 (PLA-3788) (TAC Nos. M83426 and M83427),"

November 30, 1993.

7. EMF-2209(P)(A), Revision 2, "SPCB Critical Power Correlation," Siemens Power Corporation, September 2003.

SUSQUEHANNA - UNIT 2 TS I B 3.2-8 (continued)

Revision 4

Rev.4 MCPR

BASES Reference (continued)

8. XN-NF-79-71 (P)(A) Revision 2, Supplements 1, 2, and 3, B 3.2.2 "Exxon Nuclear Plant Transient Methodology for Boiling Water Reactors," March 1986.

9. XN-NF-84-105(P)(A), Volume 1 and Volume 1 Supplements 1 and 2, "XCOBRA-T: A Computer Code for BWR Transient Thermal-Hydraulic Core Analysis," February 1987.

10. ANF-1358(P)(A) Revision 3, "The Loss of Feedwater Heating Transient in Boiling Water Reactors," Advanced Nuclear Fuels Corporation, September 2005.

11. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA- UNIT 2 TS I B 3.2-9 Revision 4

Rev. 3 LHGR

B 3.2 POWER DISTRIBUTION LIMITS B 3.2.3 LINEAR HEAT GENERATION RATE (LHGR)

B 3.2.3 BASES BACKGROUND The LHGR is a measure of the heat generation rate of a fuel rod in a fuel assembly at any axial location. Limits on LHGR are specified to ensure that fuel design limits are not exceeded anywhere in the core during normal operation. Exceeding the LHGR limit could potentially result in fuel damage and subsequent release of radioactive materials.

Fuel design limits are specified to ensure that fuel system damage, fuel rod failure, or inability to cool the fuel does not occur during the normal operations identified in Reference 1.

APPLICABLE The analytical methods and assumptions used in evaluating the fuel SAFETY ANALYSES system design are presented in References 1, 2, 3, and 4. The fuel assembly is designed to ensure (in conjunction with the core nuclear and thermal hydraulic design, plant equipment, instrumentation, and protection system) that fuel damage will not result in the release of radioactive materials in excess of regulatory limits. The mechanisms that could cause fuel damage during operational transients and that are considered in fuel evaluations are:

a. Rupture of the fuel rod cladding caused by strain from the relative expansion of the U02 pellet; and

b. Severe overheating of the fuel rod cladding caused by inadequate cooling.

A value of 1% plastic strain of the fuel cladding has been defined as the limit below which fuel damage caused by overstraining of the fuel cladding is not expected to occur (Ref. 3).

Fuel design evaluations have been performed and demonstrate that the 1% fuel cladding plastic strain design limit is not exceeded during continuous operation with LHGRs up to the operating limit specified in the COLR. A separate evaluation was performed to determine the limits of LHGR during anticipated operational occurrences. This limit, Protection Against Power Transients (PAPT), defined in reference 4, provides the acceptance criteria for LHGRs calculated in evaluation of theAOOs .

SUSQUEHANNA - UNIT 2 TS I B 3.2-10 (continued)

Revision 2

Rev.3 LHGR

BASES APPLICABLE SAFETY ANALYSES B 3.2.3 (continued)

The LHGR satisfies Criterion 2 of the NRC Policy Statement (Ref. 5).

LCO The LHGR is a basic assumption in the fuel design analysis. The fuel has been designed to operate at rated core power with sufficient design margin to the LHGR calculated to cause a 1% fuel cladding plastic strain. The operating limit to accomplish this objective is specified in the COLR.

APPLICABILITY The LHGR limits are derived from fuel design analysis that is limiting at high power level conditions. At core thermal power levels< 23% RTP, the reactor is operating with a substantial margin to the LHGR limits and, therefore, the Specification is only required when the reactor is operating at~ 23% RTP.

ACTIONS If any LHGR exceeds its required limit, an assumption regarding an initial condition of the fuel design analysis is not met. Therefore, prompt action should be taken to restore the LHGR(s) to within its required limits such that the plant is operating within analyzed conditions. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is normally sufficient to restore the LHGR(s) to within its limits and is acceptable based on the low probability of a transient or Design Basis Accident occurring simultaneously with the LHGR out of specification.

If the LHGR cannot be restored to within its required limits within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER is reduced to< 23% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to< 23% RTP in an orderly manner and without challenging plant systems .

SUSQUEHANNA - UNIT 2 TS I B 3.2-11 (continued)

Revision 2

Rev. 3 LHGR

BASES SURVEILLANCE REQUIREMENTS SR 3.2.3.1 B 3.2.3 The LHGR is required to be initially calculated within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after *I THERMAL POWER is z 23% RTP and periodically thereafter.

Additionally, LHGRs must be calculated prior to exceeding 44% RTP unless performed in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The LHGR is compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance after THERMAL POWER z 23% RTP is achieved is acceptable given the large inherent margin to operating limits at lower power levels and because the LHGRs must be calculated prior to exceeding 44% RTP.

The SuNeillance Frequency is controlled under the SuNeillance Frequency Control Program.

REFERENCES 1. FSAR, Section 4.

2. FSAR, Section 5 .

3.

4.

NUREG-0800, Section ll.A.2(g), Revision 2, July 1981.

ANF-89-98(P)(A) Revision 1 and Revision 1 Supplement 1, "Generic Mechanical Design Criteria for BWR Fuel Design,"

Advanced Nuclear Fuels Corporation, May 1995.

5. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.2-12 Revision 3

Rev.3 LHGR

BASES B 3.2.3

THIS PAGE INTENTIONALLY LEFT BLANK

SUSQUEHANNA - UNIT 2 TS I B 3.2-13 Revision 1

Rev. 6 RPS Instrumentation

B 3.3.1.1 BASES Reactor Protection System (RPS) Instrumentation B 3.3.

1.1 BACKGROUND

The RPS initiates a reactor scram when one or more monitored parameters exceed their specified limits, to preserve the integrity of the fuel cladding and the Reactor Coolant System (RCS) and minimize the energy that must be absorbed following a loss of coolant accident (LOCA). This can be accomplished either automatically or manually.

The protection and monitoring functions of the RPS have been designed to ensure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters and equipment performance. The LSSS are defined in this Specification as the Allowable Values, which, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs) during Design Basis Accidents (DBAs).

The RPS, as shown in the FSAR, Figure 7.2-1 (Ref. 1), includes

*sensors, relays, bypass circuits, and switches that are necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide range of dependent and independent parameters.

The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level, reactor vessel pressure, neutron flux, main steam line isolation valve position, turbine control valve (TCV) fast closure trip oil pressure, turbine stop valve (TSV) position, drywell pressure, and scram discharge volume (SDV) water level, as well as reactor mode switch in shutdown position and manual scram signals. There are at least four redundant sensor input signals from each of these parameters (with the exception of the reactor mode switch in shutdown scram signal). When the setpoint is reached, the channel sensor actuates, which then outputs an RPS trip signal to the trip logic. Table B 3.3.1.1-1 summarizes the diversity of sensors capable of initiating scrams during anticipated operating transients typically analyzed.

The RPS is comprised of two independent trip systems (A and B) with two logic channels in each trip system (logic

SUSQUEHANNA - UNIT 2 TS I B 3.3-1 (continued)

Revision 1

Rev.6 RPS Instrumentation

BASES BACKGROUND (continued) channels A 1 and A2, B1 and B2) as shown in Reference 1. The outputs of the logic channels in a trip system are combined in a B 3.3.1.1 one-out-of-two logic so that either channel can trip the associated trip system. The tripping of both trip systems will produce a reactor scram.

This logic arrangement is referred to as a one-out-of-two taken twice logic. Each trip system can be reset by use of a reset switch. If a full scram occurs (both trip systems trip), a relay prevents reset of the trip systems for 10 seconds after the full scram signal is received. This 1Osecond delay on reset ensures that the scram function will be completed.

Two AC powered scram pilot solenoids are located in the hydraulic control unit for each control rod drive (CRD). Each scram pilot valve is operated with the solenoids normally energized. The scram pilot valves control the air supply to the scram inlet and outlet valves for the associated CRD. When either scram pilot valve solenoid is energized, air pressure holds the scram valves closed and, therefore, both scram pilot valve solenoids must be de-energized to cause a control rod to scram. The scram valves control the supply and discharge paths for the CRD water during a scram. One of the scram pilot valve solenoids

for each CRD is controlled by trip system A, and the other solenoid is controlled by trip system B. Any trip of trip system A in conjunction with any trip in trip system B results in de-energizing both solenoids, air bleeding off, scram valves opening, and control rod scram.

The DC powered backup scram valves, which energize on a scram signal to depressurize the scram air header, are also controlled by the RPS. Additionally, the RPS System controls the SDV vent and drain valves such that when both trip systems trip, the SDV vent and drain valves close to isolate the SDV.

APPLICABLE The actions of the RPS are assumed in the safety analyses of SAFETY References 3, 4, 5 and 6. The RPS initiates a reactor scram before the ANALYSES, LCO, monitored parameter values reach the Allowable Values, specified by the and APPLICABILITY setpoint methodology and listed in Table 3.3.1.1-1 to preserve the integrity of the fuel cladding, the reactor coolant pressure boundary (RCPB), and

SUSQUEHANNA- UNIT 2 TS I B 3.3-2 (continued)

Revision 1

Rev.6 RPS Instrumentation

BASES APPLICABLE SAFETY the containment by minimizing the energy that must be absorbed following a LOCA.

B 3.3.1.1 ANALYSES, LCO, and RPS instrumentation satisfies Criterion 3 of the NRC Policy Statement.

APPLICABILITY (Ref. 2)

(continued)

Functions not specifically credited in the accident analysis are retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

The OPERABILITY of the RPS is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.1.1-1. Each Function must have a required number of OPERABLE channels per RPS trip system, with their setpoints within the specified Allowable Value, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Each channel must also respond within its assumed response time.

Allowable Values are specified for each RPS Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations.

The nominal setpoints are selected to ensure that the actual setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.

A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter reaches the setpoint, the associated device changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances,

SUSQUEHANNA - UNIT 2 TS/ B 3.3-3 (continued)

Revision 1

Rev. 6 RPS Instrumentation

BASES APPLICABLE SAFETY 8"'3.3.1.1 instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are ANALYSES, LCO, accounted for.

and APPLICABILITY (continued) Th.e OPERABILITY of scram pilot valves and associated solenoids, backup scram valves, and SDV valves, described in the Background section, are not addressed by this LCO.

The individual Functions are required to be OPERABLE in the MODES specified in the table, which may require an RPS trip to mitigate the consequences of a design basis accider:it or transient. To ensure a reliable scram function, a combination of Functions are required in each MODE to provide primary and diverse initiation signals.

The RPS is required to be OPERABLE in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies.

Control rods withdrawn from a core cell containing no fuel assemblies do not affect the reactivity of the core and, therefore, are not required to have the capability to scram. Provided all other control rods remain inserted, the RPS function is not required. In this condition, the required

SOM (LCO 3.1.1) and refuel position one-rod-out interlock (LCO 3.9.2) ensure that no event requiring RPS will occur. During normal operation in MODES 3 and 4, all control rods are fully inserted and the Reactor Mode Switch Shutdown Position control rod withdrawal block (LCO 3.3.2.1) does not allow any control rod to be withdrawn. Under these conditions, the RPS function is not required to be OPERABLE.

The exception to this is Special Operations (LCO 3.10.3 and LCO 3.10.4) which ensure compliance with appropriate requirements.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

Intermediate Range Monitor ORM) 1.a. Intermediate Range Monitor Neutron Flux-High The IRMs monitor neutron flux levels from the upper range of the source range monitor (SRM) to the lower range of the average power range monitors (APRMs). The IRMs are capable of generating trip signals that can be used to prevent fuel

SUSQUEHANNA- UNIT 2 TS I B 3.3-4 (continued)

Revision 1

Rev. 6 RPS Instrumentation

BASES APPLICABLE SAFETY 1.a. Intermediate Range Monitor Neutron Flux-High (continued)

B 3.3.1.1 ANALYSES, LCO, damage resulting from abnormal operating transients in the and APPLICABILITY intermediate power range. In this power range, the most significant source of reactivity change is due to control rod withdrawal. The IRM provides diverse protection for the rod worth minimizer (RWM), which monitors and controls the movement of control rods at low power. The RWM prevents the withdrawal of an out of sequence control rod during startup that could result in an unacceptable neutron flux excursion (Ref. 5). The IRM provides mitigation of the neutron flux excursion.

To demonstrate the capability of the IRM System to mitigate control rod withdrawal events, generic analyses have been performed (Ref. 3) to evaluate the consequences of control rod withdrawal events during startup that are mitigated only by the IRM. This analysis, which assumes that one IRM channel in each trip system is bypassed, demonstrates that the IRMs provide protection against local control rod withdrawal errors and results in peak fuel energy depositions below the 170 cal/gm fuel failure threshold criterion.

The IRMs are also capable of limiting other reactivity excursions during startup, such as cold water injection events, although no credit is specifically assumed.

The IRM System is divided into two trip systems, with four IRM channels inputting to each trip system. The analysis of Reference 3 assumes that one channel in each trip system is bypassed. Therefore, six channels with three channels in each trip system are required for IRM OPERABILITY to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. This trip is active in each of the 10 ranges of the IRM, which must be selected by the operator to maintain the neutron flux within the monitored level of an IRM range.

The analysis of Reference 3 has adequate conservatism to permit an IRM Allowable Value of 122 divisions of a 125 division scale.

The Intermediate Range Monitor Neutron Flux-High Function must be OPERABLE during MODE 2 when control rods may be withdrawn and the potential for criticality exists. In

SUSQUEHANNA - UNIT 2 TS I B 3.3-5 (continued)

Revision 2

Rev.6 RPS Instrumentation

BASES APPLICABLE SAFETY 1.a. Intermediate Range Monitor Neutron Flux-High (continued)

B 3.3.1.1 ANALYSES, LCO, MODE 5, when a cell with fuel has its control rod withdrawn, the IRMs and APPLICABILITY provide monitoring for and protection against unexpected reactivity excursions. In MODE 1, the APRM System and the RWM provide protection against control rod withdrawal error events and the I RMs are not required. In addition, the Function is automatically bypassed when the Reactor Mode Switch is in the Run position.

1.b. Intermediate Range Monitor-lnop This trip signal provides assurance that a minimum number of IRMs are OPERABLE. Anytime an IRM mode switch is moved to any position other than "Operate," the detector voltage drops below a preset level, or when a module is not plugged in, an inoperative trip signal will be received by the RPS unless the IRM is bypassed. Since only one IRM in each trip system may be bypassed, only one IRM in each RPS trip system may be inoperable without resulting in an RPS trip signal.

This Function was not specifically credited in the accident analysis but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

Six channels of Intermediate Range Monitor-lnop with three channels in each trip system are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function _on a valid signal.

Since this Function is not assumed in the safety analysis, there is no Allowable Value for this Function.

This Function is required to be OPERABLE when the Intermediate Range Monitor Neutron Flux-High Function is required .

SUSQUEHANNA - UNIT 2 TS I B 3.3-6 (continued)

Revision 1

Rev. 6 RPS Instrumentation

BA.SES APPLICABLE SAFETY Average Power Range Monitor (APRM)

B 3.3.1.1 ANALYSES, LCO, and The APRM channels provide the primary indication of neutron flux APPLICABILITY within the core and respond almost instantaneously to neutron flux (continued) increases. The APRM channels receive input signals from the local power range monitors (LPRMs) within the reactor core to provide an indication of the power distribution and local power changes. The APRM channels average these LPRM signals to provide a continuous indication of average reactor power from a few percent to greater than RTP. Each APRM channel also includes an Oscillation Power Range Monitor (OPRM) Upscale Function, which monito"rs small groups of LPRM signals to detect thermal-hydraulic instabilities.

The APRM trip System is divided into four APRM channels and four 2-out-of-4 Voter channels. Each APRM channel provides inputs to each of the four voter channels. The four voter channels are divided into two groups of two each with each group of two providing inputs to one RPS trip system. The system is designed to allow one APRM channel, but no voter channels, to be bypassed. A trip from any one

unbypassed APRM will result in a "half-trip" in all four of the voter channels, but no trip inputs to either RPS trip system.

APRM trip Functions 2.a, 2.b, 2.c, and 2.d are voted independently from OPRM Trip Function 2.f. Therefore, any Function 2.a, 2.b, 2.c, or 2.d trip from any two unbypassed APRM channels will result in a full trip in each of the four voter channels, which in turn results in two trip inputs into each RPS trip system logic channel (A1, A2, B1, and B2),

thus resulting in a full scram signal. Similarly, a Function 2.f trip from any two unbypassed APRM channels will result in a full trip from each of the four voter channels.

Three of the four APRM channels and all four of the voter channels are required to be OPERABLE to ensure that no single failure will preclude a scram on a valid signal. In addition, to provide adequate coverage of the entire core consistent with the design bases for the APRM Functions 2.a, 2.b, and 2.c, at least 20 LPRM inputs with at least three LPRM inputs from each of the four axial levels at which the LPRMs are located must be OPERABLE for each APRM channel, with no more than 9, LPRM detectors declared inoperable since the most recent APRM gain calibration. Per Reference 23, the minimum input

SUSQUEHANNA - UNIT 2 TS I B 3.3-7 (continued)

Revision 3

Rev. 6 RPS Instrumentation

BASES APPLICABLE SAFETY Average Power Range Monitor (APRM) (continued)

B 3.3.1.1 ANALYSES, LCO, requirement for an APRM channel with 43 LPRM inputs is determined and APPLICABILITY given that the total number of LPRM outputs used as inputs to an APRM channel that may be bypassed shall not exceed twenty-three (23). Hence, 20 LPRM inputs producing a channel trip signal. needed to be operable. For the OPRM Trip Function 2.f, each LPRM in an APRM channel is further associated in a pattern of OPRM "cells," as described in References 17 and 18. Each OPRM cell is capable of producing a channel trip signaL 2.a. Average Power Range Monitor Neutron Flux-High (Setdown)

For operation at low power (i.e., MODE 2), the Average Power Range Monitor Neutron Flux-High (Setdown) Function is capable of generating a trip signal that prevents fuel damage resulting from abnormal operating transients in this power range. For most operation at low power levels, the Average Power Range Monitor Neutron Flux-High (Setdown) Function will provide a secondary scram to the Intermediate Range Monitor Neutron Flux-High Function because of

the relative setpoints. With the IRMs at Range 9 or 10, it is possible that the Average Power Range Monitor Neutron Flux-High (Setdown)

Function will provide the primary trip signal for a corewide increase in power.

The Average Power Range Monitor Neutron Flux-High (Setdown)

Function together with the IRM-High Function provide mitigation for the control rod withdrawal event during startup (Section 15.4.1 of Ref 5).

Also, the Function indirectly ensures that before the reactor mode switch is placed in the run position, reactor power does not exceed 23% RTP (SL 2.1.1.1) when operating at low reactor pressure and low core flow. Therefore, it indirectly prevents fuel damage during significant reactivity increases with THERMAL POWER< 23% RTP.

The Allowable Value is based on preventing significant increases in power when THERMAL POWER is< 23% RTP.

The Average Power Range Monitor Neutron Flux-High (Setdown)

Function must be OPERABLE during MODE 2 when control rods may be withdrawn since the potential for criticality exists. In MODE 1, the Average Power Range Monitor Neutron Flux-High Function provides protection against reactivity transients and the RWM protects against control rod withdrawal error events .

SUSQUEHANNA- UNIT 2 TS I B 3.3-8 (continued)

Revision 4

Rev. 6 RPS Instrumentation

BASES APPLICABLE SAFETY 2.a. Average Power Range Monitor Neutron Flux-High (Setdown)

(continued)

B 3.3.1.1 ANALYSES, LCO, and APPLICABILITY There are provisions in the design of the NUMAC PRNM that given certain circumstances, such as loss of one division of RPS power, an individual APRM will default to a "run" mode condition logic. If the plant is in mode 2 when this occurs, the individual APRM will be in a condition where the 'run' mode setpoint (Function 2.c) and not the

'setdown' setpoint (Function 2.a) will be applied. If this condition occurs while in reactor mode 2 condition, the appropriate LCO condition per Table 3.3.1.1-1 needs to be entered.

2.b. Average Power Range Monitor Simulated Thermal Power-High The Average Power Range Monitor Simulated Thermal Power-High Function monitors neutron flux to approximate the THERMAL POWER being transferred to the reactor coolant. The APRM neutron flux is electronically filtered with a time constant representative of the fuel heat transfer dynamics to generate a signal proportional to the THERMAL POWER in the reactor. The trip level is varied as a_

function of recirculation drive flow (i.e., at lower core flows, the setpoint is reduced proportional to the reduction in power experienced as core flow is reduced with a fixed control rod pattern) but is clamped at an upper limit that is always lower than the Average Power Range Monitor Neutron Flux-High Function Allowable Value. The Average Power ,.

Range Monitor Simulated Thermal Power-High Function is not credited in any plant Safety Analyses. The Average Power Range Monitor Simulated Thermal Power-High Function Limit is set above the APRM I Rod Block to provide defense in depth to the APRM Neutron Flux-

'High for transients where THERMAL POWER increases slowly (such as loss of feedwater heating event). During these events, the THERMAL POWER increase does not significantly lag the neutron flux response and, because of a lower trip setpoint, will initiate a scram before the high neutron flux scram. For rapid neutron flux increase events, the THERMAL POWER lags the neutron flux and the Average Power Range Monitor Neutron Flux-High Function will provide a scram signal before the Average Power Range Monitor Simulated Thermal Power-High Function setpoint is exceeded.

The Average Power Range Monitor Simulated Thermal Power-High Function uses a trip level generated based on recirculation loop drive flow (W) representative of total core flow. Each APRM *channel uses one total recirculation drive flow signal. The total recirculation drive

SUSQUEHANNA - UNIT 2 TS/ B 3.3-9 (continued)

Revision 3

Rev. 6 RPS Instrumentation

BASES APPLICABLE SAFETY 2.b. Average Power Range Monitor Simulated Thermal Power-High (continued)

B 3.3.1.1 ANALYSES, LCO, and

APPLICABILITY flow signal is generated by the flow processing logic, part of the APRM channel, by summing the flow calculated from two flow transmitter signal inputs, one from each of the two recirculation drive flow loops.

The flow processing logic OPERABILITY is part of the APRM channel OPERABILITY requirements for this Function.

The adequacy of drive flow as a representation of core flow is ensured through drive flow alignment, accomplished by SR 3.3.1.1.20.

A note is included, applicable when the plant is in single recirculation

loop operation per LCO 3.4.1, which requires reducing by t1W the recirculation flow value used in the APRM Simulated Thermal Power-High Allowable Value equation. The Average Power Range Monitor Scram Function varies as a function of recirculation loop drive flow CN). t1W is defined as the difference in indicated drive flow (in percent of drive flow, which produces rated core flow) between two-loop and single-loop operation at the same core flow. The value of t1W is established to conservatively bound the inaccuracy created in the core flow/drive flow correlation due to back flow in the jet pumps associated with the inactive recirculation loop. This adjusted Allowable Value thus maintains thermal margins essentially unchanged from those for two-loop operation.

The THERMAL POWER time constant of < 7 se~onds is based on the fuel heat transfer dynamics and provides a signal proportional to the THERMAL POWER. The simulated thermal time constant is part of filtering logic in the APRM that simulates the relationship between neutron flux and core thermal power.

The Average Power Range Monitor Simulated Thermal Power-High Function is required to be OPERABLE in MODE 1 when there is the possibility of generating excessive THERMAL POWER and potentially exceeding the SL applicable to high pressure and core flow conditions (MCPR SL). During MODES 2 and 5, other IRM and APRM Functions provide protection for fuel cladding integrity.

2.c. Average Power Range Monitor Neutron Flux-High The Average Power Range Monitor Neutron Flux-High Function is capable of generating a trip signal to prevent fuel damage or excessive RCS pressure. For the overpressurization protection analysis of Reference 4, the Average Power Range Monitor Neutron Flux-High

SUSQUEHANNA - UNIT 2 TS I B 3.3-10 (continued)

Revision 3

Rev.6 RPS Instrumentation

BASES APPLICABLE SAFETY 2.c. Average Power Range Monitor Neutron Flux-High (continued)

B 3.3.1.1 1*

ANALYSES, LCO, and Function is assumed to terminate the main steam isolation valve APPLICABILITY (MSIV) closure event and, along with the safety/relief valves (S/RVs), limit the peak reactor pressure vessel (RPV) pressure to less than the ASME Code limits. The control rod drop accident (CRDA) analysis (Ref. 5) takes credit for the Average Power Range Monitor Neutron Flux-High Function to terminate the CRDA.

The CRDA analysis assumes that reactor scram occurs on Average Power Range Monitor Neutron Flux-High Function.

The Average Power Range Monitor Neutron Flux-High Function is required to be OPERABLE in MODE 1 where the potential consequences of the analyzed transients could result in the SLs (e.g., MCPR and RCS pressure) being exceeded. Although the Average Power Range Monitor Neutron Flux-High Function is assumed in the CRDA analysis, which is applicable in MODE 2, the Average Power Range Monitor Neutron Flux-High (Setdown) Function conservatively bounds the assumed trip and, together with the assumed IRM trips, provides adequate protection. Therefore, the Average Power Range Monitor Neutron Flux-High Function is not required in MODE 2.

2.d. Average Power Range Monitor-lnop Three of the four APRM channels are required to be OPERABLE for each of the APRM Functions. This Function (lnop) provides assurance that the minimum number of APRM channels are OPERABLE.

For any APRM channel, any time its mode switch is not in the "Operate" position, an APRM module required to issue a trip is unplugged, or the automatic self-test system detects a critical fault with the APRM channel, an lnop trip is sent to all four voter channels. lnop trips from two or more unbypassed APRM channels result in a trip output from each of the four voter channels to its associated trip system.

This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis .

SUSQUEHANNA- UNIT 2 TS I B 3.3-11 (continued)

Revision 3

Rev.6 RPS Instrumentation

BASES APPLICABLE SAFETY 2.d. Average Power Range Monitor-lnop (continued)

B 3.3.1.1 ANALYSES, LCO, and There is no Allowable Value for this Function.

APPLICABILITY This Function is required to be OPERABLE in the MODES where the APRM Functions are required.

2.e. 2-out-of-4 Voter The 2-out-of-4 Voter Function provides the interface between the APRM Functions, including the OPRM Trip Function, and the final RPS trip system logic. As such, it is required to be OPERABLE in the MODES where the APRM Functions are required and is necessary to support the safety analysis applicable to each of those Functions.

Therefore, the 2-out-of-4 Voter Function is required to be OPERABLE in MODES 1 and 2.

All four voter channels are required to be OPERABLE. Each voter channel includes self-diagnostic functions. If any voter channel

detects a critical fault in its own processing, a trip is issued from that voter channel to the associated RPS trip system.

The Two-Out-Of-Four Logic Module includes both the 2-out-of-4 Voter hardware and the APRM Interface hardware. The 2-out-of-4 Voter Function 2.e votes APRM Functions 2.a, 2.b, 2.c, and 2.d independently of Function 2.f. This voting is accomplished by the 2-out-of-4 Voter hardware in the Two-Out-Of-Four Logic Module.

The voter includes separate outputs to RPS for the two independently voted sets of Functions, each of which is redundant (four total outputs). The analysis in Reference 15 took credit for this redundancy

in the justification of the 12-hour Completion Time for Condition A, so.

the voter Function 2.e must be declared inoperable if any of its functionality is inoperable. The voter Function 2.e does not need to be declared inoperable due to any failure affecting only the APRM Interface hardware portion of the Two-Out-Of-Four Logic Module.

There is no Allowable Value for this Function .

SUSQUEHANNA - UNIT 2 TS I B 3.3-12 (continued)

Revision 3

Rev.6 RPS Instrumentation

BASES APPLICABLE SAFETY 2.f. Oscillation Power Range Monitor COPRM) Trip B 3.3.1.1 ANALYSES, LCO, and The OPRM Trip Function provides compliance with GDC 10, "Reactor APPLICABILITY Design," and GDC 12, "Suppression of Reactor Power Oscillations" (continued) thereby providing protection from exceeding the fuel MCPR safety limit (SL) due to anticipated thermal-hydraulic power oscillations.

References 17, 18 and 19 describe three algorithms for detecting thermal-hydraulic instability related neutron flux oscillations: the period based detection algorithm (confirmation count and cell amplitude), the amplitude based algorithm, and the growth rate algorithm. All three are implemented in the OPRM Trip Function, but the safety analysis takes credit only for the period based detection algorithm. The remaining algorithms provide defense in depth and additional protection against unanticipated oscillations. OPRM Trip Function OPERABILITY for Technical Specification purposes is based only on the period based detection algorithm.

The OPRM Trip Function receives input signals from the local power

range monitors (LPRMs) within the reactor core, which are combined into "cells" for evaluation by the OPRM algorithms. Each channel is capable of detecting thermal-hydraulic instabilities, by detecting the related neutron flux oscillations, and issuing a trip signal before the MCPR SL is exceeded. Three of the four channels are required to be OPERABLE.

The OPRM Trip is automatically enabled (bypass removed) when THERMAL POWER is~ 25% RTP, as indicated by the APRM Simulated Thermal Power, and reactor core flow is :::; the value defined in the COLR, as indicated by APRM measured recirculation drive flow.

This is the operating region where actual thermal-hydraulic instability and related neutron flux oscillations are expected to occur. Reference 21 includes additional discussion of OPRM Trip enable region limits.

These setpoints, which are sometimes referred to as the "auto-bypass" setpoints, establish the boundaries of the OPRM Trip enabled region.

The APRM Simulated Thermal Power auto-enable setpoint has 1%

deadband while the drive flow setpoint has a 2% deadband. The deadband for these setpoints is established so that it increases the enabled region once the region is entered .

SUSQUEHANNA - UNIT 2 TS I B 3.3-13 (continued)

Revision 3

Rev. 6 RPS Instrumentation

BASES APPLICABLE SAFETY 2.f. Oscillation Power Range Monitor COPRM) Trip (continued)

B 3.3.1.1 ANALYSES, LCO, and The OPRM Trip Function is required to be OPERABLE when the plant APPLICABILITY is at~ 23% RTP. The 23% RTP level is selected to provide margin in 1*

the unlikely event that a reactor power increase transient occurring without operator action while the plant is operating below 25% RTP causes a power increase to or beyond the 25% APRM Simulated Thermal Power OPRM Trip auto-enable setpoint. This OPERABILITY requirement assures that the OPRM Trip auto-enable function will be OPERABLE when required.

An APRM channel is also required to have a minimum number of OPRM cells OPERABLE for the Upscale Function 2.f to be OPERABLE. The OPRM cell operability requirements are documented in the Technical Requirements Manual, TRO 3.3.9, and are established as necessary to support the trip setpoint calculations performed in accordance with methodologies in Reference 19.

An OPRM Trip is issued from an APRM channel when the period based detection algorithm in that channel detects oscillatory changes in the neutron flux, indicated by the combined signals of the LPRM detectors in a cell, with period confirmations and relative cell amplitude exceeding specified setpoints. One or more cells in a channel*

exceeding the trip conditions will result in a channel OPRM Trip from that channel. An OPRM Trip is also issued from the channel if either the growth rate or amplitude-based algorithms detect oscillatory changes in the neutron flux for one or more cells in that channel.

(Note: To facilitate placing the OPRM Trip Function 2.f in one APRM channel in a "tripped" state, if necessary to satisfy a Required Action, the APRM equipment is conservatively designed to force an OPRM Trip output from the APRM channel if an APRM lnop condition occurs, such as when the APRM chassis keylock switch is placed in the lnop position.)

There are three "sets" of OPRM related setpoints or adjustment parameters: a) OPRM Trip auto-enable region setpoints for STP and drive flow; b) period based detection algorithm (PBDA) confirmation count and amplitude setpoints; and c) period based detection algorithm tuning parameters .

SUSQUEHANNA - UNIT 2 TS I B 3.3-14 (continued)

Revision 4

__J

Rev. 6 RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.f. Oscillation Power Range Monitor COPRM) Trip (continued)

SAFETY ANALYSES, LCO, and The first set, the OPRM Trip auto-enable setpoints, as discussed in the APPLICABILITY SR 3.3.1.1.19 Bases, are treated as nominal setpoints with no additional margins added. The settings are defined in the Technical Requirements I Manual, TRO 3.3.9, and confirmed by SR 3.3.1.1.19. The second set, the OPRM PBDA trip setpoints, are established in accordance with methodologies defined in Reference 19, and are documented in the COLR. There are no allowable values for these setpoints. The third set, the OPRM PBDA "tuning" parameters, are established or adjusted in accordance with and controlled by requirements in the Technical Requirements Manual, TRO 3.3.9.

3. Reactor Vessel Steam Dome Pressure-High An increase in the RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion. This causes the neutron flux and THERMAL POWER transferred to the reactor coolant to increase, which could challenge the integrity ot the fue1 I cladding and the RCPB. This trip Function is assumed in the low power

generator load rejection without bypass and the recirculation flow controller failure (increasing) event. However, the Reactor Vessel Steam Dome Pressure-High Function initiates a scram for transients that results in a pressure increase, counteracting the pressure increase by rapidly reducing core power. For the overpressurization protection analysis of Reference 4, reactor scram (the analyses conservatively assume a scram from either the Average Power Range Monitor Neutron Flux-High I signal, or the Reactor Vessel Steam Dome Pressure-High signal), along with the S/RVs, limits the peak RPV pressure to less than the ASME Section Ill Code limits.

High reactor pressure signals are initiated from four pressure instruments that sense reactor pressure. The Reactor Vessel Steam Dome Pressure-High Allowable Value is chosen to provide a.sufficient margin to the ASME Section Ill Code limits during the event.

Four channels of Reactor Vessel Steam Dome Pressure-High Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. The Function is required to be OPERABLE in MODES 1 and 2 when the RCS is pressurized and the potential for pressure increase exists .

SUSQUEHANNA - UNIT 2 TS I B 3.3-15 (continued)

Revision 2

Rev. 6 RPS Instrumentation

BASES APPLICABLE SAFETY ANALYSES,

4. Reactor Vessel Water Level-Low, Level 3 B 3.3.1.1 LCO, and Low RPV water level indicates the capability to cool the fuel may be APPLICABILITY threatened. Should RPV water level decrease too far, fuel damage (continued) could result. Therefore, a reactor scram is initiated at Level 3 to substantially reduce the heat generated in the fuel from fission. The Reactor Vessel Water Level-Low, Level 3 Function is assumed in the analysis of the recirculation line break (Ref. 6). The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the Emergency Core Cooling. Systems (ECCS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level-Low, Level 3 signals are initiated from four level instruments that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Reactor Vessel Water Level-Low, Level 3 Function, with two channels in each trip system arranged in a one-out-of-two

logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.

The Reactor Vessel Water Level-Low, Level 3 Allowable Value is selected to ensure that during normal operation the separator skirts are not uncovered (this protects available recirculation pump net positive suction head (NPSH) from significant carryunder) and, for transients involving loss of all normal feedwater flow, initiation of the low pressure ECCS subsystems at Reactor Vessel Water-Low Low Low, Level 1 will not be required.

The Function is required in MODES 1 and 2 where considerable energy exists in the RCS resulting in the limiting transients and a<?cidents. ECCS initiations at Reactor Vessel Water Level-Low Low, Level 2 and Low Low Low, Level 1 provide sufficient protection for level transients in all other MODES .

SUSQUEHANNA - UNIT 2 TS I B 3.3-16 (continued)

Revision 2

Rev. 6 RPS Instrumentation

BASES APPLICABLE SAFETY ANALYSES,

5. Main Steam Isolation Valve-Closure B 3.3.1.1 LCO, and MSIV closure results in loss of the main turbine and the condenser as a APPLICABILITY heat sink for the nuclear steam supply system and indicates a need to (continued) shut down the reactor to reduce heat generation. Therefore, a reactor scram is initiated on a Main Steam Isolation Valve-Closure signal before the MSIVs are completely closed in anticipation of the complete loss of the normal heat sink and subsequent overpressurization transient.

However, for the overpressurization protection analysis of Reference 4, the Average Power Range Monitor Neutron Flux-High Function, along with the S/RVs, limits the peak RPV pressure to less than the ASME Code limits. That is, the direct scram on position switches for MSIV closure events is not assumed in the overpressurization analysis.

Additionally, MSIV closure is assumed in the transients analyzed in Reference 5 (e.g., low steam line pressure, manual closure of MSIVs, high steam line flow). The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the ECCS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46 .

MSIV closure signals are initiated from position switches located on each of the eight MSIVs. Each MSIV has two position switches; one inputs to RPS trip system A while the other inputs to RPS trip system B. Thus, each RPS trip system receives an input from eight Main Steam Isolation Valve-Closure channels, each consisting of one position switch. The logic for the Main Steam Isolation Valve-Closure Function is arranged such that either the inboard or outboard valve on three or more of the main steam lines must close in order for a scram to occur.

The Main Steam Isolation Valve-Closure Allowable Value is specified to ensure that a scram occurs prior to a significant reduction in steam flow, thereby reducing the severity of the subsequent pressure transient.

Sixteen channels (arranged in pairs) of the Main Steam Isolation Valve-Closure Function, with eight channels in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude the scram from this Function on a valid signal. This Function is only required in MODE 1 since, with the MSIVs open and the heat generation rate high, a pressurization transient can occur if the MSIVs close. In addition, the Function is automatically bypassed when the Reactor Mode Switch is not in the Run position. In MODE 2, the heat generation rate is low enough so that the other diverse RPS functions provide sufficient protection .

SUSQUEHANNA- UNIT 2 TS I B 3.3-17 (continued)

Revision 3

Rev.6 RPS Instrumentation

B 3.3.1.1 BASES APPLICABLE 6. Drvwell Pressure-High SAFETY ANALYSES, LCO, and High pressure in the drywell could indicate a break in the RCPB. A APPLICABILITY reactor scram is initiated to minimize the possibility of fuel damage and (continued) to reduce the amount of energy being added to the coolant and the drywell. The Drywell Pressure-High Function is assumed in the analysis of the recirculation line break (Ref. 6). ThE! reactor scram reduces the amount of energy required to be absorbed and, along with the actions of Emergency Core Cooling Systems (ECCS), ensures that the fuel peak cladding temperature remains below the limits of 1D CFR 50.46.

High drywell pressure signals are initiated from four pressure instruments that sense drywell pressure. The Allowable Value was selected to be as low as possible and indicative of a LOCA inside primary containment.

Four channels of Drywell Pressure-High Function, *with two channels in each trip system arranged in *a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. The Function is required in MODES 1 and 2 where considerable energy exists in the RCS, resulting in the limiting transients and accidents.

7.a, 7.b. Scram Discharge Volume Water Level - High The SDV receives the water displaced by the motion of the CRD pistons during a reactor scram. Should this volume fill to a point where there is insufficient volume to accept the displaced water, control rod insertion would be hindered. Therefore, a reactor scram is initiated while the remaining free volume is still sufficient to accommodate the water from a full core scram. The two types of Scram Discharge Volume Water Level-High Functions are an input to the RPS logic. No credit is taken for a scram initiated from these Functions for any of the design basis accidents or transients analyzed in the FSAR. However, they are retained to ensure the scram function remains OPERABLE.

SDV water level is measured by two diverse methods. The level in each of the two SDVs is measured by two float type level switches and two level transmitters with trip units for a total of eight level signals. The outputs of these devices are arranged so that there is a signal from a level switch and a level transmitter with trip unit to each RPS logic channel. The level measurement instrumentation satisfies the recommendations of Reference 8 .

SUSQUEHANNA- UNIT 2 TS I B 3.3-18 (continued)

Revision 3

Rev. 6 RPS Instrumentation

BASES APPLICABLE SAFETY 7.a. 7.b. Scram Discharge Volume Water Level - High (continued)

B 3.3.1.1 ANALYSES, LCO, The Allowable Value is chosen low enough to ensure that there is and APPLICABILITY sufficient volume in the SDV to accommodate the water from a full scram.

Four channels of each type of Scram Discharge Volume Water Level-High Function, with two channels of each type in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from these Functions on a valid signal. These Functions are required in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn. At all other times, this Function may be bypassed.

8. Turbine Stop Valve-Closure Closure of the TSVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be

limited. Therefore, a reactor scram is initiated at the start of TSV closure in anticipation of the transients that would result from the closure of these valves. The Turbine Stop Valve-Closure Function is the primary scram signal for the turbine trip event analyzed in Reference 5. For this event, the reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the End of Cycle Recirculation Pump Trip (EOC-RPD System, ensures that the MCPR SL is not exceeded. Turbine Stop Valve-Closure signals are initiated from position switches located on each of the four TSVs. Two independent position switches are associated with each stop valve.

One of the two switches provides input to RPS trip system A; the other, to RPS trip system B.

Thus, each RPS trip system receives an input from four Turbine Stop Valve-Closure channels, each consisting of one position switch. The logic for the Turbine Stop Valve-Closure Function is such that three or more TSVs must be closed to produce a scram. This Function must be enabled at THERMAL POWER ;;::: 26% RTP. This. is accomplished automatically by pressure instruments sensing turbine first stage pressure. Because an increase in the main turbine bypass flow can affect this function non-conservatively, THERMAL POWER is derived from first stage pressure. The main turbine bypass valves must not cause the trip Function to be bypassed when THERMAL POWER is z26% RTP .

SUSQUEHANNA - UNIT 2 TS I B 3.3-19 (continued)

Revision 3

Rev.6 RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 8. Turbine Stop Valve-Closure (continued)

SAFETY ANALYSES, LCO, The Turbine Stop Valve-Closure Allowable Value is selected to be and APPLICABILITY high enough to detect imminent TSV closure, thereby reducing the severity of the subsequent pressure transient.

Eight channels (arranged in pairs) of Turbine Stop Valve-Closure Function, with four channels in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function if any three TSVs should close. This Function is required, consistent with analysis assumptions, whenever THERMAL POWER is 2 26% RTP. This Function is not required when THERMAL POWER is < 26% RTP since the Reactor Vessel Steam Dome Pressure- High and the Average Power Range Monitor Neutron Flux-High Functions are adequate to maintain the necessary safety margins.

9. Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Fast closure of the TCVs results in the loss of a heat sink that

produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated on TCV fast closure in anticipation of the transients that would result from the closure of these valves. The Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Function is the primary scram signal for the generator load rejection event analyzed in Reference 5. For this

event, the reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the EOC-RPT System, ensures that the MCPR SL is not exceeded.

Turbine Control Valve Fast Closure, Trip Oil Pressure-Low signals are initiated by the electrohydraulic control (EHC) fluid pressure at each control valve. One pressure instrument is associated with each control valve, and the signal from each transmitter is assigned to a separate RPS logic channel. This Function must be enabled at THERMAL POWER 2 26% RTP. This is accomplished automatically by pressure instruments sensing turbine first stage pressure. Because an increase in the main turbine bypass flow can affect this function non-conservatively, THERMAL POWER is derived from first stage pressure. The main turbine bypass valves must not cause the trip Function to be bypassed'when THERMAL POWER is 2 26% RTP .

SUSQUEHANNA- UNIT 2 TS I B 3.3-20 (continued)

Revision 3

Rev.6 RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 9. Turbine Control Valve Fast Closure, Trip Oil Pressure-Low SAFETY (continued)

ANALYSES, LCO, and APPLICABILITY The Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Allowable Value is selected high enough to detect imminent TCV fast closure.

Four channels of Turbine Control Valve Fast Closure, Trip Oil .

Pressure-Low Function with two channels in each trip system arranged in a one-out-of-two logic are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. This Function is required, consistent with the analysis assumptions, whenever THERMAL POWER is;::: 26% RTP. This Function is not required when THERMAL POWER is < 26% RTP, since the Reactor Vessel Steam Dome Pressure-High and the Average Power Range Monitor Neutron Flux-High Functions are adequate to maintain the necessary safety margins.

10. Reactor Mode Switch-Shutdown .Position

The* Reactor Mode Switch-Shutdown Position Function provides signals, via the manual scram logic channels, to each of the four RPS logic channels, which are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability.

This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRG approved licensing basis.

The reactor mode switch is a single switch with four channels, each of which provides input into one of the RPS logic channels.

There is no Allowable Value for this Function, since the channels are mechanically actuated based solely on reactor mode switch position.

Four channels of Reactor Mode Switch-Shutdown Position.

Function, with two channels in each trip system, are available and required to be OPERABLE. The Reactor Mode Switch-Shutdown Position Function is required to be OPERABLE in MODES 1 and 2, and MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn .

SUSQUEHANNA - UNIT 2 TS I B 3.3-21 (continued)

Revision 3

Rev.6 RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY 11. Manual Scram ANALYSES, LCO, and The Manual Scram push button channels provide signals, via the manual APPLICABILITY scram logic channels, to each of the four RPS logic channels, which are (continued) redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Function was not specifically credited in the accident analysis but it is retained for the overall redundancy and diversity of the RPS as required by the N RC approved licensing basis.

There is one Manual Scram push button channel for each of the four RPS logic channels. In order to cause a scram it is necessary that at least one channel in each trip system be actuated.

There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.

Four channels of Manual Scram with two channels in each trip system arranged in a one-out-of-two logic are available and required to be OPERABLE in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since

ACTIONS these are the MODES and other specified conditions when control rods are withdrawn.

A Note has been provided to modify the ACTIONS related to RPS instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RPS instrumentation channels provide appropriate compensatory measures for separate inoperable channels.

As such, a Note has been provided that allows separate Condition entry for each inoperable RPS instrumentation channel.

A.1 and A.2 Because of the diversity of sensors available to provide trip signals and the redundancy of the RPS design, an allowable out of service time of

SUSQUEHANNA- UNIT 2 TS I B 3.3-22 (continued)

Revision 2

Rev.6 RPS Instrumentation

BASES ACTIONS A.1 and A.2 (continued)

B 3.3.1.1 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months has been shown to be acceptable (Refs. 9, 15 and 16) to permit restoration of any inoperable channel to OPERABLE status.

However, this out of service time is only acceptable provided the associated Function's inoperable channel is in one trip system and the Function still maintains RPS trip capability (refer to Required Actions B.1, B.2, and C.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel or the associated trip system must be placed in the tripped condition per Required Actions A.1 and A.2. Placing the inoperable channel in trip (or the associated trip system in trip) would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternatively, if it is not desired to place the channel (or trip system) in trip (e.g., as in the case where placing the inoperable channel in trip would result in a full scram), Condition D must be entered and its Required Action taken.

As noted, Action A.2 is not applicable for APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f. lnoperability of one required APRM channel affects both trip systems. For that condition, Required Action A.1 must be satisfied, and is the only action (other than restoring OPERABILITY) that will restore capability to accommodate a single failure.

lnoperability of more than one required APRM channel of the same trip function results in loss of trip capability and entry into Condition C, as well as entry into Condition A for each channel.

8.1 and B.2 Condition B exists when, for any one or more Functions, at least one required channel is inoperable in each trip system. In this condition, provided at least one channel per trip system is OPERABLE, the RPS still maintains trip capability for that Function, but cannot accommodate a single failure in either trip system.

Required Actions 8.1 and B.2 limit the time the RPS scram logic, for any Function, would not accommodate single failure in both trip systems (e.g., one-out-of-one and one-out-of-one arrangement for a typical four channel Function). The reduced reliability of this logic arrangement was not evaluated in References 9, 15or16 for the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time. Within the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the associated Function will have all required channels OPERABLE or in trip (or any combination) in one trip system .

SUSQUEHANNA - UNIT 2 TS/ B 3.3-23 (continued)

Revision 2

Rev. 6 RPS Instrumentation

BASES ACTIONS 8.1 and 8.2 (continued)

B 3.3.1.1 Completing one of these Required Actions restores RPS to a reliability level equivalent to that evaluated in References 9, 15 and 16 which justified a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowable out of service time as presented in Condition A. The trip system in the more degraded state should be placed in trip or, alternatively, all the inoperable channels in that trip system should be placed in trip (e.g., a trip system with two inoperable channels could be in a more degraded state than a trip system with four inoperable channels if the two inoperable channels are in the same Function while the four inoperable channels are all in different Functions). The decision of which trip system is in the more degraded state should be based on prudent judgment and take into account current plant conditions (i.e., what MODE the plant is in).

If this action would result in a scram, it is permissible to place the other trip system or its inoperable channels in trip.

The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is judged acceptable based on the remaining capability to trip, the diversity of the sensors available to

provide the trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of a scram.

Alternately, if it is not desired to place the inoperable channels (or one trip system) in trip (e.g., as in the case where placing the inoperable channel or associated trip system in trip would result in a scram),

Condition D must be entered and its Required Action taken.

As noted, Condition Bis not applicable for APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f. lnoperability of an APRM channel affects both trip systems and is not associated with a specific trip system as are the APRM 2-out-of-4 Voter (Function 2.e) and other non-APRM channels for which Condition B applies. For an inoperable APRM channel, Required Action A.1 must be satisfied, and is the only action (other than restoring OPERABILITY) that will restore capability to accommodate a single failure. lnoperability of a Function in more than one required APRM channel results in loss of trip capability for that Function and entry into Condition C, as well as entry into Condition A for each channel. Because Conditions A and C provide Required Actions that are appropriate for the inoperability of APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f, and because

SUSQUEHANNA - UNIT 2 TS I B 3.3-24 (continued)

Revision 2

Rev.6 RPS Instrumentation

BASES ACTIONS B.1 and B.2 (continued)

B 3.3.1.1 these Functions are not associated with specific trip systems as are the APRM 2-out-of-4 Voter and other non-APRM channels, Condition B does not apply.

Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same trip system for the same Function result in the Function not maintaining RPS trip capability. A Function is considered to be maintaining RPS trip capability when sufficient channels are OPERABLE or in trip (or the associated trip system is in trip), such that both trip systems will generate a trip signal from the given Function on a valid signal. For the typical Function with one-out-of-two taken twice logic, this would require both trip systems to have one channel OPERABLE or in trip (or the associated trip system in trip). For Function 5 (Main Steam Isolation Valve-Closure), this would require both trip systems to have each channel associated with the MSIVs in three main steam lines (not necessarily the same main steam lines for both trip systems)

OPERABLE or in trip (or the associated trip system in trip) .

For Function 8 (Turbine Stop Valve-Closure), this would require both trip systems to have three channels, each OPERABLE or in trip (or the associated trip system in trip).

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Required Action 0.1 directs entry into the appropriate Condition referenced in Table 3.3.1.1-1. The applicable Condition specified in the Table is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time an inoperable channel has not met any Required Action of Condition A, B, or C and the associated Completion Time has expired, Condition D will be entered for that channel and provides for transfer to the appropriate subsequent Condition .

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-25 Revision 2

Rev. 6 RPS Instrumentation

BASES ACTIONS (continued)

E.1, F.1, G.1, and J.1 B 3.3.1.1 If the channel(s) is not restored to OPERABLE status or placed in trip (or the associated trip system placed in trip) within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. The allowed Completion Times are reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems. In addition, the Completion Time of Required Actions E.1 and J.1 are consistent with the Completion Time provided in LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)."

H.1 If the channel(s) is not restored to OPERABLE status or placed in trip (or the associated trip system placed in trip) within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are, therefore, not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.

1.1and1.2 Required Actions 1.1 and 1.2 are intended to ensure that appropriate actions are taken if more than two inoperable or bypassed OPRM channels result in not maintaining OPRM trip capability.

In the 4-0PRM channel configuration, any 'two' of the OPRM channels out of the total of four and one 2-out-of-4 voter channels in each RPS trip system are required to function for the OPRM safety trip function to be accomplished. Therefore, three OPRM channels assures at least two OPRM channels can provide trip inputs to the 2-out-of-4 voter channels even in the event of a single OPRM channel failure, and the minimum of two 2-out-of-4 voter channels per RPS trip system assures at least one voter channel will be operable per RPS trip system even in the event of a single voter channel failure.

References 15 and 16 justified use of alternate methods to detect and suppress oscillations under limited conditions. The alternate methods are consistent with the guidelines identified in Reference 20. The

SUSQUEHANNA- UNIT 2 TS I B 3.3-26 (continued)

Revision 2

Rev.6 RPS Instrumentation

BASES ACTIONS 1.1 and 1.2 (continued)

B 3.3.1.1 alternate-methods procedures require increased operator awareness and monitoring for neutron flux oscillations when operating in the region where oscillations are possible. If operator observes indications of oscillation, as described in Reference 20, the operator will take the actions described by procedures, which include manual scram of the reactor. The power/flow map regions where oscillations are possible are developed based on the methodology in Reference 22. The applicable regions are contained in the COLR.

The alternate methods would adequately address detection and mitigation in the event of thermal hydraulic instability oscillations.

Based on industry operating experience with actual instability oscillations, the operator would be able to recognize instabilities during this time and take action to suppress them through a manual scram.

In addition, the OPRM system may still be available to provide alarms to the operator if the onset of oscillations were to occur.

The 12-hour allowed Completion Time for Required Action 1.1 is based on engineering judgment to allow orderly transition to the alternate methods while limiting the period of time during which no automatic or alternate detect and suppress trip capability is formally in place.

Based on the small probability of an instability event occurring at all, the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is judged to be reasonable.

The* 120-day allowed Completion Time, the time that was evaluated in References 15 and 16, is considered adequate because with operation minimized in regions where oscillations may occur and implementation of the alternate methods, the likelihood of an instability event that could not be adequately handled by the alternate methods during this 120-day period was negligibly small.

The primary purpose of Required Actions 1.1 and 1.2 is to allow an orderly completion, without undue impact on plant operation, of design and verification activities required to correct unanticipated equipment design or functional problems that cause OPRM Trip Function INOPERABILITY in all APRM channels that cannot reasonably be corrected by normal maintenance or repair actions. These Required Actions are not intended and were not evaluated as a routine alternative to returning failed or inoperable equipment to OPERABLE status .

SUSQUEHANNA - UNIT 2 TS/ B 3.3-27 (continued)

Revision 2

Rev.6 RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE As noted at the beginning of the SRs, the SRs for each RPS REQUIREMENTS instrumentation Function are located in the SRs column of Table 3.3.1.1-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains RPS trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 9, 15 and 16) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RPS will trip when necessary.

SR 3.3.1.1.1 and SR 3.3.1.1.2 Performance of the CHANNEL CHECK ensures that a gross failure of

instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria, which are determined by the plant staff based on an investigation of a combination of the channel instrument uncertainties, may be used to support this parameter comparison and include indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit, and does not necessarily indicate the channel is Inoperable.

SUSQUEHANNA- UNIT 2 TS I B 3.3-28 (continued)

Revision 4

Rev. 6 RPS Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.1.1 and SR 3.3.1.1.2 (continued)

B 3.3.1.1 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.1.1.3 To ensure that the APRMs are accurately indicating the true core average power, the APRMs are calibrated to the reactor power calculated from a heat balance.

A restriction to satisfying this SR when < 23% RTP is provided that requires the SR to be met only at;:::: 23% RTP because it is difficult to accurately maintain APRM indication of core THERMAL POWER consistent with a heat balance when < 23% RTP. At low power levels, a high degree of accuracy is unnecessary because of the large, inherent margin to thermal limits (MCPR, LHGR and APLHGR). At

23% RTP, the Surveillance is required to have been satisfactorily

performed in accordance with SR 3.0.2. A Note is provided which allows an increase in THERMAL POWER above 23% if the Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching or exceeding 23% RTP. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.3-29 (continued) .

Revision 5

Rev.6 RPS Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.1.4 B 3.3.1.1 (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function_

As noted, SR 3.3.1.1.4 is not required to be performed when entering MODE 2 from MODE 1, since testing of the MODE 2 required IRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This allows entry into MODE 2 if the Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering MODE 2 from MODE 1.

Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.5

A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. (The Manual Scram Function's CHANNEL FUNCTIONAL TEST Frequency was credited in the analysis to extend many automatic scram Functions' Frequencies.) The Surveillance Frequency is controlled under the Surveillance Frequ*ency Control Program.

SR 3.3.1.1.6 and SR 3.3.1.1.7 These Surveillances are established to ensure that no gaps in neutron flux indication exist from subcritical to power operation for monitoring core reactivity status.

The overlap between SRMs and IRMs is required to be demonstrated to ensure that reactor power will not be increased into a neutron flux region without adequate indication. The overlap is demonstrated prior to fully withdrawing the SRMs from the core. Demonstrating the overlap prior to fully withdrawing the SRMs from the core is required to ensure the SRMs are on-scale for the overlap demonstration .

SUSQUEHANNA - UNIT 2 TS I B 3.3-30 (continued)

Revision 4

Rev.6 RPS Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.1.6 and SR 3.3.1.1.7 (continued)

B 3.3.1.1 The overlap between IRMs and APRMs is of concern when reducing power into the IRM range. On power increases, the system design will prevent further increases (by initiating a rod block) if adequate overlap is not maintained. Overlap between IRMs and APRMs exists when sufficient IRMs and APRMs concurrently have onscale readings such that the transition between MODE 1 and MODE 2 can be made without either APRM downscale rod block, or IRM upscale rod block. Overlap between SRMs and IRMs similarly exists when, prior to fully withdrawing the SRMs from the core, IRMs are above mid-scale on range 1 before SRMs have reached the upscale rod block.

As noted, SR 3.3.1.1. 7 is only required to be met during entry into MODE 2 from MODE 1. That is, after the overlap requirement has been met and indication has transitioned to the IRMs, maintaining overlap is not required (APRMs may be reading downscale once in MODE 2).

If overlap for a group of channels is not demonstrated (e.g.,

IRM/APRM overlap), the reason for the failure of the Surveillance should be determined and the appropriate channel(s) declared inoperable. Only those appropriate channels that are required in the current MODE or condition should be declared inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.8 LPRM gain settings are determined from the local flux profiles that are either measured by the Traversing lncore Probe (TIP) System at all functional locations or calculated for TIP locations that are not functional. The methodology used to develop the power distribution limits considers the uncertainty for both measured and calculated local flux profiles. This methodology assumes that all the TIP locations are functional for the first LPRM calibration following a refueling outage, and a minimum of 25 functional TIP locations for subsequent LPRM calibrations. The calibrated LPRMs establish the relative local flux profile for appropriate representative input to the APRM System. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.3-31 (continued)

Revision 4

Rev.6 RPS Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.1.9 and SR 3.3.1.1.14 B 3.3.1.1 (continued) A CHANNEL FUNCTIONAL TEST.is performed on each required channel to ensure that the entire channel will perform the intended function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.9 is modified by a Note that provides a general exception to the definition of CHANNEL FUNCTIONAL TEST. This exception is necessary because the design of instrumentation does not facilitate functional testing of all required contacts of the relay, which input into the combinational logic. (Reference 10) Performance of such a test could result in a plant transient or place the plant in an undo risk situation.

Therefore, for this SR, the CHANNEL FUNCTIONAL TEST verifies acceptable response by verifying the change of state of the relay, which inputs into the combinational logic. The required contacts not tested during the CHANNEL FUNCTIONAL TEST are tested under the LOGIC SYSTEM FUNCTIONAL TEST, SR 3.3.1.1.15. This is acceptable because operating experience shows that the contacts not

tested during the CHANNEL FUNCTIONAL TEST normally pass the LOGIC SYSTEM FUNCTIONAL TEST, and the testing methodology minimizes the risk of unplanned transients.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.10, SR 3.3.1.1.11, SR 3.3.1.1.13, and SR 3.3.1.1.18 A CHANNEL CALIBRATION verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

SUSQUEHANNA- UNIT 2 TS I B 3.3-32 (continued)

Revision 5

Rev. 6 RPS Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.1.10. SR 3.3.1.1.11. SR 3.3.1.1.13. and SR 3.3.1.1.18 (continued)

B 3.3.1.1 Note 1 for SR 3.3.1.1.18 states that neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal. Changes in neutron detector sensitivity are compensated for by performing the calorimetric calibration (SR 3.3.1.1.3) and the LPRM calibration against the TIPs (SR 3.3.1.1.8).

A Note is provided for SR 3.3.1.1.11 that requires the IRM SRs to be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 from MODE 1. Testing of the MODE 2 APRM and IRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This Note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR 3.0.2. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.

A second note is provided for SR 3.3.1.1.18 that requires that the recirculation flow (drive flow) transmitters, which supply the flow signal to the APRMs, be included in the SR for Functions 2. b and 2.f. The APRM Simulated Thermal Power-High Function (Function 2.b) and the OPRM Trip Function (Function 2.f) both require a valid drive flow signal. The APRM Simulated Thermal Power-High Function uses drive

flow to vary the trip setpoint. The OPRM Trip Function uses drive flow to automatically enable or bypass the OPRM Trip output to the RPS.

A CHANNEL CALIBRATION of the APRM drive flow signal requires both calibrating the drive flow transmitters and the processing hardware in the APRM equipment. SR 3.3.1.1.20 establishes a valid drive flow I core flow relationship. Changes throughout the cycle in the drive flow I core flow relationship due to the changing thermal hydraulic operating conditions of the core are accounted for in the margins included in the bases or analyses used to establish the setpoints for the APRM Simulated Thermal Power-High Function and the OPRM Trip Function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA- UNIT 2 TS I B 3.3-33 (continued)

Revision 5

Rev.6 RPS Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.1.12 B 3.3.1.1 (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. For the APRM Functions, this test supplements the automatic self-test functions that operate continuously in the APRM and voter channels. The scope of the APRM CHANNEL FUNCTIONAL TEST is that which is necessary to test the hardware.

Software controlled functions are tested as part of the initial verification and validation and are only incidentally tested as part of the surveillance testing. Automatic self-test functions check the EPROMs in which the software-controlled logic is defined. Changes in the EPROMs will be de.tected by the self-test function and alarmed via the APRM trouble alarm. .SR 3.3.1.1.1 for the APRM functions includes a step to confirm that the automatic self-test function is still operating.

The APRM CHANNEL FUNCTIONAL TEST covers the APRM channels (including recirculation flow processing -- applicable to Function 2.b and the auto-enable portion of Function 2.f only), the 2-out-of-4 Voter channels, and the interface connections into the RPS

trip systems from the voter channels .

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. (NOTE: The actual voting logic of the 2-out-of-4 Voter Function is tested as part of SR 3.3.1.1.15. The auto-enable setpoints for the OPRM Trip are confirmed by SR 3.3.1.1.19.)

A Note is provided for Function 2.a that requires this SR to be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 from MODE 1. Testing of the MODE 2 APRM Function cannot be performed in MODE 1 without utilizing jumpers or lifted leads. This Note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR3.0.2.

A second Note is provided for Functions 2.b and 2.f that clarifies that the CHANNEL FUNCTIONAL TEST for Functions 2.b and 2.f includes testing of the recirculation flow processing electronics, excluding the flow transmitters.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.3-34 (continued)

Revision 3

Rev.6 RPS Instrumentation

BASES SURVEILLANCE REQUIREMENTS .

SR 3.3.1.1.15 B 3.3.1.1 (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the

OPERABILITY of the required trip logic for a specific channeL The functional testing of control rods (LCO 3.1.3), and SDV vent and drain valves (LCO 3.1.8), overlaps this Surveillance to provide complete testing of the assumed safety function.

The LOGIC SYSTEM FUNCTIONAL TEST for APRM Function 2.e simulates APRM and OPRM trip conditions at the 2-out-of-4 Voter channel inputs to check all combinations of two tripped inputs to the 2-out-of-4 logic in the voter channels and APRM-related redundant RPS relays.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.16 This SR ensures that scrams initiated from the Turbine Stop Valve-Closure and Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Functions will not be inadvertently bypassed when THERMAL POWER is~ 26% RTP. This is performed by a Functional check that ensures the scram feature is not bypassed at~ 26% RTP. Because main turbine bypass flow can affect this function nonconservatively (THERMAL POWER is derived from turbine first stage pressure), the opening of the main turbine bypass valves must riot cause the trip Function to be bypassed when Thermal Power is > 26% RTP.

If any bypass channel's trip function is nonconservative (i.e., the Functions are bypassed at~ 26% RTP, either due to open main turbine bypass valve(s) or other reasons), then the affected Turbine Stop Valve-Closure and Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Functions are considered inoperable. Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel is considered OPERABLE.

SUSQUEHANNA- UNIT 2 TS I B 3.3-34a (continued)

Revision 2

Rev.6 RPS Instrumentation

BASES

. SURVEILLANCE REQUIREMENTS SR 3.3.1.1.16 (continued)

B 3.3.1.1 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.17 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. This test may be performed in one measurement or in overlapping segments, with verification that all components are tested.

The RPS RESPONSE TIME acceptance criteria are included in Reference 11.

RPS RESPONSE TIME for the APRM 2-out-of-4 Voter Function (2.e) includes the APRM Flux Trip output relays and the OPRM Trip output relays of the voter and the associated RPS relays and contactors.

(Note: The digital portion of the APRM, OPRM and 2-out-of-4 Voter channels are excluded from RPS RESPONSE TIME testing beeause self-testing and calibration checks the time base of the digital

electronics. Confirmation of the time base is adequate to assure required response times are met. Neutron detectors are excluded from RPS RESPONSE TIME testing because the principles of detector operation virtually ensure an instantaneous response time. See References 12 and 13).

As noted, neutron detectors are excluded from RPS RESPONSE TIME testing because the principles of detector operation virtually ensure an instantaneous response time.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA- UNIT 2 TS I B 3.3-34b (continued)

Revision 2

Rev. 6 RPS Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.1.17 (continued)

B 3.3.1.1 SR 3.3.1.1.17 for Function 2.e confirms the response time of that function, and also confirms the response time of components common to Function 2.e and other RPS Functions. (Reference 14)

The redundant outputs from the 2-out-of-4 Voter channel (2 for APRM trips and 2 for OPRM trips) are considered part of the same channel, but the OPRM and APRM outputs are considered to be separate channels for application of SR 3.3.1.1.17. The note further requires that testing of OPRM and APRM outputs from a 2-out-of-4 Voter be alternated. In addition to these commitments, References 15 and 16 require that the testing of inputs to each RPS Trip System alternate.

Combining these frequency requirements, an acceptable test sequence is one that:

a. Tests each RPS Trip System interface every other cycle,

b. Alternates the testing of APRM and OPRM outputs from any

c.

specific 2-out-of-4 Voter Channel, Alternates between divisions at least every other test cycle .

SUSQUEHANNA- UNIT 2 TS I B 3.3-34c (continued)

Revision 1

Rev. 6 RPS Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.1.17 (continued)

B 3.3.1.1 The testing sequence shown in the table below is one sequence that satisfies these requirements.

Function 2.e Testing Sequence for SR 3.3.1.1.17 "Stagg.ering" 24- . Voter Month Output Cycle Tested Voter A1 Voter A2 Voter 81 Voter 82 RPS Trip Division Output Output Output Output System 1st OPRMA1 OPRM A 1 2 nd APRM 81 APRM 8 1 rd 3 OPRMA2 OPRM A 2 4th APRM 82 APRM 8 2 5th APRM A1 APRM A 1

5th 7th 8th OPRM 81 APRMA2 OPRM 82 APRM OPRM OPRM 8

A 8

1 2

2 After 8 cycles, the sequence repeats.

Each test of an OPRM or APRM output tests each of the redundant outputs from the 2-out-of-4 Voter channel for that Function and each of the corresponding relays in the RPS. Consequently, each of the RPS relays is tested every fourth cycle. The RPS relay testing frequency is twice the frequency justified by References 15 and 16.

SUSQUEHANNA- UNIT 2 TS I B 3.3-34d (continued)

Revision O

Rev.6 RPS Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.1.19 B 3.3.1.1 (continued) This surveillance involves confirming the OPRM Trip auto-enable setpoints. The auto-enable setpoint values are considered to be nominal values as discussed in Reference 21. This surveillance ensures that the OPRM Trip is enabled (not bypassed) for the correct values of APRM Simulated Thermal Power and recirculation drive flow.

Other surveillances ensure that the APRM Simulated Thermal Power and recirculation drive flow properly correlate with THERMAL POWER (SR 3.3.1.1.2) and core flow (SR 3.3.1.1.20), respectively.

If any auto-enable setpoint is noncon~ervative (i.e., the OPRM Trip is bypassed when APRM Simulated Thermal Power;;;:: 25% and recirculation drive flows value equivalent to the core flow value defined in the COLR, then the affected channel is considered inoperable for the OPRM Trip Function. Alternatively, the OPRM Trip auto-enable setpoint(s) may be adjusted to place the channel in a conservative condition (not bypassed). If the OPRM Trip is placed in the not-bypassed condition, this SR is met, and the channel is considered OPERABLE.

For purposes of this surveillance, consistent with Reference 21, the conversion from core flow values defined in the COLR to drive flow values used for this SR can be conservatively determined by a linear scaling assuming that 100% drive flow corresponds to 100 Mlb/hr core flow, with no adjustment made for expected deviations between core flow and drive flow below 100%.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.20 The APRM Simulated Thermal Power-High Function (Function 2.b) uses drive flow to vary the trip setpoint. The OPRM Trip Function (Function 2.f) uses drive flow to automatically enable or bypass the OPRM Trip output to RPS. Both of these Functions use drive flow as a representation of reactor core flow. SR 3.3.1.1.18 ensures that the drive flow transmitters and processing electronics are calibrated. This SR adjusts the recirculation drive flow scaling factors in each APRM channel to provide the appropriate drive flow/core flow alignment.

SUSQUEHANNA- UNIT 2 TS I B 3.3-34e (continued)

Revision 2

Rev.6 RPS Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.1.20 (continued)

B 3.3.1.*1 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Figure 7.2-1.

2. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132).

3. NED0-23842, "Continuous Control Rod Withdrawal in the Startup Range," April 18, 1978.

4. FSAR, Section 5.2:2.

5. FSAR, Chapter 15.

6. FSAR, Section 6.3.3.

7.

8.

9.

Not used.

P. Check (NRG) letter to G. Lainas (NRG), "BWR Scram Discharge System Safety Evaluation," December 1, 1980.

NED0-30851-P-A, "Technical Specification Improvement Analyses for BWR Reactor Protection System," March 1988.

SUSQUEHANNA- UNIT 2 TS I B 3.3-34f Revision 1

Rev. 6 RPS Instrumentation

BASES REFERENCES (continued)

10. NRC Inspection and Enforcement Manual, Part 9900: Technical B 3.3.1.1 Guidance, Standard Technical Specification 1.0 Definitions, Issue date 12/08/86.

11. FSAR, Table 7.3-28.

12. NED0-32291-A "System Analyses for Elimination of Selected Response Time Testing Requirements," October 1995.

13. NRC Safety Evaluation Report related to Amendment No. 171 for License No. NPF 14 and Amendment No. 144 License No. NPF 22.

14. NEDO 32291-A, Supplement 1, "System Analyses for the Elimination of Selected Response Time Testing Requirements,"

October 1999.

15. NEDC-32410P-A, "Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option Ill Stability Trip Function," October 1995.

16.

17.

NEDC-3241 OP-A Supplement 1, "Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NU MAC PRNM)

Retrofit Plus Option Ill Stability Trip Function," November 1997.

NED0-31960-A, "BWR Owners' Group Long-Term Stability Solutions Licensing Methodology," November 1995.

18. NED0-31960-A, Supplement 1, "BWR Owners' Group Long-Term Stability Solutions Licensing Methodology,"

November 1995.

19. NED0-32465-A, "BWR Owners' Group Long-Term Stability Detect and Suppress Solutions Licensing Basis Methodology and Reload Applications," August 1996.

20. BWROG Letter BWROG 9479, L. A. England (BWROG) to M. J. Virgilio, "BWR Owners' Group Guidelines for Stability Interim Corrective Action," June 6, 1994 .

SUSQUEHANNA - UNIT 2 TS I B 3.3-34g Revision O

Rev. 6 RPS Instrumentation

BASES REFERENCES (continued)

21. BWROG Letter BWROG 96113, K. P. Donovan (BWROG) to L. E. Phillips (NRC), "Guidelines for Stability Option Ill B 3.3.1.1

'Enable Region' (TAC M92882)," September 17, 1996.

22. EMF-CC-074(P)(A), Volume 4, "BWR Stability Analysis:

Assessment of STAIF with Input from MICROBURN-82."

23. GE Letter to PPL, GE-2005-EMC426, "Susquehanna 1 & 2 Minimum LPRM Input Requirement for NUMAC APRM 4-Channel Design," April 26, 2005 .

SUSQUEHANNA - UNIT 2 TS I B 3.3-34h Revision 0

Rev.6 RPS Instrumentation

Table B 3.3.1.1-1(page1of1)

RPS Instrumentation Sensor Diversity Scram Sensors for Initiating Events B 3.3.1.1 RPV Variables Anticioatorv Fuel Initiation Events (a\ (b) (cl (dl (el (f) (g)

MSIV Closure x x x x Turbine Trip (w/bypass) x x x x Generator Trip (w/bypass) x x x Pressure Regulator Failure x x x x x (primary pressure decrease)

(MSIV closure trip)

Pressure Regulator Failure x x x (primary pressure decrease)

(Level 8 trip)

Pressure Regulator Failure x x (primary pressure increase)

Feedwater Controller Failure x x x x (high reactor water level)

Feedwater Controller Failure x x x (low reactor water level)

Loss of Condenser Vacuum x x x x Loss of AC Power (loss of x x x x transformer)

Loss of AC Power (loss of x x x x x x grid connections)

(a) Reactor Vessel Steam Dome Pressure-High (b) Reactor Vessel Water Level-High, Level 8 (c) Reactor Vessel Water Level-Low, Level 3 (d) Turbine Control Valve Fast Closure (e) Turbine Stop Valve-Closure (f) Main Steam Isolation Valve-Closure (g) Average Power Range Monitor Neutron Flux-High

SUSQUEHANNA- UNIT 2 TS I B 3.3-34i Revision O

Rev. 3 SRM Instrumentation

8 3.3 INSTRU.MENTATION B 3.3.1.2 Source Range Monitor (SRM) Instrumentation 8 3.3.1.2 BASES BACKGROUND The SRMs provide the operator with information relative to the neutron flux level at startup and low flux levels in the core. As such, the SRM indication is used by the operator to monitor the approach to criticality and determine when criticality is achieved. The SRMs are not fully withdrawn from the core until the SRM to intermediate range monitor (IRM) overlap is demonstrated (as required by SR 3.3.1.1.6), when the SRMs are normally fully withdrawn from the core.

The SRM subsystem of the Neutron Monitoring System (NMS) consists of four channels. Each of the SRM channels can be bypassed, but only one at any given time, by the operation of a bypass switch. Each channel includes one detector that can be physically positioned in the core. Each detector assembly consists of a miniature fission chamber with associated cabling, signal conditioning equipment, and electronics associated with the various SRM functions. The signal conditioning equipment converts the current pulses from the fission chamber to analog DC currents that correspond to the count rate. Each channel also includes indication, alarm, and control rod blocks. However, this LCO specifies OPERABILITY requirements only for the monitoring and indication functions of the SRMs.

During refueling, shutdown, and low power operations, the primary indication of neutron flux levels is provided by the SRMs or special movable detectors connected to the normal SRM circuits. The SRMs provide monitoring of reactivity changes during fuel or control rod movement and give the control room operator early indication of unexpected subcritical multiplication that could be indicative of an approach to criticality.

APPLICABLE Prevention and mitigation of prompt reactivity excursions during SAFETY ANALYSES refueling and low power operation is provided by LCO 3.9.1, "Refueling Equipment Interlocks"; LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"; LCO 3.3.1.1, "Reactor Protection System (RPS)

Instrumentation"; IRM Neutron Flux-High and Average Power Range Monitor (APRM) Neutron Flux-High (continued)

SUSQUEHANNA - UNIT 2 TS/ B 3.3-35 Revision 2

Rev.3 SRM Instrumentation

BASES APPLICABLE SAFETY ANALYSES (Setdown) Functions; and LCO 3.3.2.1, "Control Rod Block Instrumentation."

B 3.3.1.2 (continued)

The SRMs have no safety function and are not assumed to function during any FSAR design basis accident or transient analysis.

However, the SRMs provide the only on-scale monitoring of neutron flux levels during startup and refueling. Therefore, they are being retained in Technical Specifications.

LCO During startup in MODE 2, three of the four SRM channels are required to be OPERABLE to monitor the reactor flux level prior to and during control rod withdrawal, subcritical multiplication and reactor criticality, and neutron flux level and reactor period until the flux level is sufficient to maintain the IRMs on Range 3 or above. All but one of the channels are required in order to provide a representation of the overall core response during those periods when reactivity changes are occurring throughout the core.

In MODES 3 and 4, with the reactor shut down, two SRM channels

provide redundant monitoring of flux levels in the core .

In MODE 5, during a spiral offload or reload, an SRM outside the fueled region will no longer be required to be OPERABLE, since it is not capable of monitoring neutron flux in the fueled region of the core.

Fueled region is a continuous area with fuel. Thus, CORE ALTERATIONS are allowed in a quadrant with no OPERABLE SRM in an adjacent quadrant provided the Table 3.3.1.2-1, footnote (b),

requirement that the bundles being spiral reloaded or spiral offloaded are all in a single fueled region containing at least one OPERABLE SRM is met. Spiral reloading and offloading encompass reloading or offloading a cell on the edge of a continuous fueled region {the cell can be reloaded or offloaded in any sequence).

In nonspiral routine operations, two SRMs are required to be OPERABLE to provide redundant monitoring of reactivity changes occurring in the reactor core. Because of the local nature of reactivity changes during refueling, adequate coverage is provided by requiring one SRM to be OPERABLE in (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-36 Revision 2

Rev. 3 SRM Instrumentation

BASES LCO (continued) the quadrant of the reactor core where CORE ALTERATIONS are B 3.3.1.2 being performed, and the other SRM to be OPERABLE in an adjacent quadrant containing fuel. These requirements ensure that the reactivity of the core will be continuously monitored during CORE ALTERATIONS.

Special movable detectors, according to footnote (c) of Table 3.3.1.2-1, may be used during CORE ALTERATIONS in place of the normal SRM nuclear detectors. These special detectors must be connected to the normal SRM circuits in the NMS, such that the applicable neutron flux indication can be generated. These special detectors provide more flexibility in monitoring reactivity changes during fuel loading, since they can be positioned anywhere within the core during refueling. They must still meet the location requirements of SR 3.3.1.2.2 and all other required SRs for SRMs.

For an SRM channel to be considered OPERABLE, it must be providing neutron flux monitoring indication .

APPLICABILITY The SRMs are required to be OPERABLE in MODES 2, 3, 4, and 5 prior to the IRMs being on scale on Range 3 to provide for neutron monitoring. In MODE 1, the APRMs provide adequate monitoring of reactivity changes in the core; therefore, the SRMs are not required.

In MODE 2, with IRMs on Range 3 or above, the IRMs provide adequate monitoring and the SRMs are not required.

ACTIONS A.1 and B.1 In MODE 2, with the IRMs on Range 2 or below, SRMs provide the means of monitoring core reactivity and criticality. With any number of the required SRMs inoperable, the ability to monitor neutron flux is degraded. Therefore, a limited time is allowed to restore the inoperable channels to OPERABLE status.

Provided at least one SRM remains OPERABLE, Required Action A.1 allows 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to restore the required SRMs to OPERABLE status.

This time is reasonable because there is adequate capability remaining to monitor the core, there is

SUSQUEHANNA - UNIT 2 TS I B 3.3-37 (continued)

Revision 1

Rev. 3 SRM Instrumentation

BASES ACTIONS A.1 and 8.1 (continued)

B 3.3.1.2 limited risk of an event during this time, and there is sufficient time to take corrective actions to restore the required SRMs to OPERABLE status or to establish alternate IRM monitoring capability. During this time, control rod withdrawal and power increase is not precluded by this Required Action. Having the ability to monitor the core with at least one SRM, proceeding to IRM Range 3 or greater (with overlap required by SR 3.3.1.1.6), and thereby exiting the Applicability of this LCO, is acceptable for ensuring adequate core monitoring and allowing continued operation.

With three required SRMs inoperable, Required Action 8.1 allows no positive changes in reactivity (control rod withdrawal must be immediately suspended) due to inability to monitor the changes.

Required Action A.1 still applies and allows 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to restore monitoring capability prior to requiring control rod insertion. This allowance is based on the limited risk of an event during this time, provided that no control rod withdrawals are allowed, and the desire to concentrate efforts on repair, rather than to immediately shut down, with no SRMs OPERABLE.

In MODE 2, if the required number of SRMs is not restored to OPERABLE status within the allowed Completion Time, the reactor shall be placed in MODE 3. With all control rods fully inserted, the core is in its least reactive state with the most margin to criticality. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

D.1 and D.2 With one or more required SRMs inoperable in MODE 3 or 4, the neutron flux monitoring capability is degraded or nonexistent. The requirement to fully insert all insertable control rods ensures that the reactor will be at its minimum rea.ctivity level while no neutron monitoring capability is available. Placing the reactor mode switch in the shutdown position prevents subsequent control rod withdrawal by

SUSQUEHANNA - UNIT 2 TS I B 3.3-38 (continued)

Revision 1

Rev.3 SRM Instrumentation

BASES ACTIONS D.1 and D.2 (continued)

B 3.3.1.2 maintaining a control rod block. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is sufficient to accomplish the Required Action, and takes into account the low probability of an event requiring the SRM occurring during this interval.

E.1 and E.2 With one or more required SRM inoperable in MODE 5, the ability to detect local reactivity changes in the core during refueling is degraded.

CORE ALTERA TIONS must be immediately suspended and action must be immediately initiated to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Suspending CORE ALTERATIONS prevents the two most probable causes of reactivity changes, fuel loading and control rod withdrawal, from occurring.

Inserting all insertable control rods ensures that the reactor will be at its minimum reactivity given that fuel is present in the core.

Suspension of CORE ALTERATIONS shall not preclude completion of

the movement of a component to a safe, conservative position .

Action (once required to be initiated) to insert control rods must continue until all insertable rods in core cells containing one or more fuel assemblies are inserted.

SURVEILLANCE The SRs for each SRM Applicable MODE or other specified conditions REQUIREMENTS are found in the SRs column of Table 3.3.1.2-1.

SR 3.3.1.2.1 and SR 3.3.1.2.3 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on another channel. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-39 Revision 2

I

_J

Rev. 3 SRM Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.2.1 and SR 3.3.1.2.3 (continued)

B 3.3.1.2 is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria which are determined by the plant staff based on an investigation of a combination of the channel instrument uncertainties may be used to support this parameter comparison and include indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit, and does not necessarily indicate the channel is Inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.1.2.2 To provide adequate coverage of potential reactivity changes in the core, a maximum of two SRMs are required to be OPERABLE. One SRM is required to be OPERABLE in the quadrant where CORE ALTERATIONS are being performed, and the other OPERABLE SRM must be in an adjacent quadrant containing fuel. However, in accordance with Table 3.3.1.2-1, only one SRM is required during a spiral reload until the fueled region is large enough to encompass a second installed SRM. Note 1 states that the SR is required to be met only during CORE ALTERA TIONS. It is not required to be met at other times in MODE 5 since core reactivity changes are not occurring. This Surveillance consists of a review of plant logs to ensure that SRMs required to be OPERABLE for given CORE ALTERATIONS are, in fact, OPERABLE. In the event that only one SRM is required to be OPERABLE, per Table 3.3.1.2-1, footnote (b), only the a. portion of this SR is required. Note 2 clarifies that more than one of the three requirements can be met by the same OPERABLE SRM. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-40 Revision 2

Rev.3 SRM Instrumentation

BASES SURVEILLANCE REQUIREMENTS B 3.3.1.2 SR 3.3.1.2.4 This Surveillance consists of a verification of the SRM instrument readout to ensure that the SRM reading is greater than a specified minimum count rate, which ensures that the detectors are indicating count rates indicative of neutron flux levels within the core. The signal-to-noise ratio shown in Figure 3.3.1.2-1 is the SRM count rate at which there is a 95% probability that the SRM signal indicates the presence of neutrons and only a 5% probability that the SRM signal is a result of noise (Ref. 1). With few fuel assemblies loaded, the SRMs will not have a high enough count rate to satisfy the SR. Therefore, allowances are made for loading sufficient "source" material, in the form of irradiated fuel assemblies, to establish the minimum count rate.

To accomplish this, the SR is modified by a Note that states that the count rate is not required to be met on an SRM that has less than or equal to four fuel assemblies adjacent to the SRM and no other fuel

assemblies are in the associated core quadrant. With four or less fuel assemblies loaded around each SRM and no other fuel assemblies in the associated core quadrant, even with a control rod withdrawn, the configuration will not be critical.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.2.5 and SR 3.3.1.2.6 Performance of a CHANNEL FUNCTIONAL TEST demonstrates the associated channel will function properly. SR 3.3.1.2.5 is (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-41 Revision 2

Rev.3 SRM Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.2.5 and SR 3.3.1.2.6 (continued)

B 3.3.1.2 required in MODE 5, and the 7 day Frequency ensures that the channels are OPERABLE while core reactivity changes could be in progress. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.2.6 is required in MODE 2 with IRMs on Range 2 or below, and in MODES 3 and 4. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Verification of the signal to noise ratio also ensures that the detectors are inserted to an acceptable operating level. In a fully withdrawn condition, the detectors are sufficiently removed from the fueled region of the core to essentially eliminate neutrons from reaching the detector. Any count rate obtained while the detectors are fully withdrawn is assumed to be "noise" only.

The Note to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability (THERMAL

POWER decreased to IRM Range 2 or below). The SR must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after IRMs are on Range 2 or below. The allowance to enter the Applicability with the Frequency not met is reasonable, based on the limited time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels. Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable, based on the SRMs being otherwise verified.to be OPERABLE (i.e., satisfactorily performing the CHANNEL CHECK) and the time required to perform the Surveillances.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-42 Revision 2

Rev. 3 SRM Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.'1.2.7 8 3.3.1.2 (continued) Performance of a CHANNEL CALIBRATION verifies the performance of the SRM detectors and associated circuitry. The Frequency considers the plant conditions required to perform the test, the ease of performing the test, and the likelihood of a change in the system or component status. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The neutron detectors are excluded from the CHANNEL CALIBRATION because they cannot readily be adjusted. The detectors are fission chambers that are designed to have a relatively constant sensitivity over the range and with an accuracy specified for a fixed useful life.

Note 2 to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability. The SR must be performed in MODE 2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 with IRMs on Range 2 or below. The allowance to enter the Applicability with the Frequency not met is reasonable, based on the limited timeof 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels. Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable, based on the SRMs being otherwise verified to be OPERABLE (i.e., satisfactorily performing the CHANNEL CHECK) and the time required to perform the Surveillances.

REFERENCES 1. General Electric Service Information Letter (SIL) 478 "SRM Minimum Count Rate" dated December 16, 1988 .

SUSQUEHANNA - UNIT 2 TS I B 3.3-43 Revision 2

Rev.4 Control Rod Block Instrumentation B 3.3.2.1 B 3.3 INSTRUMENTATION B 3.3.2.1 Control Rod Block Instrumentation BASES BACKGROUND Control rods provide the primary means for control of reactivity changes. Control rod block instrumentation includes channel sensors, logic circuitry, switches, and relays that are designed to ensure that specified fuel design limits are not exceeded for postulated transients and accidents. During high power operation, the rod block monitor (RBM) provides protection for control rod withdrawal error events.

During low power operations, control rod blocks from the rod worth minimizer (RWM) enforce specific control rod sequences designed to mitigate the consequences of the control rod drop accident (CRDA).

During shutdown conditions, control rod blocks from the Reactor Mode Switch-Shutdown Position Function ensure that all control rods remain inserted to prevent inadvertent criticalities.

The Nominal Trip Setpoint (NTSP) is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reading the Analytical Limit and thus ensuring that the Safety Limit (SL) would not be exceeded. The NTSP accounts for various uncertainties. As such, the NTSP meets the definition of a Limiting Safety System Setting (LSSS), because the protective instrument channel activates to protect a reactor core or RCS pressure boundary Safety Limit. Rod Block Monitor functions 1a, 1b and 1c are LSSSs.

Technical Specification contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as" ... being capable of performing its specified safety function(s)." For automatic protective devices related to SLs, the required safety function is to ensure that a SL is not exceeded and therefore the NTSP is the LSSS, as defined by 10CFR 50.36. However, use of the NTSP to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as-found" value during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule, which are not necessary to ensure safety .

SUSQUEHANNA- UNIT 2 TS I B 3.3-44 (continued)

Revision 3

Rev.4 Control Rod Block Instrumentation

BASES BACKGROUND (continued)

Use of the NTSP to define "as-found" OPERABILITY under the expected circumstances described above would result in actions B 3.3.2.1 required by both rule and Technical Specifications that are not warranted. However, there is also some point beyond which the device would have not been able to perform its function due, for example, to greater than expected drift. This value needs to be specified in the Technical Specifications in order to define OPERABILITY of the devices and is designated as the Allowable Value, which is the least conservative value of the as-found setpoint that a channel can have during testing.

The Allowable Value specified in SR 3.3.2.1. 7 is the least conservative value of the as-found setpoint that a channel can have when tested, such that a channel is OPERABLE if the setpoint is found conservative with respect to the Allowable Value during the CHANNEL CALIBRATION.

The purpose of the RBM is to limit control rod withdrawal if localized neutron flux exceeds a predetermined setpoint during control rod manipulations. It is assumed to function to block further control rod withdrawal to preclude MCPR Safety Limit violation. The RBM supplies a trip signal to the Reactor Manual Control System (RMCS) to appropriately inhibit control rod withdrawal during power operation above the low power range setpoint. The RBM has two channels, either of which can initiate a control rod block when the channel output exceeds the control rod block setpoint. One RBM channel inputs into one RMCS rod block circuit and the other RBM channel inputs into the second RMCS rod block circuit. The RBM channel signal is generated by averaging a set of Local Power Range Monitor (LPRM) signals at various core heights surrounding the control rod being withdrawn. A simulated thermal power signal from one of the four redundant Average Power Range Monitor (APRM) channels supplies a reference signal for one of the RBM channels and a simulated thermal power signal from another of the APRM channels supplies the reference signal to the second RBM channel. This reference signal is used to determine which RBM range setpoint (low, intermediate, or high) is enabled. If the APRM simulated thermal is indicating less than the low power range setpoint, the RBM is automatically bypassed. The RBM is also automatically bypassed if a peripheral control rod is selected (Ref.

2) .

SUSQUEHANNA- UNIT 2 TS I B 3.3-45 (continued)

Revision 3

Rev.4 Control Rod Block lnstrum~ntation

BASES BACKGROUND (continued)

B 3.3.2.1 The purpose of the RWM is to control rod patterns during startup, such that only specified control rod sequences and relative positions are allowed over the operating range from all control rods inserted to 10% RTP. The sequences effectively limit the potential amount and rate of reactivity increase during a CRDA. Prescribed control rod sequences are stored in the RWM, which will initiate control rod withdrawal and insert blocks when the actual sequence deviates beyond allowances from the stored sequence. The RWM determines the actual sequence based position indication for each control rod.

The RWM also uses steam flow signals to determine when the reactor power is above the preset power level at which the RWM is automatically bypassed (Ref. 1). The RWM is a single channel system that provides input into RMCS rod block channel 2.

The function of the individual rod sequence steps (banking steps) is to minimize the potential reactivity increase from postulated CRDA at low power levels. However, if the possibility for a control rod to drop can be eliminated, then banking steps at low power levels are not needed to ensure the applicable event limits can not be exceeded. The rods may be inserted without the need to stop at intermediate positions since the possibility of a CRDA is eliminated by the confirmation that withdrawn control rods are coupled.

To eliminate the possibility of a CRDA, administrative controls require that any partially inserted control rods, which have not been confirmed to be coupled since their last withdrawal, be fully inserted prior to reaching the THERMAL POWER of ::;10% RTP. If a control rod has been checked for coupling at notch 48 and the rod has not been moved inward, this rod is in contact with its drive and is not required to be fully inserted prior to reaching the THERMAL POWER of ::;10%

RTP. However, if it cannot be confirmed that the control rod has been moved inward, then that rod shall be fully inserted prior to reaching the THERMAL POWER of s10% RTP. The remaining control rods may then be inserted without the need to stop at intermediate positions since the possibility of a CRDA has been eliminated .

SUSQUEHANNA - UNIT 2 TS I B 3.3-46 (continued)

Revision 3

Rev.4 Control Rod Block Instrumentation

BASES (continued)

BACKGROUND (continued)

B 3.3.2.1 With the reactor mode switch in the shutdown position, a control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained. This Function prevents inadvertent criticality as the result of a control rod withdrawal during MODE 3 or 4, or during MODE 5 when the reactor mode switch is required to be in the shutdown position. The reactor mode switch has two channels, each inputting into a separate RMCS rod block circuit. A rod block in either RMCS circuit will provide a control rod block to all control rods.

Allowable Values are specified for each applicable Rod Block Function listed in Table 3.3.2.1-1. The NTSPs (actual trip setpoints) are selected to ensure that the setpoints are conservative with respect to the Allowable Value. A channel is inoperable if its actual trip setpoint is non-conservative with respect to its required Allowable Value.

NTSPs are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor power), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The Analytical Limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the Analytical Limits, corrected for calibration, process, and some* of the instrument errors.

The NTSPs are then determined, accounting for the remaining channel uncertainties. The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, and drift are accounted for.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

APPLICABLE 1. Rod Block Monitor SAFETY ANALYSES, LCO, and The RBM is designed to prevent violation of the MCPR SL and the APPLICABILITY cladding 1% strain fuel design limit that may result from a Single Control Rod Withdrawal (RWE) event.

The analytical methods and assumptions used in evaluating the RWE event are summarized in Reference 14. The fuel thermal performance as a function of RBM Allowable Value is determined from the analysis.

The NTSP and Allowable Values are chosen as a function of power level. NTSP operating limits are established based on the specified Allowable Values .

SUSQUEHANNA- UNIT 2 TS I B 3.3-47 (continued)

Revision 3

Rev. 4 Control Rod Block Instrumentation

BASES (continued)

APPLICABLE SAFETY

1. Rod Block Monitor (continued)

B 3.3.2.1 ANALYSES, LCO, and The RBM function satisfies Criterion 3 of the NRC Policy Statement APPLICABILITY (Ref. 7).

Two channels of the RBM arE:l required to be OPERABLE, with their setpoints within the appropriate Allowable Value for the associated power range, to ensure that no single instrument failure can preclude a rod block for this Function. The actual setpoints are calibrated consistent with applicable setpoint methodology.

Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Values between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.

Nominal setpoints are those predetermined values of output at which an action should take place. The trip setpoints are compared to the actual process parameter, the calculated RBM flux (RBM channel signal). When the normalized RBM flux value exceeds the applicable trip setpoint, the RBM provides a trip output.

The analytic limits are derived from the limiting values of the process parameters. Using the GE setpoint methodology, based on ISA RP 67.04, Part II "Methodologies for the Determination of Setpoints for Nuclear Safety-Related Instrumentation" setpoint calculation Method 2, the RBM Allowable Values are determined from the analytical limits using the statistical combination of the RBM input signal calibration error, process measurement error, primary element accuracy and instrument accuracy under trip conditions. Accounting for these errors assures that a setpoint found during calibration at the Allowable Value has adequate margin to protect the analytical limit thereby protecting the Safety Limit.

For the digital RBM, there is a normalization process initiated upon rod selection, so that only RBM input signal drift over the interval from the rod selection to rod movement needs to be considered in determining the nominal trip setpoints. The RBM has no drift characteristic with no as-left or as-found tolerances since it only performs digital calculations on the digitized input signals provided by the APRMs .

SUSQUEHANNA - UNIT 2 TS I B 3.3-48 (continued)

Revision 3

Rev.4 Control Rod Block Instrumentation

BASES APPLICABLE SAFETY

1. Rod Block Monitor (continued)

B 3.3.2.1 ANALYSES, LCO, and The RBM Allowable Value demonstrates that the analytical limit would APPLICABILITY not be exceeded, thereby protecting the safety limit The nominal trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and the environment errors are accounted for and appropriately applied for the RBM. There are no margins applied to the RBM nominal trip setpoint calculations which could mask RBM degradation.

The RBM will function when operating greater than or equal to 28%

RTP. Below this power level, the RBM is not required to be OPERABLE.

The RBM selects one of three different RBM flux trip setpolnts to be applied based on the current value of THERMAL POWER. THERMAL POWER is indicated to each RBM channel by a simulated thermal power (STP) reference signal input from an associated reference APRM channel. The OPERABLE range is divided into three "power ranges," a .low power range," an "intermediate power range," and a "high power range." The RBM flux trip setpoint applied within each of these three power ranges is, respectively, the "low trip setpoint," the "intermediate trip setpoint," and the "high trip setpoint" (Allowable Values for which are defined in the COLR). To determine the current power range, each RBM channel compares its current STP input value to three power setpoints, the "low power setpoinf',(28%), the

"intermediate power setpoint (current value defined in the COLR), and the "high power setpoint" (current value defined in the COLR), which define, respectively, the lower limit of the low power range, the lower limit of the intermediate power range, and the lower limit of the high power range. The trip setpoint applicable for each power range is more restridive than the corresponding setpoint for the lower power range(s). When STP is below the low power setpoint, the RSM flux trip outputs are automatically bypassed but the low trip setpoint continues to be applied to indicate the RBM flux setpoint on the NUMAC RBM displays.

The calculated setpoints and applicable power ranges are bounding values. In the equipment implementation, it is necessary to apply a "deadband" to each setpoint. The deadband is applied to the RBM trip setpoint selection logic and the RBM trip automatic bypass logic such

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-49 Revision 3

Rev.4 Control Rod Block Instrumentation

BASES APPLICABLE SAFETY ANALYSES,

1. Rod Block Monitor (continued)

B 3.3.2.1 LCO, and that the setpoint being applied is always equal to or more conservative APPLICABILITY than the required setpoint. Since the RBM flux trip setpoint applicable to the higher power ranges are more conservative than the corresponding trip setpoints for lower power ranges, the trip setpoint applicable to the higher power range (high power range or intermediate power range) continues to be applied when STP decreases below the lower limit of that range until STP is below the power range setpoint by a value exceeding the deadband. Similarly, when STP decreases below the low power setpoint, the automatic bypass of RBM flux trip outputs will not be applied until STP decreases below the trip setpoint a value exceeding the deadband.

The RBM channel uses THERMAL POWER, as represented by the STP input value from its reference APRM channel, to automatically enable RBM flux trip outputs (remove the automatic bypass) and to select the RBM flux trip setpoint to be applied. However, the RBM Upscale function is only required to be OPERABLE when the MCPR values are less than the values defined in the COLR, depending on the THERMAL POWER level. Therefore, even though the RBM Upscale Function is implemented in each RBM channel as a single trip function with a selected trip setpoint, it is characterized in Table 3.3.2.1-1 as three Functions, the Low Power Range - Upscale Function, the Intermediate Power Range - Upscale Function, and the High Power Range - Upscale Function, to facilitate correct definition of the OPERABILITY requirements for the Functions. Each Function corresponds to one of the RBM power ranges. Due to the deadband effects on the determination of the current power range, the transition between these three Functions will occur at slightly different THERMAL POWER levels for increasing power versus decreasing power.

2. Rod Worth Minimizer The RWM enforces the banked position withdrawal sequence (BPWS) to ensure that the initial conditions of the CRDA analysis are not violated. The analytical methods and assumptions used in evaluating the CRDA are summarized in References 2, 3, 4, and 5. The BPWS requires that control rods be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions. Requirements that the control rod sequence is in compliance with the BPWS are specified in LCO 3.1.6, "Rod Pattern Control."

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-50 Revision 3

Rev. 4 Control Rod Block Instrumentation

BASES APPLICABLE SAFETY

2. Rod Block Minimizer (continued)

B 3.3.2.1 ANALYSES, LCO, and When performing a shutdown of the plant, an optional BPWS control APPLICABILITY rod sequence (Ref. 7) may be used if the coupling of each withdrawn

.control rod has been confirmed. The rods may be inserted without the need to stop at intermediate positions. When using the Reference 11 control rod insertion sequence for shutdown, the rod worth minimizer may be reprogrammed to enforce the requirements of the improved BPWS control rod insertion, or may be bypassed and the improved BPWS shutdown sequence implemented under the controls in Condition D.

The RWM Function satisfies Criterion 3 of the NRG Policy Statement.

(Ref. 7)

Since the RWM is designed to act as a backup to operator control of the rod sequences, only one channel of the RWM is available and required to be OPERABLE (Ref. 6). Special circumstances provided for in the Required Action of LCO 3.1.3, "Control Rod OPERABILITY,"

and LCO 3.1.6 may necessitate bypassing the RWM to allow continued operation with inoperable control rods, or to allow correction of a control rod pattern not in compliance with the BPWS. The RWM may be bypassed as required by these conditions, but then it must be considered inoperable and the Required Actions of this LCO followed.

Compliance with the BPWS, and therefore OPERABILITY of the RWM, is required in MODES 1 and 2 when THERMAL POWER is

< 10% RTP. When THERMAL POWER is> 10% RTP, there is no possible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA (Refs. 4 and 6). In MODES 3 and 4, *an control rods are required to be inserted into the core (except as provided in 3.10 "Special Operations");

therefore, a CRDA cannot occur. In MODE 5, since only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will be subcritical.

SUSQUEHANNA - UNIT 2 TS I B 3.3-51 (continued)

Revision 3

Rev.4 Control Rod Block Instrumentation

BASES (continued)

APPLICABLE SAFETY

3. Reactor Mode Switch-Shutdown Position B 3.3.2.1 ANALYSES, (continued) During MODES 3 and 4, and during MODE 5 when the reactor mode switch is required to be in the shutdown position, the core is assumed to be subcritical; therefore, no positive reactivity insertion events are analyzed. The Reactor Mode Switch-Shutdown Position control rod withdrawal block ensures that the reactor remains subcritical by blocking control rod withdrawal, thereby preserving the assumptions of the safety analysis.

The Reactor Mode Switch-Shutdown Position Function satisfies Criterion 3 of the NRC Policy Statement. (Ref. 7)

Two channels are required to be OPERABLE to ensure that no single channel failure will preclude a rod block when required. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on reactor mode switch position.

During shutdown conditions (MODE 3, 4, or 5), no positive reactivity insertion events are analyzed because assumptions are that control rod withdrawal blocks are provided to prevent criticality. Therefore, when the reactor mode switch is in the shutdown position, the control rod withdrawal block is required to be OPERABLE. During MODE 5 with the reactor mode switch in the refueling position, the refuel position one-rod-out interlock (LCO 3.9.2) provides the required control rod withdrawal blocks.

ACTIONS With one RBM channel inoperable, the remaining OPERABLE channel is adequate to perform the control rod block function; however, overall reliability is reduced because a single failure in the remaining OPERABLE channel can result in no control rod block capability for the RBM. For this reason, Required Action A.1 requires restoration of the inoperable channel to OPERABLE status. The Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on the low probability of an event occurring coincident with a failure in the remaining OPERABLE channel.

SUSQUEHANNA - UNIT 2 TS I B 3.3-52 (continued)

Revision 3

Rev. 4 Control Rod Block Instrumentation

BASES ACTIONS (continued)

B 3.3.2.1 If Required Action A.1 is not met and the associated Completion Time has expired, the inoperable channel must be placed in trip within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . If both RSM channels are inoperable, the RBM is not capable of performing its intended function; thus, one channel must also be placed in trip. This initiates a control rod withdrawal block, thereby ensuring that the RBM function is met.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities and is acceptable because it minimizes risk while allowing time for restoration or tripping of inoperable channels.

C.1, C.2.1.1. C.2.1.2. and C.2.2 With the RWM inoperable during a reactor startup, the operator is still capable of enforcing the prescribed control rod sequence. However, the overall reliability is reduced because a single operator error ca*n result in violating the control rod sequence. Therefore, control rod movement must be immediately suspended except by scram .

Alternatively, startup may continue if at least 12 control rods have already been withdrawn, or a reactor startup with an inoperable RWM was not performed in the last calendar year, i.e. the last 12 months.

Required Actions C.2.1.1 and C.2.1.2 require verification of these conditions by review of plant logs and control room indications. A reactor startup with an inoperable RWM is defined as rod withdrawal during startup when the RWM is required to be OPERABLE. Once Required Action C.2.1.1 or C.2.1.2 is satisfactorily completed, control rod withdrawal may proceed in accordance with the restrictions imposed by Required Action C.2.2. Required Action C.2.2 allows for the RWM Function to be performed manually and requires a double check of compliance with the prescribed rod sequence by a second licensed operator (Reactor Operator or Senior Reactor Operator) or other qualified member of the technical staff. The RWM may be bypassed under these conditions to allow continued operations. In addition, Required Actions of LCO 3.1.3 and LCO 3.1.6 may require bypassing the RWM, during which time the RWM must be considered inoperable with Condition C entered and its Required Actions taken .

SUSQUEHANNA - UNIT 2 TS I B 3.3-53 (continued)

Revision 3

Rev.4 Control Rod Block Instrumentation

BASES (continued)

ACTIONS (continued)

B 3.3.2.1 With the RWM inoperable during a reactor shutdown, the operator is still capable of enforcing the prescribed control rod sequence.

Required Action D.1 allows for the RWM Function to be performed manually and requires a double check of compliance with the prescribed rod sequence by a second licensed operator (Reactor Operator or Senior Reactor Operator) or other qualified member of the technical staff. The RWM may be bypassed under these conditions to allow the reactor shutdown to continue.

E.1 and E.2 With one Reactor Mode Switch-Shutdown Position control rod withdrawal block channel inoperable, the remaining OPERABLE channel is adequate to perform the control rod withdrawal block function. However, since the Required Actions are consistent with the normal action of an OPERABLE Reactor Mode Switch-Shutdown Position Function (i.e., maintaining all control rods inserted), there is no distinction between having one or two channels inoperable .

In both cases (one or both channels inoperable), suspending all control rod withdrawal and initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies will ensure that the core is subcritical with adequate SOM ensured by LCO 3.1.1.

Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are therefore not required to be inserted.

Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each Control Rod REQUIREMENTS Block instrumentation Function are found in the SRs column of Table 3.3.2.1-1 .

SUSQUEHANNA - UNIT 2 TS I B 3.3-54 (continued)

Revision 3

Rev.4 Control Rod Block Instrumentation

BASES (continued)

SURVEILLANCE REQUIREMENTS The Surveillances are modified by a Note to indicate that when an B 3.3.2.1 RBM channel is placed in an inoperable status solely for performance (continued) of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains control rod block capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis Refs. 9, 12, and 13 assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that a control rod block will be initiated when necessary.

SR 3.3.2.1.1 A QHANNEL FUNCTIONAL TEST is performed for each RBM channel to ensure that the entire channel will perform the intended function. It includes the Reactor Manual Control Multiplexing System input. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SR 3.3.2.1.2 and SR 3.3.2.1.3 A CHANNEL FUNCTIONAL TEST is performed for the RWM to ensure that the entire system will perform the intended function. The CHANNEL FUNCTIONAL TEST for the RWM is performed by attempting to withdraw a control rod not in compliance with the prescribed sequence and verifying a control rod block occurs and by verifying proper indication of the selection error of at least one out-of-sequence control rod. As noted in the SRs, SR 3.3.2.1.2 is not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after any control rod is withdrawn in MODE 2. As noted, SR 3.3.2.1.3 is not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after THERMAL POWER is::; 10% RTP in MODE 1. This allows entry into MODE 2 for SR 3.3.2.1.2, and entry into MODE 1 when THERMAL POWER is::; 10% RTP for SR 3.3.2.1.3, to perform the required Surveillance if the Frequency is not met per SR 3.0.2.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the SRs. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.3-54a (continued)

Revision 1

Rev.4 Control Rod Block Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.2.1.4 B 3.3.2.1 (continued) The RBM setpoints are automatically varied as a function of Simulated Thermal Power. Three control rod block Allowable Values are specified in Table 3.3.2.1-1, each within a specific power range. The power at which the control rod block Allowable Values automatically change are based on the APRM signal's input to each RMB channel.

Below the minimum power setpoint, the RBM is automatically bypassed. These control rod block NTSPs must be verified periodically to be less than or equal to the specified Allowable Values.

If any power range setpoint is non-conservative, then the affected RBM channel is considered inoperable.

As noted, neutron detectors are excluded from the Surveillance because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal. Neutron detectors are adequately tested in SR 3.3.1.1.3 and SR 3.3.1.1.8. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.1.5 The RWM is automatically bypassed when power is above a specified value. The power level is determined from steam flow signals. The automatic bypass setpoint must be verified periodically to be not bypassed::; 10% RTP. This is performed by a Functional check. If th~

RWM low power setpoint is nonconservative, then the RWM is considered inoperable. Alternately, the low power setpoint channel can be placed in the conservative condition (nonbypass). If placed in the nonbypassed condition, the SR is met and the RWM is not considered inoperable. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.1.6 A CHANNEL FUNCTIONAL TEST is performed for the Reactor Mode Switch-Shutdown Position Function to ensure that the entire channel will perform the intended function. The CHANNEL FUNCTIONAL TEST for the Reactor Mode Switch-Shutdown Position Function is performed by attempting to withdraw any control rod with the reactor mode switch in the shutdown position and verifying a control rod block occurs .

SUSQUEHANNA- UNIT 2 TS I B 3.3-54b (continued)

Revision 1

Rev. 4.

Control Rod Block Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.2.1.6 (continued)

B 3.3.2.1 As noted in the SR, the Surveillance is not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the reactor mode switch is in the shutdown position, since testing of this interlock with the reactor mode switch in any other position cannot be performed without using jumpers, lifted leads, or movable links. This allows entry into MODES 3 and 4 if the Frequency is not met per SR 3.0.2. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the SRs.

The Surveillance Frequency is controlled u,nder the Surveillance Frequency Control Program.

SR 3.3.2.1. 7 CHANNEL CALIBRATION is a test that verifies the channel responds to the measured parameter with the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibration consistent with the plant specific setpoint methodology.

As noted, neutron detectors are excluded from the CHANNEL CALIBRATION because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal.

Neutron detectors are adequately tested in SR 3.3.1.1.2 and SR 3.3.1.1.8.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.3-54c (continued)

Revision 1

Rev.4 Control Rod Block Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.2.1. 7 (continued)

B 3.3.2.1 SR 3.3.2.1. 7 for the RBM Functions is modified by two Notes as identified in Table 3.3.2.1-1. The RBM Functions are Functions that are LSSSs for reactor core Safety Limits. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is not the NTSP but is conservative with respect to the Allowable Value. For digital channel components, no as-found tolerance or as-left tolerance can be specified. Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with design-basis .

assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. These channels will also be identified in the Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition for continued OPERABILITY. The second Note requires that the as-left setting for the instrument be returned to the NTSP. If the as-left instrument setting cannot be returned to the NTSP, then the instrument channel shall be declared inoperable. The second note also requires that the NTSP and NTSP methodology are to be contained in a document controlled by 10 CFR 50.59.

SR 3.3.2.1.8 The RWM will only enforce the proper control rod sequence if the rod sequence is properly input into the RWM computer. This SR ensures that the proper sequence is loaded into the RWM so that it can perform its intended function. The Surveillance is performed once prior to declaring RWM OPERABLE following loading of sequence into RWM, since this is when rod sequence input errors are possible.

REFERENCES 1. FSAR, Section 7.7.1.2.8.

2. FSAR, Section 7.6.1.a.5.7

3. NEDE-24011-P-A-9-US, "General Electrical Standard Application for Reload Fuel," Supplement for United States, Section S 2.2.3.1, September 1988.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-54d Revision O

Rev.4 Control Rod Block Instrumentation

BASES REFERENCES (continued) 4.

B 3.3.2.1 "Modifications to the Requirements for Control Rod Drop Accident Mitigating Systems," BWR Owners' Group, July 1986.

5. NED0-21231, "Banked Position Withdrawal Sequence,"

January 1977.

6. NRG SER, "Acceptance of Referencing of Licensing Topical Report NEDE-24011-P-A," "General Electric Standard Application for Reactor Fuel, Revision 8, Amendment 17,"

December 27, 1987.

7. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 32193)

8. NEDC-30851-P-A, "Technical Specification Improvement Analysis for BWR Control Rod Block Instrumentation," October 1988.

9. GENE-770-06-1, "Addendum to Bases for changes to .

Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation, Technical Specifications," February 1991 .

10. FSAR, Section 15.4.2.

11. NEDO 33091-A, Revision 2, "Improved BPWS Control Rod Insertion Process," July 2004.

12. NEDC 32410P-A, "Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option Ill Stability Trip Function," October 1995.

13. NEDC 3241 OP-A, Supplement 1, "Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM)

Retrofit Plus Option .111 Stability Trip Function," November 1997.

14. XN-NF-90-10(P)(A) Volume 4, Revision 1, "Exxon Nuclear Methodology for Boiling Water Reactors: Application of the ENC Methodology to BWR Reloads," Exxon Nuclear Company, June 1986.

SUSQUEHANNA- UNIT 2 TS I B 3.3-54e Revision 1

Rev. 3 Feedwater - Main Turbine High Water Level Trip Instrumentation

B 3.3 INSTRUMENTATION B 3.3.2.2 Feedwater - Main Turbine High Water Level Trip Instrumentation BASES B 3.3.

2.2 BACKGROUND

The feedwater - main turbine high water level trip instrumentation is designed to detect a potential failure of the Feedwater Level Control System that causes excessive feedwater flow.

With excessive feedwater flow, the water level in the reactor vessel rises toward the high water level, Level 8 reference point, causing the trip of the three feedwater pump turbines and the main turbine.

Reactor Vessel Water Level-High, Level 8 signals are provided by level sensors that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level in the reactor vessel (variable leg). Three channels of Reactor Vessel Water Level instrumentation are input to the Integrated Controls System (ICS) to provide the Reactor Vessel Water Level High, Level 8 trips of the Feedwater Pump Turbines and the Main Turbine.

The channel trip signals are evaluated independently in each of the three ICS distributed control logic cabinets located in the Computer Room using a two-out-of-three channel coincident trip logic

configuration, to provide the Level 8 trips of the feedwater pump turbines. The feedwater pump turbine trip initiation signal is provided with redundant trip paths to the individual feedwater pump turbine ICS cabinets located in the turbine building. The Level 8 trip of the Main Turbine is provided directly by the ICS via a hardwired discrete contact two-out-of-three channel coincident trip logic inputting to the main turbin electro-hydraulic controls.

A trip of the feedwater pump turbines limits further increase in reactor vessel water level by limiting further addition of feedwater to the reactor vessel. A trip of the main turbine and closure of the stop valves protects the turbine from damage due to water entering the turbine.

APPLICABLE SAFETY The feedwater - main turbine high water level trip instrumentation is ANALYSES assumed to be capable of providing a turbine trip in the design basis transient analysis for a feedwater controller failure, maximum demand event (Ref. 1). The Level 8 trip indirectly initiates a reactor scram from the main turbine trip (above 26% RTP) and trips the feedwater pumps, thereby terminating the event. The reactor scram mitigates the reduction in MCPR.

SUSQUEHANNA- UNIT 2 TS I B 3.3-55 Revision 2

Rev.3 Feedwater- Main Turbine High Water Level Trip Instrumentation

BASES APPLICABLE SAFETY ANALYSES (continued)

B 3.3.2.2 Feedwater - main turbine high water level trip instrumentation satisfies Criterion 3 of the NRC Policy Statement. (Ref. 3)

LCO The LCO requires three channels of the Reactor Vessel Water Level-High, Level 8 trip instrumentation to be OPERABLE to ensure that no single instrument failure will prevent the feedwater pump turbines and main turbine trip on a valid Level 8 signal. Two of the three channels are needed to provide trip signals in order for the feedwater - main turbine trips to occur. Each channel must have its setpoint set within the specified Allowable Value of SR 3.3.2.2.3. The Allowable Value is set to ensure that the thermal limits are not exceeded during the event.

The actual setpoint is calibrated to be consistent with the applicable setpoint methodology assumptions. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter reaches the setpoin(

the associated device changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

SUSQUEHANNA - UNIT 2 TS I B 3.3-56 (continued)

Revision O

Rev. 3 Feedwater - Main Turbine High Water Level Trip Instrumentation

BASES (continued)

APPLICABILITY B 3.3.2.2 The feedwater - main turbine high water level trip instrumentation is required to be OPERABLE at~ 23% RTP to ensure that the fuel cladding integrity Safety Limit is not violated during the feedwater controller failure, maximum demand event. As discussed in the Bases of LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR),"

sufficient margin to these limits exists below 23% RTP; therefore, the requirements are only necessary when operating at or above this power level.

ACTIONS A Note has been provided to modify the ACTIONS related to feedwater - main turbine high water level trip instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition.

Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable feedwater - main turbine high water level trip

instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable feedwater -

main turbine high water level trip instrumentation channel.

With one channel inoperable, the remaining two OPERABLE channels can provide the required trip signal. However, overall instrumentation reliability is reduced because a single failure in one of the remaining channels concurrent with feedwater controller failure, maximum demand event, may result in the instrumentation not being able to perform its intended function. Therefore, continued operation is only allowed for a limited time with one channel inoperable. If the inoperable channel cannot be restored to OPERABLE status within the Completion Time, the channel must be placed in the tripped condition per Required Action A.1. Placing the (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-57 Revision 1

Rev.3 Feedwater- Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES ACTIONS A.1 (continued) inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in a feedwater or main turbine trip), Condition C must be entered and its Required Action taken.

If the failure only affects the trip function of a single main feed pump, an option is always available to remove the affected component from service and restore OPERABILITY. This is acceptable because removing the component from service performs the safety function.

The Completion Time of 7 days is based on the low probability of the event occurring coincident with a single failure in a remaining OPERABLE channel.

With two or more channels inoperable, the feedwater - main turbine high water level trip instrumentation cannot perform its design function (feedwater - main turbine high water level trip capability is not maintained) .. Therefore, continued operation is only permitted for a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months period, during which feedwater - main turbine high water level trip capability must be restored. The trip capability is considered maintained when sufficient channels are OPERABLE or in trip such that the feedwater - main turbine high water level trip logic will generate a trip signal on a valid signal. This requires two channels to each be OPERABLE or in trip. If the required channels cannot be restored to OPERABLE status or placed in trip, Condition C must be entered and its Required Action taken.

If the failure only affects the trip function of a single main feed pump, an option is always available to remove the affected component from service and restore OPERABILITY. This is acceptable because removing the component from service performs the safety function.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-58 Revision O

Rev. 3 Feedwater - Main Turbine High Water Level Trip Instrumentation

BASES ACTIONS B.1 (continued)

B 3.3.2.2 The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is sufficient for the operator to take corrective action, and takes into account the likelihood of an event requiring actuation of feedwater - main turbine high water level trip instrumentation occurring during this period. It is also consistent with the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time provided in LCO 3.2.2 for Required Action A.1, since this instrumentation's purpose is to preclude a MCPR violation.

With the required channels not restored to OPERABLE status or placed in trip, THERMAL POWER must be reduced to < 23% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . As discussed in the Applicability section of the Bases, operation below 23% RTP results in sufficient margin to the required limits, and the feedwater - main turbine high water level trip instrumentation is not required to protect fuel integrity during the feedwater controller failure, maximum demand event. The allowed Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is based on operating experience to

reduce THERMAL POWER to< 23% RTP from full power conditions in an orderly manner and without challenging plant systems.

If the failure only affects the trip function of a single main feed pump, an option is always available to remove the affected component from service and restore OPERABILITY. This is acceptable because removing the component from service performs the safety function.

SURVEILLANCE The Surveillances are modified by a Note to indicate that when a REQUIREMENTS channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains feedwater - main turbine high water level trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-59 Revision 1

Rev.3 Feedwater - Main Turbine High Water Level Trip Instrumentation

BASES SURVEILLANCE REQUIREMENTS taken. This Note is based on the reliability analysis (Ref. 2) assumption that 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is the average time required to perform B 3.3.2.2 (continued) channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the feedwater pump turbines and main turbine will trip when necessary.

SR 3.3.2.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels, or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria which are determined by the plant staff based on an investigation of a combination of the channel instrument uncertainties may be used to support this parameter comparison and include indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit, and does not necessarily indicate the channel is Inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

(continued)

SUSQUEHANNA - UNIT 2 TS/ B 3.3-60 Revision 1

Rev.3 Feedwater- Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES SURVEILLANCE SR 3.3.2.2.2 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. Note 1 provides a general exception to the definition of CHANNEL FUNCTIONAL TEST. This exception is necessary because the design architecture of the ICS (e.g. digital control blocks and logic) does not facilitate complete functional testing of all required logic blocks, which input into the combinational logic. (Reference 4) Performance of such a test could result in a plant transient or place the plant in an undo risk situation.

Therefore, for this SR, the CHANNEL FUNCTIONAL TEST verifies acceptable response by verifying the change of state of the logical blocks, which input into the combinational logic. The required logical blocks not tested during the CHANNEL FUNCTIONAL TEST are tested under the LOGIC SYSTEM FUNCTIONAL TEST, SR 3.3.2.2.4. This is acceptable because operating experience shows that the logical blocks not tested during the CHANNEL FUNCTIONAL TEST normally pass the LOGIC SYSTEM FUNCTIONAL TEST, and the testing

methodology minimizes the risk of unplanned transients .

Note 2 provides a second specific exception to the definition of CHANNEL FUNCTIONAL TEST. For the Feedwater - Main Turbine High Water Level Trip Function, certain required channel logical blocks are not included in the performance of the CHANNEL FUNCTIONAL TEST. These exceptions are necessary because the circuit design does not facilitate functional testing of the entire channel through to the combinational logic. (Reference 4) Specifically, testing of all

required logical blocks could lead to unplanned transients. Therefore, for this circuit, the CHANNEL FUNCTIONAL TEST verifies acceptable response by verifying the actuation of circuit devices up to the point where further testi6g could result in an unplanned transient.

(References 5 and 6) The required logical blocks not tested during the CHANNEL FUNCTIONAL TEST are tested under the LOGIC SYSTEM FUNCTIONAL TEST, SR 3.3.2.2.4. This exception is acceptable because operating experience shows that the devices not tested during the CHANNEL FUNCTIONAL TEST normally pass the LOGIC SYSTEM FUNCTIONAL TEST, and the testing methodology minimizes the risk of Ul"'!planned transients.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-61 Revision 2

Rev. 3 Feedwater - Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES SURVEILLANCE SR 3.3.2.2.3 REQUIREMENTS (continued) CHANNEL CAUBRATION verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.2.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the feedwater - main turbine valves is included as part of this Surveillance and overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the assumed safety function. Therefore, if a valve is incapable of operating, the associated instrumentation would also be inoperable. The

REFERENCES Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

1. FSAR, Section 15.1.2.

2. GENE-770-06-1, "Bases for Changes to Surveillance Test Selected Instrumentation Technical Specifications,"

February 1991.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132)

4. NRG Inspection and Enforcement Manual, Part 9900: Technical Guidance, Standard Technical Specification Section 1.0 Definitions, Issue date 12/08/86.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-62 Revision 1

Rev. 3 Feedwater - Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES REFERENCES 5. PLA-2618: NRG Inspection Reports 50-387/85-28 and 50-88/85-(continued) 23.

6. NRC Region I Combined Inspection 50-387/90-20; 50-388/90-20 .

SUSQUEHANNA - UNIT 2 TS I B 3.3-63 Revision 0

Rev. 9 PAM Instrumentation B 3.3.3.1 B 3.3 INSTRUMENTATION B 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND The primary purpose of the PAM instrumentation is to display plant variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Events.

The instruments that monitor these variables are designated as Type A, Category I, and non-Type A, Category I, in accordance with Regulatory Guide 1.97 (Ref. 1).

The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected plant parameters to monitor and assess plant status and behavior following an accident. This capability is consistent with the recommendations of Reference 1.

APPLICABLE SAFETY ANALYSES The PAM instrumentation LCO ensures the OPERABILITY of Regulatory Guide 1.97, Type A variables so that the control room operating staff can:

Perform the diagnosis specified in the Emergency Operating Procedures (EOPs). These variables are restricted to preplanned actions for the primary success path of Design Basis Accidents (DBAs), (e.g., loss of coolant accident (LOCA)), and

Take the specified, preplanned, manually controlled actions for which no automatic control is provided, which are required for safety systems to accomplish their safety function.

The PAM instrumentation LCO also ensures OPERABILITY of Category I, non-Type A, variables so that the control room operating staff can:

Determine whether systems important to safety are performing their intended functions;

SUSQUEHANNA - UNIT 2

)

TS I B 3.3-64

(continued)

Revision 2

Rev. 9 PAM Instrumentation

BASES

. APPLICABLE SAFETY ANALYSES B 3.3.3.1 Determine the potential for causing a gross breach of the barriers to radioactivity release; (continued)

Determine whether a gross breach of a barrier has occurred; and

Initiate action necessary to protect the public and for an estimate of the magnitude of any impending threat.

The plant specific Regulatory Guide 1.97 Analysis (Ref. 2 and 3) documents the process that identified Type A and Category I, non-Type A, variables.

Accident monitoring instrumentation that satisfies the definition of Type A in Regulatory Guide 1.97 meets Criterion 3 of the NRC Policy Statement. (Ref. 4) Category I, non-Type A, instrumentation is retained in Technical Specifications (TS) because they are intended to assist operators in minimizing the consequences of accidents. Therefore, these Category I variables are important for reducing public risk.

LCO LCO 3.3.3.1 requires two OPERABLE channels for all but one Function to ensure that no single failure prevents the operators from being presented with the information necessary to determine the status of the plant and to bring the plant to, and maintain it in, a safe condition following that accident.

Furthermore, provision of two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information.

The exception to the two channel requirement is primary containment isolation valve (PCIV) position. In this case, the important information is the status of the primary containment penetrations. The LCO requires one position indicator for each active PCIV. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve and prior knowledge of passive valve or via system boundary

SUSQUEHANNA- UNIT 2 TS I 8 3.3-65 (continued)

Revision 2

Rev.9 PAM Instrumentation B 3.3.3.1 BASES LCO status. If a normally active PCIV is known to be closed and (continued) deactivated, position indication is not needed to determine status.

Therefore, the position indication for valves in this state is not required to be OPERABLE.

The following list is a discussion of the specified instrument Functions listed in Table 3.3.3.1-1 in the accompanying LCO. Table 83.3.3.1-1 provides .a listing of the instruments that are used to meet the operability requirements for the specific functions.

1. Reactor Steam Dome Pressure Reactor steam dome pressure is a Type A, Category 1, variable provided to support monitoring of Reactor Coolant System (RCS) integrity and to verify operation of the Emergency Core Cooling Systems (ECCS). Two independent pressure channels, consisting of three wide range control room indicators and one wide range control room recorder per channel with a range of O psig to 1500 psig, monitor pressure. The wide range recorders are the primary method of indication available for use by the operators during an accident, therefore, the PAM Specification deals specifically with this portion of the instrument channel.

2. Reactor Vessel Water Level Reactor vessel water level is a Type A, Category 1, variable provided to support monitoring of core cooling and to verify operation of the ECCS. A combination of three different level instrument ranges, with two independent channels each, monitor Reactor Vessel Water Level.

The extended range instrumentation measures from -150 inches to 180 inches and outputs to three control room level indicators per channel. The wide range instrumentation measures from -150 inches to 60 inches and outputs to one control room recorder and three control room indicators per channel. The fuel zone range instrumentation measures from -31 O inches to -11 O inches and outputs to a control room recorder (one channel) and a control room indicator (one channel). These three ranges of instruments combine to provide level indication from the bottom of the Core to above the main steam line. The wide range level recorders, the fuel zone level indicator and level recorder, and one inner ring extended range level indicator per channel are the primary method of indication available for use by the operator during an accident, therefore the PAM

SUSQUEHANNA - UNIT 2 TS I B 3.3-66 (continued)

Revision 4

Rev. 9 PAM Instrumentation

BASES LCO 2. Reactor Vessel Water Level (continued)

B 3.3.3.1 Specification deals specifically with this portion of the instrument channel.

3. Suppression Chamber Water Level Suppression chamber water level is a Type A, Category 1, variable provided to detect a breach in the reactor coolant pressure boundary (RCPB). This variable is also used to verify and provide long term surveillance of ECCS function. A combination of two different level instrument ranges, with two independent channels each, monitor Suppression chamber water level. The wide range instrumentation measures from the ECCS suction lines to approximately the top of the chamber and outputs to one control room recorder per channel. The wide range recorders are the primary method of indication available for use by the operator during an accident, therefore the PAM Specification deals specifically with this portion of the instrument channel.

4. Primary Containment Pressure Primary Containment pressure is a Type A, Category 1, variable provided to detect a breach of the RCPB and to verify ECCS functions that operate to maintain RCS integrity. A combination of two different pressure instrument ranges, with two independent channels each, monitor primary containment pressure. The LOCA range measures from -15 psig to 65 psig and outputs to one control room recorder per channel. The accident range measures from O psig to 250 psig and outputs to one control room recorder per channel (same recorders as the LOCA range). The recorders (both ranges) are the primary method of indication available for use by the operator during an accident, .I therefore the PAM Specification deals specifically with this portion of the instrument channel.

5. Primary Containment High Radiation Primary containment area radiation (high range) is provided to monitor the potential of significant radiation releases

SUSQUEHANNA - UNIT 2 TS I B 3.3-67 (continued)

Revision 3

Rev. 9 PAM Instrumentation

BASES LCO 5. Primary Containment High Radiation (continued)

B 3.3.3.1 and to provide release assessment for use by operators in determining the need to invoke site emergency plans. Two independent channels, which output to one control room recorder per channel with a range of 10° to 1X108 R/hr, monitor radiation. The PAM Specification deals specifically with this portion of the instrument channel.

6. Primary Containment Isolation Valve CPCIV) Position PCIV position is provided for verification of containment integrity. In the case of PCIV position, the important information is the isolation status of the containment penetration. The LCO requires a channel of valve position indication in the control room to be OPERABLE for an active PCIV in a containment penetration flow path, i.e., two total channels of PCIV position indication for a penetration flow path with two active valves. For containment penetrations with only one active PCIV having control room indication, Note (b) requires a single channel of valve position indication to be OPERABLE. This is sufficient to redundantly verify the isolation status of each isolable penetration via indicated status of the active valve, as applicable, and prior knowledge of passive valve or system boundary status. If a penetration flow path is isolated, position indication for the PCIV(s) in the associated penetration flow path is not needed to determine status. Therefore, the position indication for valves in an isolated penetration flow path is not required to be OPERABLE. Those valves which require position indication are specified in Table B 3.6.1.3-1. Furthermore, the loss of position indication does not necessarily result in the PCIV being inoperable.

The PCIV position PAM instrumentation consists of position switches unique to PCIVs, associated wiring and control room indicating lamps (not necessarily unique to a PCIV) for active PCIVs (check valves and manual valves are not required to have position indication). Therefore, the PAM Specification deals specifically with these instrument channels .

SUSQUEHANNA- UNIT 2 TS I B 3.3-68 (continued)

Revision 4

Rev.9 PAM Instrumentation

BASES LCO (continued)

7. Neutron Flux B 3.3.3.1 Wide range neutron flux is a Category I variable provided to verify reactor shutdown. The Neutron Monitoring System Average Power Range Monitors (APRM) provides reliable neutron flux measurement from 0% to 125% of full power. The APRM consists of four channels each with their own chassis powered with redundant power supplies.

The APRM sends signals to the analog isolator module which in tum sends individual APRM signals to the recorders used for post accident monitoring. The PAM function for neutron flux is satisfied by having two channels of APRM provided for post accident monitoring. The PAM Specification deals specifically with this portion of the instrument channel.

The Neutron Monitoring System (NMS) was evaluated against the criteria established in General Electric NED0-31558A to ensure its acceptability for post-accident monitoring. NED0-31558A provides alternate criteria for the NMS to meet the post-accident monitoring guidance of Regulatory Guide 1.97. Based on the evaluation, the NMS was found to meet the criteria established in NED0-31558A.

The APRM sub-function of the NMS is used to provide the Neutron Flux monitoring identified in TS 3.3.3.1 (Ref. 5 and 6).

8. Not Used .

SUSQUEHANNA- UNIT 2 TS I B 3.3-69 (continued)

Revision 5

Rev. 9 PAM Instrumentation B 3.3.3.1 BASES LCO 9. Diywell Atmosphere Temperature (continued)

Drywell atmosphere temperature is a Category I variable provided to verify RCS and containment integrity and to verify the effectiveness of ECCS actions taken to prevent containment breach. Two independent temperature channels, consisting of two control room recorders per channel with a range of 40 to 440 degrees F, monitor temperature.

The PAM Specification deals specifically with the inner ring temperature recorder portion of the instrument channel.

1 O. Suppression Chamber Water Temperature Suppression Chamber water temperature is a Type A, Category 1, variable provided to detect a condition that could potentially lead to containment breach and to verify the effectiveness of ECCS actions taken to prevent containment breach. The suppression chamber water temperature instrumentation allows operators to detect trends in suppression chamber water temperature in sufficient time to take action to prevent steam quenching vibrations in the suppression pool.

Two channels are required to be OPERABLE. Each channel consists of eight sensors of which a minimum of four sensors (one sensor in each quadrant) must be OPERABLE to consider a channel OPERABLE. The outputs for the temperature sensors are displayed on two independent indicators in the control room and recorded on the monitoring units located on control room panel 2C601. The temperature indicators are the primary method of indication available for use by the operator during an accident, therefore the PAM Specification deals specifically with this portion of the instrument channel.

APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1 and 2.

These variables are related to the diagnosis and preplanned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1 and 2. In MODES 3, 4, and 5, plant conditions are such that the likelihood of an event that would require PAM instrumentation is extremely low; therefore, PAM instrumentation is not required to be OPERABLE in these MODES .

SUSQUEHANNA - UNIT 2 TS I B 3.3-70 (continued)

Revision 4

Rev. 9 PAM Instrumentation

B 3.3.3.1 BASES (continued)

ACTIONS A Note has been provided to modify the ACTIONS related to PAM instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for inoperable PAM instrumentation channels provide appropriate compensatory measures for separate Functions. As such, a Note has been provided that allows separate Condition entry for each inoperable PAM Function.

When one or more Functions have one required channel that is inoperable, the required inoperable channel must be restored to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channels, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.

If a channel has not been restored to OPERABLE status in 30 days, this Required Action specifies initiation of action in accordance with Specification 5.6.7, which requires a written report to be submitted to the NRC. This report discusses the results of the root cause evaluation of the inoperability and identifies proposed restorative actions .

SUSQUEHANNA - UNIT 2 TS I B 3.3-71 (continued)

Revision 3

Rev.9 PAM Instrumentation

BASES ACTIONS B.1 (continued)

B 3.3.3.1 This action is appropriate in lieu of a shutdown requirement because alternative actions are identified before the written report is submitted to the* NRC, and given the likelihood of plant conditions that would require information provided by this instrumentation.

When one or more Functions have two required channels that are inoperable (i.e., two channels inoperable in the same Function), one channel in the Function should be restored to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all petformance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.

This Required Action directs entry into the appropriate Condition referenced in Table 3.3.3.1-1. The applicable Condition referenced in the Table is Function dependent. Each time an inoperable channel has not met any Required Action of Condition C, as applicable, and the associated Completion Time has expired, Condition D is entered for that channel and provides for transfer to the appropriate subsequent Condition.

For the majority of Functions in Table 3.3.3.1-1, if any Required Action and associated Completion Time of Condition C are not met, the plant must be brought to a MODE in which the LCO not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions

SUSQUEHANNA - UNIT 2 TS I B 3.3-72 (continued)

Revision 2

Rev.9 PAM Instrumentation

BASES ACTIONS E.1 (continued)

B 3.3.3.1 from full power conditions in an orderly manner and without challenging plant systems.

Since alternate means of monitoring primary containment area radiation have been developed and tested, the Required Action is not to shut down the plant, but rather to follow the directions of Specification 5.6.7. These alternate means will be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels.

SURVEILLANCE The following SRs apply to each PAM instrumentation Function in REQUIREMENTS Table 3.3.3.1-1 .

SR 3.3.3.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel against a similar parameter on other channels. It is based on the assumption

.that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria which are determined by the plant staff based on an investigation of a combination of the channel instrument uncertainties, may be used to support this *

SUSQUEHANNA - UNIT 2 TS I B 3.3-73 (continued)

Revision 3

Rev.9 PAM Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.3.1.1 (continued)

B 3.3.3.1 parameter comparison and include indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit, and does not necessarily indicate the channel is Inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.3.1.2 and SR 3.3.3.1.3 The PCIV Position Function is adequately demonstrated by the Remote Position Indication performed in accordance with 5.5.6, "lnservice Testing Program." CHANNEL CALIBRATION verifies that the channel responds to measured parameter with the necessary range and accuracy, and does not include alarms.

The CHANNEL CALIBRATION for the Containment High Radiation instruments shall consist of an electronic calibration of the channel, not including the detector, for range decades above 1 O R/hr and a one point calibration check of the detector below 1O R/hr with an installed or portable gamma source.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.3-74 (continued)

Revision 4

Rev. 9 PAM Instrumentation B 3.3.3.1 BASES (continued)

REFERENCES 1. Regulatory Guide 1.97 Rev. 2, "Instrumentation for Light Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," February 6, 1985.

2. Nuclear Regulatory Commission Letter A. Schwencer to N. Curtis, Emergency Response Capability, Conformance to R.G. 1.97, Rev. 2, dated February 6, 1985.

3. PP&L Letter (PLA-2222), N. Curtis to A. Schwencer, *dated May 31, 1984.

4. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 32193).

5. NED0-31558A, BWROG Topical Report, Position on NRC Reg.

Guide 1.97, Revision 3 Requirements for Post Accident Neutron Monitoring System (NMS).

6. Nuclear Regulatory Commission Letter from C. Poslusny to R. G. Byram dated July 3, 1996.

SUSQUEHANNA - UNIT 2 TS I B 3.3-75 Revision 2

Rev.9 PAM Instrumentation

TABLE B 3.3.3.1-1 Post Accident Instruments (Page 1of3)

B 3.3.3.1 lnstrumenWariable Element Transmitter Recorder Indicator

1. Reactor Steam NIA PT-24201A UR-24201A Pl-24202A Dome Pressure (Rea)* Pl-24202A1 Pl-24204A NIA PT-242018 UR-242018 Pl-242028 (left side)

(Red)* Pl-2420281 (left side)

Pl-242048 (left side)

2. Reactor Vessel NIA LT-24201A UR-24201A Ll-24201A (left side)

Water Level (Wide Range) (Blue)* Ll-24201A1 (left side)

Ll-24203A (left side)

NIA LT-242018 UR-242018 Ll-242018 (left side)

(Wide Range) (Blue)* Ll-2420181 (left side)

Ll-242038 (left side)

NIA LT-24203A NIA Ll-24201 A (right side)*'1>

(Extended Range) Ll-24201A1 (right side)

Ll-24203A (right side)

NIA LT-242038 NIA Ll-24201 B (right side)*<1>

(Extended Range) Ll-2420181 (right side)

Ll-242038 (right side)

NIA LT-24202A UR-24201A NIA (Fuel Zone Ranae) (Brown)*

N/A LT-242028 UR-242018 (Fuel Zone Range) IBrown)*

3. Suppression NIA LT-25776A UR-25776A NIA Chamber Water Level (Wide Ranae) (Red)*

NIA LT-257768 UR-257768 NIA Mfide Ranae) (Red)".

NIA LT-25775A UR-25776A Ll-25775A (Narrow Range) (Blue)

NIA LT-257758 UR-257768 Ll-257758 (Narrow Ranae) <Blue\

SUSQUEHANNA - UNIT 2 TS I B 3.3-75a Revision 6

Rev. 9 PAM Instrumentation

TABLE B 3.3.3.1-1 Post Accident Instruments (Page 2 of 3)

B 3.3.3.1 le Element Transmitter Recorder Indicator

4. Primary NIA PT-25709A UR-25701A (Dark Blue)* NIA Containment Pressure (0 to 250 psig)

NIA PT-25709B UR-25701 B (Dark Blue)* NIA (0 to 250 psia)

NIA PT-25710A UR-25701A (Red)* NIA

(-15 to 65 psig)

NIA PT-25710B UR-25701 B (Red)* NIA

(-15 to 65 osia)

5. Primary Containment UR-25776A RE-25720A RITS-25720A NIA High Radiation (Green)*

UR-25n6B RE-25720B RITS-257208 NIA (Green)*

6 . PCIVPosition See Technical Specification Bases Table B 3.6.1.3-1 for PCIV that require position indication to be OPERABLE

7. Neutron Flux NIA APRM-1 NR-C51-2R603A NIA

(red pen)*

NIA APRM-2 NR-C51-2R603B NIA (red pen)*

NIA APRM-3 NR-C51-2R603C NIA (red pen)*

NIA APRM-4 N R-C51-2R603D NIA (red oen)*

8 . Not Used

SUSQUEHANNA - UNIT 2 TS I B 3.3-75b Revision 6

Rev. 9 PAM Instrumentation

TABLE B 3.3.3.1-1 Post Accident Instruments (Page 3 of 3)

B 3.3.3.1 I lnstrumentNariable Element Transmitter Recorder Indicator

9. Drywell Atmosphere TE-25790A TT-25790A UR-25701A (Brown)* NIA Temperature TR-25790A (Red)

TE-257908 TT-257908 UR-25701 B (Brown)* N/A TR-257908 (Red)

. 10. Suppression Chamber TE-25753 TX-25751 TIAH-25751* Tl-25751 Water Temperature TE-25755 TE-25757 TE-25759 TE-25763 TE-25765 TE-25767 TE-25769 TE-25752 TX-25752 TIAH-25752" Tl-25752 TE-25754 TE-25758 TE-25760 TE-25762 TE-25766 TE-25768 TE-25no Indicates that the instrument (and associated components in the instrument channel) is considered as instrument channel surveillance acceptance criteria.

(1) In the case of the inner ring indicators for extended range level, it is recommended that Ll-24201A and Ll-242018 be used as acceptance criteria, however Ll-24201A1, Ll-2420181, Ll-24203A. or Ll-242038 may be used in their place provided that surveillance requirements are satisfied. Only one set of these instruments needs to be OPERABLE.

SUSQUEHANNA - UNIT 2 TS I B 3.3-75c Revision 6

Rev. 2 Remote Shutdown System

B 3.3 INSTRUMENTATION B 3.3.3.2 Remote Shutdown System B 3.3.3.2 BASES BACKGROUND The Remote Shutdown System provides the control room operator with sufficient instrumentation and controls to place and maintain the plant in a safe shutdown condition from a location other than the control room. This capability is necessary to protect against the possibility of the control room becoming inaccessible. A safe shutdown condition is defined as MODE 3. With the plant in MODE 3, the Reactor Core Isolation Cooling (RCIC) System, the safety/relief valves, and the Residual Heat Removal Shutdown Cooling System can be _used to remove core decay heat and meet all safety requirements. The long term supply of water for the RCIC and the ability to operate shutdown cooling from outside the control room allow extended operation in MODE3.

In the event that the control room becomes inaccessible, the operators can establish control at the remote shutdown panel and place and maintain the plant in MODE 3. Not all controls and necessary transfer switches are located at the remote shutdown panel. Some controls will have to be operated locally at the switchgear, motor control panels, or other local stations. The plant automatically reaches MODE 3 following a plant shutdown and can be maintained safely in MODE 3 for an extended period of time.

The OPERABILITY of the Remote Shutdown System control and instrumentation Functions ensures that there is sufficient information available on selected plant parameters to place and maintain the plant in MODE 3 should the control room become inaccessible.

APPLICABLE The Remote Shutdown System is required to provide equipment at .

SAFETY ANALYSES appropriate locations outside the control room with a design capability to promptly shut down the reactor to MODE 3, including the necessary instrumentation.and controls, to maintain the plant in a safe condition in MODE 3 .

SUSQUEHANNA- UNIT 2 TS I B 3.3-76 (continued)

Revision 0

Rev.2 Remote Shutdown System

BASES APPLICABLE SAFETY ANALYSES B 3.3.3.2 The criteria governing the design and the specific system requirements of the Remote Shutdown System are located in 10 CFR 50, (continued) Appendix A, GDC 19 (Ref. 1).

The Remote Shutdown System is considered an important contributor to reducing the risk of accidents; as such, it has been retained in the Technical Specifications (TS) as indicated in the NRC Policy Statement. (Ref. 3)

LCO The Remote Shutdown System LCO provides the requirements for the OPERABILITY of the instrumentation and controls necessary to place and maintain the plant in MODE 3 from a location other than the control room.

The controls, instrumentation, and transfer switches are those required in Table 3.3.3.2-1.

The Remote Shutdown System is OPERABLE if all instrument and control channels needed to support the remote shutdown function are OPERABLE. In some cases, the required information or control capability is available from several alternate sources. In these cases, the Remote Shutdown System is OPERABLE as long as one channel of any of the alternate information or control sources for each Function is OPERABLE.

The Remote Shutdown System instruments and control circuits covered by this LCO do not need to be energized to be considered OPERABLE. This LCO is intended to ensure that the instruments and control circuits will be OPERABLE if plant conditions require that the Remote Shutdown System be placed in operation.

APPLICABILITY The Remote Shutdown System LCO is applicable in MODES 1 and 2.

This is required so that the plant can be placed and maintained in MODE 3 for an extended period of time from a location other than the control room.

This LCO is not applicable in MODES 3, 4, and 5. In these MODES, the plant is already subcritical and in a condition of reduced Reactor Coolant System energy. Under these conditions, considerable time is available to restore

SUSQUEHANNA - UNIT 2 TS I B 3.3-77 (continued)

Revision O

Rev.2 Remote Shutdown System

BASES APPLICABILITY B 3.3.3.2 necessary instrument control Functions if control room instruments or (continued) control becomes unavailable. Consequently, the TS do not require OPERABILITY in MODES 3, 4, and 5.

ACTIONS A Note has been provided to modify the ACTIONS related to Remote Shutdown System Functions. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable Remote Shutdown System Functions provide appropriate compensatory measures for separate Functions. As such, a Note has been provided that allows separate Condition entry for each inoperable Remote Shutdown System Function .

Condition A addresses the situation where one or more required Functions of the Remote Shutdown System is inoperable. This includes any Function listed in Table 3.3.3.2-1, as well as the control and transfer switches.

The Required Action is to restore the Function (both divisions, if applicable) to OPERABLE status within 30 days. The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room .

SUSQUEHANNA - UNIT 2 TS I B 3.3-78 (continued)

Revision 1

Rev. 2 Remote Shutdown System B 3.3.3.2 BASES ACTIONS (continued)

If the Required Action and associated Completion Time of Condition A are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reach the required MODE from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each Remote REQUIREMENTS Shutdown System Instrument Function are located in the SRs column of Table 3.3.3.2-1.

SR 3.3.3.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria which are determined by the plant staff based on an investigation of a combination of the channel instrument uncertainties may be used to support this parameter comparison and include indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit, and does not necessarily indicate the channel is Inoperable. As specified in the Surveillance, a CHANNEL CHECK is only required for those channels that are normally energized.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.3-79 (continued)

Revision 0

Rev.2 Remote Shutdown System

BASES SURVEILLANCE SR 3.3.3.2.2 B 3.3.3.2 REQUIREMENTS (continued) SR 3.3.3.2.2 verifies each required Remote Shutdown System transfer switch and control circuit performs the intended function. This verification is performed from the remote shutdown panel. Operation of the equipment from the remote shutdown panel is not necessary.

The Surveillance can be sati~fied by performance of a continuity check. This will ensure that if the control room becomes inaccessible, the plant can be placed and maintained in MODE 3 from the remote shutdown panel and the local control stations. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.3.2.3 CHANNEL CALIBRATION verifies that the channel respond.s to measured parameter values with the necessary range and accuracy.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 19.

2. FSAR 7.4.1.4.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 32193)

SUSQUEHANNA- UNIT 2 TS I B 3.3-80 Revision 1

Rev.2 EOC-RPT Instrumentation B 3.3.4.1 B 3.3 INSTRUMENTATION B 3.3.4.1 End of Cycle Recirculation Pump Trip (EOC-RPT) Instrumentation BASES BACKGROUND* The EOC-RPT instrumentation initiates a recirculation pump trip (RPT) to reduce the peak reactor pressure and power resulting from turbine trip or generator load rejection transients to provide additional margin to core thermal MCPR Safety Limits (SLs).

The need for the additional negative reactivity in excess of that normally inserted on a scram reflects end of cycle reactivity considerations. Flux shapes at the end of cycle are such that the control rods may not be able to ensure that thermal limits are maintained by inserting sufficient negative reactivity during the first few feet of rod travel upon a scram caused by Turbine Control Valve (TCV)

Fast Closure, Trip Oil Pressure-Low or Turbine Stop Valve (TSV)-

Closure. The physical phenomenon involved is that the void reactivity feedback due to a pressurization transient can add positive reactivity at a faster rate than the control rods can add negative reactivity .

The EOC-RPT instrumentation, as shown in Reference 1, is composed of sensors that detect initiation of closure of the TSVs or fast closure of the TCVs, combined with relays, logic circuits, and fast acting circuit breakers that interrupt power from the recirculation pump motor generator (MG) set generators to each of the recirculation pump motors. When the setpoint is reached, the channel output relay actuates, which then outputs an EOC-RPT signal to the trip logic.

When the RPT breakers trip open, the recirculation pumps coast down under their own inertia. The EOC-RPT has two identical trip systems, either of which can actuate an RPT.

Each EOC-RPT trip system is a two-out-of-two logic for each Function; thus, either two TSV-Closure or two TCV Fast Closure, Trip Oil Pressure-Low signals are required for a trip system to actuate. The Turbine Stop Valve - Closure functions such that:

(1) The closing of one Turbine Stop Valve will not cause an RPT trip.

SUSQUEHANNA- UNIT 2 TS I B 3.3-81 (continued)

Revision O

Rev.2 EOC-RPT Instrumentation

BASES BACKGROUND (continued)

(2) The closing of two Turbine Stop Valves may or may not cause an RPT trip depending on which stop valves are B 3.3.4.1 closed.

(3) The closing of three. or more Turbine Stop Valves will always yield an RPT trip.

If either trip system actuates, both recirculation pumps will trip. There are two RPT breakers in series per recirculation pump. One trip system trips one of the two RPT breakers for each recirculation pump, and the second trip system trips the other RPT breaker for each recirculation pump.

APPLICABLE The TSV-Closure and the TCV Fast Closure, Trip Oil Pressure-Low SAFETY Functions are designed to trip the recirculati.on pumps in the event of a ANALYSES, LCO, turbine trip or generator load rejection to mitigate the neutron flux, heat and APPLICABILITY flux, and pressure transients, and to increase the margin to the MCPR SL. The analytical methods and assumptions used in evaluating the turbine trip and generator load rejection, as well as other safety analyses that take credit for EOC-RPT, are summarized in References 2 and 3.

To mitigate pressurization transient effects, the EOC-RPT must trip the recirculation pumps after initiation of closure movement of either the TSVs or the TCVs. The combined effects of this trip and a scram reduce fuel bundle power more rapidly than a scram alone, resulting in an increased margin to the MCPR SL. .Alternatively, MCPR limits for an inoperable EOC-RPT, as specified in the COLR, are sufficient to mitigate pressurization transient effects. The EOC-RPT function is automatically disabled when turbine first stage pressure is< 26% RTP.

EOC-RPT instrumentation satisfies Criterion 3 of the NRC Policy Statement. (Ref. 6)

The OPERABILITY of ~he EOC-RPT is dependent on the OPERABILITY of the individual instrumentation channel Functions.

Each Function must have a required number of OPERABLE channels in each trip system, with their setpoints within the specified Allowable Value of SR 3.3.4.1.2. The actual setpoint is calibrated consistent with applicable (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-82 Revision 1

Rev.2 EOC-RPT Instrumentation

BASES APPLICABLE setpoint methodology assumptions. Channel OPERABILITY also B 3.3.4.1 SAFETY includes the associated RPT breakers. Each channel (including the ANALYSES, LCO, associated RPT breakers) must also respond within its assumed and APPLICABILITY response time.

(continued)

Allowable Values are specified for each EOC-RPT Function specified in the LCO. Nominal trip setpoints are specified in the setpoint calculations. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit assumed in the transient and accident analysis in order to account for instrument uncertainties appropriate to the Function. Trip setpoints are those predetermined values of output at which an action should take place ..

The setpoints are compared to the actual process parameter (e.g.,

TSV position), and when the measured output value of the process parameter reaches the setpoint, the associated device changes state .

The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift).

The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

Alternatively, since this instrumentation protects against a MCPR SL violation, with the instrumentation inoperable, modifications to the MCPR limits (LCO 3.2.2) may be applied to allow this LCO to be met.

The MCPR penalty for the EOC-RPT inoperable condition is specified in the COLR.

The specific Applicable Safety Analysis, LCO, and Applicability discussions are listed below on a Function by Function basis.

SUSQUEHANNA - UNIT 2 TS I B 3.3-83 (continued)

Revision O

Rev.2 EOC-RPT Instrumentation

BASES APPLICABLE SAFETY Turbine Stop Valve-Closure B 3.3.4.1 ANALYSES, LCO, Closure of the TSVs and a main turbine trip result in the loss of a heat and APPLICABILITY sink that produces reactor pressure, neutron flux, and heat flux (continued) transients that must be limited. Therefore, an RPT is initiated on TSV-Closure in anticipation of the transients that would result from closure of these valves. EOC-RPT decreases reactor power and aids the reactor scram in ensuring that the MCPR SL is not exceeded during the worst case transient. Closure of the TSVs is determined by measuring the position of each valve. There are two separate position switches associated with each stop valve, the signal from each switch being assigned to a separate trip channel. The logic for the TSV-Closure Function is such that two or more TSVs must be closed to produce an EOC-RPT. This Function must be enabled at THERMAL POWER~ 26% RTP. This is accomplished automatically by pressure instruments sensing turbine first stage pressure. Because an increase in the main turbine bypass flow can affect this function nonconservatively (THERMAL POWER is derived from first stage pressure), the main turbine bypass valves must not cause the trip Functions to be bypassed when thermal power is ~ 26% RTP. Four channels of TSV-Closure, with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an EOC-RPT from this Function on a valid signal. The TSV-Closure Allowable Value is selected to detect imminent TSV closure.

This protection is required, consistent with the safety analysis assumptions, whenever THERMAL POWER is~ 26% RTP. Below 26% RTP, the Reactor Vessel Steam Dome Pressure-High and the Average Power Range Monitor (APRM) Fixed Neutron Flux-High Functions of the Reactor Protection System (RPS) are adequate to maintain the necessary safety margins.

Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Fast closure of the TCVs during a generator load rejection results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, an RPT is initiated on TCV Fast Closure, Trip Oil Pressure-Low in anticipation of the transients that would result from the closure of these valves. The EOC-RPT decreases reactor power and aids the

SUSQUEHANNA - UNIT 2 TS/ 8 3.3-84 (continued)

Revision 1

Rev.2 EOC-RPT Instrumentation

BASES APPLICABLE SAFETY Turbine Control Valve Fast Closure. Trip Oil Pressure-Low (continued)

B 3.3.4.1 ANALYSES, LCO, and APPLICABILITY reactor scram in ensuring that the MCPR SL is not exceeded during the worst case transient.

Fast closure of the TCVs is determined by measuring the electrohydraulic control fluid pressure at each control valve. There is one pressure instrument associated with each control valve, and the signal from each instrument is assigned to a separate trip channel.

The logic for the TCV Fast Closure, Trip Oil Pressure-Low Function is such that two or more TCVs must be closed (pressure instrument trips) to produce an EOC-RPT. This Function must be enabled at THERMAL POWER ~ 26% RTP. This is accomplished automatically by pressure instruments sensing turbine first stage pressure. Because an increase in the main turbine bypass flow can affect this function nonconservatively (THERMAL POWER is derived from first stage pressure) the main turbine bypass valves must not cause the trip Functions to be bypassed when thermal power is~ 26% RTP. Four channels of TCV Fast Closure, Trip Oil Pressure-Low, with two

channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an EOC-RPT from this Function on a valid signal. The TCV Fast Closure, Trip Oil Pressure-Low Allowable Value is selected high enough to detect imminent TCV fast closure.

This protection is required consistent with the safety analysis whenever THERMAL POWER is~ 26% RTP. 'Below 26% RTP, the Reactor Vessel Steam Dome Pressure-High and the APRM Fixed Neutron Flux-High Functions of the RPS are adequate to maintain the necessary safety margins.

ACTIONS A Note has been provided to modify the ACTIONS related to EOC-RPT instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-85 Revision 1

Rev.2 EOC-RPT Instrumentation

BASES ACTIONS (continued) inoperable EOC-RPT instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a B 3.3.4.1 Note has been provided that allows separate Condition entry for each inoperable EOC-RPT instrumentation channel.

A.1, A.2 and A.3 With one or more channels inoperable, but with EOC-RPT trip capability maintained (refer to Required Actions B.1 and B.2 Bases),

the EOC-RPT System is capable of performing the intended function.

However, the reliability and redundancy of the EOC-RPT instrumentation is reduced such that a single failure in the remaining trip system could result in the inability of the EOC-RPT System to perform the intended function. Therefore, only a limited time is allowed to restore compliance with the LCO. Because of the diversity of sensors available to provide trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of an EOC-RPT, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is provided to restore the inoperable channels (Required Action A.1). Alternately, the inoperable channels may be placed in trip (Required Action A.2) or Required Action A.3 MCPR Limits for inoperable EOC-RPT can be app.lied since these would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. As noted, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable breaker, since this may not adequately compensate for the inoperable breaker (e.g., the breaker may be inoperable such that it will not open). If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an RPT, or if the inoperable channel is the result of an inoperable breaker), Condition C must be entered and its Required Actions taken.

B.1 and B.2 Required Actions B.1 and B.2 are intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not maintaining EOC-RPT trip capability. A Function is considered to be maintaining EOC-RPT trip

SUSQUEHANNA - UNIT 2 TS I B 3.3-86 (continued)

Revision O

Rev.2 EOC-RPT Instrumentation

BASES ACTIONS B.1 and B.2 (continued)

B 3.3.4.1 capability when sufficient channels are OPERABLE or in trip, such that the EOC-RPT System will generate a trip signal from the given

Function on a valid signal and both recirculation pumps can be tripped.

This requires two channels of the Function in the same trip system, to each be OPERABLE or in trip, and the associated RPT breakers to be OPERABLE or in trip. Alternately, Required Action 8.2 requires the MCPR limit for inoperable EOC-RPT, as specified in the COLR, to be applied. This also restores the margin to MCPR assumed in the safety analysis.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is sufficient time for the operator to take corrective action, and takes into account the likelihood of an event requiring actuation of the EOC-RPT instrumentation during this period.

It is also consistent with the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time provided in LCO 3.2.2 for Required Action A.1, since this instrumentation's purpose is to preclude a MCPR violation.

C.1 and C.2 With any Required Action and associated Completion Time not met, THERMAL POWER must be reduced to < 26% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

Alternately, the associated recirculation pump may be removed from service, since this performs the intended function of the instrumentation. The allowed Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable, based on operating experience, to reduce THERMAL POWER to < 26% RTP from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE The Surveillances are modified by a Note to indicate that when a REQUIREMENTS channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains EOC-RPT trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 4) assumption of the average (continued)

SUSQUEHANNA- UNIT 2 TS I B 3.3-87 Revision 1

Rev.2 EOC-RPT Instrumentation

BASES SURVEILLANCE REQUIREMENTS time required to perform channel Surveillance. That analysis B 3.3.4.1 demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly (continued) reduce the probability that the recirculation pumps will trip when necessary.

SR 3.3.4.1.1 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

This SR is modified by a Note that provides a general exception to the definition of CHANNEL FUNCTIONAL TEST. This exception is necessary because the design of instrumentation does not facilitate .

functional testing of all required contacts of the relay which input into the combinational logic. (Reference 7) Performance of such a test could result in a plant transient or place the plant in an undo risk situation. Therefore, for this SR, the CHANNEL FUNCTIONAL TEST verifies acceptable response by verifying the change of state of the

- relay which inputs into the combinational logic. The required contacts not tested during the CHANNEL FUNCTIONAL TEST are tested under the LOGIC SYSTEM FUNCTIONAL TEST, SR 3.3.4.1.3. This is acceptable because operating experience shows that the contacts not tested during the CHANNEL FUNCTIONAL TEST normally pass the LOGIC SYSTEM FUNCTIONAL TEST, and the testing methodology minimizes the risk of unplanned transients.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.1.2 CHANNEL CALIBRATION verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-88 Revision 1

Rev.2 EOC-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE SR 3.3.4.1.2 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.1.3 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers is included as a part of this test, overlapping the LOGIC SYSTEM FUNCTIONAL TEST, to provide complete testing of the associated safety function. Therefore, if a breaker is incapable of operating, *the associated instrument channel(s) would also be inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SR 3.3.4.1.4' This SR ensures that an EOC-RPT initiated from the TSV-Closure and TCV Fast Closure, Trip Oil Pressure-Low Functions will not be*

inadvertently bypassed when THERMAL POWER is 2:: 26% RTP. This is performed by a Functional check that ensures the EOC-RPT Function is not bypassed. Because increasing the main turbine bypass flow can affect this function nonconservatively (THERMAL POWER is derived from first stage pressure) the main turbine bypass valves must not cause the trip Functions to be bypassed when thermal power is;:::: 26% RTP. If any functions are bypassed at 2:: 26% RTP, either due to open main turbine bypass valves or other reasons, the affected TSV-Closure and TCV Fast Closure, Trip Oil Pressure-Low Functions are considered inoperable. Alternatively, the bypass channel can be placed (continued)

SUSQUEHANNA - UNIT 2 TS I 8 3.3-89 Revision 2

Rev. 2 EOC-RPT Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.4.1.4 (continued)

B 3.3.4.1 in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met with the channel considered OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.1.5 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The EOC-RPT SYSTEM RESPONSE TIME acceptance criteria are included in Reference 5.

A Note to the Surveillance states that breaker interruption time may be assumed from the most recent performance of SR 3.3.4.1.6. This is allowed since the time to open the contacts after energization of the trip coil and the arc suppression time are short and do not appreciably

change, due to the design of the breaker opening device and the fact that the breaker is not routinely cycled.

Response times cannot be determined at power because operation of final actuated devices is required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-90* Revision 1

Rev.2 EOC-RPT Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.4.1.6 B 3.3.4.1 (continued) This SR ensures that the RPT breaker interruption time (arc suppression time plus time to open the contacts) is provided to the EOC-RPT SYSTEM RESPONSE TIME test. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Figure 7.2-1-4 (EOC-RPT logic diagram).

2. FSAR, Sections 15.2 and 15.3.

3. FSAR, Sections 7.1 and 7.6.

4. GENE-770-06-1, "Bases For Changes To Surveillance Test Intervals And Allowed Out-Of-Service Times For Selected Instrumentation Technical Specifications," February 1991.

5. FSAR Table 7.6-10 .

6.

7.

Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 32193).

NRG Inspection and Enforcement Manual, Part 9900: Technical Guidanc;:e, Standard Technical Specification Section 1.0 Definitions, Issue date 12/08/86. *

SUSQUEHANNA - UNIT 2 TS I B 3.3-91 Revision 1

Rev. 1 ATWS-RPT Instrumentation

B 3.3 INSTRUMENTATION B 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation B 3.3.4.2 BASES BACKGROUND The A TWS-RPT System initiates an RPT, adding negative reactivity, following events in which a scram does not (but should) occur, to lessen the effects of an A TWS event. Tripping the recirculation pumps adds negative reactivity from the increase in steam voiding in the core area as core flow decreases. When Reactor Vessel Water Level--Low Low, Level 2 or Reactor Steam Dome Pressure--High setpoint is reached, the Recirculation Pump Trip (RPT) breakers trip.

The ATWS-RPT System includes sensors, relays, bypass capability, circuit breakers, and switches that are necessary to cause initiation of an RPT. When the setpoint is reached, the channel sensor actuates, which then outputs an A TWS-RPT signal to the trip logic.

The A TWS-RPT consists of two independent trip systems, with two channels of Reactor Steam Dome Pressure--High and two channels of Reactor Vessel Water Level--Low Low, Level 2 in each trip system.

Each ATWS-RPT trip system is a two-out-of-two logic for each Function. Thus, either two Reactor Water Level--Low Low, Level 2 or two Reactor Pressure--High signals are needed to trip a trip system.

The outputs of the channels in a trip system are combined in a logic so that either trip system will trip both recirculation pumps (by tripping the respective RPT breakers).

There are two RPT breakers in series provided for each of the two recirculation pumps for a total of four breakers. One trip system trips one of the two breakers for each recirculation pump, and the second trip system trips the other breaker for each recirculation pump.

APPLICABLE The A TWS-RPT is credited in the ASME Overpressure Safety SAFETY Analyses. The A TWS-RPT initiates an RPT to aid in preserving the ANALYSES, LCO integrity of the fuel cladding following events in which a scram does and, APPLICABILITY not, but should, occur. Based on its contribution to the reduction of overall plant risk, the instrumentation is included as required by the NRC Policy Statement. (Ref. 3)

SUSQUEHANNA - UNIT 2 TS I B 3.3-92 (continued)

Revision 1

Rev. 1 A TWS-RPT Instrumentation

BASES APPLICABLE SAFETY ANALYSES The OPERABILITY of the ATWS-RPT is dependent on the OPERABILITY of the individual instrumentation channel Functions.

B 3.3.4.2 LCO, and Each Function must have a required number of OPERABLE channels APPLICABILITY in each trip system, with their setpoints within the specified Allowable (continued) Value of SR 3.3.4.2.3 or SR 3.3.4.2.4. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Channel OPERABILITY also includes the associated RPT breakers. In the event one RPT breaker is inoperable for tripping, the two channels of Reactor Vessel Water Level--Low Low, Level 2 and the two channels of Reactor Steam Dome Pressure--High that are associated with that RPT breaker, are considered inoperable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.

Allowable Values are specified for each ATWS-RPT Function specified in the LCO. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter reaches the setpoint, the associated device changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10CFR 50.49) are accounted for.

The individual Functions are required to be OPERABLE in MODE 1 to protect against common mode failures of the Reactor Protection System by providing a diverse trip to mitigate the consequences of a postulated A TWS event. The Reactor Steam Dome Pressure--High and Reactor Vessel Water Level--Low Low, Level 2 Functions are required to be

SUSQUEHANNA - UNIT 2 TS I B 3.3-93 (continued)

Revision 1

Rev. 1 A TWS-RPT Instrumentation

BASES APPLICABLE SAFETY OPERABLE in MODE 1, since the reactor is producing significant B 3.3.4.2 power and the recirculation system could be at high flow. During this ANALYSES, LCO, MODE, the potential exists for pressure increases or low water level, and APPLICABILITY assuming an A TWS event. In MODE 2, the reactor is at low power (continued) and the recirculation system is at low flow; thus, the potential is low for a pressure increase or low water level, assuming an A TWS event.

Therefore, the ATWS-RPT is not necessary. In MODES 3 and 4, the reactor is shut down with all control rods inserted; thus, an A TWS event is not significant and the possibility of a significant pressure increase or low water level is negligible. In MODE 5, the one rod out interlock ensures that the reactor remains subcritical; thus, an A TWS event is not significant. In addition, the reactor pressure vessel (RPV) head is not fully tensioned and no pressure transient threat to the reactor coolant press*ure boundary (RCPB) exists.

The specific Applicable Safety Analyses and LCO discussions are listed below on a Function by Function basis.

a. Reactor Vessel Water Level--Low Low, Level 2 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the A TWS-RPT System is .

initiated at Level 2 to aid in maintaining level above the top of the active fuel. The reduction of core flow reduces the neutron flux and THERMAL POWER and, therefore, the rate of coolant boil off.

Reactor vessel water level signals are initiated from four level instruments that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Reactor Vessel Water Level-Low Low, Level 2, with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure can preclude an ATWS-RPT from this Furiction on a valid signal. The Reactor Vessel Water Level--Low Low, Level 2 Allowable Value is chosen so that the system will not be initiated after a Level 3 scram with feedwater still available, and for convenience with the reactor core isolation cooling high pressure coolant injection initiation.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-94 Revision 1

Rev.1 A TWS-RPT Instrumentation

BASES APPLICABLE SAFETY

b. Reactor Steam Dome Pressure--High 83.3.4.2 ANALYSES, LCO, and Excessively high RPV pressure may rupture the RCPB. An APPLICABILITY increase in the RPV pressure during reactor operation (continued) compresses the steam voids and results in a positive reactivity insertion. This increases neutron flux and THERMAL POWER, which could potentially result in fuel failure and overpressurization. The Reactor Steam Dome Pressure-High Function initiates an RPT for transients that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power generation. For the overpressurization event, the RPT aids in the termination of the A TWS event and, along with the safety/relief valves, limits the peak RPV pressure to less than the ASME Section Ill Code Service Level C limits (1500 psig).

The Reactor Steam Dome Pressure-High signals are initiated from four pressure instruments that monitor reactor steam dome pressure. Four channels of Reactor Steam Dome Pressure-High, with two channels in each trip system, are available and are required to be OPERABLE to ensure that no single instrument failure can preclude an A TWS-RPT from this Function on a valid signal. The Reactor Steam Dome Pressure-High Allowable Value is chosen to provide an adequate margin to the ASME Section Ill Code Service Level C allowable Reactor Coolant System pressure.

ACTIONS A Note has been provided to modify the ACTIONS related to A TWS-RPT instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3* also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable ATWS-RPT instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable A TWS-RPT instrumentation channel.

SUSQUEHANNA - UNIT 2 TS I B 3.3-95 (continued)

Revision 1

Rev. 1 A TWS-RPT Instrumentation

BASES ACTIONS (continued)

A.1 and A.2 B 3.3.4.2 With one or more channels inoperable, but with ATWS-RPT capability for each Function maintained (refer to Required Action 8.1 Bases), the ATWS-RPT System is capable of performing the intended function.

However, the reliability and redundancy of the A TWS-RPT instrumentation is reduced, such that a single failure in the remaining trip system could result in the inability of the A TWS-RPT System to perform the intended function. Therefore, only a limited time is allowed to restore the inoperable channels to OPERABLE status. Because of the diversity of sensors available to provide trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of ATWS-RPT, 14 days is provided to restore the inoperable channel (Required Action A.1). Alternately, the inoperable channel may be placed in trip (Required Action A.2), since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. As noted, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable breaker, since this may not adequately compensate for the inoperable breaker (e.g., the breaker may be inoperable such that it will not open). If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an RPT), or if the inoperable channel is the result of an inoperable breaker, on expiration of the 14 day Completion Time Condition D must be entered and its Required Actions taken.

Required Action 8.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not maintaining A TWS-RPT trip c capability. A Function is considered to be maintaining A TWS-RPT trip capability when sufficient channels are OPERABLE or in trip such that the A TWS-RPT System will generate a trip signal from the given Function on a valid signal, and both recirculation pumps can be tripped. This requires two channels of the Function in the same trip system to each be OPERABLE or in trip, and the RPT breakers associated with that trip system (one for each operating recirculation pump) to be OPERABLE or in trip .

SUSQUEHANNA - UNIT 2 TS I B 3.3-96 (continued)

Revision 1

Rev. 1 A TWS-RPT Instrumentation B 3.3.4.2 BASES ACTIONS 8.1 (continued)

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is sufficient for the operator to take corrective action (e.g., restoration or tripping of channels) and takes into account the likelihood of an event requiring actuation of the A TWS-RPT instrumentation during this period and that one Function is still maintaining A TWS-RPT trip capability.

Required Action C.1 is intended to ensure that appropriate Actions are taken if multiple, inoperable, untripped channels within both Functions result in both Functions not maintaining A TWS-RPT trip capability.

The description of a Function maintaining A TWS-RPT trip capability is discussed in the Bases for Required Action 8.1 above.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is sufficient for the operator to take corrective action and takes into account the likelihood of an event requiring actuation of the A TWS-RPT instrumentation during this period .

D.1 and D.2 With any Required Action and associated Completion Time not met, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (Required Action 0.2).

Alternately, the associated recirculation pump may be removed from service since this performs the intended function of the instrumentation (Required Action D.1). The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, both to reach MODE 2 from full power conditions and to remove a recirculation pump from service in an orderly manner and without challenging plant systems .

SUSQUEHANNA- UNIT 2 TS I B 3.3-97 (continued)

Revision 1

Rev. 1 A TWS-RPT Instrumentation

BASES SURVEILLANCE REQUIREMENTS The Surveillances are modified by a Note to indicate that when a B 3.3.4.2 channel is placed in an inoperable status solely for performance of required Surveillances, entry into the associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains A TWS-RPT trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 2) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the recirculation pumps will trip when necessary.

SR 3.3.4.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria which are determined by the plant staff based on an investigation of a combination of the channel instrument uncertainties may be used to support this parameter comparison and include indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit, and does not necessarily indicate the channel is inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the required channels of this LCO.

I (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-98 Revision 2

Rev. 1 A TWS-RPT Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.4.2.2 B 3.3.4.2 (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

This SR is modified by a Note that provides a general exception to the definition of CHANNEL FUNCTIONAL TEST. This exception is necessary because the design of instrumentation does not facilitate functional testing of all required contacts of the relay which input into the combinational logic. (Reference 4) Performance of such a test could result in a plant transient or place the plant in an undo risk situation. Therefore, for this SR, the CHANNEL FUNCTIONAL TEST verifies acceptable response by verifying the change of state of the relay which inputs into the combinational logic. The required contacts not tested during the CHANNEL FUNCTIONAL TEST are tested under the LOGIC SYSTEM FUNCTIONAL TEST, SR 3.3.4.2.5. This is acceptable because operating experience shows that the contacts not tested during the CHANNEL FUNCTIONAL TEST normally pass the LOGIC SYSTEM FUNCTIONAL TEST, and the testing methodology minimizes the risk of unplanned transients .

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.2.3 and SR 3.3.4.2.4 A CHANNEL CALIBRATION verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-99 Revision 2

Rev. 1 A TWS-RPT Instrumentation

BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.4.2.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrate*s the B 3.3.4.2 OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump RPT breakers is included as part of this Surveillance and overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the assumed safety function.

Therefore, if a breaker is incapable of operating, the associated instrument channel(s) (two channels of Reactor Vessel Water Level--

Low Low, Level 2 and two channels of Reactor Steam Dome Pressure-

-High) would be inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

I REFERENCES 1. GENE-637, 024, -0893, Evaluation of SSES A TWS Performance for Power Uprate Conditions, Sept 1993.

2. NEDE-770-06-1, "Bases for Changes To Surveillance Test

- 3.

Intervals and Allowed Out-of-Service Times For Selected Instrumentation Technical Specifications," February 1991.

Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 32193)

4. NRC Inspection and Enforcement Manual, Part 9900: Technical Guidance, Stcindard Technical Specification Section 1.0 Definitions, Issue date 12/08/86.

SUSQUEHANNA - UNIT 2 TS I B 3.3-100 Revision 2

Rev.6 ECCS Instrumentation B 3.3.5.1 B 3.3 INSTRUMENTATION B 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation BASES BACKGROUND The purpose of the ECCS instrumentation is to initiate appropriate responses from the systems to ensure that the fuel is adequately cooled in the event of a design basis accident or transient.

For most anticipated operational occurrences and Design Basis Accidents (DBAs), a wide range of dependent and independent parameters are monitored.

The ECCS instrumentation actuates core spray (CS), low pressure coolant injection (LPCI), high pressure coolant injection (HPCI),

Automatic Depressurizatiori System (ADS), the diesel generators (DGs) and other features described in the DG background. The equipment involved with each of these systems with exception of the DGs and other features, is described in the Bases for LCO 3.5. 1, "EGGS-Operating."

Core Spray System The CS System may be initiated by either automatic or manual means.

Automatic initiation occurs for conditions of Reactor Vessel Water Level Low, Low, Low, Level 1 or Drywell Pressure - High concurrent with Reactor Pressure - Low. Each of these diverse variables is monitored by four redundant instruments. The initiation logic for one CS loop is arranged in a one-out-of-two-twice network using level and pressure instruments which will generate a signal wnen:

(1) both level sensors are tripped, or (2) two high drywell pressure sensors and two low reactor vessel pressure sensors are tripped, or (3) a combination of one channel of level sensor and one of the other channels of high drywell pressure sensor together with its associated low reactor vessel pressure sensor (i.e.,

Channel A level sensor and Channel C high drywell pressure' sensor and low reactor vessel pressure sensor).

(continued)

SUSQUEHANNA- UNIT 2 TS I B 3.3-101 Revision 1

Rev. 6 ECCS Instrumentation

BASES BACKGROUND Core Spray System (continued)

B 3.3.5.1 Once an initiation signal is received by the CS control circuitry, the signal is sealed in until manually reset. The logic can also be initiated by use of a manual push button (one push button per subsystem).

Upon receipt of an initiation signal, the CS pumps are started 15 seconds after initiation signal if normal offsite power is available and 10.5 seconds after diesel generator power is available.

The CS test line isolation valve, which is also a primary containment isolation valve (PCIV), is closed on a CS initiation signal to allow full system flow assumed in the accident analyses and maintain primary containment isolated. The CS System also monitors the pressure in the reactor to ensure that, before the injection valves open, the reactor pressure has fallen to a value below the CS System's maximum design pressure. The variable is monitored by four redundant instruments.

The instrument outputs are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

Low Pressure Coolant Injection System

The LPCI is an operating mode of the Residual Heat Removal (RHR)

System, with two LPCI subsystems. The LPCI subsystems may be initiated by automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level Low, Low, Low, Level 1 or Drywell Pressure - High concurrent with Reactor Pressure - Low. Each of these diverse variables is monitored by four instruments in two divisions. Each division is arranged in a one-out-of-two-twice network using level and pressure instruments which will generate a signal when:

(1) both level sensors are tripped, or (2) two high drywall pressure sensors and two low reactor vessel pressure sensors are tripped, or (3) a combination of one channel of level sensor and one of the other channel of high drywell pressure sensor together with its associated low reactor vessel pressure sensor (i.e., Channel A level sensor and Channel C high drywall and low reactor vessel pressure sensor).

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-102 Revision 1

Rev. 6 ECCS Instrumentation

BASES BACKGROUND Low Pressure Coolant Injection System (continued)

B 3.3.5.1 The initiation logic is cross connected between divisions (i.e., either start signal will start all four pumps and open both loop's injection valves). Once an initiation signal is received by the LPCI control circuitry, the signal is sealed in until manually reset. The cross division start signals for the pumps affect both the opposite division's start logic and the pump's 4KV breaker start logic. The cross division start signal to the opposite division's start logic is for improved reliability. The cross division start signals to the pump's 4KV breaker start logic is needed to ensure specific control power failures do not prevent the start of an adequate number of LPCI pumps.

Upon receipt of an initiation signal, all LPCI pumps start after a 3 second time delay when normal AC power is lost and standby diesel generator power is available. If normal power is available, LPCI pumps A and B will start immediately and pumps C and D will start 7.0 seconds after initiation signal to limit loading of the offsite sources.

The RHR test line and spray line are also isolated on a LPCI initiation

signal to allow the full system flow assumed in the accident analyses and for those valves which are also PCIVs maintain primary containment isolated.

The LPCI System monitors the pressure in the reactor to ensure that, before an injection valve opens, the reactor pressure has fallen to a value below the LPCI System's maximum design pressure. The variable is monitored by four redundant instruments. The instrument outputs are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

Logic is provided to close the recirculation pump discharge valves to ensure that LPCI flow does not bypass the core when it injects into the recirculation lines. The logic consists of an initiation signal (Low reactor water level and high drywell pressure in a one out of two taken twice logic) from both divisions of LPCI instruments and a pressure permissive. The pressure variable is monitored by four redundant instruments. The instrument outputs are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

(continued)

SUSQUEHANNA - UNIT 2 TS I 8 3.3-103 Revision 1

Rev.6 ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND High Pressure Coolant Injection System (continued)

The HPCI System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low, Level 2 or Drywell Pressure-High. Each of these variables is monitored by four redundant instruments. The instrument outputs are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic for each Function.

The HPCI System also monitors the water level in the condensate storage tank (CST). HPCI suction is normally maintained on the CST until it transfers to the suppression pool on low CST level or is manually transferred by the operator. Reactor grade water in the CST is the normal source. Upon receipt of a HPCI initiation signal, the CST suction valve is automatically signaled to open (it is normally in the open position) unless the suppression pool suction valve is open. If the water level in the CST falls to the level switch process setpoint value, an automatic suction transfer is initiated. The suppression pool suction valve receives a signal to open and in parallel, the CST suction valve receives a signal to close to complete the transfer. Two level

switches are used to detect low water level in the CST. Either switch can cause the suppression pool suction valve to open and the CST suction valve to close.

The HPCI provides makeup water to the reactor until the reactor vessel water level reaches the Reactor Vessel Water Level-High, Level 8 trip, at which time the HPCI turbine trips, which causes the turbine's stop valve, minimum flow valve, the cooling water isolation valve, and the injection valve to close. The logic is two-out-of-two to provide high reliability of the HPCI System. The HPCI System automatically restarts

if a Reactor Vessel Water Level-Low Low, Level 2 signal is subsequently received.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-104 Revision 3

Rev. 6 ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Automatic Depressurization System (continued)

The ADS may be initiated by either automatic or manual means.

Automatic initiation occurs when signals indicating Reactor Vessel Water Level-Low Low Low, Level 1; Drywell Pressure-High or AOS Drywell Bypass Actuation Timer; confirmed Reactor Vessel Water Level-Low, Level 3; and CS or LPCI Pump Discharge Pressure-High are all present and the ADS Initiation Timer has timed out. There are two instruments each for Reactor Vessel Water Level-Low Low Low, Level 1 and Drywall Pressure-High, and one instrument for confirmed Reactor Vessel Water Level-Low, Level 3 in each of the two ADS trip systems. Each of these instruments drives a relay whose contacts form the initiation logic.

Each ADS trip system includes a time delay between satisfying the initiation logic and the actuation of the ADS valves. The ADS Initiation Timer time delay setpoint is chosen to be long enough that the HPCI system has sufficient operating time to recover to a level above Level 1, yet not so long that the LPCI and CS Systems are unable to adequately cool the fuel if the HPCI fails to maintain that level. An alarm in the control room is annunciated when either of the timers is timing. Resetting the ADS initiation signals resets the ADS Initiation Timers. The ADS also monitors the discharge pressures of the four LPCI pumps and the four CS pumps. Each ADS trip system includes two discharge pressure permissive instruments from both CS pumps in the division and from either of the two LPCI pumps in the associated Division (i.e., Division 1 LPCI pumps A or C input to ADS trip system A, and Division 2 LPCI pumps B or D input to ADS trip system B). The signals are used as a permissive for ADS actuation, indicating that there is a source of core coolant available once the ADS has depressurized the vessel. With both CS pumps in a division or one of the LPCI pumps operating sufficient flow is available to permit automatic depressurization.

The ADS logic in each trip system is arranged in two strings. Each string has a contact from each of the following variables: Reactor Vessel Water Level-Low Low Low, Level 1; Drywell Pressure-High; or Drywell Pressure Bypass Actuation Timer. One of the two strings in each trip system must also have a confirmed Reactor Vessel Water Level-Low, Level 3. All contacts in both logic strings must close, the ADS initiation timer must time out, and a (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-105 Revision 1

Rev.6 ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Automatic Depressurization System (continued) loop of CS or LPCI pump discharge pressure signal must be present to initiate an ADS trip system. Either the A or B trip system will Cquse all the ADS relief valves to open. Once the Drywell Pressure-High signal, the ADS Drywall Pressure Bypass Actuation Timer, or the ADS initiation signal is present, it is individually sealed in until manually reset.

Manual inhibit switches are provided in the control room for the ADS; however, their function is not required for ADS OPERABILITY (provided ADS is not inhibited when required to be OPERABLE).

Diesel Generators and Other Initiated Features The DGs may be initiated by either automatic or manual means.

Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low Low, Level 1 or Drywell Pressure-High. The DGs are also initiated upon loss of voltage signals (Refer to the Bases for LCO 3.3.8.1, "Loss of Power (LOP) Instrumentation," for a discussion of these signals.) The initiation logic is arranged in a one-out-of-two-twice network using level and pressure instruments which will generate a signal when:

(1) both level sensors are tripped, or (2) both high drywell pressure sensors are tripped, or (3) a combination of one level sensor and one high drywell pressure sensor is tripped.

DGs A and B receive their initiation signal from CS system initiation logic Division I and Division II respectively. DGs C and D receive their initiation signals from either LPCI systems initiation logic Division I or Division II. The DGs can also be started manually from the control room and locally from the associated DG room. The DG initiation signal is a sealed in signal and must be manually reset. The DG initiation logic is reset by resetting the associated ECCS initiation logic.

Upon receipt of a loss of coolant accident (LOCA) initiation signal, each DG is automatically (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-106 Revision 1

Rev. 6 ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Diesel Generators and Other Initiated Features (continued) started, is ready to load in approximately 10 seconds, and will run in standby conditions (rated voltage and speed, with the DG output breaker open). The DGs will only energize their respective Engineered Safety Feature buses if a loss of offsite power occurs. (Refer to Bases for LCO 3.3.8.1.).

In addition to DG initiation, the ECCS instrumentation initiates other design features. Signals from the CS System logic initiate (1) the reset of two Emergency Service Water (ESW) timers, (2) the reset of the degraded grid timers for the 4kV buses on both units, (3) LOCA load shed schemes, and (4) the trip of Drywell Cooling equipment. Signals from the LPCI System logic initiate (1) the reset of two Emergency Service Water (ESW) timers, (2) the trip of turbine building chillers, and (3) the trip of reactor building chillers. The ESW pump timer reset feature assures the ESW pumps do not start concurrently with the CS or LPCI pumps. If one or both ESW pump timer resets in a division or reactor building/turbine building chiller trips are inoperable; two offsite circuits with the 4kV buses aligned to their normal configuration are

required to be OPERABLE. If one or both ESW pump timer resets in a division or reactor building/turbine building chiller trips are inoperable; the effects on one offsite circuit have not been analyzed; and therefore, the offsite circuit is assumed not to be capable of accepting the required loads during certain accident events. The ESW pump timer reset is not required in MODES 4 and 5 because concurrent pump starts, on a LOCA signal, of the ESW pumps (initiated by the DG start circuitry) with CS or LPCI pumps cannot occur in these MODES.

APPLICABLE The actions of the ECCS are explicitly assumed in the safety analyses SAFETY of References 1 and 2. The ECCS is initiated to preserve the integrity ANALYSES, LCO, of the fuel cladding by limiting the post LOCA peak cladding and APPLICABILITY temperature to less than the 10 CFR 50.46 limits.

(continued)

SUSQUEHANNA- UNIT 2 TS I B 3.3-107 Revision 2

Rev. 6 ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE ECCS instrumentation satisfies Criterion 3 of the NRC Policy SAFETY Statement (Ref. 4). Certain instrumentation Functions are retained for ANALYSES, LCO, other reasons and are described below in the individual Functions and APPLICABILITY discussion.

(continued)

The OPERABILITY of the ECCS instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Each ECCS subsystem must also respond within its assumed response time. Table 3.3.5.1-1, footnotes (b) and (c), are added to show that certain ECCS instrumentation Functions are also required to be OPERABLE to perform DG initiation and actuation of other Technical Specifications (TS) function.

Allowable Values are specified for each ECCS Function specified in the table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the

setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.

A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter reaches the setpoint, the associated device changes state.

The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined, accounting for the remaining instrument errors (e.g., drift).

The trip setpoints derived in this manner (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-108 Revision 1

Rev.6 ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE provide adequate protection because instrumentation uncertainties, SAFETY ANALYSES process effects, calibration tolerances, instrument drift, and severe LCO, and environment errors (for channels that must function in harsh APPLICABILITY environments as defined by 10 CFR 50.49) are accounted for.

(continued)

An exception to the methodology described to derive the Allowable Value is the methodology used to determine the Allowable Values for the ECCS pump start time delays and HPCI CST Level 1 - Low.

These Allowable Values are based on system calculations and/or engineering judgement which establishes a conservative limit at which the function should occur.

In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions that may require ECCS (or DG) initiation to mitigate the consequences of a design basis transient or accident. To ensure reliable ECCS and DG function, a combination of Functions is required to provide primary and secondary initiation signals. The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis .

Core Spray and Low Pressure Coolant Injection Systems 1.a. 2.a. Reactor Vessel Water Level-Low Low Low, Level 1 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. The low pressure ECCS and associated DGs are initiated at Level 1 to ensure that core spray and flooding functions are available to prevent or minimize fuel damage. The Reactor Vessel Water Level-Low Low Low, Level 1 is one of the Functions assumed to be OPERABLE and capable of initiating the ECCS during the transients analyzed in References 2. In addition, the Reactor Vessel Water Level-Low Low Low, Level 1 Function is directly assumed in the analysis of the recirculation line break (Ref. 1). The core cooling function of the ECCS, along with the scram action of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. '

(continued)

SUSQUEHANNA- UNIT 2 TS I B 3.3-109 Revision 2

Rev.6 ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.a. 2.a. Reactor Vessel Water Level-Low Low Low. Level 1 SAFETY (continued)

ANALYSES, LCO, and APPLICABILITY Reactor Vessel Water Level-Low Low Low, Level 1 signals are initiated from four level instruments that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to allow time for the low pressure core flooding systems to activate and provide adequate cooling.

The initiation logic for LPCI pumps and injection valves is cross connected such that either division's start signal will start all four pumps and open both loop's injection valves. This cross division logic is required in MODES 1, 2, and 3. In MODES 4 and 5, redundancy in the initiation circuitry is not required. Therefore, in MODES 4 and 5 for LPCI, only one division of initiation logic is required.

DGs C and D which are initiated from the LPCI LOCA initiation are cross connected such that both DGs receive an initiation signal from both Divisions of the LPCI LOCA initiation circuitry. This cross connected logic is only required in MODES 1, 2, and 3. In MODES 4 and 5, redundancy in the DG initiation circuitry is not required.

Therefore, in MODES 4 and 5 for DGs C and D only one division of EGGS initiation logic is required.

Four channels of Reactor Vessel Water Level-Low Low Low, Level 1 Function are only required to be OPERABLE when the EGGS or DG(s) are required to be OPERABLE to ensure that no single instrument failure can preclude EGGS and DG initiation. Refer to LCO 3.5.1 and LCO 3.5.2, "EGGS-Shutdown," for Applicability Bases for the low pressure EGGS subsystems; LCO 3.8.1, "AC Sources-Operating"; and LCO 3.8.2, "AC Sources-Shutdown," for Applicability Bases for the DGs.

(continued)

SUSQUEHANNA- UNIT 2 TS I B 3.3-110 Revision 1

Rev. 6 ECCS Instrumentation

BASES APPLICABLE SAFETY 1.b. 2.b. Drvwell Pressure-High B 3.3.5.1 ANALYSES, LCO, and High pressure in the drywell could indicate a break in the reactor APPLICABILITY coolant pressure boundary (RCPB). The low pressure ECCS (continued) (provided a concurrent low reactor pressure signal is present) and associated DGs, without a concurrent low reactor pressure signal, are initiated upon receipt of the Drywall Pressure-High Function in order to minimize the possibility of fuel damage. The Drywell Pressure-High Function, along with the Reactor Water Level-Low Low Low, Level 1 Function, is directly assumed in the analysis of the recirculation line break (Ref. 1). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

High drywell pressure signals are initiated from four pressure instruments that sense drywell pressure. The Allowable Value was selected to be as low as practical and be indicative of a LOCA inside primary containment The Drywell Pressure-High Function is required to be OPERABLE when the ECCS or DG is required to be OPERABLE

in conjunction with times when the primary containment is required to be OPERABLE. Thus, four channels of the CS and LPCI Drywell Pressure-High Function are required to be OPERABLE in MODES 1, 2, and 3 to ensure that no single instrument failure can preclude ECCS and DG initiation. In MODES 4 and 5, the Drywell Pressure-High Function is not required, since there is insufficient energy in the reactor to pressurize the primary containment to Drywell Pressure-High setpoint Refer to LCO 3.5.1 for Applicability Bases for the low pressure ECCS subsystems and to LCO 3.8.1 for Applicability Bases for the DGs.

1.c. 1.d, 2.c. 2.d Reactor Steam Dome Pressure-Low Low reactor steam dome pressure signals are used as permissives for the low pressure ECCS subsystems. The low reactor pressure permissive is provided to prevent a high drywell pressure condition which is not accompanied by low reactor pressure, i.e. a false LOCA signal, from disabling two RHR pumps on the other unit. The low reactor steam dome pressure permissive also ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these

SUSQUEHANNA - UNIT 2 TS I B 3.3-111 (continued)

Revision 1

Rev. 6 ECCS Instrumentation

B 3.3.5.1 BASES APPLICABLE 1.c, 1.d, 2.c. 2.d Reactor Steam Dome Pressure-Low SAFETY (continued)

ANALYSES, LCO, and APPLICABILITY subsystems' maximum design pressure. The Reactor Steam Dome Pressure-Low is one of the Functions assumed to be OPERABLE and capable of permitting initiation of the ECCS during the transients analyzed in Reference 2. In addition, the Reactor Steam Dome Pressure-Low Function is directly assumed in the analysis of the recirculation line break (Ref. 1). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

The Reactor Steam Dome Pressure-Low signals are initiated from four pressure instruments that sense the reactor dome pressure.

The pressure instruments are set to actuate between the Upper and Lower Allowable Values on decreasing reactor dome pressure.

The Upper Allowable Value is low enough to ensure that the reactor

dome pressure has fallen to a value below the Core Spray and RHR/LPCI maximum design pressures to preclude overpressurization.

The Lower Allowable Value is high enough to ensure that the ECCS injection prevents the fuel peak cladding temperature from exceeding the limits of 10 CFR 50.46.

DGs C and D which are initiated from the LPCI LOCA initiation are cross connected such that both DGs receive an initiation signal from both Divisions of the LPCI LOCA initiation circuitry. This cross connected logic is only required in MODES 1, 2, and 3. In MODES 4 and 5, redundancy in the DG initiation circuitry is not required.

Therefore, in MODES 4 and 5 for DGs C and D only one division of ECCS initiation logic is required.

Four channels of Reactor Steam Dome Pressure-Low Function are required to be OPERABLE only when the ECCS is required to be OPERABLE to ensure that no single instrument failure can preclude ECCS initiation. Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the low pressure ECCS subsystems.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-112 Revision 1

Rev.6 ECCS Instrumentation

BASES APPLICABLE SAFETY ANALYSES 1.e. 2.f. Manual Initiation B 3.3.5.1 LCO, and The Manual Initiation push button channels introduce signals into the APPLICABILITY appropriate ECCS logic to provide manual initiation capability and are (continued). redundant to the automatic protective instrumentation. There is one push button for each of the CS and LPCI subsystems (i.e., two for CS and two for LPCI).

The Manual Initiation Function is not assumed in any accident or transient analyses in the FSAR. However, the Function is retained for overall redundancy and diversity of the low pressure ECCS function as required by the NRC in the plant licensing basis.

There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons. Each channel of the Manual Initiation Function (one channel per subsystem) is required to be OPERABLE only when the associated ECCS is required to be OPERABLE. Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the low pressure ECCS subsystems .

2.e. Reactor Steam Dome Pressure-Low (Recirculation Discharge Valve Permissive)

Low reactor steam dome pressure signals are used as permissives for recirculation discharge and bypass valves closure. This ensures that the LPCI subsystems inject into the proper RPV location assumed in the safety analysis. The Reactor Steam Dome Pressure-Low is one of the Functions assumed to be OPERABLE and capable of closing the valves during the transients analyzed in Reference 2. The core

cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The Reactor Steam Dome Pressure-Low Function is directly assumed in the analysis of the recirculation line break (Ref. 1).

The Reactor Steam Dome Pressure-Low signals are initiated from four pressure instruments that sense the reactor dome pressure.

The Allowable Value is chosen to ensure that the valves close prior to commencement of LPCI injection flow into the core, as assumed in the safety analysis.

SUSQUEHANNA - UNIT 2 TS I B 3.3-113 (continued)

Revision 2

Rev. 6 ECCS Instrumentation

BASES APPLICABLE SAFETY 2.e. Reactor Steam Dome Pressure-Low (Recirculation Discharge Valve Permissive) (continued)

B 3.3.5.1 ANALYSES, LCO, and APPLICABILITY Four channels of the Reactor Steam Dome Pressure-Low Function are only required to be OPERABLE in MODES 1, 2, and 3 with the associated recirculation pump discharge valve open. With the valve(s) closed, the function instrumentation has been performed; thus, the Function is not required. In MODES 4 and 5, the loop injection location is not critical since LPCI injection through the recirculation loop in either direction will still ensure that LPCI flow reaches the core (i.e.,

there is no significant reactor steam dome back pressure).

HPCI System 3.a Reactor Vessel Water Level - Low Low, Level 2 Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage

could result. Therefore, the HPCI System is initiated at Level 2 to maintain level above the top of the active fuel. The Reactor Vessel Water Level-Low Low, Level 2 is one of the Functions assumed to be OPERABLE analyzed in Reference 2. Additionally, the Reactor Vessel Water Level-Low Low, Level 2 Function associated with HPCI is directly assumed i.n the analysis of the recirculation line break (Ref. 2).

The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from four level instruments that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The HPCI Reactor Vessel Water Level-Low Low, Level 2 Allowable Value is chosen to be consistent with the Reactor Core Isolation Cooling (RCIC) System Reactor Vessel Water Level - Low Low, Level 2 Allowable value.

Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are required to be OPERABLE only when HPCI is required to be OPERABLE to ensure that no single instrument failure can preclude HPCI initiation. Refer to LCO 3.5.1 for HPCI Applicability Bases.

SUSQUEHANNA - UNIT 2 TS I B 3.3-114 (continued)

Revision 1

Rev. 6 EGGS Instrumentation B 3.3.5.1 BASES

. APPLICABLE 3.b. Drvwell Pressure-High SAFETY ANALYSES, LCO, and High pressure in the drywell could indicate a break in the RCPB. The APPLICABILITY HPCI System is initiated upon receipt of the Drywall Pressure-High (continued) Function in order to minimize the possibility of fuel damage. The Drywell Pressure-High Function, along with the Reactor Water Level-Low Low, Level 2 Function, is directly assumed in the analysis of the recirculation line break (Ref. 1). The core cooling function of the EGGS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

High drywell pressure signals are initiated from four pressure instruments that sense drywall pressure. The Allowable Value was selected to be as low as possible to be indicative of a LOCA inside primary containment.

Four channels of the Drywell Pressure-High Function are required to be OPERABLE when HPCI is required to be OPERABLE to ensure that no single instrument failure can preclude HPCI initiation. Refer to

LCO 3.5.1 for the Applicability Bases for the HPCI System .

3.c. Reactor Vessel Water Level-High, Level 8 High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel.

Therefore, the Level 8 signal is used to trip the HPCI turbine to prevent overflow into the main steam lines (MSLs). The Reactor Vessel Water .

Level-High, Level 8 Function i~ not assumed it:i the accident and transient analyses. It was retained since it is a potentially significant contributor to risk.

Reactor Vessel Water Level-High, Level 8 signals for HPCI are initiated from two level instruments. Both Level 8 signals are required in order to trip HPCI. This ensures that no single instrument failure can preclude an HPCI initiation or trip. The Reactor Vessel Water Level-High, Level 8 Allowable Value is chosen to prevent flow from the HPCI System from overflowing into the MSLs.

SUSQUEHANNA - UNIT 2 TS I B 3.3-115 (continued)

Revision 2

Rev.6 EGGS Instrumentation

BASES APPLICABLE SAFETY 3.c. Reactor Vessel Water Level-High. Level 8 (continued)

B 3.3.5.1 ANALYSES, LCO, Two channels of Reactor Vessel Water Level-High, Level 8 Function and APPLICABILITY are required to be OPERABLE only when HPCI is required to be OPERABLE. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCI Applicability Bases.

3.d. Condensate Storage Tank Level-Low The Condensate Storage Tank-Low signal indicates that a conservatively calculated NPSH-available limit is being approached.

Normally the suction valves between HPCI and the CST are open and, upon receiving a HPCI initiation signal, water for HPCI injection would be taken from the CST. However, if the water level. in the CST falls to the level switch process setpoint value, an automatic suction transfer is initiated. The suppression pool suction valve receives a signal to open and in parallel, the CST suction valve receives a signal to close to complete the transfer. The HPCI suction transfer must be initiated prior to CST level dropping below the technical specification allowable

value to ensure that an adequate suction head for the pump and an uninterrupted supply of makeup water is available to the HPCI pump.

The Function is implicitly assumed in the accident and transient analyses (which take credit for HPCI) since the analyses assume that the HPCI suction source is the suppression pool.

Condensate Storage Tank Level-Low signals are initiated from two level instruments. The logic is arranged such that either level switch can cause the suppression pool suction valves to open and the CST suction valve to close. The Condensate Storage Tank Level-Low Function Allowable Value is high enough to ensure adequate pump suction head while water is being taken from the CST.

Two channels of the Condensate Storage Tank Level-Low Function are required to be OPERABLE only when HPCI is required to be OPERABLE to ensure that no single instrument failure can preclude HPCI swap to suppression pool source. Refer to LCO 3.5.1 for HPCI Applicability Bases.

SUSQUEHANNA - UNIT 2 TS I B 3.3-116 (continued)

Revision 3

Rev. 6 ECCS Instrumentation

BASES B 3.3.5.1 3.e. Manual Initiation The Manual Initiation push button channel introduces signals into the HPCI logic to provide manual initiation capability and is redundant to the automatic protective instrumentation. *There is one push button for the HPCI System. .

SUSQUEHANNA - UNIT 2 TS I B 3.3-117 (continued)

Revision 2

Rev. 6 ECCS Instrumentation

BASES APPLICABLE SAFETY

3. e. Manual Initiation (continued)

B 3.3.5.1 ANALYSES, LCO, The Manual Initiation Function is not assumed in any accident or and APPLICABILITY transient analyses in the FSAR. However, the Function is retained for overall redundancy and diversity of the HPCI function as required by the NRC in the plant licensir:ig basis.

There is no Allowable Value* for this Function since the channel is mechanically actuated based solely on the position of the push button.

One channel of the Manual Initiation Function is required to be OPERABLE only when the HPCI System is required to be OPERABLE. Refer to LCO 3.5.1 for HPCI Applicability Bases.

Automatic Depressurization Svstem 4.a. 5.a. Reactor Vessel Water Level-Low Low Low. Level 1 Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, ADS receives one of the signals necessary for

initiation from this Function. The Reactor Vessel Water Level-Low Low Low, Level 1 is one of the Functions assumed to be OPERABLE and capable of initiating the ADS during the accident analyzed in Reference 1. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level-Low Low Low, Level 1 signals are initiated from four level instruments that sense the difference between a

the pressure due to constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low Low, Level 1 Function are required to be OPERABLE only when ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. Two channels input to ADS trip system A, while the other two channels input to ADS trip system B. Refer to LCO 3.5.1 for ADS Applicability Bases.

SUSQUEHANNA - UNIT 2 TS I B 3.3-118.

(continued)

Revision 2

Rev.6 ECCS Instrumentation

BASES APPLICABLE 4.a. 5.a. Reactor Vessel Water Level-Low Low Low. Level 1 B 3.3.5.1 SAFETY (continued)

ANALYSES, LCO, and APPLICABILITY The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to allow time for the low pressure core flooding systems to initiate and provide adequate cooling.

4.b, 5.b 'Drywell Pressure - High High pressure in the drywell could indicate a break in the RCPB.

Therefore, ADS receives one of the signals necessary for initiation from this Function in order to minimize the possibility of fuel damage.

The Drywell Pressure-High is assumed to be OPERABLE and capable of initiating the ADS during the accidents analyzed in Reference 2. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46 .

- Drywall Pressure-High signals are initiated from four pressure instruments that sense drywall pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.

Four channels of Drywell Pressure-High Function are only required to be OPERABLE when ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. Two channels input to ADS trip system A, while .the other two channels input to ADS trip system B. Refer to LCO 3.5.1 for ADS Applicability Bases.

4.c, 5.c. Automatic Depressurization System Initiation Timer The purpose of the Automatic Depressurization System Initiation Timer is to de.lay depressurization of the reactor vessel to allow the HPCI System time to maintain reactor vessel water level. Since the rapid depressurization caused by ADS operation is one of the most severe transients on the reactor vessel, its occurrence should be limited. By delaying initiation of the ADS Function, the operator is given the chance to monitor the success or failure of the HPCI System to maintain water level, and then to decide whether or not to allow ADS to initiate, to delay initiation further by

SUSQUEHANNA- UNIT 2 TS I B 3.3-119

(continued)

Revision 1

Rev. 6 ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 4.c, 5.c. Automatic Depressurization System Initiation Timer SAFETY (continued)

ANALYSES, LCO, and APPLICABILITY recycling the timer, or to inhibit initiation permanently. The Automatic Depressurization System Initiation Tinier Function is assumed to be OPERABLE for the accident analyses of Reference 1 that require ECCS initiation and assume failure of the HPCI System.

There are two Automatic Depressurization System Initiation Timer relays, one in each of the two ADS trip systems. The Allowable Value for the Automatic Depressurization System Initiation Timer is chosen so that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling.

Two channels of the Automatic Depressurization System Initiation Timer Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. (One channel inputs to ADS trip system A, while the other channel inputs to ADS trip system 8. Refer to LCO 3.5.1 for ADS Applicability Bases.

4.d, 5.d. Reactor Vessel Water Level-Low, Level 3 The Reactor Vessel Water Level-Low, Level 3 Function is used by the ADS only as a confirmatory low water level signal. ADS receives one of the signals necessary for initiation from Reactor Vessel Water Level-Low Low Low, Level 1 signals. In order to prevent spurious initiation of the ADS due to spurious Level 1 signals, a Level 3 signal must also be received before ADS initiation commences.

Reactor Vessel Water Level-Low, Level 3 signals are initiated from two level instruments that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Allowable Value for Reactor Vessel Water Level-Low, Level 3 is selected at the RPS Level 3 scram Allowable Value for convenience.

Refer to LCO 3.3.1.1, "Reactor Protection System (RPS)

Instrumentation," for the Bases discussion of this Function.

SUSQUEHANNA- UNIT 2 TS I B 3.3-120 (continued)

Revision 2

Rev. 6 ECCS Instrumentation

BASES APPLICABLE SAFETY ANALYSES 4.d. 5.d. Reactor Vessel Water Level-Low. Level 3 (continued)

B 3.3.5.1

. LCO, and Two channels of Reactor Vessel Water Levell-Low, Level 3 Function APPLICABILITY are required to be OPERABLE only when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. One channel inputs to ADS trip system A, while the other channel inputs to ADS trip system B. Refer to LCO 3.5.1 for ADS Applicability Bases.

4.e. 4.f. 5.e. 5.f. Core Spray and Low Pressure Coolant Injection Pump Discharge Pressure - High The Pump Discharge Pressure-High signals from the CS and LPCI pumps are used as permissives for ADS initiation, indicating that there is a source of low pressure cooling water available once the ADS has depressurized the vessel. Pump Discharge Pressure-High is one of the Functions assumed to be OPERABLE and capable of permitting ADS initiation during the events analyzed in Reference 1 with an assumed HPCI failure. For these events the ADS depressurizes the reactor vessel so that the low pressure ECCS can perform the core cooling functions. This core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Pump discharge pressure signals are initiated from twelve pressure instruments, two on the discharge side of each of the four LPCI pumps and one on the discharge of each of CS pumps. In order to generate an ADS permissive in. one trip system, it is necessary that only one LPCI pump or one CS subsystem indicate the high discharge pressure condition. The Pump Discharge Pressure-High Allowable Value is less than the pump discharge pressure when the pump is operating in a full flow mode and high enough to avoid any condition that results in a discharge pressure permissive when the CS and LPCI pumps are aligned for injection and the pumps are not running. The actual operating point of this function is not assumed in any transient or accident analysis.

Twelve channels of Core Spray and Low Pressure Coolant Injection Pump Discharge Pressure-High Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. Two CS channels associated with CS pumps A and C and four LPCI channels associated with LPCI pumps A and C are required for trip system A.

Two CS channels associated with CS pumps B and D and four LPCI channels

SUSQUEHANNA - UNIT 2 TS I B 3.3-121 (continued)

Revision 3

Rev.6 ECCS Instrumentation

BASES APPLICABLE SAFETY 4.e. 4.f, 5.e. 5.f.

Pump Discharge Pressure- High (continued)

B 3.3.5.1 Core Spray and Low Pressure Coolant Injection ANALYSES, LCO, and APPLICABILITY. associated with LPCI pumps B and D are required for trip system B.

Refer to LCO 3.5.1 for ADS Applicability Bases.

4.g, 5.g. Automatic Depressurization System Drywell Pressure Bypass Actuation Timer One of the signals required for ADS initiation is Drywell Pressure-High. However, if the event requiring ADS initiation occurs outside the drywall (e.g., main steam line break outside containment}, a high drywall pressure signal may never be present. Therefore, the Automatic Depressurization System Drywell Pressure Bypass Actuation Timer is used to bypass the Drywall Pressure-High Function after a certain time period has elapsed. Operation of the

Automatic Depressurization System Drywell Pressure Bypass Actuation Timer Function is not assumed in any accident analysis.

The instrumentation is retained in the TS because ADS is part of the primary success path for mitigation of a DBA.

There are fourAutomatic Depressurization System Drywall Pressure Bypass Actuation Timer relays, two in .each of the two ADS trip systems. The Allowable Value for the Automatic Depressurization System Low Water Level Actuation Timer is chosen to ensure that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling.

Four channels of the Automatic Depressurization System Drywell Pressure Bypass Actuation Timer Function are required to be OPERABLE only when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation.

Refer to LCO 3.5.1 for ADS Applicability Bas.es.

4.h. 5.h. Manual Initiation The Manual Initiation push button channels introduce signals into the ADS logic to provide manual initiation capability and are redundant to the automatic protective instrumentation. There are two push buttons for each ADS trip system for a total of four.

SUSQUEHANNA - UNIT 2 TS I B 3.3-122 (continued)

Revision 3

Rev.6 ECCS Instrumentation

BASES APPLICABLE SAFETY 4.h, 5.h. Manual Initiation (continued)

B 3.3.5.1 ANALYSES, LCO, The Manual Initiation Function is not assumed in any accident or and APPLICABILITY transient analyses in the FSAR. However, the Function is retained for overall redundancy and diversity of the ADS functions as required by the NRC in the plant licensing basis.

There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons. Four channels of the Manual Initiation Function (two channels per trip system) are only required to be OPERABLE when the ADS is required to be OPERABLE. Refer to LCO 3.5.1 for ADS Applicability Bases.

ACTIONS A Note has been provided to modify the ACTIONS related to ECCS instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in

separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for inoperable ECCS instrumentation channels provide appropriate compensatory measures for separate inoperable Condition entry for each inoperable ECCS instrumentation

channel.

Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.1-1. The applicable Condition referenced in the table is Function dependent. Each time a channel is discovered inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition .

SUSQUEHANNA - UNIT 2 TS I B 3.3-123 (continued)

Revision 1

Rev. 6 ECCS Instrumentation

BASES.

ACTIONS (continued)

B.1. B.2, and B.3 B 3.3.5.1 Required Actions B.1 and B.2 are intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in redundant automatic initiation capability being lost for the feature(s). Required Action B.1 features would be those that are initiated by Functions 1.a, 1.b, 1.c, 2.a, 2.b, and 2.c (e.g., low pressure ECCS). The Required Action B.2 system would be HPCI.

For Required Action B.1, redundant automatic initiation capability is lost if (a) one Function 1.a, 1.b, 1.c, 2.a, or 2.b is inoperable and untripped with only one offsite source OPERABLE, or (b) one or more Function 1.a or Function 2.a channels in both divisions are inoperable and untripped, or (c) one or more Function 1.b or Function 2.b channels in both divisions are inoperable and untripped, or (d) one or more Function 1.c or Function 2.c channels in both divisions are inoperable and untripped.

For (a) above (Function 1.a, 1.b, 1.c, 2.a, or 2.b is inoperable and untripped with only one offsite source OPERABLE), the ESW pump timer resets may not receive a reset signal and the Reactor Building

chillers, Turbine Building chillers and the Drywell cooling equipment may not receive a trip signal. Without the reset of the ESW pump timers and without the trip of the Reactor Building and Turbine Building chillers, the OPERABLE offsite circuit may not be capable of accepting starts of the ESW pumps concurrently with CS or LPCI pumps. For this situation, both the OPERABLE offsite circuit and the DG, that would not be capable of starting, should be declared inoperable.

ACTIONS required by LCO 3.8.1 "AC Sources Operating" or LCO 3.8.2 "AC Sources Shutdown" should be taken or disable the affected reactor building/turbine building chillers and disable the affected ESW pumps automatic initiation capability and take the ACTIONS required by LCO 3.7.2 "ESW System".

For the Drywell cooling equipment trip, inoperability of this feature would require that the associated drywall cooling fans be declared inoperable in accordance with LCO 3.6.3.2 "Drywell Air Flow System".

With two offsite sources OPERABLE and one Function 1.a, 1.b, 1.c, 2.a or 2.b inoperable and untripped, sufficient ECCS equipment is available to meet the design basis accident analyses .

SUSQUEHANNA - UNIT 2 TS I B 3.3-124 (continued)

Revision 2

Rev. 6 ECCS Instrumentation

BASES ACTIONS B.1, B.2, and B.3 (continued)

B 3.3.5.1 For (b), (c) and (d) above, for each Division, since each inoperable channel would have Required Action B.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the.

affected portion of the associated system of low pressure ECCS, DGs, and associated features to be declared inoperable. However, since channels in both Divisions are inoperable and untripped, and the Completion Times started concurrently for the channels in both subsystems, this results in the affected portions in the associated low pressure ECCS and DGs being concurrently declared inoperable.

For Required Action 8.2, redundant automatic initiation capability is lost if two Function 3.a or two Function 3.b channels are inoperable and untripped in the same trip system. In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.3 is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . As noted (Note 1 to Required Action 8.1), Required Action B.1 is only applicable in MODES 1, 2, and 3. In MODES 4 and 5, the specific initiation time of the low pressure ECCS is not assumed and the probability of a LOCA is lower. Thus, a total loss of initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action B.3) is allowed during MODES 4 and 5. There is no similar Note provided for Required Action 8.2 since HPCI instrumentation is not required in MODES 4 and 5; thus, a Note is not necessary. Notes are also provided (Note 2 to Required Action B.1 and the Note to Required Action 8.2) to

SUSQUEHANNA- UNIT 2 TS I 8 3.3-124a (continued)

Revision 0

Rev.6 ECCS Instrumentation

BASES ACTIONS B.1. B.2. and B.3 (continued}

B 3.3.5.1 delineate which Required Action is applicable for each Function that requires entry into Condition B if an associated channel is inoperable.

This ensures that the proper !oss of initiation capability check is performed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action 8.1, the Completion Time only begins upon discovery that a redundant feature in both Divisions (e.g., both CS subsystems) cannot be automatically initiated due to inoperable, untripped channels within the same Function as described in the paragraph above. For Required Action B.2, the Completion Time only begins upon discovery that the HPCI System cannot be automatically initiated due to two inoperable, untripped channels for the associated Function in the same trip system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action 8.3. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition G must be entered and its Required Action taken .

SUSQUEHANNA - UNIT 2 TS I B 3.3-125 (continued)

Revision 1

Rev. 6 EGGS Instrumentation

BASES ACTIONS (continued)

C.1 and C.2 B 3.3.5.1 INTERIM ADMINISTRATIVE DIRECTION Technical Specification Table 3.3.5.1-1, "HPCI System, Function 3.e, Conditions Referenced from Required Action A.1" contains a typographical error (CR 620823). The "D" referenced should be "C."

In accordance with Administrative Letter 98-10, direction is provided until proposed TS change (LDCN 3798) is approved by the NRC.

Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Function result in redundant automatic initiation capability being lost for the feature(s).

Required Action C.1 features would be those that are initiated by Functions 1.d, 2.d, and 2.e (i.e., low pressure ECCS). Redundant automatic initiation capability is lost if either (a) two or more Function 1.d channels are inoperable such that the trip system loses initiation capability, (b) two or more Function 2.d channels are inoperable in the same trip system such that the trip system loses initiation capability, or (c) two or more Function 2.e channels are inoperable affecting LPCI pumps in different subsystems. In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action C.2 is not appropriate and the feature(s) associated with the inoperable channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Since each inoperable channel would have Required Action C.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion of the associated system to be declared inoperable. However, since channels for both low pressure ECCS subsystems are inoperable (e.g., both CS subsystems), and the Completion Times started concurrently for the channels in both subsystems, this results in the affected portions in both subsystems being concurrently declared inoperable. For Fl,mctions 1.d, 2.d, and 2.e, the affected portions are the associated low pressure ECCS

pumps. As noted (Note 1), Required Action C.1 is only applicable in MODES 1, 2, and 3. In MODES 4 and 5, the specific initiation time of the ECCS is not assumed and the probability of a LOCA is lower.

Thus, a total loss of automatic initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action C.2) is allowed during MODES 4 and 5.

Note 2 states that Required Action C.1 is only applicable for Fun~tions 1.d, 2.d, and 2.e. Required Action C.1 is not applicable to Functions 1.e, 2.f, and 3.e (which also require entry into this Condition if a: channel in these Functions is inoperable), since they are the Manual Initiation Functions and are not assumed in any accident or transient

SUSQUEHANNA - UNIT 2 TS I B 3.3-126 (continued)

Revision 2

Rev. 6 ECCS Instrumentation

- BASES ACTIONS C.1 and C.2 (continued)

B 3.3.5.1 analysis. Thus, a total loss of manual initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action C.2) is allowed. Required Action C.1 is also not applicable to Function 3.c (which also requires entry into this Condition if a channel in this Function is inoperable), since the loss of one channel results in a loss of the Function (two-out-of-two logic).

This loss was considered during the development of Reference 3 and considered acceptable for the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed by Required Action C.2.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action C.1, the Completion Time only begins upon discovery that the same feature in both subsystems (e.g., both CS subsystems) cannot be.automatically initiated due to inoperable channels within the same Function as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels .

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition G must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action would either cause the initiation or it would not necessarily result in a safe state for the channel in all events.

D.1, D.2.1, and D.2.2 INTERIM ADMINISTRATIVE DIRECTION Technical Specification Table 3.3.5.1-1, "HPCI System, Function 3.e, Conditions Referenced from Required Action A.1" contains a typographical error (CR 620823). The "D" referenced should be "C."

In accordance with Administrative Letter 98-10, direction is provided until ro osed TS chan e LDCN 3798 is a roved b the NRC.

Required Action D.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic component initiation capability for *

SUSQUEHANNA- UNIT 2 TS I B 3.3-127 (continued)

Revision 3

Rev.6 ECCS Instrumentation B 3.3.5.1 BASES ACTIONS D.1. D.2.1. and D.2.2 continued) the HPCI System. Automatic component initiation capability is lost if two Function 3.d channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Actions D.2.1 and D.2.2 is not appropriate and the HPCI System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of HPCI initiation capability. A Note identifies that Required Action D.1 is only applicable if the HPCI pump suction is not aligned to the suppression pool, since, if aligned, the Function is already performed. This allows the HPCI pump suction to be realigned to the Suppression Pool within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , if desired.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action D. 1, the Completion Time only begins upon discovery that the HPCI System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Function. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion

Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels. Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1 or the suction source must be aligned to the suppression pool per Required Action D.2.2. Placing the inoperable channel in trip performs the intended function of the channel (shifting the suction source to the suppression pool). Performance of either of these two Required Actions will allow operation to continue. If it is not desired to perform Required Actions D.2.1 and D.2.2, Condition G must be entered and its Required Action taken.

E.1 and E.2 Required Action E.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within similar ADS trip system A and B Functions result in redundant automatic initiation capability being lost for the ADS. Redundant automatic initiation capability

SUSQUEHANNA - UNIT 2 TS I B 3.3-128 (continued)

Revision 2

Rev.6 ECCS Instrumentation B 3.3.5.1 BASES ACTIONS E.1 and E.2 (continued) is lost if either (a) one Function 4.a channel and one Function 5.a channel are inoperable and untripped, (b) one Function 4.b channel and one Function 5.b channel are inoperable and untripped, or (c) one Function 4.d channel and one Function 5.d channel are inoperable and untripped.

lri this situation (loss of automatic initiation capability), the 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months or 8 day allowance, as applicable, of Required Action E.2 is not appropriate and all ADS valves must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of ADS initiation capability.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action E.1, the Completion Time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable, untripped channels within similar ADS trip system Functions as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

BeC:ause of the diversity of sensors available to provide initiation .

signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status if both HPCI and RCIC are OPERABLE. If either HPCI or RCIC is inoperable, the time is shortened to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months . If the status of HPCI or RCIC changes such that the Completion Time changes from 8 days to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability. However, the total time for an inoperable, untripped channel cannot exceed 8 days. If the status of HPCI or RCIC changes such that the Completion Time changes from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable, untripped channel. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time,

. the channel must be placed in the tripped condition per Required Action E.2. Placing the inoperable channel in trip would conservatively compensate for the

SUSQUEHANNA- UNIT 2 TS I B 3.3-129 (continued)

Revision 1

Rev.6 ECCS Instrumentation

BASES ACTIONS E.1 and E.2 (continued)

B 3.3.5.1 inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition G must be entered and its Required Action taken.

F.1 and F.2 Required Action F.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within similar ADS trip system Functions result in automatic initiation capability being lost for the ADS.

Automatic initiation capability is lost if either (a) one Function 4.c channel and one Function 5.c channel are inoperable, (b) a combination of Function 4.e, 4.f, 5.e, and 5.f channels are inoperable such that both ADS trip systems lose initiation capability, or (c) one or more Function 4.g channels and one or more Function 5.g channels are inoperable .

In this situation (loss of automatic initiation capability), the 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months or 8 day allowance, as applicable, of Required Action F.2 is not appropriate, and all ADS valves must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of ADS initiation capability. The Note to Required Action F.1 states that Required Action F.1 is only applicable for Functions 4.c, 4.e, 4.f, 4.g, 5.c, 5.e, 5.f, and 5.g. Required Action F.1 is not applicable to Functions 4.h and 5.h (which also require entry into this Condition if a channel in these Functions is inoperable), since they are the Manual Initiation Functions and are not assumed in any accident or transient analysis. Thus, a total loss of manual initiation capability for 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months or 8 days (as allowed by Required Action F.2) is allowed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action F.1, the Completion Time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable channels within similar ADS trip system Functions as described in the paragraph above. The

SUSQUEHANNA- UNIT 2 TS I B 3.3-130 (continued)

Revision 1

Rev.6 ECCS Instrumentation B 3.3.5.1 BASES ACTIONS F.1 and F.2 (continued) 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status if both HPCI and RCIC are OPERABLE (Required Action F.2). If either HPCI or RCIC is inoperable, the time shortens to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months . If the status of HPCI or RClC changes such that the Completion Time changes from 8 days to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability. However, the total time for an inoperable channel cannot exceed 8 days. If the status of HPCI or RCIC changes such that the Completion Time changes from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable channel. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service

time, Condition G must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events.

With any Required Action and associated Completion Time not met, the associated supported feature(s) may be incapable of performing the intended function, and those associated with inoperable untripped channels must be declared inoperable immediately.

SURVEILLANCE As noted in the beginning of the SRs, the SRs for each ECCS REQUIREMENTS instrumentation Function are found in the SRs column of Table 3.3.5.1-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to

SUSQUEHANNA- UNIT 2 TS I B 3.3-131 (continued)

Revision 1

Rev. 6 ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months as follows: (a) for Function 3.c and 3.f; and (b) for Functions REQUIREMENTS other than 3.c and 3.f provided the associated Function or redundant (continued) Function maintains ECCS initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 3) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the ECCS will initiate when necessary.

In addition, for Functions 1.a, 1.b, 1.c, 2.a, and 2.b, the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance is acceptable provided both offsite sources are OPERABLE.

SR 3.3.5.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that

instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK guarantees that undetected channel failure is limited; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria which are determined by the plant staff based on an investigation of a combination of the channel instrument uncertainties may be used to support this parameter comparison and include indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit, and does not necessary indicate the channel is Inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal checks of channels during normal operational use of the displays associated with the channels required by the LCO .

SUSQUEHANNA - UNIT 2 TS I B 3.3-132 (continued)

Revision 3

Rev.6 ECCS Instrumentation

B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

This SR is modified by a Note that provides a general exception to the definition of CHANNEL FUNCTIONAL TEST. This exception is necessary because the design of instrumentation does not facilitate functional testing of all required contacts of the relay which input into the combinational logic. (Reference 5) Performance of such a test could result in a plant transient or place the plant in an undo risk situation. Therefore, for this SR, the CHANNEL FUNCTIONAL TEST verifies acceptable response by verifying the change of state of the relay which inputs into the combinational logic. The required contacts not tested during the CHANNEL FUNCTIONAL TEST are tested under the LOGIC SYSTEM FUNCTIONAL TEST, SR 3.3.5.1.5. This is acceptable because operating experience shows that the contacts not tested during the CHANNEL FUNCTIONAL TEST normally pass the LOGIC SYSTEM FUNCTIONAL TEST, and the testing methodology

minimizes the risk of unplanned transients .

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.1.3 and SR 3.3.5.1.4 A CHANNEL CALIBRATION is a complete check that verifies the channel responds to the measured parameter within the necessary range and accuracy..CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.3-133 (continued)

Revision 2

Rev.6 ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.5 REQUIREMENTS The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel.

The system functional testing performed in LCO 3.5.1, LCO 3.5.2, LCO 3.8.1, and LCO 3.8.2 overlaps this Surveillance to complete testing of the assumed safety function. The LOGIC SYSTEM FUNCTIONAL TEST tests the operation of the initiation logic up to but not including the first contact which is unique to an individually supported feature such as the starting of a DG.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.3.

2. FSAR, Chapter 15.

3. NEDC-30936-P-A, "BWR Owners' Group Technical Specification

4.

Improvement Analyses for ECCS Actuation Instrumentation, Part 2," December 1988.

Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 32193).

5. NRC Inspection and Enforcement Manual, Part 9900: Technical Guidance, Standard Technical Specification Section 1.0 Definitions, Issue date 12/08/86.

SUSQUEHANNA - UNIT 2 TS I B 3.3-134 Revision 2

Rev. 1 RCIC System Instrumentation B 3.3.5.2 B 3.3 INSTRUMENTATiON B 3.3.5.2 Reactor Core Isolation c*ooling (RCIC) System Instrumentation BASES BACKGROUND The purpose of the RCIC System instrumentation is to initiate actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is unavailable, such that initiation of the low pressure Emergency Core Cooling Systems (ECCS) pumps does not occur. A more complete discussion of RCIC System operation is provided in the Bases of LCO 3.5.3, "RCIC System."

The RCIC System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of.reactor vessel Low Low water level. The variable is monitored by four instruments. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic arrangement. Once initiated, the RCIC logic seals in and can be reset by the operator only

when the reactor vessel water level signals have cleared .

The RCIC test line isolation valve is closed on a RCIC initiation signal to allow full system flow and maintain primary containment isolated in the event RCIC is not operating.

The RCIC System also monitors the water levels in the condensate storage tank (CSD which is the normal suction source of reactor grade water for RCIC. Upon receipt of a RCIC initiation signal, the CST suction valve is automatically signaled to open (it is normally in the open position) unless the pump suction from the suppression pool valve is open. If the water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens, and then the CST suction valve automatically closes. Two level switches are used to detect low water level iri the CST. Either switch can cause the suppression pool suction valve to open and the CST suction valve to close.

The RCIC System provides makeup water to the reactor until the reactor vessel water level reaches the high water level (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-135 Revision O

Rev. 1 RCIC System Instrumentation B 3.3.5.2 BASES BACKGROUND (Level 8) trip (two-out-of-two logic), at which time the RCIC steam (continued) supply and cooling water supply valves close (the injection valve also closes due to the closure of the steam supply valves). The RCIC System restarts if vessel level again drops to the low level initiation point (Level 2).

APPLICABLE The function of the RCIC System to provide makeup coolant to the SAFETY reactor is used to respond to transient events. The RCIC System is ANALYSES, LCO, not an Engineered Safety Feature System and no credit is taken in the and APPLICABILITY safety analyses for RCIC System operation. Based on its contribution to the reduction of overall plant risk, however, the system, and therefore its instrumentation, are included in the Technical Specifications as required by the NRC Policy Statement (Ref. 2).

Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the RCIC System instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.2-1. Each Function must have a

required number qf OPERABLE channels with their setpoints within the specified Allowable Values, where appropriate. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each RCIC System instrumentation Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between a

CHANNEL CALIBRATIONS. Operation with trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified accounts for instrument uncertainties appropriate to the Function. These uncertainties are described in the setpoint methodology.

An exception to the methodology described to derive the Allowable Value is the methodology used to determine the Allowable Value for the Condensate Storage Tank Low* Level. This Allowable Value is based on a system calculation and (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-136 Revision O

Rev.1 RCIC System Instrumentation B 3.3.5.2 BASES APPLICABLE and engineering judgement which establishes a conservative limit at SAFETY which the Function should occur.

ANALYSES, LCO, and APPLICABILITY The individual Functions are required to be OPERABLE in MODE 1, (continued) and in MODES 2 and 3 with reactor steam dome pressure> 150 psig since this is when RCIC is required to be OPERABLE. (Refer to LCO 3.5.3 for Applicability Bases for the RCIC System.)

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Reactor Vessel Water Level-Low Low, Level 2 Low reactor pressure vessel (RPV) water level indicates that normal feedwater flow is irisufficient to maintain reactor vessel water level and that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the RCIC System is initiated at Level 2 to assist in maintaining water level

above the top of the active fuel.

Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from four level instruments that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value is set high enough such that for complete loss of feedwater flow, the RCIC System flow with high pressure coolant injection assumed to fail will be sufficient to avoid initiation of low pressure ECCS at Level 1.

Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-137 Revision O

Rev. 1 RCIC System Instrumentation B 3.3.5.2 BASES APPLICABLE 2. Reactor Vessel Water Level-High, Level 8 SAFETY ANALYSES, LCO, High RPV water level indicates that sufficient cooling water inventory and APPLICABILITY* exists in the reactor vessel such that there is no danger to the fuel.

(continued) Therefore, the Level 8 signal is used to close the RCIC steam supply and cooling water supply valves to prevent overflow into the main steam lines (MSLs). (The injection valve also closes due to the closure of the steam supply valve.)

Reactor Vessel Water Level-High, Level 8 signals for RCIC are initiated from two level instruments, which sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level-High, Level 8 Allowable Value is high enough to preclude isolating the injection valve of the RCIC during normal operation, yet low enough to trip the RCIC System prior to water overflowing into the MSLs.

Two channels of Reactor Vessel Water Level-High, Level 8 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases.

3. Condensate Storage Tank Level-Low The Condensate Storage Tank-Low signal indicates that a conservatively calculated NPSH-available limit is being approached.

Normally, the suction valve between the RCIC pump and the CST is open and, upon receiving a RCIC initiation signal, water for RCIC injection would be taken from the CST. However, if the water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens, and then the CST suction valve automaticallycloses. This ensures that an adequate suction head for the pump and an uninterrupted supply of makeup water is available to the RCIC pump should it be desired to realign the suction to the remaining reserve volume in the CST. This logic also has a manual override function initiated by manual closure of the suppression pool suction valve. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valves must be open before the CST suction valve automatically closes.

(continued)

SUSQUEHANNA - UNIT 2 . TS I B 3.3-138 Revision 1

Rev. 1 RCIC System Instrumentation B 3.3.5.2 BASES APPLICABLE 3. Condensate Storage Tank Level-Low (continued)

SAFETY ANALYSES, LCO, Two level switches are used to detect low water level in the CST. The and APPLICABILITY Condensate Storage Tank Level-Low Function Allowable Value is set high enough to ensure adequate pump suction head while water is being taken from the CST.

Two channels of Condensate Storage Tank Level-Low Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source. Refer to LCO 3.5.3 for RCIC Applicability Bases.

4. Manual Initiation The Manual Initiation push button switch introduces a signal into the RCIC System initiation logic that is redundant to the automatic protective instrumentation and provides manual initiation capability.

There is one push button for the RCIC System resulting in a single channel trip Function .

The Manual Initiation Function is not assumed in any accident or transient analyses in the FSAR. However, the Function is retained for overall redundancy and diversity of the RCIC function as required by the NRC in the plant licensing basis.

There is no Allowable Value for this Function since the channel is mechanically actuated based solely on the position of the push button.

One channel of Manual Initiation is required to be OPERABLE when RCIC is required to be OPERABLE.

ACTIONS A Note has been provided to modify the ACTIONS related to RCIC System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent di'{isions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for (continued)

SUSQUEHANNA - UNIT 2 TS I 8 3.3-139 Revision O

Rev. 1 RCIC System Instrumentation B 3.3.5.2 BASES ACTIONS inoperable RCIC System instrumentation channels provide appropriate (continued) compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable RCIC System instrumentation channel.

Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.2-1. The applicable Condition referenced in the Table is Function dependent. Each time a channel is discovered to be inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

B.1and8.2 Required Action 8.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the RCIC System. In this case, automatic initiation capability is lost if two Function 1 channels in the same trip system are inoperable and untripped. In this situation (loss of automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action 8.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of RCIC initiation capability.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action B.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically initiated due to two inoperable, untripped Reactor Vessel Water Level-Low Low, Level 2 channels in the same trip system.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-140 Revision O

Rev.1 RCIC System Instrumentation 8 3.3.5.2 BASES ACTIONS . B.1 and B.2 (continued)

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition E must be entered and its Required Action taken.

A risk based analysis was performed and determined that an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (Ref. 1) is acceptable to permit restoration of any inoperable channel to OPERABLE status (Required Action C.1). A Required Action (similar to Required Action B.1) limiting the allowable out of service time, if a loss of automatic RCIC initiation

. capability exists, is not required. This Condition applies to the Reactor Vessel Water Level-High, Level 8 Function whose logic is arranged such that any inoperable channel will result in a loss of automatic RCIC trip protection capability.

As stated above, this loss of automatic RCIC trip protection capability was analyzed and determined to be acceptable. This Condition also applies to the Manual. Initiation Function. Since this Function is not assumed in any accident or transient analysis, a total loss of manual initiation capability (Required Action C.1) for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed. The Required Action does not allow placing a channel in trip since this action would not necessarily result in a safe state for the channel in all events.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-141 Revision 0

Rev. 1 RCIC System Instrumentation B 3.3.5.2 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued)

Required Action D.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in automatic component initiation capability being lost for the feature(s). For Required Action 0.1, the RCIC System is the only associated feature. In this case, automatic initiation capability is lost if two Function 3 channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Actions D.2.1 and D.2.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of RCIC initiation capability. A note identifies that required Action 0.1 is only applicable if the RCIC pump suction is not aligned to the suppression pool since, if aligned, the Function is already performed. This allows the RCIC pump suction to be realigned to the suppression pool within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , if desired.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action D.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Function. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1, which performs the intended function of the channel (shifting the suction source to the suppression pool). Alternatively, Required Action D.2.2 allows the manual alignment of the RCIC suction (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-142 Revision 0

Rev. 1 RCIC System Instrumentation B 3.3.5.2 BASES ACTIONS D.1. D.2, and D.2.2 (continued) to the suppression pool, which also performs the intended function. If it is not desired to perform Required Actions D.2.1 and D.2.2, Condition E must be entered and its Required Action taken.

With any Requi"red Action and associated Completion Time not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.

SURVEILLANCE As noted in the beginning of the SRs, the SRs for each RCIC System REQUIREMENTS instrumentation Function are found in the SRs column of Table 3.3.5.2-1.

The Surveillances are modified by a Note to indicate that when a

channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed as follows: (a) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Function 2 and 4; and (b) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Functions other than Function 2 and 4, provided the associated Function maintains trip capability.

Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 1) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RCIC will initiate when necessary.

SR 3.3.5.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a parameter on other similar channels. It is based on the assumption that

instrument channels monitoring the same parameter should read (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-143 Revision 1

Rev. 1 RCIC System Instrumentation B 3.3.5.2 BASES SURVEILLANCE SR 3.3.5.2.1 (continued)

REQUIREMENTS approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A .

CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria which are determined by the plant staff based on an investigation of a combination of the channel instrument uncertainties may be used to support this parameter comparison and include indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit, and does not necessarily indicate the channel is Inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire ci;lannel will perform the intended function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that provides a general exception to the definition of CHANNEL FUNCTIONAL TEST. This exception is necessary because the design of instrumentation does not facilitate functional testing of all required contacts of the relay which input into the combinational logic. (Reference 3) Performance of such a test could result in a plant transient or place the plant in an undo risk situation. Therefore, for this SR, the CHANNEL FUNCTIONAL TEST verifies acceptable response by verifying (continued)

SUSQUEHANNA- UNIT 2 TS I B 3.3-144 Revision 1

Rev. 1 RCIC System Instrumentation B 3.3.5.2 BASES SURVEILLANCE SR 3.3.5.2.2 (continued)

REQUIREMENTS the change of state of the relay which inputs into the combinational logic. The required contacts not tested during the CHANNEL FUNCTIONAL TEST are tested under the LOGIC SYSTEM FUNCTIONAL TEST, SR 3.3.5.2.5. This is acceptable because operating experience shows that the contacts not tested during the CHANNEL FUNCTIONAL TEST normally pass the LOGIC SYSTEM FUNCTIONAL TEST, and the testing methodology minimizes the risk of unplanned transients.

SR 3.3.5.2.3 and SR 3.3.5.2.4 A CHANNEL CALIBRATION verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.2.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel.

The system functional testing performed in LCO 3.5.3 overlaps this Surveillance to provide complete testing of the safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-145 Revision 1

Rev.1 RCIC System Instrumentation B 3.3.5.2 BASES REFERENCES 1. NEDE-770-06-2, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications,"

February 1991.

2.

Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 32193).

3. NRC Inspection and Enforcement Manual, Part 9900: Technical Guidance, Standard Technical Specification Section 1.0 Definitions, Issue date 12/08/86.

SUSQUEHANNA - UNIT 2 TS I B 3.3-146 Revision 1

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 B 3.3.6.1 Primary Containment Isolation Instrumentation BASES BACKGROUND The primary containment isolation instrumentation automatically initiates closure of appropriate primary containment isolation valves (PCIVs) .. The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs). Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA.

The isolation instrumentation includes the sensors, relays, and instruments that are necessary to cause initiation of primary containment and reactor coolant pressure boundary (RCPB) isolation.

When the setpoint is reached, the sensor actuates, which then outputs an isolation signal to the isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The

input parameters to the isolation logics are (a) reactor vessel water

level, (b) area ambient and emergency cooler temperatures, (c) main steam line (MSL) flow measurement, (d) Standby Liquid Control (SLC)

System initiation, (e) condenser vacuum, (f) main steam line pressure, (g) high pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) steam line ~ pressure, (h) SGTS Exhaust radiation, (i) HPCI and RCIC steam line pressure, 0) HPCI and RCIC turbine exhaust diaphragm pressure, (k) reactor water cleanup (RWCU) differential flow and high flow, (I) reactor steam dome pressure, and (m) drywell pressure. Redundant sensor input signals from each parameter are provided for initiation of isolation. The only exception is SLC System initiation. In addition, manual isolation of the logics is provided.

Primary containment isolation instrumentation has inputs to the trip logic of the isolation functions listed below.

SUSQUEHANNA - UNIT 2 B 3.3-147 (continued)

Revision O

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 1. Main Steam Line Isolation (continued)

Most MSL Isolation Functions receive inputs from four channels. The outputs from these channels are combined in a one-out-of-two taken twice logic to initiate isolation of all main steam isolation valves (MSIVs). The outputs from the same channels are arranged into two two-out-of-two logic trip systems to isolate all MSL drain valves. The MSL drain line has two isolation valves with one two-out-of-two logic system associated with each valve.

The exceptions to this arrangement are the Main Steam Line Flow-High Function. The Main Steam Line Flow-High Function uses 16 flow channels, four for each steam line. One channel from each steam line inputs to one of the four trip strings. Two trip strings make up each trip system and both trip systems must trip to cause an MSL isolation. Each trip string has four inputs (one per MSL), any one of which will trip the trip string. The trip strings are arranged in a one-out-of-two taken twice logic. This is effectively a one-out-of-eight taken twice logic arrangement to initiate isolation of the MSIVs. Similarly, the 16 flow channels are connected into two two-out-of-two logic trip systems (effectively, two one-out-of-four twice logic), with each trip system isolating one of the two MSL drain valves.

2. Primary Containment Isolation Most Primary Containment Isolation Functions receive inputs from four channels. The outputs from these channels are arranged into two two-out-of-two logic trip systems. One trip system initiates isolation of all inboard primary containment isolation valves, while the other trip system initiates isolation of all outboard primary containment isolation valves. Each logic closes one of the two valves on each penetration, so that operation of either logic isolates the penetration.

The exceptions to this arrangement are as follows. Hydrogen and Oxygen Analyzers, which isolate Division I Analyzer on a Division I isolation signal, and Division II Analyzer on a Division II isolation signal.

This is to ensure monitoring capability is not lost. Chilled Water to recirculation pumps and Liquid Radwaste Collection System isolation valves where both inboard and outboard valves will isolate on either

SUSQUEHANNA - UNIT 2 B 3.3-148 (continued)

Revision O

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 2. Primary Containment Isolation (continued) division providing the isolation signal. Traversing incore probe ball valves and the instrument gas to the drywell to suppression chamber vacuum breakers only have one isolation valve and receives a signal from only one division.

3., 4. High Pressure Coolant Injection System Isolation and Reactor Core Isolation Cooling System Isolation Most Functions that isolate HPCI and RCIC receive input from two channels, with each channel in one trip system using a one-out-of-one logic. Each of the two trip systems in each isolation group is connected to one of the two valves on each associated penetration.

The exceptions are the HPCI and RCIC Turbine Exhaust Diaphragm Pressure-High and Steam Supply Line Pressure-Low Functions ..

These Functions receive inputs from four turbine exhaust diaphragm pressure and four steam supply pressure channels for each system.

The outputs from the turbine exhaust diaphragm pressure and steam supply pressure channels are each connected to two two-out-of-two trip systems. Each trip system isolates one valve per associated penetration.

5. Reactor Water Cleanup System Isolation The Reactor Vessel Water Level-Low Low, Level 2 Isolation Function receives input from four reactor vessel water level channels. The outputs from the reactor vessel water level channels are connected into two two-out-of-two trip systems. The Differential Flow-High, Flow- High, and SLC System Initiation Functions receive input from two channels, with each channel in one trip system using a one-out-of-one logic. The temperature isolations are divided into three Functions.

These Functions are Pump Area, Penetration Area, and Heat Exchanger Area. Each area is monitored by two temperature monitors, one for each trip system. These are configured so that any one input will trip the associated trip system. Each of the two trip systems is connected to one of the two valves on each RWCU penetration .

SUSQUEHANNA - UNIT 2 B 3.3-149 (continued)

Revision 0

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 6. Shutdown Cooling System Isolation (continued)

The Reactor Vessel Water Level-Low, Level 3 Function receives input from four reactor vessel water level channels. The outputs from the reactor vessel water level channels are connected to two two-out-of-two trip systems. The Reactor Vessel Pressure-High Function receives input from two channels, with each channel in one trip system using a one-out-of-one logic. Each of the two trip systems is connected to one of the two valves on each shutdown cooling penetration.

7. Traversing lncore Probe System Isolation The Reactor Vessel Water Level-Low, Level 3 Isolation Function receives input from two reactor vessel water level channels. The Drywell Pressure-High Isolation Function receives input from two drywall pressure channels. The outputs from the reactor vessel water level channels and drywell pressure channels are connected into one two-out-of-two logic trip system.

When either Isolation Function actuates, the TIP drive mechanisms will

. withdraw the TIPs, if inserted , and close the inboard TIP System isolation ball valves when the proximity probe senses the TIPs are withdrawn into the shield. The TIP System isolation ball valves are only open when the TIP System is in use. The outboard TIP System isolation valves are manual shear valves.

APPLICABL~ The isolation signals generated by the primary containment isolation SAFETY instrumentation are implicitly assumed in the safety analyses of ANALYSES, References 1 and 2 to initiate closure of valves to limit offsite doses.

LCO, and Refer to LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs),"

APPLICABILITY Applicable Safety Analyses Bases for more detail of the safety analyses.

Primary containment isolation instrumentation satisfies Criterion 3 of the NRC Policy Statement. (Ref. 8) Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion .

SUSQUEHANNA - UNIT 2 TS I B 3.3-150 (continued)

Revision 1

I I

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE The OPERABILITY of the primary containment instrumentation is SAFETY dependent on the OPERABILITY of the individual instrumentation .

ANALYSES, channel Functions specified in Table 3.3.6.1-1. Each Function must LCO, and have a required number of OPERABLE channels, with their setpoints APPLICABILITY within the specified Allowable Values, where appropriate. A channel is (continued) inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Each channel must also respond within its assumed response time, where appropriate.

Allowable Values are specified for each Primary Containment Isolation Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter reaches the setpoint,

the associated device changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g.; drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

In general, the individual Functions are required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, "Primary Containment." Functions that have different Applicabilities are discussed below in the individual Functions discussion .

SUSQUEHANNA - UNIT 2 TS I B 3.3-151 (continued)

Revision 2

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE The specific Applicable Safety Analyses, LCO, and Applicability SAFETY discussions are listed below on a Function by Function basis.

ANALYSES, LCO, and The penetrations which are isolated by the below listed functions can APPLICABILITY be determined by referring to the PCIV Table found in the Bases of

. (continued) LCO 3.6.1.3, "Primary Containment Isolation Valves."

Main Steam Line Isolation 1.a. Reactor Vessel Water Level-Low Low Low, Level 1 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of the MSIVs and other interfaces with the reactor vessel occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water Level-Low Low Low, Level 1 Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals.

The Reactor Vessel Water Level-Low Low Low, Level 1 Function associated with isolation is assumed in the analysis of the recirculation line break (Ref. 1). The isolation of the MSLs on Level 1 supports actions to ensure that offsite dose limits are not exceeded for a OBA.

Reactor vessel water level signals are initiated from four level instruments that sense the difference betwee*n the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low Low, Level 1 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to be the same as the ECCS Level 1 Allowable Value (LCO 3.3.5.1) to ensure that the MSLs isolate on a potential loss of coolant accident (LOCA) to prevent offsite and co~trol room doses from exceeding regulatory limits .

SUSQUEHANNA - UNIT 2 TS I B 3.3-152 (continued)

Revision 2

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.b. Main Steam Line Pressure-Low SAFETY ANALYSES, Low MSL pressure indicates that there may be a problem with the LCO, and turbine pressure regulation, which could result in a low reactor vessel APPLICABILITY water level condition and the RPV cooling down more than 100°F/hr if (continued) the pressure loss is allowed to continue. The Main Steam Line Pressure-Low Function is directly assumed in the analysis of the pressure regulator failure (Ref. 2). For this event, the closure of the .

MSIVs ensures that the RPV temperature change limit (100°F/hr) is not reached. In addition, this Function supports actions to ensure that Safety Limit 2.1.1.1 is not exceeded. (This Function closes the MSIVs prior to pressure decreasing below 785 psig, which results in a scram due to MSIV closure, thus reducing reactor power to < 23% RTP.)

The MSL low pressure signals are initiated from four instruments that are connected to the MSL header. The instruments are arranged such that, even though physically separated from each other, each instrument is able to detect low MSL pressure. Four channels of Main Steam Line Pressure-Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function .

The Main Steam Line Pressure-Low trip will only occur after a 500 milli-second time delay to prevent any spurious isolations.

The Allowable Value was selected to be high enough to prevent excessive RPV depressurization. The Main Steam Line Pressure-Low Function is only required to be OPERABLE in MODE 1 since this is when the assumed transient can occur (Ref. 2).

1.c. Main Steam Line Flow-High Main Steam Line Flow-High is provided to detect a break of the MSL and to initiate closure of the MS IVs. If the steam were allowed to continue flowing out of the break, the reactor would depressurize and the core could uncover. If the RPV water level decreases too far, fuel damage could occur. Therefore, the isolation is initiated on high flow to prevent or minimize core damage. The Main Steam Line Flow-High Function is directly assumed in the analysis of the main steam line break (MSLB) (Ref. 1). The isolation action, along with the scram function of the Reactor Protection System (RPS), ensures that the fuel peak

SUSQUEHANNA- UNIT 2 TS I B 3.3-153 (continued)

Revision 2

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.c. Main Steam Line Flow-High (continued)

SAFETY ANALYSES, LCO, cladding temperature remains below the limits of 10 CFR 50.46 and and offsite and control room doses do not exceed regulatory limits.

APPLICABILITY The MSL flow signals are initiated from 16 instruments that are connected to the four MSLs. The instruments are arranged such that, even though physically separated from each other, all four connected to one MSL would be able to detect the high flow. Four channels of Main Steam Line Flow-High Function for each unisolated MSL (two channels per trip system) are available and are required to be OPERABLE so that no single instrument failure will preclude detecting a break in any individual MSL.

1.d. Condenser Vacuum-Low The Allowable Value is chosen to ensure that offsite dose limits are not exceeded due to the break.

The Condenser Vacuum-Low Function is provided to prevent overpressurization of the main condenser in the* event of a loss of the

main condenser vacuum. Since the integrity of the condenser is an assumption in offsite dose calculations, the Condenser Vacuum-Low Function is assumed to be OPERABLE and capable of.initiating closure of the MSIVs. The closure of the MSIVs is initiated to prevent the addition of steam that would lead to additional condenser pressurization and possible rupture of the diaphragm installed to protect the turbine exhaust hood, thereby preventing a potential radiation leakage path following an accident.

Condenser vacuum pressure signals are derived from four pressure*

instruments that sense the pressure in the condenser. Four channels of Condenser Vacuum-Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.-

The Allowable Value is chosen to prevent damage to the condenser due to pressurization, thereby ensuring its integrity for offsite dose analysis. As noted (footnote (a) to Table 3.3.6.1-1), the channels are not required to be OPERABLE in MODES 2 and 3 when all main turbine stop valves (TSVs) are closed, since the potential for condenser overpressurization is minimized. Switches are provided to manually bypass the channels when all TSVs are closed .

SUSQUEHANNA - UNIT 2 TS I B 3.3-154 (continued)

. Revision 2

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.e. Reactor Building Main Steam Tunnel Temperature-High SAFETY ANALYSES, LCO, Reactor Building Main Steam Tunnel temperature is provided to detect and APPLICABILITY a leak in the RCPB and provides diversity to the high flow (continued) instrumentation. The isolation occurs when a very small leak has occurred. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. However, credit for these instruments is not taken in any transient or accident analysis in the FSAR, since bounding analyses are performed for large breaks, such as MSLBs.

Area temperature signals are initiated from thermocouples located in the area being monitored. Four channels of Reactor Building Main Steam Tunnel Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The reactor building main steam tunnel temperature trip will only occur after a one second time delay.

The temperature monitoring Allowable Value is chosen to detect a leak

equivalent to approximately 25 gpm of water.

1.f. Manual Initiation The Manual Initiation push button channels introduce signals into the MSL isolation logic that are redundant to the automatic protective instrumentation and provide manual isolation capability. There is no specific FSAR safety analysis that takes credit for this Function. It is retained for the overall redundancy and diversity of the isolation function as required by the NRC in the plant licensing basis.

There are four push buttons for the logic, two manual initiation push button per trip system. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.

Two channels of Manual Initiation Function are available and are required to be OPERABLE in MODES 1, 2, and 3, since these are the MODES in which the MSL isolation automatic Functions are required to be OPERABLE.

SUSQUEHANNA - UNIT 2 TS I B 3.3-155 (continued)

Revision 1

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE Primary Containment Isolation SAFETY ANALYSES, LCO, and 2.a. Reactor Vessel Water Level - Low, Level 3 APPLICABILITY (continued) Low RPV water level indicates that the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 3 supports actions to ensure that offsite and control room dose regulatory limits are not exceeded. The Reactor Vessel Water Level-Low, Level 3 Function associated with isolation is implicitly assumed in the FSAR analysis as these leakage paths are assumed to be isolated post LOCA.

Reactor Vessel Water Level-Low, Level 3 signals are initiated from level instruments that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low, Level 3 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function .

The Reactor Vessel Water Level-Low, Level 3 Allowable Value was chosen to be the same as the RPS Level 3 scram Allowable Value .

(LCO 3.3.1.1 ), since isolation of these valves is not critical to orderly plant shutdown.

2.b. Reactor Vessel Water Level-Low Low, Level 2 Low RPV water level indicates that the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 2 supports actions to ensure that offsite and control room dose regulatory limits are not exceeded. The Reactor Vessel Water Level-Low Low, Level 2 Function associated with isolation is implicitly assumed in the FSAR analysis as these leakage paths are assumed to be isolated post LOCA.

Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from level instruments that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available and

SUSQUEHANNA- UNIT 2 TS I B 3.3-156 (continued)

Revision 2

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.b. Reactor Vessel Water Level - Low Low, Level 2 (continued)

SAFETY ANALYSES, LCO, are required to be OPERABLE to ensure that no single instrument and , failure can preclude the isolation function.

APPLICABILITY The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value was chosen to be the same as the ECCS Level 2 Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA.

2.c. Reactor Vessel Water Level-Low Low Low, Level 1 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 1 supports actions to ensure the offsite and control room dose regulatory limits are not exceeded. The Reactor Vessel Water Level - Low Low Low, Level 1 Function associated with isolation is implicitly assumed in the FSAR analysis as these leakage

paths are assumed to be isolated post LOCA.

Reactor vessel water level signals are initiated from four level instruments that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low Low, Level 1 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to be the same as the ECCS Level 1 Allowable Value (LCO 3.3.5.1) to ensure that the associated penetrations isolate on a potential loss of coolant accident (LOCA) to prevent offsite and control room doses from exceeding regulatory limits .

SUSQUEHANNA - UNIT 2 TS I B 3.3-157 (continued)

Revision 2

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.d. Drywell Pressure-High SAFETY

'ANALYSES, LCO, and High drywell pressure can indicate a break in the RCPB inside the APPLICABILITY primary containment. The isolation of some of the primary (continued) containment isolation valves on high drywell pressure supports actions to ensure that offsite and control room dose regulatory limits are not exceeded. The Drywell Pressure-High Function, associated with isolation of the primary containment, is implicitly assumed in the FSAR accident analysis as these leakage paths are assumed to be isolated post LOCA.

High drywell pressure signals are initiated from pressure instruments that sense the pressure in the drywell. Four channels of Drywell Pressure-High per Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be the same as the ECCS Drywell Pressure-High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment.

2.e. SGTS Exhaust Radiation-High High SGTS Exhaust radiation indicates possible gross failure of the fuel cladding. Therefore, when SGTS Exhaust Radiation High is detected, an isolation is initiated to limit the release of fission products.

However, this Function is not assumed in any accident or transient analysis in the FSAR because other leakage paths (e.g., MSIVs) are more limiting.

The SGTS Exhaust radiation signals are initiated from radiation detectors that are located in the SGTS Exhaust. Two channels of SGTS Exhaust Radiation-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value is low enough to promptly detect gross failures in the fuel cladding .

SUSQUEHANNA - UNIT 2 TS I B 3.3-158 (continued)

Revision 2

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.f. Manual Initiation SAFETY ANALYSES, LCO, and The Manual Initiation push button channels introduce signals into the APPLICABILITY primary containment isolation logic that are redundant to the automatic (continued) protective instrumentation and provide manual isolation capability.

There is no specific FSAR safety analysis that takes credit for this Function. It is retained for overall redundancy and diversity of the isolation function as required by the NRC in the plant licensing basis.

There are two push buttons for the logic, one manual initiation push button per trip system. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.

Two channels of the Manual Initiation Function are available and are required to be OPERABLE in MODES 1, 2, and 3, since these are the MODES in which the Primary Containment Isolation automatic Functions are required to be OPERABLE.

High Pressure Coolant Injection and Reactor Core Isolation

Cooling Svstems Isolation 3.a .. 4.a. HPCI and RCIC Steam Line A Pressure-High Steam Line A Pressure High Functions are provided to detect a break of the RCIC or HPCI steam lines and initiate closure of the steam line isolation valves of the appropriate system. If the steam is allowed to continue flowing out of the break, the reactor will depressurize and the core can uncover. Therefore, the isolations are initiated on high flow to prevent or minimize core damage. The isolation action, along with the scram function of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. Specific credit for these Functions is not assumed in any FSAR accident analyses since the bounding analysis is performed for large breaks such as recirculation and MSL breaks. However, these instruments prevent the RCIC or HPCI steam line breaks from becoming bounding.

The HPCI and RCIC Steam Line /1 Pressure - High signals are initiated from instruments (two for HPCI and two for RCIC) that are connected

SUSQUEHANNA - UNIT 2 TS I B 3.3-159 (continued)

Revision 1

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.a., 4.a. HPCI and RCIC Steam Line A Pressure-High (continued)

SAFETY ANALYSES, LCO, to the system steam lines. Two channels of both HPCI and RCIC and Steam Line A pressure-High Functions are available and are required APPLICABILITY to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The steam line A Pressure - High will only occur after a 3 second time delay to prevent any spurious isolations.

The Allowable Values are chosen to be low enough to ensure that the trip occurs to prevent fuel damage and maintains the MSLB event as the bounding event, and high enough to be above the maximum transient steam flow during system startup.

3.b., 4.b. HPCI and RCIC Steam Supply Line Pressure-Low Low MSL pressure indicates that the pressure of the steam in the HPCI or RCIC turbine may be too low to continue operation of the associated system's turbine. These isolations are for equipment protection and are not assumed in any transient or accident analysis in

the FSAR. However, they also provide a diverse signal to indicate a possible system break. These instruments are included in Technical Specifications (TS) because of the potential for risk due to possible failure of the instruments preventing HPCI and RCIC initiations (Ref. 3).

The HPCI and RCIC Steam Supply Line Pressure-Low signals are initiated from instruments (four for HPCI and four for RCIC) that are connected to the system steam line. Four channels of both HPCI and RCIC Steam Supply Line Pressure-Low Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are selected to be high enough to prevent damage to. the system's turbine .

SUSQUEHANNA - UNIT 2 TS I B 3.3-160 (continued/

Revision 1

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.c., 4.c. HPCI and RCIC Turbine Exhaust Diaphragm Pressure-High SAFETY ANALYSES, LCO, and APPLICABILITY High turbine exhaust diaphragm pressure indicates that a release of (continued) steam into the associated compartment is possible. That is, one of two exhaust diaphragms has ruptured. These isolations are to prevent steam from entering the associated compartment and are not assumed in any transient or accident analysis in the FSAR. These instruments are *included in the TS because of the potential for risk due to possible failure of the instruments preventing HPCI and RCIC initiations (Ref. 3).

The HPCI and RCIC Turbine Exhaust Diaphragm Pressure-High signals are initiated from instruments (four for HPCI and four for RCIC) that are connected to the area between the rupture diaphragms on each system's turbine exhaust line. Four channels of both HPCI and RCIC Turbine Exhaust Diaphragm Pressure-High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values is low enough to identify a high turbine exhaust pressure condition resulting from a diaphragm rupture, or a leak in the diaphragm adjacent to the exhaust line and high enough to prevent inadvertent system isolation.

3.d., 4.d. Drvwell Pressure-High High drywell pressure can indicate a break in the RCPB. The HPCI and RCIC isolation of the turbine exhaust vacuum breaker line is provided to prevent communication with the wetwell when high drywell pressure exists. A potential leakage path exists via the turbine exhaust. The isolation is delayed until the system becomes unavailable for injection (i.e., low steam supply line pressure). The isolation of the HPCI and RCIC turbine exhaust vacuum breaker line by Drywell Pressure-High is indirectly assumed in the FSAR accident analysis because the turbine exhaust vacuum breaker line leakage path is not assumed to contribute to offsite doses and is provided for long term containment isolation .

SUSQUEHANNA - UNIT 2 TS I B 3.3-161 (continued)

Revision 1

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.d., 4.d. Drywell Pressure-High (continued)

SAFETY ANALYSES, LCO, and High drywell pressure signals are initiated from pressure instruments APPLICABILITY that sense the pressure in the drywell. Four channels of both HPCI and RCIC Drywell Pressure-High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be the same as the ECCS Drywell Pressure-High Allowable Value (LCO 3.3.5.1), since this is indicative of a LOCA inside primary containment.

3.e., 3.f., 3.g., 4.e .. 4.f.. 4.g., HPCI and RCIC Area and Emergency Cooler Temperature-High HPCI and RCIC Area and Emergency Cooler temperatures are provided to detect a leak from the associated system steam piping.

The isolation occurs when a small leak has occurred and is diverse to the high flow instrumentation. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. These Functions are not assumed in any FSAR transient or accident analysis, since

bounding analyses are performed for large breaks such as recirculation or MSL breaks.

Area and Emergency Cooler Temperature-High signals are initiated from thermocouples that are appropriately located to protect the system that is being monitored. Two instruments monitor each area.

Two channels for each HPCI and RCIC Area and Emergency Cooler Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The HPCI and RCIC Pipe Routing area temperature trips will only occur after a 15 minute time delay to prevent any spurious temperature isolations due to short temperature increases and allows operators sufficient time to determine which system is leaking. The other ambient temperature trips will only occur after a one second time delay to prevent any spurious temperature isolations.

SUSQUEHANNA - UNIT 2 TS I B 3.3-162 (continued)

Revision 1

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE . 3.e .. 3.f., 3.g., 4.e .. 4.f.. 4.g., HPCI and RCIC Area and Emergency SAFETY Cooler Temperature-High (continued)

ANALYSES, LCO, and APPLICABILITY The Allowable Values are set low enough to detect a leak equivalent to 25 gpm, and high enough to avoid trips at expected operating temperature.

3.h., 4.h. Manual Initiation The Manual Initiation push button channels introduce signals into the HPCI and RCIC systems' isolation logics that are redundant to the automatic protective instrumentation and provide manual isolation capability. There is no specific FSAR safety analysis that takes credit for these Functions. They are retained for overall redundancy and diversity of the isolation function as required by the NRC in the plant licensing basis.

There is one manual initiation push button for each of the HPCI and RCIC systems. One isolation pushbutton per system will introduce an isolation to one of the two trip systems. There is no Allowable Value

for these Functions, since the channels are mechanically actuated based solely on the position of the push buttons.

Two channels of both HPCI and RCIC Manual Initiation Functions are available and are required to be OPERABLE in MODES 1, 2, and 3 since these are the MODES in which the HPCI and RCIC systems' Isolation automatic Functions are required to be OPERABLE.

Reactor Water Cleanup System Isolation 5.a. RWCU Differential Flow-High The high differential flow signal is provided to detect a break in the RWCU System. This will detect leaks in the RWCU System when area temperature would not provide detection (i.e., a cold leg break).

Should the reactor coolant continue to flow out of the break, offsite dose limits may be exceeded. Therefore, isolation of the RWCU System is initiated when high differential flow is sensed to prevent exceeding offsite doses. A 45 second time delay is provided to prevent spurious trips during most RWCU operational transients. This Function is not assumed in any

SUSQUEHANNA - UNIT 2 TS I B 3.3-163 (continued)

Revision 2

Rev. 8 Primary Containment Isolation Instrumentation

BASES APPLICABLE SAFETY ANALYSES, 5.a. RWCU Differential Flow-High (continued)

B 3.3.6.1 LCO, and FSAR transient or accident analysis, sirice bounding analyses are APPLICABILITY performed for large breaks such as MSLBs.

The high differential flow signals are initiated from instruments that are connected to the inlet (from the recirculation suction) and outlets (to condenser and feedwater) of the RWCU System. Two channels of Differential Flow-High Function are available and are required to be OPERABLE to ensure that no single instrument failure downstream of the common summer can preclude the isolation function.

The Differential Flow-High Allowable Value ensures that a break of the RWCU piping is detected.

5.b, 5.c, 5.d RWCU Area Temperatures-High RWCU area temperatures are provided to detect a leak from the RWCU System. The isolation occurs even when small leaks have occurred and is diverse to the high differential flow instrumentation for

the hot portions of the RWCU System. If the small leak continues without isolation, offsite dose limits may be reached. Credit for these instruments is not taken in any transient or accident analysis in the FSAR, since bounding analyses are performed for large breaks such as recirculation or MSL breaks.

Area temperature signals are initiated from temperature elements that are located in the area that is being monitored. Six thermocouples provide input to the Area Temperature-High Function (two per area).

Six channels are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The area temperature trip will only oc~ur after a one second time to prevent any spurious temperature isolations.

The Area Temperature-High Allowa.ble Values are set low enough to detect a leak equivalent to 25 gpm .

SUSQUEHANNA - UNIT 2 TS I B 3.3-164 (continued)

Revision 2

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 5.e. SLC System Initiation SAFETY ANALYSES, LCO, and The isolation of the RWCU System is required when the SLC System APPLICABILITY has been initiated to prevent dilution and removal of the boron solution (continued) by the RWCU System (Ref. 4). SLC System initiation signals are initiated from the two SLC pump start signals.

There is no Allowable Value associated with this Function since the channels are mechanically actuated based solely on the position of the SLC System initiation switch.

Two channels (one from each pump) of the SLC System Initiation Function are available and are required to be OPERABLE only in MODES 1, 2, and 3 which is consistent with the Applicability for the SLC System (LCO 3.1. 7).

As noted (footnote (b) to Table 3.3.6.1-1), this Function is only required to close the outboard RWCU isolation valve trip systems.

5.f. Reactor Vessel Water Level-Low Low. Level 2

Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some interfaces with the reactor vessel occurs to isolate the potential sources of a break. The isolation of the RWCU System on Level 2 supports actions to ensure that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The Reactor Vessel Water Level-Low Low, Level 2 Function associated with RWCU isolation is not directly assumed in the FSAR safety analyses because the RWCU System line break is bounded by breaks of larger systems (recirculation and MSL breaks ,

are more limiting).

Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from four level instruments that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the ves.sel. Four channels of

SUSQUEHANNA - UNIT 2 TS I B 3.3-165 (continued)

Revision 2

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 5.f. Reactor Vessel Water Level-Low Low. Level 2 (continued)

SAFETY ANALYSES, LCO, and Reactor Vessel Water Level-Low Low, Level 2 Function are available APPLICABILITY and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level-Low Low, Level 2 Allowable Value (LCO 3.3.5.1), since the capability to cool the fuel may be threatened.

5.g. RWCU Flow - High RWCU Flow......:...High Function is provided to detect a break of the RWCU System. Should the reactor coolant continue to flow out of the

break, offsite dose limits may be exceeded. Therefore, isolation is initiated on high flow to prevent or minimize core damage. The isolation action, along with the scram function of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. Specific credit for this Function is not assumed in any

FSAR accident analyses since the bounding analysis is performed for large breaks such as recirculation and MSL breaks'.

The RWCU Flow-High signals are initiated from two instruments. Two channels of RWCU Flow-High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The RWCU flow trip will only occur after a 5 second time delay to

. prevent spurious trips.

The Allowable Value is chosen to be low enough to ensure that the trip occurs to prevent fuel damage and maintains the MSLB event as the bounding event.

SUSQUEHANNA - UNIT 2 TS I B 3.3-166 (continued)

Revision 2

Rev. 8

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 5.h. Manual Initiation SAFETY ANALYSES, LCO, and The Manual Initiation push button channels introduce signals into the APPLICABILITY RWCU System isolation logic that are redundant to the automatic (continued) protective instrumentation and provide manual isolation capability.

There is no specific FSAR safety analysis that takes credit for this Function. It is retained for overall redundancy and diversity of the isolation function as required by the. NRC in the plant licensing basis.

There are two push buttons for the logic, one manual initiation push button per trip system. There is no Allowable Value for this Function, since the channels are mechanically actuated based solely on the position of the push buttons.

Two channels of the Manual Initiation Function are available and are required to be OPERABLE in MODES 1, 2, and 3 since these are the MODES in which the RWCU System Isolation automatic Functions are required to be OPERABLE.

Shutdown Cooling System Isolation

6.a. Reactor Steam Dome Pressure-High The Reactor Steam Dome Pressure-High Function is provided to isolate the shutdown cooling portion of the Residual Heat Removal (RHR) System. This interlock is provided only for equipment protection to prevent an intersystem LOCA scenario, and credit for the interlock is not assumed in the accident or transient analysis in the FSAR.

The Reactor Steam Dome Pressure-High signals are initiated from two instruments. Two channels of Reactor Steam Dome Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Function is only required to be OPERABLE in MODES 1, 2, and 3, since these are the only MODES in which the reactor can be pressurized with the exception *at Special Operations LCO 3.10.1; thus, equipment protection is needed. The Allowable Value was chosen to be low enough to protect the system equipment from overpressurization .

SUSQUEHANNA - UNIT 2 TS I B 3.3-167 (continued)

Revision 1

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 6.b. Reactor Vessel Water Level-Low, Level 3 SAFETY ANALYSES, LCO, and Low RPV water level indicates that the capability to cool the fuel may APPLICABILITY be threatened. Should RPV water level decrease too far, fuel damage (continued) could result. Therefore, isolation of some reactor vessel interfaces occurs to begin isolating the potential sources of a break. The Reactor Vessel Water Level-Low, Level 3 Function associated with RHR Shutdown Cooling System isolation is not directly assumed in safety analyses because a break of the RHR Shutdown Cooling System is bounded by breaks of the recirculation and MSL.

The RHR Shutdown Cooling System isolation on Level 3 supports actions to ensure that the RPV water level does not drop below the top of the active fuel during a vessel draindown event caused by a leak (e.g., pipe break or inadvertent valve opening) in the RHR Shutdown Cooling System.

Reactor Vessel Water Level-Low, Level 3 signals are initiated from four level instruments that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure

due to the actual water level (variable leg) in the vessel. Four channels (two channels per trip system) of the Reactor Vessel Water Level-Low, Level 3 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. As noted (footnote (c) to Table 3.3.6.1-1), only two channels of the Reactor Vessel Water Level-Low, Level 3 Function are required to be OPERABLE in MODES 4 and 5 (and must input into the same trip system), provided the RHR Shutdown Cooling System integrity is maintained. System integrity is maintained provided the piping is intact and no maintenance is being performed that has the potential for draining the reactor vessel through the system.

The Reactor Vessel Water Level-Low, Level 3 Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level-Low, Level 3 Allowable Value (LCO 3.3.1.1), since the capability to cool the fuel may be threatened.

The Reactor Vessel Water Level-Low, Level 3 Function is only required to be OPERABLE in MODES 3, 4, and 5 to prevent this potential flow path from lowering the reactor vessel level to the top of the fuel.

SUSQUEHANNA - UNIT 2 TS I B 3.3-168 (continued)

Revision 1

Rev. 8 Primary Containment Isolation Instrumentation

B 3.3.6.1 BASES APPLICABLE 6.b. Reactor Vessel Water Level-Low. Level 3 (continued)

SAFETY ANALYSES, LCO, and In MODES 1 and 2, another isolation (i.e., Reactor Steam Dome APPLICABILITY Pressure-High) and administrative controls ensure that this flow path remains isolated to prevent unexpected loss of inventory via this flow path.

6.c Manual Initiation The Manual Initiation push button channels introduce signals to RHR Shutdown Cooling System isolation logic that is redundant to the automatic protective instrumentation and provide manual isolation capability. There is no specific FSAR safety analysis that takes credit for this Function. It is retained for overall redundancy and diversity of the isolation function as required by the NRC in the plant licensing basis.

There are two push buttons for the logic, one manual initiation push button per trip system. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the

position of the push buttons .

Two channels of the Manual Initiation Function are available and are required to be OPERABLE in MODES 3, 4, and 5, since these are the MODES in which the RHR Shutdown Cooling System Isolation automatic Function are required to be OPERABLE.

As noted (footnote (c) to Table 3.3.6.1-1), only one channel of the Manual Initiation Function is required to be OPERABLE in MODES 4 and 5 provided the RHR Shutdown Cooling System integrity is maintained. System integrity is maintained provided the piping is intact and no maintenance is being performed that has the potential for draining the reactor vessel through the system.

Traversing lncore Probe System Isolation 7.a Reactor Vessel Water Level - Low, Level 3 Low RPV water level .indicates that the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 3 supports actions to

SUSQUEHANNA - UNIT 2 TS I B 3.3-169 (continued)

Revision 3

Rev. 8 Primary Containment Isolation Instrumentation

BASES APPLICABLE SAFETY 7.a Reactor Vessel Water Level - Low, Level 3 (continued)

B 3.3.6.1 ANALYSES, ensure that offsite and control room dose regulatory limits are not LCO, and exceeded. The Reactor Vessel Water Level - Low, Level 3 Function APPLICABILITY associated with isolation is implicitly assumed in the FSAR analysis as these leakage paths are assumed to be isolated post LOCA. Reactor Vessel Water Level - Low, Level 3 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Two channels of Reactor Vessel Water Level - Low, Level 3 Function are available and are required to be OPERABLE to ensure that no single instrument failure can initiate an inadvertent isolation actuation. The isolation function is ensured by the manual shear valve in each penetration .

. The Reactor Vessel Water Level - Low, Level 3 Allowable Value was chosen to be the same as the RPS Level 3 scram Allowable Value (LCO 3.3.1.1), since isolation of these valves is not critical to orderly plant shutdown.

7.b. Drvwell Pressure - High High drywall pressure can indicate a break in the RCPB inside the primary containment. The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite and control room dose regulatory limits are not exceeded. The Drywell Pressure - High Function, associated with isolation of the primary containment, is implicitly assumed in the FSAR accident analysis as these leakage paths are assumed to be isolated post LOCA.

High drywall pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Two channels of Drywell Pressure - High per Function are available and are required to be OPERABLE to ensure that no single instrument failure can initiate an inadvertent actuation. The isolation function is ensured by the manual shear valve in each penetration.

The Allowable Value was selected to be the same as the ECCS Drywell Pressure - High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment.

SUSQUEHANNA - UNIT 2 TS I B 3.3-170 (continued)

Revision 3

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS The ACTIONS are modified by two Notes. Note 1 allows penetration flow path(s) to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated. Note 2 has been provided to modify the ACTIONS related to primary containment isolation instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable primary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable primary containment isolation instrumentation channel.

Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Functions 2.a, 2.d, 6.b, 7.a and 7.b and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions other than Functions 2.a, 2.d, 6.b, 7.a and 7.b has been shown to be acceptable (Refs. 5 and 6) to permit restoration of any inoperable channel to OPERABLE status. This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation), Condition C must be entered and its Required Action taken .

SUSQUEHANNA- UNIT 2 TS I B 3.3-171 (continued)

Revision 1

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS B.1 and B.2 (continued)

Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in redundant automatic isolation capability being lost for the associated penetration flow path(s). The MSL Isolation Functions are considered to be maintaining isolation capability when sufficient channels are OPERABLE or in trip, such that both trip systems will generate a trip signal from the given Function o_n a valid signal. The other isolation functions are considered to be maintaining isolation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate a trip signal from the given Function on a valid signal. This ensures that one of the two PCIVs in the associated penetration flow path can receive an isolation signal from the given Function. For Functions 1.a, 1.b, 1.d, and 1.e, this would require both trip systems to have one channel OPERABLE or in trip. For Function 1.c, this would require both trip systems to have one channel, associated with each MSL, OPERABLE or in trip. Therefore, this would require both trip systems to have one channel per location OPERABLE or in trip. For Functions 2.a, 2.b, 2.c, 2.d, 3.b, 3.c, 3.d, 4.b, 4.c, 4.d, 5.f, and 6.b, this would require one trip system to have

two channels, each OPERABLE or in trip. For Functions 2.e, 3.a, 3.e, 3.f, 3.g, 4.a, 4.e, 4.f, 4.g, 5.a, 5.b, 5.c, 5.d, 5.e, 5.g, and 6.a, this would require one trip system to have one channel OPERABLE or in trip.

The Condition does not include the Manual Initiation Functions (Functions 1.f, 2.f, 3.h, 4.h, 5.h, and 6.c), since they are not assumed in any accident or transient analysis. Thus, a total loss of manual initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action A.1) is allowed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Required Action C.1 directs entry into the appropriate Condition referenced in Table 3.3.6.1-1. The applicable Condition specified in Table 3.3.6.1-1 is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time an inoperable channel has not met any Required Action of Condition A or B and the associated Completion Time has expired, Condition C will be entered for that

channel and provides for transfer to the appropriate subsequent Condition .

SUSQUEHANNA - UNIT 2 TS I B 3.3-172 (continued)

Revision 1

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS D.1, D.2.1. and D.2.2 (continued)

If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply.

This is done by placing the plant in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months (Required Actions D.2.1 and D.2.2).

Alternately, the associated MSLs may be isolated (Required Action D.1), and, if allowed (i.e., plant safety analysis allows operation with an MSL isolated), operation with that MSL isolated may continue.

Isolating the affected MSL accomplishes the safety function of the inoperable channel. The Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply.

This is done by placing the plant in at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems.

If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels.

If it is not desired to isolate the affected penetration flow path(s) (e.g.,

as in the case where isolating the penetration flow path(s) could result in a reactor scram), Condition H must be entered and its Required Actions taken.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing sufficient time for plant operations personnel to isolate the affected penetration flow path(s) .

SUSQUEHANNA- UNIT 2 TS I B 3.3-173 (continued)

Revision 1

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS (continued)

If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is acceptable due to the fact that these Functions are either not assumed in any accident or transient analysis in the FSAR (Manual Initiation) or, in the case of the TIP System isolation, the TIP System penetration is a small bore (0.280 inch), its isolation in a design basis event (with loss of offsite power) would be via the manually operated shear valves, and the ability to manually isolate by either the normal isolation valve or the shear valve is unaffected by the inoperable instrumentation. It should be noted, however, that the TIP System is powered from an auxiliary instrumentation bus which has an uninterruptible power supply and hence, the TIP drive mechanisms and ball valve control will still function in the event of a loss of offsite power. Alternately, if it is not desired to isolate the affected penetration flow path(s) (e.g., as in the case where isolating the penetration flow path(s) could result in a reactor scram), Condition H must be entered and its Required Actions taken .

H.1 and H.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, or any Required Action of Condition F or G is not met and the associated Completion Time has expired, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the .

plant in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems .

SUSQUEHANNA- UNIT 2 TS I B 3.3-174 (continued)

Revision 1

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS 1.1 and 1.2 (continued)

If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated SLC subsystem(s) is declared inoperable or the RWCU System is isolated. Since this Function is required to ensure that the SLC System performs its intended function, sufficient remedial measures are provided by declaring the associated SLC subsystems inoperable or isolating the RWCU System .

SUSQUEHANNA - UNIT 2 TS I B 3.3-174a (continued)

Revision 1

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS 1.1 and 1.2 (continued The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing sufficient time for personnel to isolate the RWCU System.

J.1 and J.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path should be closed. However, if the shutdown cooling function is needed to provide core cooling, these Required Actions allow the penetration flow path to remain unisolated provided action is immediately initiated to restore the channel to OPERABLE status or to

isolate the RHR Shutdown Cooling System (i.e., provide alternate decay heat removal capabilities so the penetration flow path can be isolated). Actions must continue until the channel is restored to OPERABLE status or the RHR Shutdown Cooling System is isolated.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each Primary

REQUIREMENTS Containment Isolation instrumentation Function are found in the SRs column of Table 3.3.6.1-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 5 and 6) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the PCIVs will isolate the penetration floyv path(s) when necessary.

SR 3.3.6.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one

SUSQUEHANNA - UNIT 2 TS I B 3.3-175 (continued)

Revision 2

Rev.8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.1 (continued)

REQUIREMENTS channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria which are determined by the plant staff based on an investigation of a combination of the channel instrument uncertainties may be used to support this parameter comparison and include indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit, and does not necessarily indicate the channel is Inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements

less formal checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.6.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. Note 1 provides a general exception to the definition of CHANNEL FUNCTIONAL TEST. This exception is necessary because the design of instrumentation does not facilitate functional testing of all required contacts of the relays which input into the combinational logic. (Reference 11) Performance of such a test could result in a plant transient or place the plant in an undo risk situation. Therefore, for this SR, the CHANNEL FUNCTIONAL TEST verifies acceptable response by verifying the change of state of the relay which inputs into the combinational logic.

The required contacts not tested during the CHANNEL FUNCTIONAL TEST are tested under the LOGIC

SUSQUEHANNA- UNIT 2 TS I B 3.3-176 (continued)

Revision 2

Rev. 8 Primary Containment Isolation Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.6.1.2 (continued)

SYSTEM FUNCTIONAL TEST, SR 3.3.6.1.5. This is acceptable B 3.3.6.1 because operating experience shows that the contacts not tested during the CHANNEL FUNCTIONAL TEST normally pass the LOGIC SYSTEM FUNCTIONAL TEST, and the testing methodology minimizes the risk of unplanned transients.

Note 2 provides a second specific exception to the definition of CHANNEL FUNCTIONAL TEST. For Functions 2.e, 3.a, and 4.a, certain channel relays are not included in the performance of the CHANNEL FUNCTIONAL TEST. These exceptions are necessary because the circuit design does not facilitate functional testing of the entire channel through to the coil of the relay which enters the combinational logic. (Reference 11) Specifically, testing of all required relays would require rendering the affected system (i.e., HPCI or RCIC) inoperable, or require lifting of leads and inserting test equipment which could lead to unplanned transients. Therefore, for these circuits, the CHANNEL FUNCTIONAL TEST verifies acceptable response by verifying the actuation of circuit devices up to the point where further testing could result in an unplanned transient. (References 10 and 12)

The required relays not tested during the CHANNEL FUNCTIONAL TEST are tested under the LOGIC SYSTEM FUNCTIONAL TEST, SR 3.3.6.1.5. This exception is acceptable because operating experience shows that the devices not tested during the CHANNEL FUNCTIONAL TEST normally pass the LOGIC SYSTEM FUNCTIONAL TEST, and the testing methodology minimizes the risk of unplanned transients.

SR 3.3.6.1.3 and SR 3.3.6.1.4 A CHANNEL CALIBRATION verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.3-177 (continued)

Revision 2

Rev.8 Primary Containment Isolation Instrumentation

BASES SURVEILLANCE REQUIREMENTS SR 3.3.6.1.3 and SR 3.3.6.1.4 (continued)

B 3.3.6.1 It should be noted that some of the Primary Containment High Drywell pressure instruments, although only required to be calibrated as a 24 month Frequency, are calibrated quarterly based on the TS requirements.

SR 3.3.6.1.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel.

The system functional testing performed on PCIVs in LCO 3.6.1.3 overlaps this Surveillance to provide complete testing of the assumed safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.1.6 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident

analysis. Testing is performed only on channels where the guidance given in Reference 9 could not be met, which identified that degradation of response time can usually be detected by other surveillance tests.

As stated in Note 1, the response time of the sensors for Function 1.b is excluded from ISOLATION SYSTEM RESPONSE TIME testing.

Because the vendor does not provide a design instrument response time, a penalty value to account for the sensor response time is included in determining total channel response time. The penalty value is based on the historical performance of the sensor.

(Reference 13) This allowance is supported by Reference 9 which determined that significant degradation of the sensor channel response time can be detected during performance of other Technical Specification SRs and that the sensor response time is a small part of the overall ISOLATION RESPONSE TIME testing .

SUSQUEHANNA - UNIT 2 TS I B 3.3-178 (continued)

Revision 3

Rev. 8 Primary Containment Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.6 (continued)

REQUIREMENTS Function 1.a and 1.c channel sensors and logic components are excluded from response time testing in accordance with the provisions of References 14 and 15.

As stated in Note 2, response time testing of isolating relays is not required for Function 5.a. This allowance is supported by Reference

9. These relays isolate their respective isolation valve after a nominal 45 second time delay in the circuitry. No penalty value is included in the response time calculation of this function. This is due to the historical response time testing results of relays of the same manufacturer and model number being less than 100 milliseconds, which is well within the expected accuracy of the 45 second time delay relay.

ISOLATION SYSTEM RESPONSE TIME acceptance criteria are included in Reference 7. This test may be performed in one measurement, or in overlapping segments, with verification that all components are tested .

REFERENCES The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

1. FSAR, Section 6.3.

2. FSAR, Chapter 15.

3. NED0-31466, "Technical Specification Screening Criteria Application and Risk Assessment," November 1987.

4. FSAR, Section 4.2.3.4.3.

5. NEDC-31677P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation,"

July 1990.

SUSQUEHANNA - UNIT 2 TS I B 3.3-179 (continued)

Revision 4

Rev. 8

- BASES Primary Containment Isolation Instrumentation B 3.3.

6.1 REFERENCES

6. NEDC-30851 P-A Supplement 2, "Technical Specifications (continued) Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation," March 1989.

7. FSAR, Table 7.3-29.

8. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132)

9. NED0-32291P-A "System Analyses for Elimination of Selected Response Time Testing Requirements," October 1995.

10. PPL Letter to NRG, PLA-2618, Response to NRG INSPECTION REPORTS 50-387/85-28 AND 50-388/85-23, dated April 22, 1986.

11. NRG Inspection and Enforcement Manual, Part 9900:

Technical Guidance, Standard Technical Specification Section 1.0 Definitions, Issue date 12/08/86.

12.

13.

Susquehanna Steam Electric Station NRG REGION I COMBINED INSPECTION 50-387/90-20; 50-388/90-20, File R41-2, dated March 5, 1986.

NRG Safety Evaluation Report related to Amendment No. 171 for License No. NPF-14 and Amendment No. 144 for License No. NPF-22.

14. NEDO 32291-A, Supplement 1 "System Analyses for the Elimination of Selected Response Time Testing Requirements,"

October 1999.

15. NEDO 32291, Supplement 1, Addendum 2, "System Analyses for the Elimination of Selected Response Time Testing Requirements," September 5, 2003.

SUSQUEHANNA- UNIT 2 TS I B 3.3-179a Revision 2

Rev. 5 Secondary Containment Isolation Instrumentation

B 3.3 B 3.3.6.2 INSTRUMENTATION Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES BACKGROUND The secondary containment isolation instrumentation automatically initiates closure of appropriate secondary containment isolation valves (SCIVs) and starts the Standby Gas Treatment (SGT) System. The function of these systems, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Ref. 1). Secondary containment.isolation and establishment of vacuum with the SGT System within the assumed time limits ensures that fission products that leak from primary containment following a OBA, or are released outside primary containment, or are released during certain operations when primary containment is not required to be OPERABLE are maintained within applicable limits.

The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of secondary containment isolation.

When the setpoint is reached, the channel sensor actuates, which then outputs a secondary containment isolation signal to the isolation logic.

Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logic are (1) reactor vessel water level, (2) drywell pressure, (3) refuel floor high exhaust duct radiation - high, (4) refuel floor wall exhaust duct radiation - high, and (5) railroad access shaft exhaust duct radiation - high. Only appropriate ventilation zones are isolated for different isolation signals. Isolation signals for drywell pressure and vessel water level will isolate the affected Unit's zone (Zone I for Unit 1 and Zone II for Unit 2) and Zone Ill.

Redundant sensor input signals from each parameter are provided for initiation of isolation. In addition, manual initiation of the logic is provided.

The Functions are arranged as follows for each trip system. The Reactor Vessel Water Level - Low Low, Level 2 and Drywell Pressure - High are each arranged in a two-out-of-two logic. The Refuel Floor High Exhaust Duct Radiation - High, Refuel Floor Wall Exhaust Duct Radiation - High and the Railroad Access Shaft Exhaust Duct Radiation - High are arranged into one-out-of-one trip systems. One trip

SUSQUEHANNA - UNIT 2 TS I B 3.3-180 (continued)

Revision 1

Rev.5 Secondary Containment Isolation Instrumentation

BASES BACKGROUND B 3.3.6.2 system initiates isolation of one automatic isolation valve (damper) and (continued) starts one SGT subsystem (including its associated reactor building recirculation subsystem) while the other trip system initiates isolation of the other automatic isolation valve in the penetration and starts the other SGT subsystem (including its associated reactor building recirculation subsystem). Each logic closes one of the two valves on each penetration and starts one SGT subsystem, so that operation of either logic isolates the secondary containment and provides for the necessary filtration of fission products.

APPLICABLE The isolation signals generated by the secondary containment isolation SAFETY instrumentation are implicitly assumed in t!ie safety analyses of ANALYSES, References 1 and 2 to initiate closure of valves and start the SGT System LCO, and to limit offsite and control room doses.

APPLICABILITY Refer to LCO 3.6.4.2, i*secondary Containment Isolation Valves (SCIVs),"

and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System," Applicable Safety Analyses Bases for more detail of the safety analyses .

The secondary containment isolation instrumentation satisfies Criterion 3 of the NRG Policy Statement. (Ref. 7) Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the secondary containment isolation instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions. Each Function must have the required number of OPERABLE channels with their setpoints set within the specified Allowable Values, as shown in Table 3.3.6.2-1. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Each channel must also respond within its assumed response time, where appropriate.

Allowable Values are specified for each Function specified in the Table.

Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable .

SUSQUEHANNA- UNIT 2 TS I B 3.3-181 (continued)

Revision 3

Rev. 5 Secondary Containment Isolation Instrumentation

B 3.3.6.2 BASES APPLICABLE Trip setpoints are those predetermined values of output at which an action SAFETY should take place. The setpoints are compared to the actual process ANALYSES, parameter (e.g., reactor vessel water level), and when the measured LCO, and output value of the process parameter reaches the setpoint, the APPLICABILITY, associated device changes state. The analytic limits are derived from the (continued) limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip SAFETY ANALYSES, setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions when SCIVs and the SGT System are required .

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Reactor Vessel Water Level-Low Low. Level 2 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The Reactor Vessel Water Level-Low Low, Level 2 Function is one of the Functions assumed to be OPERABLE and capable of providing isolation and initiation signals. The isolation and initiation systems on Reactor Vessel Water Level-Low Low, Level 2 support actions to ensure that any offsite releases are within the limits calculated in the safety analysis.

Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from level instruments that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water

SUSQUEHANNA~ UNIT 2 TS I B 3.3-182 (continued)

Revision 1

Rev. 5 Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 1. Reactor Vessel Water Level-Low Low, Level 2 (continued)

SAFETY ANALYSES, level (variable leg) in the vessel. Four channels of Reactor Vessel Water LCO, and Level-Low Low, Level 2 Function are available and are required to be APPLICABILITY OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value was chosen to be the same as the High Pressure Coolant Injection/Reactor Core .Isolation Cooling (HPCl/RCIC) Reactor Vessel Water Level-Low Low, Level 2 Allowable Value (LCO 3.3.5.1 and LCO 3.3.5.2), since this could indicate that the capability to cool the fuel is being threatened.

The Reactor Vessel Water Level-Low Low, Level 2 Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the Reactor Coolant System (RCS); thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, this Function is not required. In addition, the Function is

also required to be OPERABLE during operations with a potential for draining the reactor vessel (OPDRVs) because the capability of isolating potential sources of leakage must be provided to ensure that offsite and control room dose limits are not exceeded if core damage occurs.

Reactor Vessel Water Level--Low Low, Level 2 will isolate the affected Unit's zone (i.e., Zone* 1for Unit 1 and Zone II for Unit 2) and Zone Ill.

2. .Drywall Pressure-High High drywell pressure can indicate a break in the reactor coolant pressure boundary (RCPB). An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The isolation on high drywell pressure supports actions to ensure that any offsite releases are within the limits calculated in the safety analysis. However, the Drywell Pressure-High Function associated with

SUSQUEHANNA - UNIT 2 TS I B 3.3-183 (continued)

Revision 2

Rev. 5 Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 2. Drvwell Pressure - High (continued)

SAFETY ANALYSES, isolation is not assumed in any FSAR accident or transient analyses. It is LCO, and retained for the overall redundancy and diversity of the secondary APPLICABILITY containment isolation instrumentation as required by the NRG approved licensing basis.

High drywell pressure signals are initiated from pressure instruments that sense the pressure in the drywell. Four channels of Drywell Pressure-High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude performance of the isolation function.

The Allowable Value was chosen to be the same as the ECCS Drywall Pressure-High Function Allowable Value (LCO 3.3.5.1) since this is indicative of a loss of coolant accident (LOCA).

The Drywell Pressure-High Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the RCS; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. This Function is not required in MODES 4 and 5 because the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES.

Drywell Pressure - High will isolate the affected Unit's zone (i.e., Zone I for Unit 1 and Zone II for Unit 2) and Zone Ill.

3, 4. 5. 6. 7 Refuel Floor High Exhaust Duct. Refuel Floor Wall Exhaust Duct, and Railroad Access Shaft Exhaust Duct Radiation-High High secondary containment exhaust radiation is an indication of possible gross failure of the fuel cladding due to a fuel handling accident. When Exhaust Radiation-High is detected, secondary containment isolation and actuation of the SGT System are initiated to limit the release of fission products as assumed in the FSAR safety analyses (Ref. 4) .

SUSQUEHANNA- UNIT 2 TS I B 3.3-184 (continued)

Revision 1

Rev. 5 Secondary Containment Isolation Instrumentation

BASES APPLICABLE B 3.3.6.2 3, 4, 5.* 6, 7 Refuel Floor High Exhaust Duct. Refuel Floor Wall Exhaust SAFETY Duct. and Railroad Access Shaft Exhaust Duct Radiation-High ANALYSES, (continued)

LCO, and The Exhaust Radiation-High signals are initiated from radiation detectors APPLICABILITY that are located on the ventilation exhaust ductwork coming from the refueling floor zones and the Railroad Access Shaft. The signal from each detector is input to an individual monitor whose trip outputs are assigned to an isolation channel. Eight channels of Refuel Floor High Exhaust Duct and Wall Exhaust Duct Radiation-High Function (four from Unit 1 and four from Unit 2) and two channels of Railroad Access Shaft Exhaust Duct Radiation - High Function (both from Unit 1) are available to ensure that no single instrument failure can preclude the isolation function.

Operability of the Unit 1 and Unit 2 Refuel Floor High Exhaust Duct Radiation Instrumentation and the Unit 1 and Unit 2 Refuel Floor Wall Exhaust Duct Radiation Instrumentation does not require HVAC system airflow in the ductwork.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding.

The Refuel Floor Exhaust Radiation-High Functions are required to be OPERABLE during CORE ALTERATIONS, OPDRVs, and movement of irradiated fuel assemblies in the secondary containment, because the capability of detecting radiation releases due to fuel failures (due to a fuel handling accident) must be provided to ensure that offsite and control room dose limits are not exceeded.

The Railroad Access Shaft Exhaust Duct Radiation - High Function is only required to be OPERABLE during handling of irradiated fuel within the Railroad Access Shaft, and directly above the Railroad Access Shaft with the Railroad Access Shaft Equipment Hatch open. This provides the capability of detecting radiation releases due to fuel failures resulting from dropped fuel assemblies which ensures that offsite and control room dose limits are not exceeded.

Refuel Floor High and Wall Exhaust Duct and Railroad Access Shaft Exhaust Duct Radiation - High Functions will isolate Zone Ill of secondary containment.

SUSQUEHANNA- UNIT 2 TS I B 3.3-185 (continued)

Revision 4

Rev. 5 Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 8. Manual Initiation SAFETY ANALYSES, A Manual Initiation can be performed for secondary containment isolation LCO, and by initiating a Primary Containment Isolation. There is no specific FSAR APPLICABILITY safety analysis that takes credit for this Function. It is retained for the (continued) overall redundancy and diversity of the secondary containment isolation instrumentation as required by the NRG approved licensing basis.

There are two push buttons for the logic, one manual initiation push button per trip system. There is no Allowable Value for this Function, since the channels are mechanically actuated based solely on the position of the push buttons.

Two channels of Manual Initiation Function are available and are required to be OPERABLE in MODES 1, 2, and 3, and during CORE ALTERATIONS, OPDRVs, and movement of irrad_iated fuel assemblies in the secondary containment. These are the MODES and other specified conditions in which the Secondary Containment Isolation automatic Functions are required to be OPERABLE .

ACTIONS A Note has been provided to modify the ACTIONS related to secondary containment isolation instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However; the Required Actions for inoperable secondary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable secondary containment isolation instrumentation channel.

SUSQUEHANNA - UNIT 2 TS I B 3.3-186 (continued)

Revision 1

Rev. 5 Secondary Containment Isolation Instrumentation

BASES ACTIONS (continued)

A.1 B 3.3.6.2 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Function 2, and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions other than Function 2, has been shown to be acceptable (Refs. 5 and 6) to permit restoration of any inoperable channel to OPERABLE status. This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation), Condition C must be entered and its Required Actions taken .

Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic isolation capability for the associated penetration flow path(s) or a complete Joss of automatic initiation capability for the SGT System. A Function is considered to be maintaining secondary containment isolation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate a trip signal from the given Function on a valid signal. This ensures that one of the two SCIVs in the associated penetration flow path and one SGT subsystem (including its associated reactor building recirculation subsystem) can be initiated on an isolation signal from the given Function.

For the Functions with two logic trip systems (Functions 1, 2, 3, 4, 5, 6 and 7), this would require one trip system to have the required channel(s)

OPERABLE or in trip. The Condition does not include the Manual Initiation Function (Function 8), since it is not assumed in any accident or transient analysis. Thus, a total loss of manual initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action A.1) is allowed .

SUSQUEHANNA - UNIT 2 TS I B 3.3-187 (continued)

Revision 2

Rev. 5 Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES ACTIONS B.1 (continued)

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

C.1. C.2.1, and C.2.2 If any Required Action and associated Completion Time of Condition A or B are not met, the ability to isolate the secondary containment and start the SGT System cannot be ensured. Therefore, further actions must be performed to ensure the ability to maintain the secondary containment function. Isolating the associated zone (closing the ventilation supply and exhaust automatic isolation dampers) and starting the associated SGT subsystem (including its associated reactor building recirculation subsystem) in the emergency mode (Required Action C.1) performs the intended function of the instrumentation and allows operation to continue.

Alternately, declaring the associated SCIVs and SGT subsystem(s)

(including its associated reactor building recirculation subsystem) inoperable (Required Actions C.2.1 and C.2.2) is also acceptable since the Required Actions of the respective LCOs (LCO 3.6.4.2 and LCO 3.6.4.3) provide appropriate actions for the inoperable components.

One hour is sufficient for plant operations personnel to establish required plant conditions or to declare the associated components inoperable without unnecessarily challenging plant systems.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each Secondary REQUIREMENTS Containment Isolation instrumentation Function are located in the SRs column of Table 3.3.6.2-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains secondary containment isolation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the

SUSQUEHANNA- UNIT 2 TS I B 3.3-188 (continued)

Revision 2

Rev. 5 Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE channel must be returned to OPERABLE status or the applicable REQUIREMENTS Condition entered and Required Actions taken. This Note is based on the (continued) reliability analysis (Refs. 5 and 6) assumption of the average time required to perform channel surveillance. That analysis demonstrated the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the SCIVs will isolate the associated penetration flow paths and that the SGT System will initiate when necessary.

SR 3.3.6.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL

CALIBRATION .

Agreement criteria which are determined by the plant staff based on an investigation of a combination of the channel instrument uncertainties may be used to support this parameter comparison and include indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit, and does not necessarily indicate the channel is Inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal checks of channel status during normal operational use of the displays associated with channels required by the LCO .

SUSQUEHANNA - UNIT 2 TS I B 3.3-189 (continued)

Revision 2

Rev. 5 Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE SR 3.3.6.2.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

This SR is modified by a Note that provides a general exception to the definition of CHANNEL FUNCTIONAL TEST. This exception is necessary because the design of instrumentation does not facilitate functional testing of all required.contacts of the relay which input into the combinational logic. (Reference 8) Performance of such a test could result in a plant transient or place the plant in an undo risk situation. Therefore, for this SR, the CHANNEL FUNCTIONAL TEST verifies acceptable response by verifying the change of state of the relay which inputs into the combinational logic. The required contacts not tested during the CHANNEL FUNCTIONAL TEST are tested under the LOGIC SYSTEM FUNCTIONAL TEST, SR 3.3.6.2.5. This is acceptable because operating experience shows that the contacts not tested during the CHANNEL FUNCTIONAL TEST normally pass the LOGIC SYSTEM FUNCTIONAL TEST, and the testing methodology minimizes the risk of unplanned transients .

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.2.3 and SR 3.3.6.2.4 A CHANNEL CALIBRATION verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.3-190 (continued)

Revision 2

Rev. 5 Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE REQUIREMENTS SR 3 *3 *6 *2 *5 (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing performed on SCIVs and the SGT System in LCO 3.6.4.2 and LCO 3.6.4.3, respectively, overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1~ FSAR, Section 6.3.

2. FSAR, Chapter 15

3. FSAR, Section 15.2.

4. FSAR, Sections 15.7.

5. NEDC-31677P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation," July 1990.

6. NEDC-30851 P-A Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and EGGS Instrumentation," March 1989.

7. Final Policy Statement on Technical Specifications Improvements, July 22, 1993. (58 FR 32193)

8. NRG Inspection and Enforcement Manual, Part 9900: Technical Guidance, Standard Technical Specification Section 1.0 Definitions, Issue date 12/08/86.

SUSQUEHANNA - UNIT 2 TS I B 3.3-191 Revision 2

Rev. 3 CREOAS System Instrumentation B 3.3.7.1 B 3.3 INSTRUMENTATION B 3.3.7.1 Control Room Emergency Outside Air Supply (CREOAS) System Instrumentation BASES BACKGROUND The CREOAS System is designed to provide a radiologically controlled environment to ensure the habitability of the control room for the safety of control room operators under all plant conditions. Two independent CREOAS subsystems are each capable of fulfilling the stated safety function. The instrumentation and controls for the CREOAS System automatically initiate action to pressurize the main control room to minimize the consequences of radioactive material in the control room environment.

In the event of a loss of coolant accident (LOCA) signal (Reactor Vessel Water Level-Low Low, Level 2 or Drywell Pressure-High), Refuel Floor High Exhaust Duct Radiation-High, Refuel Floor Wall Exhaust Duct Radiation-High, Railroad Access Shaft Exhaust Duct Radiation-High or Main Control Room Outside Air Intake Radiation-High signal, the CREOAS System is automatically started in the pressurization/filtration mode.

The CREOAS System instrumentation has two trip systems. Each trip system receives input from each of the Functions listed above and initiates associated subsystem. The Functions are arranged for each trip system as follows: the Reactor Vessel Water Level-Low Low, Level 2 and Drywell Pressure-High are each arranged in a two-out-of-two logic. The Refuel Floor High Exhaust Duct Radiation - High, Refuel Floor Wall Exhaust Duct Radiation - High, the Main Control Room Outside Air Intake Radiation - High and the Railroad Access Shaft Exhaust Duct Radiation -

High are arranged in a one-out-of-one logic. With the exception of the Main Control Room Outside Air Intake Radiation - High all the instruments also initiate a secondary containment isolation. When the setpoint is reached, the sensor actuates, which then outputs a CREOAS System initiation signal to the initiation logic.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-192 Revision O

Rev. 3 CREOAS System Instrumentation B 3.3.7.1, BASES (continued)

APPLICABLE The ability of the CREOAS System to maintain the habitability of the main SAFETY control room is explicitly assumed for certain accidents as discussed in the ANALYSES, FSAR safety analyses (Refs. 1 and 2). CREOAS System operation LCO, and ensures that the radiation exposure of control room personnel, through APPLICABILITY the duration of any one of the postulated accidents, does not exceed regulatory limits.

CREOAS System instrumentation satisfies Criterion 3 of the NRC Policy Statement. (Ref. 5)

The OPERABILITY of the CREOAS System instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.7.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each CREOAS System Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the.

setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter reaches the setpoint, the associated device changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-193 Revision 1

Rev.3 CREOAS System Instrumentation B 3.3.7.1 BASES APPLICABLE function in harsh environments as defined by 10 CFR 50.49) are SAFETY accounted for.

ANALYSES, The specific Applicable Safety Analyses, LCO, and Applicability LCO, and discussions are listed below on a Function by Function basis.

APPLICABILITY (continued)

1. Reactor Vessel Water Level-Low Low. Level 2 low reactor pressure vessel (RPV) water level indicates that the capability of cooling the fuel may be threatened. A low reactor vessel water level could indicate a LOCA and will automatically initiate the CREOAS System, since this could be a precursor to a potential radiation release and subsequent radiation exposure to control room personnel.

Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from four level instruments that sense the difference between the pressure due to a constant column of water (referencE} leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available (two channels per trip system) and are required to be OPERABLE to ensure

that no single instrument failure can preclude a CREOAS System initiation. The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value was chosen to be the same as the HPCI and RCIC Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value (LCO 3.3.5.1, "ECCS Instrumentation and LCO 3.3.5.2 "RCIC Instrumentation").

The Reactor Vessel Water Level-Low Low, Level 2 Function is required to be OPERABLE in MODES 1, 2, and 3, and during operations with a potential for draining the reactor vessel (OPDRVs) to ensure that the control room personnel are protected during a LOCA. In MODES 4 and 5 at.times other than OPDRVs, the probability of a vessel draindown event resulting in a release of radioactive material into the environment is minimal. In addition, adequate protection is performed by the Control Room Air Inlet Radiation-High Function. Therefore,. this Function is not required in other MODES and specified conditions.

(continued)

SUSQUEHANNA- UNIT 2 TS I B 3.3-194 Revision 0

Rev.3 CREOAS System Instrumentation B 3.3.7.1 BASES APPLICABLE 2. Drvwell Pressure-High SAFETY ANALYSES, High pressure in the drywell could indicate a break in the reactor coolant LCO, and pressure boundary. A high drywell pressure signal could indicate a LOCA APPLICABILITY and will automatically initiate the CREOAS System, since this could be a (continued) precursor to a potential radiation release and subsequent radiation exposure to control room personnel.

Drywell Pressure-High signals are initiated from four pressure instruments that sense drywell pressure. Four channels of Drywell Pressure-High Function are available (two channels per trip system) and are required to be OPERABLE to ensure that no single instrument failure can preclude CREOAS System initiation. The Drywell Pressure-High Allowable Value was chosen to be the same as the ECCS Drywell Pressure-High Allowable Value (LCO 3.3.5.1).

The Drywell Pressure-High Function is required to be OPERABLE in MODES 1, 2, and 3 to ensure that control room personnel are protected in the event of a LOCA. In MODES 4 and 5, the Drywell Pressure-High Function is not required since there is insufficient energy in the reactor to pressurize the drywell to the Drywall Pressure-High setpoint.

3, 4, 5, 6, 7 Refuel Floor High Exhaust Duct, Refuel Floor Wall Exhaust Duct and Railroad Access Shaft Exhaust Duct Radiation-High High secondary containment exhaust radiation is an indication of possible gross failure of the fuel cladding. The release may have originated from the refueling floor due to a fuel handling accident. When Exhaust Radiation-High is detected CREOAS is initiated to maintain the habitability of the main control room.

The Exhaust Radiation-High signals are initiated from radiation detectors that are located on the ventilation exhaust ducting coming from the refueling floor zone and the Railroad Access Shaft. The signal from each detector is input to an individual monitor whose trip outputs are assigned to an isolation channel. Eight total channels Refuel Floor High Exhaust Duct and Wall Exhaust (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-195 Revision O

_J

Rev. 3 CREOAS System Instrumentation B 3.3.7.1 BASES APPLICABLE 3, 4. 5, 6, 7 Refuel Floor High Exhaust Duct. Refuel Floor Wall Exhaust SAFETY Duct and Railroad Access Shaft Exhaust Duct Radiation-High (continued)

ANALYSES, LCO, and Duct Radiation-High Function (four from Unit 1 and four from Unit 2), and APPLICABILITY two channels of the Railroad Access Shaft Exhaust Radiation - High Function (both from Unit 1) are available and are required to be OPERABLE when the associated Refuel Floor Exhaust System is in operation to ensure that no single instrument failure can preclude the initiation function.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding. The Refuel Floor Exhaust Duct and Wall Exhaust Duct Radiation-High are required to be OPERABLE during CORE ALTERATIONS, OPDRVs, and movement of irradiated fuel assemblies in the secondary containment, because the capability of detecting radiation releases due to fuel failures (due to fuel uncovery or dropped fuel assemblies) must be provided to ensure that offsite and control room dose limits are not exceeded.

The Railroad Access Shaft Exhaust Duct Radiation - High Function is only required to be OPERABLE during handling of irradiated fuel within the Railroad Access Shaft, and directly above the Railroad Access Shaft with the Railroad Access Shaft Equipment Hatch open, because the capability of detecting radiation releases due to fuel failures (dropped fuel assemblies) must be provided to ensure that offsite and control room dose limits are not exceeded.

8. Main Control Room Outside Air Intake Radiation-High The main control room outside air intake radiation monitors measure radiation levels at the control structure outside air intake duct. A high radiation level may pose a threat to main control room personnel; thus, automatically initiating the CREOAS System. The Control Room Air Inlet Radiation-High Function consists of two independent monitors. Two channels of Control Room Air Inlet Radiation-High are available and are required to be OPERABLE to ensure that no single instrument failure can preclude CREOAS System initiation. The Allowable Value was selected to ensure protection of the control room personnel.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-196 Revision 2

Rev. 3 CREOAS System Instrumentation B 3.3.7.1 BASES APPLICABLE 8. Main Control Room Outside Air Intake Radiation-Hiah (continued)

SAFETY ANALYSES, The Control Room Air Inlet Radiation-High Function is required to be LCO, and OPERABLE in MODES 1, 2, and 3 and during CORE ALTERATIONS, APPLICABILITY OPDRVs, and movement of irradiated fuel assemblies in the secondary containment, to ensure that control room personnel are protected during a LOCA, fuel handling event, or vessel draindown event. During MODES 4 and 5, when these specified conditions are not in progress (e.g., CORE ALTERA TIONS), the probability of a LOCA or fuel damage is low; thus, the Function is not required.

9. Manual Initiation A Manual Initiation can be performed for CREOAS isolation by initiating a Primary Containment Isolation. There is no specific FSAR safety analysis that takes credit for this Function. It is retained for the overall redundancy and diversity of the secondary containment isolation instrumentation as required by the NRC approved licensing basis.

There are two push buttons for the logic, one manual initiation push button per trip system. There is no Allowable Value for this Function, since the channels are mechanically actuated based solely on the position of the push buttons.

Two channels of Manual Initiation Function are available and are required to be OPERABLE in MODES 1, 2, and 3, and during CORE ALTERATIONS, OPDRVs, and movement of irradiated fuel assemblies in the secondary containment. These are the MODES and other specified conditions in which the Secondary Containment Isolation automatic Functions are required to be OPERABLE.

ACTIONS A Note has been provided to modify the ACTIONS related to CREOAS System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-197 Revision O

Rev. 3 CREOAS System Instrumentation B 3.3.7.1 BASES ACTIONS entry into the Condition. Section 1.3 also specifies that Required Actions (continued) of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable CREOAS System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a. Note has been provided that allows separate Condition entry for each inoperable CREOAS System instrumentation channel.

Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.7.1.-1. The applicable Condition specified in the Table is Function dependent. Each time a channel is discovered inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

B.1.1. B.1.2. B.2.1, and B.2.2 Because of the diversity of sensors available to provide initiation signals

and the redundancy of the CREOAS System design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Function 2 and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for all other Functions has been shown to be acceptable (Refs. 3 and 4) to permit restoration of any inoperable channel to OPERABLE status. However, this out of service time is only acceptable provided the associated Function is still maintaining CREOAS System initiation capability. A Function is considered to be maintaining CREOAS System initiation capability when sufficient channels are OPERABLE or in trip such that one trip system will generate an initiation signal from the given Function on a valid signal. For Functions 1 and 2, this would require one trip system to have two channels per logic string OPERABLE or in trip. For Functions 3, 4, 5, 6 and 7, this would require one trip system to have one channel OPERABLE. .

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-198 Revision O

Rev.3 CREOAS System Instrumentation B 3.3.7.1 BASES ACTIONS B.1.1, B.1.2, B.2.1, and B.2.2 (continued)

Required Action B.1.2 is provided to allow the associated CREOAS subsystem(s) to be placed in the pressurization/ filtration mode of operation within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This is acceptable because placing the associated CREOAS subsystem(s) in the pressurization/filtration mode performs the safety function of the affected instrumentation. The method used to place the CREOAS subsystem(s) in operation must provide for automatically re-initiating the subsystem(s) upon restoration of power following a loss of power to the CREOAS subsystem(s).

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time (B.1.1, B.1.2) is acceptable because it minimizes risk while allowing time for restoring, tripping of channels or placing in operation.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.2.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to

continue .

Required Action B.2.2 is provided to allow the associated CREOAS subsystem(s) to be placed in the pressurization/filtration mode of operation. This is acceptable because placing the associated CREOAS subsystem(s) in the pressurization/filtration mode performs the safety function of the affected instrumentation. The method used to place the CREOAS subsystem(s) in operation must provide for automatically re-initiating the subsystem(s) upon restoration of power following a loss of power to the CREOAS subsystem(s).

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-199 Revision 0

. Rev. 3 CREOAS System Instrumentation

B 3.3.7.1 BASES ACTIONS C.1.1, C.1.2 and C.2 (continued)

Because of the diversity of sensors available to provide initiation signals and the redundancy of the CREOAS System design, an allowable out of service time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is provided to permit restoration of any inoperable channel to OPERABLE status.* However, this out .of service time is only acceptable provided the associated Function is still maintaining CREOAS System initiation capability. A Function is considered to be maintaining CREOAS System initiation capabilitywhen sufficient channels are OPERABLE or in trip such that one trip system will generate an initiation signal from the given Function on a valid signal. For Function 8, this would require one trip system to have one channel OPERABLE or in trip.

For loss of CREOAS System initiation capability, the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance of Required Action C.2 is not appropriate. If the Function is not maintaining CREOAS System initiation capability, the CREOAS System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of discovery of the loss of CREOAS System initiation capability in both trip systems.

Required Action C.1.2 is provided to allow the associated CREOAS subsystem(s) to be placed in pressurization/ filtration mode of operation within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This is acceptable because placing the associated CREOAS subsystem(s) in the pressurization/filtration mode performs the safety function of the affected instrumentation. The method used to place the CREOAS subsystem(s) in operation must provide for automatically re-initiating the subsystem(s) upon restoration of power following a loss of power to the CREOAS subsystem(s).

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time (C.1.1 and C.1.2) is acceptable because it minimizes risk while allowing time for restoring or tripping of channels.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the

tripped condition per Required Action C.2. Placing the inoperable channel in trip performs the intended function of the channel (starts the lead CREOAS subsystems in the pressurization/filtration mode). Alternately, if it is not desired to place the channel in trip (e.g., as in the case where it is not desired to start the subsystem), Condition D must be entered and its Required Action taken. The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is based on the (continued)

SUSQUEHANNA- UNIT 2 TS I B 3.3-200 Revision O

Rev.3 CREOAS System Instrumentation

B 3.3.7.1 BASES ACTIONS C.1.1. C.1.2 and C.2 (continued) consideration that this Function provides the primary signal to start the CREOAS System; thus, ensuring that the design basis of the CREOAS System is met.

With any Required Action and associated Completion Time not met, the associated CREOAS subsystem must be declared inoperable immediately per Required Action 0.1 to ensure that control room personnel will be protected in the event of a Design Basis Accident.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each CREOAS System REQUIREMENTS instrumentation Function are located in the SRs column of Table 3.3.7.1-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains CREOAS System initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allo'!lfance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 3 and 4) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the CREOAS System will initiate when necessary.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-201 Revision O

Rev.3 CREOAS System Instrumentation B 3.3.7.1 BASES SURVEILLANCE REQUIREMENTS SR 3 *3 *7 *1

1 (continued) Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even.more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria which are determined by the plant staff based on an investigation of a combination of the channel instrument uncertainties may be used to support this parameter comparison and include indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit, and does not necessarily indicate the channel is Inoperable .

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal checks of channel status during normal operational use of the displays associated with channels required by the LCO.

SR 3.3.7.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-202 Revision 1

Rev. 3

- BASES CREOAS System Instrumentation B 3.3.7.1 SURVEILLANCE REQUIREMENTS SR 3.3.7.1.2 (continued)

This SR is modified by two Notes. Note 1 provides a general exception to the definition of CHANNEL FUNCTIONAL TEST. This exception is necessary because the design of instrumentation does not facilitate functional testing of all required contacts of the relays which input into the combinational logic. (Reference 6) Performance of such a test could result in a plant transient or place the plant in an undo risk situation.

Therefore, for this SR, the CHANNEL FUNCTIONAL TEST verifies acceptable response by verifying the change of state of the relay which inputs into the combinational logic. The required contacts not tested during the CHANNEL FUNCTIONAL TEST are tested under the LOGIC SYSTEM FUNCTIONAL TEST, SR 3.3.7.1.5. This is acceptable because operating experience shows that the contacts not tested during the CHANNEL FUNCTIONAL TEST normally pass the LOGIC SYSTEM FUNCTIONAL TEST, and the testing methodology minimizes the risk of unplanned transients.

Note 2 provides a second specific exception to the definition of CHANNEL FUNCTIONAL TEST. For Function 8, certain channel relays are not included in the performance of the CHANNEL FUNCTIONAL TEST.

These exceptions are necessary because the circuit design does not facilitate functional testing of the entire channel through to the coil of the relay which enters the combinational logic. (Reference 6) .Specifically, testing of all required relays would require lifting of of leads and inserting test equipment which could lead to unplanned transients. Therefore, for these circuits, the CHANNEL FUNCTIONAL TEST verifies acceptable response by verifying the actuation of circuit devices up to the point where further testing would result in an unplanned transient. (References 7 and

8) The required relays not tested during the CHANNEL FUNCTIONAL TEST are tested under the LOGIC SYSTEM FUNCTIONAL TEST, SR 3.3.7.1.5. This is acceptable because operating experience shows that the devices not tested during the CHANNEL FUNCTIONAL TEST normally pass the LOGIC SYSTEM FUNCTIONAL TEST, and the testing methodology minimizes the risk of unplanned transients.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-203 Revision O

Rev. 3 CREOAS System Instrumentation B 3.3.7.1 BASES SURVEILLANCE REQUIREMENTS SR 3.3.7.1.3 and SR 3.3.7.1.4 (continued) A CHANNEL CALIBRATION verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.7.1.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.7.3, "Control Room Emergency Outside Air Supply (CREOAS) System," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance

REFERENCES Frequency Control Program .

1. FSAR, Section 6.4.1.

2. FSAR, Table 15.2.

3. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," February 1991.

4. NEDC-31677P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation," July 1990.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-204 Revision 1

Rev.3 CREOAS System Instrumentation B 3.3.7.1 BASES REFERENCES 5. Final Policy Statement on Technical Specification Improvements, (continued) July 22, 1993 (58 FR 32193).

6. NRC Inspection and Enforcement Manual, Part 9900: Technical Guidance, Standard Technical Specification Section 1.0 Definitions, Issue date 12/08/86.

7. PPL Letter to NRC, PLA-2618, Response to NRC INSPECTION REPORTS 50-387/85-28 and 50-388/85-23, dated April 22, 1986.

8. Susquehanna Steam Electric Station NRC REGION I COMBINED INSPECTION 50-387/90-20; 50-388/90-20, File R41-2, dated March 5, 1986 .

SUSQUEHANNA - UNIT 2 TS I B 3.3-205 Revision O

Rev.4 LOP Instrumentation

B 3.3.8.1 B 3.3 INSTRUMENTATION B 3.3.8.1 Loss of Power (LOP) Instrumentation BASES BACKGROUND Successful operation of the required safety functions of the Emergency Core Cooling Systems (ECCS) is dependent upon the availability of adequate power sources for energizing the various components such as pump motors, motor operated valves, and the associated control components. The LOP instrumentation monitors the 4.16 kV emergency buses. Offsite power is the preferred source of power for the 4.16 kV emergency buses. If the monitors determine that insufficient power is available, the buses are disconnected from the offsite power sources and connected to the onsite diesel generator (DG) power sources.

Each 4.16 kV emergency bus has its own independent LOP instrumentation and associated trip logic. The voltage for each bus is monitored at three levels, which can be considered as three different undervoltage Functions: Loss of Voltage(< 20%), 4.16 kV Emergency Bus Undervoltage Degraded Voltage LOCA (< 93%), and 4.16 kV

Emergency Bus Undervoltage Low Setting (Degraded Voltage)(< 65%) .

Each Function, with the exception of the Loss of Voltage relays is monitored by two undervoltage relays for each emergency bus, whose outputs are arranged in a two-out-of-two logic configuration. The Loss of Voltage Function is monitored by one undervoltage relay for each emergency bus, whose output is arranged in a one-out-of-one logic configuration. When voltage degrades below the setpoint, the channel output relay actuates, which then outputs a LOP trip signal to the trip logic.

APPLICABLE The LOP instrumentation is required for Engineered Safety Features to SAFETY function in any accident with a loss of offsite power. The Unit 1 LOP ANALYSES, instrumentation is required to be operable for Unit 2 when the associated LCO, and Unit 1 4.16 kV emergency buses are required to be operable per Unit 2 APPLICABILITY T.S. 3.8.7 and 3.8.8. The required channels of LOP instrumentation ensure that.the ECCS and other assumed systems powered from the DGs, provide plant protection in the event of any of the Reference 1 and 2 analyzed accidents in which a loss of offsite power is assumed. The initiation of the DGs on loss of offsite power, and subsequent initiation of the ECCS, ensure that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-206 Revision 1

Rev. 4 LOP Instrumentation B 3.3.8.1 BASES APPLICABLE Accident analyses credit the loading of the DG based on the loss of offsite SAFETY power during a loss of coolant accident. The diesel starting and loading ANALYSES, times have been included in the delay time associated with each safety LCO, and system component requiring DG supplied power following a loss of offsite APPLICABILITY power.

(continued)

The LOP instrumentation satisfies Criterion 3 of the NRG Policy Statement. (Ref. 3)

The OPERABILITY of the LOP instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.8.1-1. Each Function must have a required number of OPERABLE channels per 4.16 kV emergency bus, with their setpoints within the specified Allowable Values. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

The Allowable Values are specified for each Function in the Table. Trip setpoints are specified in the system calculations. The setpoints are selected to ensure that the setpoints do not exceed the Allowable Value.

Operation with a trip setpoint less conservative than the nominal trip setpoint, but within the Allowable Value, is acceptable. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g.,

degraded voltage), and when the measured output value of the process parameter reaches the setpoint, the associated device changes state.

The Allowable Values are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are then derived based on engineering judgment.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

(continued)

SUSQUEHANNA - UNIT 2 B 3.3-207 Revision O

Rev.4 LOP Instrumentation B 3.3.8.1 BASES APPLICABLE 1. 4.16 kV Emergency Bus Undervoltage (Loss of Voltage< 20%)

SAFETY ANALYSES, Loss of voltage on a 4.16 kV emergency bus indicates that offsite power LCO, and may be completely lost to the respective emergency bus and is unable to APPLICABILITY supply sufficient power for proper operation of the applicable equipment.

(continued) Therefore, the power supply to the bus is transferred from offsite power to DG power when the voltage on the bus drops below the Loss of Voltage Function Allowable Values (loss of voltage with a short time delay). This ensures that adequate power will be available to the required equipment.

The Bus Undervoltage Allowable Values are low enough to prevent inadvertent power supply transfer, but high enough to ensure that power is available to the required equipment. The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that power is available to the required equipment.

One channel of 4.16 kV Emergency Bus Undervoltage (Loss of Voltage)

Function per associated emergency bus is required to be OPERABLE when the associated DG is required to be OPERABLE to ensure that no

single instrument failure can preclude the DG function. 4.16 kV Emergency Bus Undervoltage (Loss of Voltage) relay controls and provides a permissive to allow closure of the associated alternate source breaker and the associated DG breaker. (one channel input to each of the four DGs.) Refer to LCO 3.8.1, "AC Sources-Operating," and 3.8.2, "AC Sources-Shutdown," for Applicability Bases for the DGs.

2., 3. 4.16 kV Emergency Bus Undervoltage (Degraded Voltage)

A reduced voltage condition on a 4 kV emergency bus indicates that, while offsite power may not be completely lost to the respective emergency bus, available power may be insufficient for starting large ECCS motors without risking damage to the motors that could disable the ECCS function. Therefore, power supply to the bus is transferred from offsite power to onsite DG power when there is no offsite power or a degraded power supply to the bus. This transfer will occur only if the voltage of the primary and alternate power sources drop below the Degraded Voltage Function (continued)

SUSQUEHANNA - UNIT 2 B 3.3-208 Revision O

Rev.4 LOP Instrumentation

B 3.3.8.1 BASES APPLICABLE 2 .. 3. 4.16 kV Emergency Bus Undervoltage (Degraded Voltage)

SAFETY (continued)

ANALYSES, LCO, and Allowable Values (degraded voltage with a time delay) and the source APPLICABILITY breakers trip which causes the DG to start. This ensures that adequate power will be available to the required equipment.

Two Functions are provided to monitor degraded voltage at two different levels. These Functions are the Degraded Voltage LOCA (< 93%) and Degraded Voltage Low Setting(< 65%). These relays respond to ,.

degraded voltage as follows: 93% for approximately 5 minutes (wh"en no LOCA signal is present) and approximately 1O seconds (with a LOCA signal present), and 65% (Degraded Voltage Low Setting). The Degraded Voltage LOCA Function preserves the assumptions of the LOCA analysis and the Degraded Voltage Low Setting Function preserves the assumptions of the accident sequence analysis in the FSAR. The circuitry is designed such that with the LOCA signal present, the non-LOCA time delay is physically bypassed.

The Bus Undervoltage Allowable Values are low enough to prevent

inadvertent power supply transfer, but high enough to ensure that sufficient power is available to the required equipment. The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that sufficient power is available to the required equipment.

Two channels of 4.16 kV Emergency Bus Undervoltage (Degraded Voltage) per Function (Functions 2 and 3) per associated bus are required

. to be OPERABLE when the associated DG is required to be OPERABLE.

This ensures no single instrument failure can preclude the start of DGs (each logic inputs to each of the four DGs). Refer to LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for the DGs.

ACTIONS A Note has been provided to modify the ACTIONS related to LOP instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into (continued)

SUSQUEHANNA - UNIT 2 B 3.3-209 Revision O

Rev. 4 LOP Instrumentation B 3.3.8.1 BASES ACTIONS the Condition. Section 1.3 also specifies that Required Actions of the (continued) Condition continue to apply for each additional failu're, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable LOP instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable LOP instrumentation channel.

Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.8.1-1 when LOP instrumentation channels are inoperable for reasons other than for the performance of SR 3.8.1.19 on Unit 1. The applicable Condition specified in the Table is Function dependent. Each time a channel associated with a Unit 1 4.16 kV ESS Bus since the Unit 1 4.16 kV ESS Buses power station common loads such as SGTS, CREOASS, and ESW or a Unit 2 4.16 ESS Bus is discovered inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition .

With one or more required channels on the Unit 1 4.16 kV ESS Buses in one Division for the performance of SR 3.8.1.19 in Unit 1 inoperable but not resulting in a loss of safety function, the remaining channels are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining channels could result in the minimum required ESF functions not being supported. Therefore, the required Unit 1 4.16 kV ESS Bus channels must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-21 O Revision 1

Rev.4 LOP Instrumentation B 3.3.8.1 BASES ACTIONS C.1 (continued)

With one or more channels of a Function inoperable, the Function is not capable of performing the intended function. Therefore, only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore the inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action C.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability: restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels .

With one channel of the Function inoperable, the Function is not capable of performing the intended function. Therefore, only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore the inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition E must be entered and its Required Action taken.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of channels.

If the Required Action and associated Completion Times of Conditions B, C, or D are not met, the associated Function is not capable of performing the intended function. Therefore, the associated DG(s) is declared inoperable immediately for Unit 2 only. This requires entry into applicable Conditions and Required Actions of Unit 2 LCO 3.8.1 and LCO 3.8.2, which provide appropriate actions for the inoperable DG(s).

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-211 Revision 2

Rev.4 LOP Instrumentation

BASES.

SURVEILLANCE REQUIREMENTS As noted at the beginning of the SRs, the SRs for each LOP instrumentation Function are located in the SRs column of B 3.3.8.1 Table 3.3.8.1-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains DG initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

SR 3.3.8.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of in.~trumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the

instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria which are determined by the plant staff based on an investigation of a combination of the channel instrument uncertainties may be used to support this parameter comparison and include indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal checks of channels during normal operational use of the displays associated with channels required by the LCO.

SR 3.3.8.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-212 Revision 2

Rev. 4 LOP Instrumentation B 3.3.8.1 BASES SURVEILLANCE SR 3.3.8.1.2 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SR 3.3.8.1.3 A CHANNEL CALIBRATION verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.8.1.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed in LCO 3.8.1 and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety functions.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.3.

2. FSAR, Chapter 15.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 32193) .

SUSQUEHANNA - UNIT 2 TS I B 3.3-213 Revision 2

Rev. 1 RPS Electric Power Monitoring

B 3.3 B 3.3.8.2 INSTRUMENTATION Reactor Protection System (RPS) Electric Power Monitoring B 3.3.8.2 BASES BACKGROUND RPS Electric Power Monitoring System is provided to isolate the RPS bus from the motor generator (MG) set or an alternate power supply in the event of overvoltage, undervoltage, or underfrequency. This system protects the loads connected to the RPS bus against unacceptable voltage and frequency conditions (Ref. 1) and forms an important part of the primary success path of the essential safety circuits. Some of the essential equipment powered from the RPS buses includes the RPS logic, scram solenoids, and various valve isolation logic.

RPS electric power monitoring assembly will detect any abnormal high or low voltage or low frequency condition in the outputs of the two MG sets or the alternate power supply and will de-energize its respective RPS bus, thereby causing all safety functions normally powered by this bus to de-energize.

In the event of failure of an RPS Electric Power Monitoring System (e.g.,

both in series electric power monitoring assemblies), the RPS loads may experience significant effects from the unregulated power supply.

Deviation from the nominal conditions can potentially cause damage to the scram solenoids and other Class 1E devices.

In the event of a low voltage condition for an extended period of time, the scram solenoids can chatter and potentially lose their pneumatic control capability, resulting in a loss of primary scram action.

In the event of an overvoltage condition, the RPS logic relays and scram solenoids, as well as the main steam isolation valve (MSIV) solenoids, may experience a voltage higher than their design voltage. If the overvoltage condition persists for an extended time period, it may cause equipment degradation and the loss of plant safety function.

Two redundant Class 1E circuit breakers are connected in series between each RPS bus and its MG set, and between each RPS bus and its alternate power supply. Each of these (continued)

SUSQUEHANNA- UNIT 2 B 3.3-214 Revision 0

Rev.1 RPS Electric Power Monitoring

BASES BACKGROUND circuit breakers has an associated independent set of Class 1 E B 3.3.8.2 (continued) overvoltage, undervoltage, and underfrequency sensing logic. Together,*

a circuit breaker and its sensing logic constitute an electric power

monitoring assembly. If the output of the MG set exceeds predetermined limits of overvoltage, undervoltage, or underfrequency, a trip coil driven by this logic circuitry opens the circuit breaker, which removes the associated power supply from service.

APPLICABLE The RPS electric power monitoring is necessary to meet the assumptions SAFETY of the safety analyses by ensuring that the equipment powered from the ANALYSES RPS buses can perform its intended function. RPS electric power monitoring provides protection to the RPS and other systems that receive power from the RPS buses, by acting to disconnect the RPS from the power supply under specified conditions that could damage the RPS bus powered equipment.

RPS electric power monitoring satisfies Criterion 3 of the NRC Policy.

Statement (Ref. 3) .

LCO The OPERABILITY of each RPS electric power monitoring assembly is dependent on the OPERABILITY of the overvoltage, undervoltage, and underfrequency logic, as well as the OPERABILITY of the associated circuit breaker. Two electric power monitoring assemblies are required to be OPERABLE for each inservice power supply. This provides redundant protection against any abnormal voltage or frequency conditions to ensure that no single RPS electric power monitoring assembly failure can preclude the function of RPS bus powered components. Each inservice electric power monitoring assembly's trip logic setpoints are required to be within the specified Allowable Value. The actual setpoint is calibrated consistent with applicable analysis assumptions.

Allowable Values are specified for each RPS electric power monitoring assembly trip logic (refer to SR 3.3.8.2.2). Trip setpoints are specified in the setpoint calculations. The setpoints are selected to ensure that the setpoints do not.exceed the Allowable Value. A channel is inoperable if (continued)

SUSQUEHANNA- UNIT 2 B 3.3-215 Revision 0

Rev. 1 RPS Electric Power Monitoring

BASES LCO B 3.3.8.2 its actual trip setpoint is not within its required Allowable Value. Trip (continued) setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., overvoltage), and when the measured output value of the process parameter reaches the setpoint, the associated device changes state. The RPS Power Monitoring Allowable Values are derived from the limiting values of the process parameters obtained from the safety analysis.

The Allowable Values for the instrument settings are based on the RPS power supply providing a suitable power source for the associated electrical loads. The most limiting voltage requirement and associated line losses determine the settings of the electric power monitoring instrument channels. The settings are calculated based on the continuous loads on the buses and RPS MG set or alternate power supply being 120 VAC and 60 Hz. A time delay is provided for each of the RPS power monitoring functions. The time delay is provided only to prevent spurious trips and does not impact the OPERABILITY of the RPS power monitoring system, provided it would not prevent a required trip from actuating .

APPLICABILITY The operation of the RPS electric power monitoring assemblies is essential to disconnect the RPS bus powered components from the MG set or alternate power supply during abnormal voltage or frequency conditions. Since the degradation of a nonclass 1E source supplying power to the RPS bus can occur as a result of any random single failure, the OPERABILITY of the RPS electric power monitoring assemblies is required when the RPS bus powered components are required to be OPERABLE. This results in the RPS Electric Power Monitoring System OPERABILITY being required in MODES 1, 2, and 3; and in MODES 4 and 5.

ACTIONS A.1 If one RPS electric power monitoring assembly for an inservice power supply (MG set or alternate) is inoperable, or one RPS electric power monitoring assembly on each (continued)

SUSQUEHANNA - UNIT 2 B 3.3-216 Revision O

Rev. 1 RPS Electric Power Monitoring

BASES ACTIONS A.1 (continued)

B 3.3.8.2 inservice power supply is inoperable, the OPERABLE assembly will still provide protection to the RPS bus powered components under degraded voltage or frequency conditions. However, the reliability and redundancy of the RPS Electric Power Monitoring System is reduced, and only a limited time (72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ) is allowed to restore the inoperable assembly to OPERABLE status. If the inoperable assembly cannot be restored to OPERABLE status, the associated power supply(s) must be removed frpm service (Required Action A.1). This places the RPS bus in a safe condition. An alternate power supply with OPERABLE powering monitoring assemblies may then be used to power the RPS bus.

The\ 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the remaining OPERABLE electric power monitoring assembly and the low probability of an event requiring RPS electric power monitoring protection occurring during this period. It allows time for plant operations personnel to take corrective actions or to place the plant in the required condition in an orderly manner and without challenging plant systems .

Alternately, if it is not desired to remove the power supply from service (e.g., as in the case where removing the power supply(s) from service would result in a scram or isolation), Condition C or D, as applicable, must be entered and its Required Actions taken.

If both power monitoring assemblies for an inservice power supply (MG set or alternate) are inoperable or both power monitoring assemblies in each inservice power supply are inoperable, the system protective function is lost. In this condition, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore one assembly to OPERABLE status for each inservice power supply. If one inoperable assembly for each inservice power supply cannot be restored to OPERABLE status, the associated power supply(s) must be removed from service within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (Required Action 8.1). An alternate power supply with (continued)

SUSQUEHANNA - UNIT 2 B 3.3-217 Revision O

Rev. 1 RPS Electric Power Monitoring

BASES ACTIONS B.1 (continued)

B 3.3.8.2 OPERABLE assemblies may then be used to power one RPS bus. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is sufficient for the plant operations personnel to take corrective actions and is acceptable because it minimizes risk while allowing time for restoration or removal from service of the electric power monitoring assemblies.

Alternately, if it is not desired to remove the power supply(s) from service (e.g., as in the case where removing the power supply(s) from service would result in a scram or isolation), Condition C or D, as applicable, must be entered and its Required Actions taken.

C.1 and C.2 If any Required Action and associated Completion Time of Condition A or B are not met in MODE 1, 2, or 3, a plant shutdown must be performed.

This places the plant in a condition where minimal equipment, powered through the inoperable RPS electric power monitoring assembly(s), is required and ensures that the safety function of the RPS (e.g., scram of control rods) is not required. The plant shutdown is accomplished by placing the plant in MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1. D.2.1, and D.2.2 If any Required Action and associated Completion Time of Condition A or B are not met in MODE 4 or 5, the operator must immediately initiate action to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Required Action D.1 results in the least reactive condition for the reactor core and ensures that the safety function of the RPS (e.g., scram of control rods) is not required.

(continued)

SUSQUEHANNA - UNIT 2 B 3.3-218 Revision 0

Rev. 1 RPS Electric Power Monitoring B 3.3.8.2 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued)

In addition, action must be immediately initiated to either restore one electric power monitoring assembly to OPERABLE status for the inservice power source supplying the required instrumentation powered from the RPS bus (Required Action D.2.1) or to isolate the RHR Shutdown Cooling System (Required Action D.2.2). Required Action D.2.1 is provided because the RHR Shutdown Cooling System may be needed to provide core cooling. All actions must continue until the applicable Required Actions are completed.

SURVEILLANCE REQUIREMENTS SR 3 *3 *8 *2 *1 A CHANNEL FUNCTIONAL TEST is performed on each overvoltage, undervoltage, and underfrequency system to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

As noted in the Surveillance, the CHANNEL FUNCTIONAL TEST is only required to be performed while the plant is in a condition in which the loss of the RPS bus will not jeopardize steady state power operation (the design of the system is such that the power source must be removed from service to conduct the Surveillance). The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is intended to indicate an outage of sufficient duration to allow for scheduling and proper performance of the Surveillance.

The Note in the Surveillance is based on guidance provided in Generic Letter 91-09 (Ref. 2). The Surveillance Frequency is controlled under the Surveillance Frequency Control Pr<;>gram.

SR 3.3.8.2.2 CHANNEL CALIBRATION verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.3-219 Revision 1 I

Rev. 1 RPS Electric Power Monitoring

BASES SURVEILLANCE B 3.3.8.2 REQUIREMENTS SR 3.3.8.2.2 (continued)

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.8.2.3 Performance of a system functional test demonstrates that, with a required system actuation (simulated or actual) signal, the logic of the system will automatically trip open the associated power monitoring assembly. Only one signal per power monitoring assembly is required to be tested. This Surveillance overlaps with the CHANNEL CALIBRATION to provide complete testing of the safety function. The system functional test of the Class 1E circuit breakers is included as part of this test to provide complete testing of the safety function. If the breakers are incapable of operating, the associated electric power monitoring assembly would be inoperable .

REFERENCES The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

1. FSAR, Section 8.3.1.6.

2. NRC Generic Letter 91-09, "Modification of Surveillance Interval for the Electrical Protective Assemblies in Power Supplies for the Reactor Protection System

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 32193)

SUSQUEHANNA - UNIT 2 TS I B 3.3-220 Revision 1

_I

Rev. 5 Recirculation Loops Operating

B 3.4 B 3.4.1 REACTOR COOLANT SYSTEM (RCS)

Recirculation Loops Operating B 3.4.1 BASES BACKGROUND The Reactor Coolant Recirculation System is designed to provide a forced coolant flow through the core to remove heat from the fuel. The forced coolant flow removes more heat from the fuel than would be possible with just natural circulation. The forced flow, therefore, allows operation at significantly higher power than would otherwise be possible. The recirculation system also controls reactivity over a wide span of reactor power by varying the recirculation flow rate to control the void content of the moderator. The Reactor Coolant Recirculation System consists of two recirculation pump loops external to the reactor vessel. These loops provide the piping path for the driving flow of water to the reactor vessel jet pumps. Each external loop contains one variable speed motor driven recirculation pump, a motor generator (MG) set to control pump speed and associated piping, jet pumps, valves, and instrumentation. The recirculation pump, piping, and valves are part of the reactor coolant pressure boundary and are located inside the drywell structure. The jet pumps are reactor vessel internals .

The recirculated coolant consists of saturated water from the steam separators and dryers that has been subcooled by incoming feedwater.

This water passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold, from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the suction flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the driving flow. The drive flow and suction flow are mixed in the jet pump throat section. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core. The subcooled water enters the bottom of the fuel channels and contacts the fuel

SUSQUEHANNA- UNIT 2 TS I B 3.4-1 (continued)

Revision 2

Rev. 5 Recirculation Loops Operating

BASES BACKGROUND B 3.4.1 cladding, where heat is transferred to the coolant. As it rises, the coolant (continued) begins to boil, creating steam voids within the fuel channel that continue until the coolant exits the core. Because of reduced moderation, the steam voiding introduces negative reactivity that must be compensated for to maintain or to increase reactor power. The recirculation flow control allows operators to increase recirculation flow and sweep some of the voids from the fuel channel, overcoming the negative reactivity void effect.

Thus, the reason for having variable recirculation flow is to compensate for reactivity effects of boiling over a wide range of power generation without having to move control rods and disturb desirable flux patterns.

Each recirculation loop is manually started from the control room. The MG set provides regulation of individual recirculation loop drive flows. The flow in each loop is manually controlled.

APPLICABLE The operation of the Reactor Coolant Recirculation System is an initial SAFETY condition assumed in the design basis loss of coolant accident (LOCA)

ANALYSES (Ref. 1). During a LOCA caused by a recirculation loop pipe break, the intact loop is assumed to provide coolant flow during the first few seconds of the accident. The initial core flow decrease is rapid because the recirculation pump in the broken loop ceases to pump reactor coolant to the vessel almost immediately. The pump in the intact loop coasts down relatively slowly. This pump coastdown governs the core flow response for the next several seconds until the jet pump suction is uncovered (Ref. 1). The analyses assume that both loops are operating at the same flow prior to the accident. However, the LOCA analysis was reviewed for the case with a flow mismatch between the two loops, with the pipe break assumed to be in the loop with the higher flow. While the flow coastdown and core response are potentially more severe in this assumed case (since the intact loop starts at a lower flow rate and the core response is the same as if both loops were operating at a lower flow rate), a small mismatch has been determined to be acceptable based on engineering judgment. The recirculation system is also assumed to have sufficient flow coastdown characteristics to maintain fuel thermal margins during abnormal operational transients (Ref. 2), which are analyzed in Chapter 15 of the FSAR.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-2 Revision 2

Rev. 5 Recirculation Loops Operating

BASES APPLICABLE Plant specific LOCA analyses have been performed assuming only one B 3.4.1 SAFETY operating recirculation loop. These analyses have demonstrated that, in ANALYSES the event of a LOCA caused by a pipe break in the operating recirculation (continued) loop, the Emergency Core Cooling System response will provide adequate core cooling, provided that the APLHGR limit for SPC ATRIUM'-10 fuel is modified.

The transient analyses of Chapter 15 of the FSAR have also been performed for single recirculation loop operation and demonstrate sufficient flow coastdown characteristics to maintain fuel thermal margins during the abnormal operational transients analyzed provided the MCPR requirements are modified. During single recirculation loop operation, modification to the Reactor Protection System (RPS) average power range monitor (APRM) instrument setpoints is also required to account for the different relationships between recirculation drive flow and reactor core flow. The APLHGR, LHGR, and MCPR limits for single loop operation are specified in the COLR. The APRM Simulated Thermal Power-High setpoint is in LCO 3.3.1.1, "Reactor Protection System (RPS)

Instrumentation." In addition, a restriction on recirculation pump speed is incorporated to address reactor vessel internals vibration concerns and assumptions in the event analysis.

Recirculation loops operating satisfies Criterion 2 of the NRC Policy Statement (Ref. 5).

LCO Two recirculation loops are required to be in operation with their flows matched within the limits specified in SR 3.4.1.1 to ensure that during a LOCA caused by a break of the piping of one recirculation loop the assumptions of the LOCA analysis are satisfied. With the limits specified in SR 3.4.1.1 not met, the recirculation loop with the lower flow must be considered not in operation. With only one recirculation loop in operation, modifications to the required APLGHR limits (LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE"), LHGR limits (LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), and APRM Simulated Thermal Power-High setpoint (LCO 3.3.1.1) may be applied to allow continued operation consistent with the safety analysis assumptions.

Furthermore, restrictions are placed on recirculation pump speed to ensure the initial assumption of the event analysis are maintained.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-3 Revision 4

Rev.5

Recirculation Loops Operating

BASES LCO (continued)

The LCO is modified by a Note that allows up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to establish the required limits and setpoints after a change from two recirculation loops B 3.4.1 operation to single recirculation loop operation. If the limits and setpoints are not in compliance with the applicable requirements at the end of this period, the ACTIONS required by the applicable specifications must be implemented. This time is provided to stabilize operation with one recirculation loop by: limiting flow in the operating loop, limiting total THERMAL POWER, monitor APRM and local power range monitor

{LPRM) neutron flux noise levels; and, fully implementing and confirming the required limit and setpoint modifications.

APPLICABILITY In MODES 1 and 2, requirements for operation of the Reactor Coolant Recirculation System are necessary since there is considerable energy in the reactor core and the limiting design basis transients and accidents are assumed to occur.

In MODES 3, 4, and 5, the consequences of an accident are reduced and the coastdown characteristics of the recirculation loops are not important.

ACTIONS When operating with no recirculation loops operating in MODE 1*. the potential for thermal-hydraulic oscillations is greatly increased. Although this transient is protected for expected modes of oscillation by the OPRM system, when OPERABLE per LCO 3.3.1.1, function 2. f (Reference 3, 4),

the prudent response to the natural circulation condition is to preclude potential thermal-hydraulic oscillations by immediately placing the mode switch in the shutdown position.

Recirculation loop flow must match within required limits when both recirculation loops are in operation. *If flow mismatch is not within required limits, matched flow must be restored within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . If matched flows are not restored, the recirculation loop with lower flow must be declared "not in operation." Should a LOCA occur with recirculation loop flow not matched, the core flow coastdown and resultant core response may not be bounded by the LOCA analyses. Therefore, only a limited time is allowed prior to imposing restrictions associated with single loop operation. Operation with only one recirculation loop satisfies the requirements of the LCO and the initial conditions of the accident sequence.

{continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-4 Revision 4

Rev. 5 Recirculation Loops Operating

BASES ACTIONS The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is based on the low probability of an accident B 3.4.1 (continued) occurring during this time period, providing a reasonable time to complete the Required Action, and considering that frequent core monitoring by operators allows abrupt changes in core flow conditions to be quickly detected.

These Required Actions do not require tripping the recirculation pump in the lowest flow loop when the mismatch between total jet pump flows of the two loops is greater than the required limits. However, in cases where large flow mismatches occur, low flow or reverse flow can occur in the low flow loop jet pumps, causing vibration of the jet pumps. If zero or reverse flow is detected, the condition should be alleviated by changing recirculation pump speed to re-establish foiward flow or by tripping the pump. Additional recirculation loop flow rate restrictions during single loop operation are provided in TRM Section 3.4.6.

With no recirculation loops in operation while in MODE 2 or if after going to single loop operations the required limits and setpoints cannot be established, the plant must be brought to MODE 3, where the LCO does not apply within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In this condition, the recirculation loops are not required to be operating because of the reduced severity of DBAs and minimal dependence on the recirculation loop coastdown characteristics.

The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable to reach MODE 3 from full power conditions in an orderly manner without challenging plant systems.

SURVEILLANCE SR 3.4.1.1 REQUIREMENTS This SR ensures the recirculation loops are within the allowable limits for mismatch. At low core flow (i.e.,< 75 million lbm/hr), the MCPR requirements provide larger margins to the fuel cladding integrity Safety Limit such that the potential adverse effect of early boiling transition during a LOCA is reduced. A larger flow mismatch can therefore be allowed when core flow is < 75 million lbri'l/hr. The recirculation loop jet pump flow, as used in this Surveillance, is the summation of the flows from all of the jet pumps associated with a single recirculation loop.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-5 Revision 4

Rev.5 Recirculation Loops Operating

BASES SURVEILLANCE SR 3.4.1.1 (continued)

B 3.4.1 REQUIREMENTS The mismatch is measured in terms of core flow. If the flow mismatch exceeds the specified limits, the loop with the lower flow is considered inoperable. The SR is not required when both loops are not in operation since the mismatch limits are meaningless during single loop or naturar circulation operation. The Surveillance must be performed within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after both loops are in operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.1.2 As noted, this SR is only applicable when in single loop operation. This SR ensures the recirculation pump limit is maintained. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.3.3. 7.

2. FSAR, Section 5.4.1.4 .

3. GE NED0-31960-A "BWROG Long Term.Stability Solutions Licensing Methodology," November 1995.

4. GE NED0-31960-A "BWROG Long Term Stability Solutions Licensing Methodology," Supplement 1, November 1995.

5. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA- UNIT 2 TS I B 3.4-6 Revision 4

Rev.5 Recirculation Loops Operating

8 3.4.1 THIS PAGE INTENTIONALLY LEFT BLANK

SUSQUEHANNA - UNIT 2 TS/ B 3.4-7 Revision 3

Rev. 5 Recirculation Loops Operating

B 3.4.1

THIS PAGE INTENTIONALLY LEFT BLANK

SUSQUEHANNA - UNIT 2 TS I B 3.4-8 Revision 3

Rev.5 Recirculation Loops Operating

B 3.4.1

THIS PAGE INTENTIONALLY LEFT BLANK

SUSQUEHANNA - UNIT 2 TS I 8 3.4-9 Revision 3

Rev. 4 Jet Pumps

B 3.4 B 3.4.2 REACTOR COOLANT SYSTEM (RCS)

Jet Pumps B 3.4.2 BASES BACKGROUND The Reactor Coolant Recirculation System is described in the Background section of the Bases for LCO 3.4.1, "Recirculation Loops Operating,"

which discusses the operating characteristics of the system and how these characteristics affect the Design Basis Accident (OBA) analyses.

The jet pumps are part of the Reactor Coolant Recirculation System and are designed to provide forced circulation through the core to remove heat from the fuel. The jet pumps are located in the annular region between the core shroud and the vessel inner wall. Because the jet pump suction elevation is at two-thirds core height, the vessel can be reflooded and coolant level maintained at two-thirds core height even with the complete break of the recirculation loop pipe that is located below the jet pump suction elevation.

Each reactor coolant recirculation loop contains ten jet pumps.

Recirculated coolant passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the suction flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the drive flow. The drive flow and suction flow are mixed in the jet pump throat section. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core.

TRM Section 3.4.6 provides discussion of single loop operation flow rate requirements to address jet pump structural concerns during this mode of operation.

APPLICABLE Jet pump OPERABILITY is an explicit assumption in the design basis loss SAFETY of coolant accident (LOCA) analysis evaluated in Reference 1.

ANALYSES (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-10 Revision 1

Rev. 4 Jet Pumps

B 3.4.2 BASES APPLICABLE The capability of reflooding the core to two-thirds core height is dependent SAFETY upon the structural integrity of the jet pumps. If the structural system, ANALYSES including the beam holding a jet pump in place, fails, jet pump (continued) displacement and performance degradation could occur, resulting in an increased flow area through the jet pump and a lower core flooding elevation. This could adversely affect the water level in the core during the reflood phase of a LOCA as well as the assumed blowdown flow during a LOCA.

Jet pumps satisfy Criterion 2 of the NRC Policy Statement (Ref. 4).

LCO The structural failure of any of the jet pumps could cause significant degradation in the ability of the jet pumps to allow reflooding to two-thirds core height during a LOCA. OPERABILITY of all jet pumps is required to ensure that operation of the Reactor Coolant Recirculation System will be consistent with the assumptions used.in the licensing basis analysis (Ref. 1) .

APPLICABILITY In MODES 1 and 2, the jet pumps are required to be OPERABLE since there is a large amount of energy in the reactor core and since the limiting DBAs are assumed to occur in these MODES. This is consistent with the requirements for operation of the Reactor Coolant Recirculation System (LCO 3.4.1).

In MODES 3, 4, and 5, the Reactor Coolant Recirculation System is not required to be in operation, and when not in operation, sufficient flow is not available to evaluate jet pump OPERA.BILITY.

ACTIONS A.1 An inoperable jet pump can increase the blowdown area and reduce the capability of reflooding during a design basis LOCA. If one or more of the jet pumps are inoperable, the (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-11 Revision O

Rev. 4 Jet Pumps

BASES ACTIONS A.1 (continued)

B 3.4.2 plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS SR 3 .4* 2 *1 This SR is designed to detect significant degradation in jet pump performance that precedes jet pump failure (Ref. 2). This SR is required to be performed only when the loop has forced recirculation flow since surveillance checks and measurements can only be performed during jet pump operation. With no forced recirculation flow, stresses on jet pump assemblies are significantly reduced. The jet pump failure of concern is a complete mixer displacement due to jet pump beam failure. Jet pump plugging is also of concern since it adds flow resistance to the recirculation loop. Significant degradation is indicated if the specified criteria confirm unacceptable deviations from established patterns or relationships. The allowable deviations from the established patterns have been developed based on the variations experienced at plants during normal operation and with jet pump assembly failures (Refs. 2 and 3). Each recirculation loop must satisfy two of the performance criteria provided. Since refueling activities (fuel assembly replacement or shuffle, as well as any modifications to fuel support orifice size or core plate bypass flow) can affect the relationship between core flow, jet pump flow, and recirculation loop flow, these relationships may need to be re-established each cycle. Similarly, initial entry into extended single loop operation may also require establishment of these relationships. During the initial weeks of operation under such conditions, while base-lining new "established patterns," engineering judgment of the daily surveillance results is used to detect significant abnormalities, which could indicate a jet pump failure. "

The recirculation pump speed operating characteristics (loop (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-12 Revision 0

Rev. 4 Jet Pumps

BASES SURVEILLANCE REQUIREMENTS SR 3.4.2.1 (continued)

B 3.4.2 drive flow versus pump speed) are determined by the flow resistance from the loop suction through the jet pump nozzles. A change in the relationship indicates a plug, flow restriction, loss in pump* hydraulic performance, leakage, or new flow path between the recirculation pump discharge and jet pump nozzle. For this criterion, loop drive flow versus pump speed relationship must be verified. Note that recirculation pump speed is directly proportional to recirculation motor generator speed (Reference 5). Therefore, recirculation motor generator speed can be used for the purposes of this surveillance.

Individual jet pumps in a recirculation loop normally do not have the same flow. The unequal flow is due to the drive flow manifold, which does not distribute flow equally to all risers. The flow (or jet pump diffuser to lower plenum differential pressure) pattern or relationship of one jet pump to the loop average is repeatable. An appreciable change in this relationship is an indication that increased (or reduced) resistance has occurred in one of the jet pumps. This may be indicated by an increase in the relative flow for a jet pump that has experienced beam cracks .

The deviations from normal are considered indicative of a potential problem in the recirculation drive flow or jet pump system (Ref. 2). Normal flow ranges and established jet pump flow and differential pressure patterns are established by plotting historical data as discussed in Reference 2.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. If this SR has not been performed in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at the time an idle recirculation loop is restored to service, Note 1 allows 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the idle recirculation loop is in operation before the SR must be completed because these checks can only be performed during jet pump operation. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is an acceptable time to establish conditions and complete data collection and evaluation.

Note 2 allows deferring completion of this SR until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after THERMAL POWER is greater than 23% of RTP. During low flow conditions, jet pump noise approaches the threshold

SUSQUEHANNA - UNIT 2 TS I B 3.4-13 (continued)

Revision 3

.Rev. 4 Jet Pumps

BASES SURVEILLANCE SR 3.4.2.1 (continued)

B 3.4.2 REQUIREMENTS response of the associated flow instrumentation and precludes the collection of repeatable and meaningful data.

REFERENCES 1. FSAR, Section 6.3.

2. GE Service Information Letter No. 330, June 9, 1990.

3. NUREG/CR-3052, November 1984.

4. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132).

5. FSAR, Section 7.7 .

SUSQUEHANNA - UNIT 2 TS I B 3.4-14 Revision 1

Rev.1 RCS Operational LEAKAGE.

B 3.4.4 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.4 RCS Operational LEAKAGE BASES BACKGROUND The RCS includes systems and components that contain or transport the coolant to or from the reactor core. The pressure containing components of the RCS and the portions of connecting systems out to and including the isolation valves define the reactor coolant pressure boundary (RCPB).

The joints of the RCPB components are welded or bolted.

During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. Limits on RCS operational LEAKAGE are required to ensure appropriate action is taken before the integrity of the RCPB is impaired. This LCO specifies the types and limits of LEAKAGE. This protects the RCS pressure boundary described in 10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A (Refs 1, 2, and 3).

The safety significance of RCS LEAKAGE from the RCPB varies widely depending on the source, rate, and duration. Therefore, detection of LEAKAGE in the primary containment is necessary. Methods for quickly separating the identified LEAKAGE from the unidentified LEAKAGE are necessary to provide the operators quantitative information to permit them to take corrective action should a leak occur that is detrimental to the safety of the facility or the public.

A limited amount of leakage inside primary containment is expected from auxiliary systems that cannot be made* 100% leaktight. Leakage from these systems should be detected and isolated from the primary containment atmosphere, if possible, so as not to mask RCS operational LEAKAGE detection.

This LCO deals with protection of the RCPB from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident.

SUSQUEHANNA - UNIT 2 B 3.4-19 (continued)

Revision 0

Rev.1 RCS Operational LEAKAGE B 3.4.4 BASES (continued)

APPLICABLE The allowable RCS operational LEAKAGE limits are based on the SAFETY predicted and experimentally observed behavior of pipe cracks. The ANALYSES normally expected background LEAKAGE due to equipment design and the detection capability of the instrumentation for determining system LEAKAGE were also considered. The evidence from experiments suggests that, for LEAKAGE even greater than the specified unidentified LEAKAGE limits, the probability is small that the imperfection or crack associated with such LEAKAGE would grow rapidly.

The unidentified LEAKAGE flow limit allows time for corrective action before the RCPB could be significantly compromised. The 5 gpm limit is a small fraction of the calculated flow from a critical crack in the primary system piping. Crack behavior from experimental programs (Refs. 2 and 3) shows that leakage rates of hundreds of gallons per minute will precede crack instability (Ref. 4).

The low limit on increase in unidentified LEAKAGE assumes a failure mechanism of intergranular stress corrosion cracking (IGSCC) that produces tight cracks. This flow increase limit is capable of providing an early warning of such deterioration.

No applicable safety analysis assumes the' total LEAKAGE limit. The total LEAKAGE limit considers RCS inventory makeup capability and drywell floor sump capacity.

RCS operational LEAKAGE satisfies Criterion 2 of the NRC Policy Statement (Ref. 7).

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being indicative of

_material degradation. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE. Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

SUSQUEHANNA - UNIT 2 B 3.4-20 (continued)

Revision O

Rev.1 RCS Operational LEAKAGE B 3.4.4 BASES LCO b. Unidentified LEAKAGE (continued)

The 5 gpm of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the dryw*ell sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO could result in continued degradation of the RCPB.

c. Total LEAKAGE The total LEAKAGE limit is based on a reasonable minimum detectable amount. The limit also accounts for LEAKAGE from known sources (identified LEAKAGE). Violation of this LCO indicates an unexpected amount of LEAKAGE and, therefore, could indicate new or additional degradation in an RCPB component or system.

d. Unidentified LEAKAGE Increase An unidentified LEAKAGE increase of > 2 gpm within the previous 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months period indicates a potential flaw in the RCPB and must be quickly evaluated to determine the source and extent of the LEAKAGE. The increase is measured relative to the steady state value; temporary changes in LEAKAGE rate as a result of transient conditions (e.g., startup) are not considered. As such, the 2 gpm increase limit is only applicable in MODE 1 when operating pressures and temperatures are established. Violation of this LCO could result in continued degradation of the RCPB.

APPLICABILITY In MODES 1, 2, and 3, the RCS operational LEAKAGE LCO applies; because the potential for RCPB LEAKAGE is greatest when the reactor is pressurized.

In MODES 4 and 5, RCS operational LEAKAGE limits are not required since the reactor is not pressurized and stresses in the RCPB materials and potential for LEAKAGE are reduced .

SUSQUEHANNA - UNIT 2 B 3.4-21 (continued)

Revision O

Rev.1 RCS Operational LEAKAGE

- BASES (continued)

ACTIONS A.1 B 3.4.4 With RCS unidentified or total LEAKAGE greater than the limits, actions must be taken to reduce the leak. Because the LEAKAGE limits are conservatively below the LEAKAGE that would constitute a critical crack size, 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is allowed to reduce the LEAKAGE rates before the reactor must be shut down. If an unidentified LEAKAGE has been identified and quantified, it may be reclassified and considered as identified LEAKAGE; however, the total LEAKAGE limit would remain unchanged.

B.1 and B.2 An unidentified LEAKAGE increase of > 2 gpm within a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months period is an indication of a potential flaw in the RCPB and must be quickly evaluated. Although the increase does not necessarily violate the absolute unidentified LEAKAGE limit, certain susceptible components must be determined not to be the source of the LEAKAGE increase within the required Completion Time. For an unidentified LEAKAGE increase greater than required limits, an alternative to reducing LEAKAGE increase to within limits (i.e., reducing the LEAKAGE rate such that the current rate is less than the "2 gpm increase in the previous 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months " limit; either by isolating the source or other possible methods) is to evaluate service sensitive type 304 and type 316 austenitic stainless steel piping that is subject to high stress or that contains relatively stagnant or intermittent flow fluids and determine it is not the source of the increased LEAKAGE.

This type piping is very susceptible to IGSCC.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable to properly reduce the LEAKAGE increase or verify the source before the reactor must be shut down without unduly jeopardizing plant safety.

C.1 and C.2 If any Required Action and associated Completion Time of Condition A or Bis not met or if pressure boundary LEAKAGE exists, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable,

SUSQUEHANNA - UNIT 2 B 3.4-22 (continued)

Revision O

Rev.1 RCS Operational LEAKAGE B 3.4.4 BASES ACTIONS C.1 and C.2 (continued) based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant safety systems.

SURVEILLANCE REQUIREMENTS SR 3 .4.4. 1 The RCS LEAKAGE is monitored by a variety of instruments designed to provide alarms when LEAKAGE is indicated and to quantify the various types of LEAKAGE. Leakage detection instrumentation is discussed in more detail in the Bases for LCO 3.4.6, "RCS Leakage Detection Instrumentation." Sump level and flow rate are typically monitored to determine actual LEAKAGE rates; however, any method may be used to quantify LEAKAGE within the guidelines of Reference 5. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 30.

2. GEAP-5620, April 1968.

3. NUREG-76/067, October 1975.

4. FSAR, Section 5.2.5.4.

5. Regulatory Guide 1.45.

6. Generic Letter 88-01, Supplement 1.

7. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.4-23 Revision 1 I

Rev~ 5 RCS Leakage Detection Instrumentation B 3.4.6 83.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.6 RCS Leakage Detection Instrumentation BASES BACKGROUND GDC 30of10 CFR 50, Appendix A (Ref. 1), requires means for detecting and, to the extent practical, identifying the location of the source of RCS LEAKAGE. Regulatory Guide 1.45, *Revision 0, (Ref. 2) describes acceptable methods for selecting leakage detection systems.

Limits on LEAKAGE from the reactor coolant pressure boundary (RCPB) are required so that appropriate action can be taken before the integrity of the RCPB is impaired (Ref. 2). Leakage detection systems for the RCS are provided to alert the operators when leakage rates above normal background levels are detected and also to supply quantitative measurement of leakage rates. The Bases for LCO 3.4.4, "RCS Operational LEAKAGE," discuss the limits on RCS LEAKAGE rates.

Systems for separating the LEAKAGE of an identified source from an unidentified source are necessary to provide prompt and quantitative information to the operators to permit them to take immediate corrective action.

LEAKAGE from the RCPB inside the drywell is detected by at least one of two or three independently monitored v~riables, such as sump level changes and drywell gaseous and particulate radioactivity levels. The primary means of quantifying LEAKAGE in the drywell is the drywell floor drain sump monitoring system which consists of two drywell floor drain sump level Channels. Both Channels are required to be Operable to satisfy the LCO.

The drywell floor drain sump monitoring system monitors the LEAKAGE collected in the floor drain sump. This unidentified LEAKAGE consists of LEAKAGE from control rod drives, valve flanges or packings, floor drains, the Closed Cooling Water System, and drywell air cooling unit condensate drains, and any LEAKAGE not collected in the drywell equipment drain tank.

The level of each drywell sump is continuously recorded in the Main

Control Room. The change in (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-30 Revision 2

Rev. 5 RCS Leakage Detection Instrumentation

BASES BACKGROUND (continued) sump level per unit time determines the leak rate and is calculated from the recorder.

B 3.4.6 The floor drain sump level indicators have switches that start and stop the sump pumps when required. If the sump fills to the high high level setpoint, an alarm sounds in the control room.

The primary containment air monitoring systems continuously monitor the primary containment atmosphere for airborne particulate and gaseous radioactivity. A sudden increase of radioactivity, which may be attributed to RCPB steam or reactor water LEAKAGE, is annunciated in the control room.

APPLICABLE A threat of significant compromise to the RCPB exists if the barrier SAFETY contains a crack that is large enough to propagate rapidly. LEAKAGE ANALYSES rate limits are set low enough to detect the LEAKAGE emitted from a single crack in the RCPB (Refs. 3 and 4). The allowed LEAKAGE rates are well below the rates predicted for critical crack sizes (Ref. 6).

Therefore, these limits provide adequate response before a significant break in the RCPB can occur.

RCS leakage detection instrumentation satisfies Criterion 1 of the NRC Policy Statement (Ref. 7).

LCO This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide confidence that small amounts of unidentified LEAKAGE are detected in time to allow actions to place the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.

The LCO requires two instruments to be OPERABLE.

The drywell floor drain sump monitoring system is required to quantify the unidentified LEAKAGE rate from the RCS. Thus, for the system to be considered OPERABLE, the sump level monitoring portion of the system must be OPERABLE and capable of determining the leakage rate. The identification of an increase in unidentified LEAKAGE will be delayed by the time required for the unidentified LEAKAGE to travel to the drywell floor drain sump and it may take longer than one hour to detect a 1 gpm increase in unidentified LEAKAGE, depending on the origin and magnitude of the LEAKAGE. This sensitivity is acceptable for primary containment sump monitor OPERABILITY.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-31 Revision 1

Rev. 5 RCS Leakage Detection Instrumentation B 3.4.6 BASES LCO The reactor coolant contains radioactivity that, when released to the (continued) primary containment, can be detected by the gaseous or particulate primary containment atmospheric radioactivity monitor. Only one of the two detectors is required to be OPERABLE. Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and. rapid responses to RCS LEAKAGE, tiut have recognized limitations. Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission

'products appear from fuel element cladding contamination or cladding defects. If there are few fuel element cladding defects and low levels of activation products, it may not be possible for the gaseous or particulate primary containment atmospheric radioactivity monitors to detect a 1 gpm increase within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months during normal operation. However, the gaseous or particulate containment primary atmospheric radioactivity monitor is OPERABLE when it is capable of detecting a 1 gpm increase in unidentified LEAKAGE within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months given an RCS activity equivalent to that assumed in the design calculations for the monitors (Reference 6).

The LCO is satisfied when monitors of diverse measurement means are available. Thus, the drywell floor drain sump monitoring system, in combination with a gaseous or particulate primary containment atmospheric radioactivity monitor provides an acceptable minimum.

APPLICABILITY In MODES 1, 2, and 3, leakage detection systems are required to be OPERABLE to support LCO 3.4.4. This Applicability is consistent with that for LCO 3.4.4.

ACTIONS With the drywell floor drain sump monitoring sy~tem inoperable, the primary containment atmospheric activity monitor will provide indication of changes in leakage.

With the drywell floor drain sump monitoring system inoperable, operation may continue for 30 days. However, RCS unidentified and total LEAKAGE is still required to be determined every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (SR 3.4.4.1).

The 30 day Completion Time of Required Action A.1 is acceptable, based on operating experience, considering the multiple forms of leakage detection that are still available.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-32 Revision 2

Rev. 5 RCS Leakage Detection Instrumentation B 3.4.6 BASES ACTIONS B.1 and B.2 (continued)

With both gaseous and particulate primary containment atmospheric monitoring channels inoperable, grab samples of the primary containment atmosphere must be taken and analyzed to provide periodic leakage information. Provided a sample is obtained and analyzed once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , the plant may be operated for up to 30 days to allow restoration of at least one of the required monitors.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval provides periodic information that is adequate to detect LEAKAGE. The 30 day Completion Time for restoration recognizes that at least one other form of leakage detection is available.

C.1, C.2 and C.3 With the drywell floor drain sump monitoring system inoperable, the only means of detecting LEAKAGE is the primary containment atmospheric gaseous radiation monitor. A Note clarifies this applicability of the Condition. The primary containment atmospheric gaseous radiation monitor typically cannot detect a 1 gpm leak within one hour when RCS activity is low. In addition, this configuration does not provide the required diverse means of leakage detection. Indirect methods of monitoring RCS leakage must be implemented. Grab samples of the primary containment atmosphere must be taken and analyzed and monitoring of RCS leakage by administrative means must be performed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to provide alternate periodic information.

Administrative means of monitoring RCS leakage include monitoring and trending parameters that may indicate an increase in RCS leakage. There are diverse alternative mechanisms from which appropriate indicators may be selected based on plant conditions. It is not necessary to utilize all of these methods, but a method or methods should be selected considering the current plant conditions and historical or expected sources of unidentified leakage. The administrative methods are primary containment pressure, temperature, Component Cooling Water System outlet temperatures and makeup, Reactor Recirculation System pump seal pressure and temperature and motor cooler temperature indications, Drywall cooling fan outlet temperatures, Reactor Building Chiller amperage, Control Rod Drive System flange temperatures, Safety Relief Valve tailpipe temperature, flow, pressure, or other approved methods.

These indications, coupled with the atmospheric grab samples, are sufficient to alert the operating staff to an unexpected increase in unidentified LEAKAGE.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-33 Revision 2

Rev.5 RCS Leakage Detection Instrumentation B 3.4.6 BASES ACTIONS C.1, C.2 and C.3 (continued)

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval is sufficient to detect increasing RCS leakage. The Required Action provides 7 days to restore another RCS leakage monitor to OPERABLE status to regain the intended leakage detection diversity.

The 7 day Completion Time ensures that the plant will not be operated in a degraded configuration for a lengthy time period.

D.1 and D.2 If any Required Action of Condition A, B or C cannot be met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to perform the actions in an orderly manner and without challenging plant systems.

With all required monitors inoperable, no required automatic means of monitoring LEAKAGE are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE REQUIREMENTS SR 3 .4* 6 *1 This SR is for the performance of a CHANNEL CHECK of the required primary containment atmospheric monitoring system. The check gives reasonable confidence that the channel is operating properly. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.6.2 This SR is for the performance of a CHANNEL FUNCTIONAL TEST of the required RCS leakage detection instrumentation. The test ensures that the monitors can perform their function in the desired manner. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-34 Revision 1

Rev. 5 RCS Leakage Detection Instrumentation B 3.4.6 BASES SURVEILLANCE REQUIREMENTS SR 3 .4. 5 .3 (continued)

This SR is for the performance of a CHANNEL CALIBRATION of required leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES

1. 10 CFR 50, Appendix A, GDC 30.

2. Regulatory Guide 1.45, Revision 0, "Reactor Coolant Pressure Boundary Leakage Detection Systems," May 1973.

3. GEAP-5620, April 1968.

4 . NUREG-75/067, October 1975.

5. FSAR, Section 5.2.5.4.

6. FSAR, Section 5.2.5.1.2

7. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA- UNIT 2 TS I B 3.4-34a Revision 1 I

Rev.3 RCS Specific Activity B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.7 RCS Specific Activity BASES BACKGROUND During circulation, the reactor coolant acquires radioactive materials due to release of fission products from fuel leaks into the reactor coolant and activation of corrosion products in the reactor coolant. These radioactive materials in the reactor coolant can plate out in the RCS, and, at times, an accumulation will break away to spike the normal level of radioactivity.

The release of coolant during a Design Basis Accident (OBA) could send radioactive materials into the environment.

Limits on the maximum allowable level of radioactivity in the reactor coolant are established to ensure that in the event of a release of any radioactive material to the environment during a DBA, radiation doses are maintained within regulatory limits.

This LCO contains iodine specific activity limits. The iodine isotopic activities per gram of reactor coolant are expressed in terms of a DOSE EQUIVALENT 1-131. The allowable levels are intended to limit the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months radiation dose to an individual at the site boundary to regulatory limits.

APPLICABLE Analytical methods and assumptions involving radioactive material in the

SAFETY primary coolant are presented in the FSAR (Ref. 2). The specific activity ANALYSES in the reactor coolant (the source term) is an initial condition for evaluation of the consequences of an accident due to a main steam line break (MSLB) outside containment. No fuel damage is postulated in the MSLB accident, and the release of radioactive material to the environment is assumed to end when the main steam isolation valves (MSIVs) close completely.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-35 Revision 1

Rev. 3 RCS Specific Activity B 3.4.7 BASES APPLICABLE This MSLB release forms the basis for determining offsite and control SAFETY room doses (Ref. 2). The limits on the specific activity of the primary ANALYSES coolant ensure that the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose at the site boundary, resulting from an (continued) MSLB outside containment during steady state operation, will not exceed regulatory limits.

The limits on specific activity are values from a parametric evaluation of typical site locations. These limits are conservative because the evaluation considered more restrictive parameters than for a specific site, such as the location of the site boundary and the meteorological conditions of the site.

RCS specific activity satisfies Criterion 2 of the NRC Policy Statement (Ref. 3).

LCO The specific iodine activity is limited to~ 0.2 µCi/gm DOSE EQUIVALENT 1-131. This 'limit ensures the source term assumed in the safety analysis for the MSLB is not exceeded, so any release of radioactivity to the

APPLICABILITY environment during an MSLB will not exceed regulatory limits .

In MODE 1, and MODES 2 and 3 with any main steam line not isolated, limits on the primary coolant radioactivity are applicable since there is an escape path for release of radioactive material from the primary coolant to the environment in the event of an MSLB outside of primary containment.

In MODES 2 and 3 with the main steam lines isolated, such limits do not apply since an escape path does not exist. In MODES 4 and 5, no limits are required since the reactor is not pressurized and the potential for leakage is reduced .

SUSQUEHANNA - UNIT 2 TS I B 3.4-36 (continued)

Revision 1

Rev.3 RCS Specific Activity B 3.4.7 BASES (continued)

ACTIONS A.1 and A.2 When the reactor coolant specific activity exceeds the LCO DOSE EQUIVALENT 1-131 limit, but is s 4.0 µCi/gm, samples must be analyzed for DOSE EQUIVALENT 1-131 at least once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . In addition, the specific activity must be restored to the LCO limit within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The Completion Time of once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is based on the time needed to take and analyze a sample. The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time to restore the activity level provides a reasonable time for temporary coolant activity increases (iodine spikes or crud bursts) to be cleaned up with the normal processing systems.

A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODE(S) while relying on the ACTIONS.

This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to power operation .

8.1, 8.2.1. 8.2.2.1, and 8.2.2.2 If the DOSE EQUIVALENT 1-131 cannot be restored to s 0.2 µCi/gm within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , or if at any time it is > 4.0 µCi/gm, it must be determined at least once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and all the main steam lines must be isolated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Isolating the main steam lines precludes the possibility of releasing radioactive material to the environment in an amount that would exceed dose regulatory limits during a postulated MSLB accident.

Alternatively, the plant can be placed in MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This option is provided for those instances when isolation of main steam lines is not desired (e.g., due to the decay heat loads). In MODE 4, the requirements of the LCO are no longer applicable.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-37 Revision 2

Rev. 3 RCS Specific Activity B 3.4.7 BASES ACTIONS B.1. B.2.1. B.2.2.1. and B.2.2.2 (continued)

The Completion Time of once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is the time needed to take and analyze a sample. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to isolate the main steam lines in an orderly manner and without challenging plant systems. Also, the allowed Completion Times for Required Actions B.2.2.1 and B.2.2.2 for placing the unit in MODES 3 and 4 are reasonable, based on operating experience, to achieve the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS SR 3 .4* 7 *1 This Surveillance is performed to ensure iodine remains within limit during normal operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that requires this Surveillance to be performed only in MODE 1 because the level of fission products generated in other MODES is much less.

REFERENCES 1. Deleted.*

2. FSAR, Section 15.6.4.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.4-38 Revision 2

Rev. 3 RHR Shutdown Cooling System-Hot Shutdown B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.8 Residual Heat Removal (RHR) Shutdown Cooling System-Hot Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to reduce the temperature of the reactor coolant to s 200°F. This decay heat removal is in preparation for performing refueling or maintenance operations, or for keeping the reactor in the Hot Shutd.own condition.

The shutdown cooling function of the RHR System provides decay heat removal and is manually controlled. Each RHR loop consists of two motor driven pumps, a heat exchanger, and associated piping and valves. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the RHR Service Water System (LCO 3. 7.1, "Residual Heat Removal Service Water (RHRSW)

System") .

APPLICABLE Decay heat removal by operation of the RHR System in the shutdown SAFETY cooling mode is not required for mitigation of any event or accident ANALYSES evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result. Although the RHR shutdown cooling subsystem does not meet a specific criterion of the NRG Policy Statement (Ref. 1), it was identified in the NRC Policy Statement as a significant contributor to risk reduction. Therefore, the RHR Shutdown Cooling System is retained as a Technical Specification.

LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and when no recirculation pump is in operation, one shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one OPERABLE RHR pump, one heat exchanger, and the associated piping and valves. The two subsystems have a common suction source and are allowed to have a common heat exchanger and (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-39 Revision 0

Rev. 3 RHR Shutdown Cooling* System-Hot Shutdown B 3.4.8 BASES LCO common discharge piping. Thus, to meet the LCO, both pumps in one (continued) loop or one pump in each of the two loops must be OPERABLE. Since the piping and heat exchangers are passive components that are assumed not to fail, they are allowed to be common to both subsystems.

Each shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. In MODE 3, one RHRshutdown cooling subsystem can provide the requ_ired cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain or reduce the reactor coolant temperature as required .. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required.

Note 1 permits both RHR shutdown cooling subsystems to be shut down for a period of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. Note 2 allows one RHR shutdown cooling subsystem to be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for the performance of Surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that

necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy.

APPLICABILITY In MODE 3 with reactor steam dome pressure below the RHR cut in permissive pressure (i.e., the actual pressure at which the interlock resets) the RHR System may be operated in the shutdown cooling mode to remove decay heat to reduce or maintain coolant temperature.

Otherwise, a recirculation pump is required to be in operation.

In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR cut in permissive pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the shutdown cooling piping. Decay heat removal at reactor pressures greater than or equal to the RHR cut in permissive pressure is typically accomplished by condensing (continued)

SUSQUEHANNA- UNIT 2 TS I B 3.4-40 Revision 0

Rev. 3 RHR Shutdown Cooling System-Hot Shutdown B 3.4.8 BASES APPLICABILITY the steam in the main condenser. Additionally, in MODE 2 below this (continued) pressure, the OPERABILITY requirements for the Emergency Core Cooling Systems (ECCS) (LCO 3.5.1, "EGGS-Operating") do not allow placing the RHR shutdown cooling subsystem into.operation.

The requirements for decay heat removal in MODES 4 and 5 are discussed in LCO 3.4.9, "Residual Heat Removal (RHR) Shutdown Cooling System-Cold Shutdown"; LCO 3.9.7, "Residual Heat Removal (RHR)-High Water Level"; and LCO 3.9.8, "Residual Heat Removal (RHR)-Low Water Level."

ACTIONS A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.'3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based

on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.

A.1. A.2, and A.3 With one required RHR shutdown cooling subsystem inoperable for decay heat removal, except as permitted by LCO Note 2, the inoperable subsystem must be restored to OPERABLE status (continued)

SUSQUEHANNA- UNIT 2 TS I B 3.4-41 Revision 2

Rev. 3 R.HR Shutdown Cooling System-Hot Shutdown

BASES B 3.4.8 ACTIONS A.1, A.2, and A.3 (continued) without delay. In this condition, the remaining OPERABLE subsystem can provide the necessary decay heat removal. The overall reliability is reduced, however, because a single failure in the OPERABLE subsystem could result in reduced RHR shutdown cooling capability. Therefore, an alternate method of decay heat removal must be provided.

With both RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability.

This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities.

The required cooling capacity of the alternate method must be ensured by verifying (by calculation or demonstration) its capability to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability.

Alternate methods that can be used include (but are not limited to) the Spent Fuel Pool Cooling System and the Reactor Water Cleanup System.

However, due to the potentially reduced reliability of the alternate methods of decay heat removal, it is also required to reduce the reactor coolant temperature to the point where MODE 4 is entered.

B.1, B.2, and B.3 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as permitted by LCO Note 1, reactor coolant circulation by the RHR shutdown cooling subsystem or recirculation pump must be restored without delay.

Until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant temperature. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the coolant circulation function

SUSQUEHANNA - UNIT 2 TS I B 3.4-42 (continued)

Revision O

Rev. 3 RHR Shutdown Cooling System-Hot Shutdown B 3.4.8 BASES ACTIONS B.1, B.2, and B.3 (continued) and is modified such that the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. This will provide assurance of continued temperature monitoring capability.

During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate.

SURVEILLANCE SR 3.4.8.1

. REQUIREMENTS This Surveillance verifies that one RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This Surveillance is modified by a Note allowing sufficient time to align the RHR System for shutdown cooling operation after the pressure interlock that isolates the system resets, or for placing a recirculation pump in operation. The Note takes exception to the requirements of the Surveillance being met (i.e., forced coolant circulation is not required for this initial 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months period), which also allows entry into the Applicability of this Specification in accordance with SR 3.0.4 since the Surveillance will not be "not met" at the time of entry into the Applicability.

REFERENCES 1. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.4-43 Revision 1

Rev.2 RHR Shutdown Cooling System-Cold Shutdown B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.9 Residual Heat Removal (RHR) Shutdown Cooling System-Cold Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to maintain the temperature of the reactor coolant~ 200°F. This decay heat removal is in preparation for performing refueling or maintenance operations, or for keeping the reactor in the Cold Shutdown condition.

The shutdown cooling function of the RHR System provides decay heat removal and is manually controlled. Each RHR loop consists of two motor driven pumps, a heat exchanger, and associated piping and valves. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the RHR Service Water System .

APPLICABLE SAFETY ANALYSES Decay heat removal by operation of the RHR System in the shutdown cooling mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result. Although the RHR Shutdown Cooling System does not meet a specific criterion of the NRC Policy Statement (Ref. 1), it was identified in the NRC Policy Statement as a significant contributor to risk reduction.

Therefore, the RHR Shutdown Cooling System is retained as a Technical Specification.

LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and when no recirculation pump is in operation, one RHR shutdown cooling subsystem must be in operation. An OPERABLE RH R shutdown cooling subsystem consists of an RHR pump with an associated RHRSW pump, a heat exchang*er, valves, piping, instruments, and controls to ensure the corresponding flow paths are OPERABLE. On the primary side, the two subsystems have a common suction source and are

SUSQUEHANNA - UNIT 2 TS I B 3.4-44 (continued)

Revision 0

Rev. 2 RHR Shutdown Cooling System-Cold Shutdown

BASES 8 3.4.9 LCO allowed to have a common heat exchanger and common discharge (continued) piping. Thus, to meet the LCO, both pumps in one loop or one pump in each of the two loops must be OPERABLE. Since the piping and heat exchangers are passive components that are assumed not to fail, they are allowed to be common to both subsystems. For each pump required to be OPERABLE on the primary (RHR) side, an associated RHRSW pump must be OPERABLE on the secondary side to transport decay heat to the UHS. Therefore, if two RHR pumps (and one heat exchanger) in the same loop are being used to comprise two shutdown cooling subsystems, the two RHRSW pumps (one from Unit 1 and one from Unit 2) which are capable of servicing the subject heat exchanger must be OPERABLE.

In MODE 4, the RHR cross tie valves (HV-151-F010A and B) may be opened to allow pumps in one loop to discharge through the opposite recirculation loop to make a complete subsystem. Additionally, each shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. In MODE 4, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain or reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required.

Note 1 permits both RHR shutdown cooling subsystems to be shut down for a period of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. Note 2 allows one RHR shutdown cooling subsystem to be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for the performance of Surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy.

APPLICABILITY In MODE 4, the RHR Shutdown Cooling System may be operated in the shutdown cooling mode to remove decay heat to

SUSQUEHANNA- UNIT 2 TS I B 3.4-45 (continued)

Revision O

Rev. 2 RHR Shutdown Cooling System-Cold Shutdown

BASES B 3.4.9 APPLICABILITY maintain coolant temperature below 200°F. Othemise, a recirculation (continued) pump is required to be in operation.

In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR cut in permissive pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the shutdown cooling piping. Decay heat removal at reactor pressures greater than or equal to the RHR cut in permissive pressure is typically accomplished by condensing the steam in the main condenser. Additionally, in MODE 2 below this pressure, the OPERABILITY requirements for the Emergency Core Cooling Systems (ECCS) (LCO 3.5.1, "ECCS-Operating") do not allow placing the RHR shutdown cooling subsystem into operation.

The requirements for decay heat removal in MODE 3 below the cut in permissive pressure and in MODE 5 are discussed in LCO 3.4.8, "Residual Heat Removal (RHR) Shutdown Cooling System-Hot Shutdown";

LCO 3.9.7, "Residual Heat Removal (RHR)-High Water Level"; and LCO 3.9.8, "Residual Heat Removal (RHR)-Low Water Level."

ACTIONS A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be

inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.

SUSQUEHANNA - UNIT 2 TS I B 3.4-46 (continued)

Revision 1

Rev. 2 RHR Shutdown Cooling System-Cold Shutdown

BASES B 3.4.9 ACTIONS A.1 (continued)

With one of the two required RHR shutdown cooling subsystems inoperable, except as permitted by LCO Note 2, the remaining subsystem is capable of providing the required decay heat removal. However, the overall reliability is reduced. Therefore, an alternate method of decay heat removal must be provided. With both RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability. This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities.

Furthermore, verification of the functional availability of these alternate method(s) must be reconfirmed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. This will provide assurance of continued heat removal capability.

The required cooling capacity of the alternate method must be ensured by verifying (by calculation or demonstration) its capability to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability.

Alternate methods that can be used include (but are not limited to) the R~actor Water Cleanup System.

8.1 and 8.2 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as permitted by LCO Note 1, and until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. The alternate method may use forced or natural circulation. This will provide the necessary circulation for monitoring coolant temperature. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the coolant circulation function and is modified such that the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. This will provide assurance of continued temperature monitoring capability.

SUSQUEHANNA - UNIT 2 TS I B 3.4-47 (continued)

Revision O

Rev. 2 RHR Shutdown Cooling System-Cold Shutdown

BASES ACTIONS B.1 and B.2 (continued)

B 3.4.9 During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR Shutdown Cooling System or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate.

SURVEILLANCE SR 3.4.9.1 REQUIREMENTS This Surveillance verifies that one RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.4-48 Revision 1

Rev. 5 RCS PIT Limits

B 3.4 B 3.4.10 BASES REACTOR COOLANT SYSTEM (RCS)

RCS Pressure and Temperature (PIT) Limits B 3.4.10 BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.

This Specification contains PIT limit curves for heatup, cooldown, and inservice leakage and hydrostatic testing, and limits for the maximum rate of change of reactor coolant temperature. The heatup curve provides limits for both heatup and criticality.

Each PIT limit curve defines an acceptable region for normal operation. The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region .

The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure.

Therefore, the LCO limits apply mainly to the vessel.

10CFR 50, Appendix G (Ref. 1), requires the establishment of Prr limits for material fracture toughness requirements of the RCPB materials.

Reference 1 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests.

It mandates the use of the ASME Code,Section XI, Appendix G (Ref. 2).

The actual shift in the RTNOT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 3) and Appendix H of 10 CFR 50 (Ref. 4). The operating PIT limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of RG 1.99, "Radiation Embrittlement of Reactor Vessel Materials (Ref. 5).

The calculations to determine neutron fluence will be developed using the BWRVIP RAMA code methodology, which is NRC approved and meets the intent of RG 1.190, "Calculational and Dosimetry Methods for Determining Pressure Vessel Neutron Fluence" (Ref. 11). See FSAR Section 4.1.4.5 for.

determining fluence (Ref. 12).

SUSQUEHANNA - UNIT 2 TS I B 3.4-49 (continued)

Revision 3

Rev. 5 RCS PIT Limits

BASES BACKGROUND .

(continued)

The PIT limit curves are composite curves established by superimposing B 3.4.10 limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the PIT limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.

The heatup curve used to develop the PIT limit curve composite represents a different set of restrictions than the cooldown curve used to develop the PIT limit curve composite because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.

The criticality limits include the Reference 1 requirement that they be at least 40°F above the heatup curve or the cooldown curve and not lower than the minimum permissible temperature for the inservice leakage and hydrostatic testing.

The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components.

ASME Code,Section XI, Appendix E (Ref. 6), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.

APPLICABLE The PIT limits are not derived from Design Basis Accident (OBA) analyses.

SAFETY They are prescribed during normal operation to avoid encountering pressure, ANALYSES temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB, a condition that is unanalyzed. Reference 7 establishes the methodology for determining the PIT limits. Since the PIT limits are not derived from any OBA, there are no acceptance limits related to the PIT limits. Rather, the PIT limits are acceptance limits themselves since they preclude operation in an unanalyzed condition.

RCS PIT limits satisfy Criterion 2 of the NRC Policy Statement (Ref. 8).

The Effective Full Power Years (EFPY) shown on the curves are approxi-mations of the ratio of the energy that has been and is anticipated to be generated in a year to the energy that could have been generated if the unit ran at original thermal power rating of 3293 Mvvr for the entire year.

These values are based on fluence limits that are not to be exceeded .

SUSQUEHANNA- UNIT 2 TS I B 3.4-50 (continued)

Revision 2

Rev.5 RCS PIT Limits

BASES (continued)

LCO The elements of this LCO are:

B 3.4.10

a. RCS pressure and temperature are to the right of the applicable curves specified in Figures 3.4.10-1 through 3.4.10-3 and within the applicable heat-up or cool down rate specified in SR 3.4.10.1 during RCS heatup, cooldown, and inservice leak and hydrostatic testing;

b. The temperature difference between the reactor vessel bottom head coolant and the reactor pressure vessel (RPV) coolant is s 145°F during recirculation pump startup, and during increases in THERMAL POWER or loop flow while operating at low THERMAL POWER or loop flow;

c. The temperature difference between the reactor coolant in the respective recirculation loop and in the reactor vessel is s 50°F during recirculation pump startup, and during increases in THERMAL POWER or loop flow while operating at low THERMAL POWER or loop flow;

d. RCS pressure and temperature are to the right of the criticality limits specified in Figure 3.4.10-3 prior to achieving criticality; and

e. The reactor vessel flange and the head flange temperatures are ;;::: 70°F when tensioning the reactor vessel head bolting studs.

These limits define allowable operating regions and permit a large number of operating cycles while also providing a wide margin to nonductil e failure.

The PIT limit composite curves are calculated using the worst case of material properties, stresses, and temperature change rates anticipated under all heatup and cooldown conditions. The design calculations account for the reactor coolant fluid temperature impact on the inner wall of the vessel and the temperature gradients through the vessel wall. Because these fluid temperatures drive the vessel wall temperature gradient, monitoring reactor coolant temperature provides a conservative method of ensuring the PIT limits are not exceeded. Proper monitoring of vessel temperatures to assure compliance with brittle fracture temperature limits and vessel thermal stress limits during normal heatup and cooldown, and during inservice leakage and hydrostatic testing, is established in PPL Calculation EC 062-0573 (Ref. 9). For PIT curves A, B, and C, the bottom head drain line coolant temperature should be monitored and maintained to the right of the most limiting curve.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-51 Revision 2

Rev. 5 RCS PIT Limits

BASES LCO (continued)

Curve A must be used for any ASME Section Ill Design Hydrostatic Tests performed at unsaturated reactor conditions. Curve A may also be used for ASME Section XI inservice leakage and hydrostatic testing when B 3.4.10 heatup and cooldown rates can be limited to 20°F in a one-hour period.

Curve A is based on pressure stresses only. Thermal stresses are assumed to be insignificant. Therefore, heatup and cooldown rates are limited to 20°F in a one-hour period when using Curve A to ensure minimal thermal stresses. The recirculation loop suction line temperatures should be monitored to determine the temperature change rate.

Curves B and C are to be used for non-nuclear and nuclear heatup and cooldown, respectively. In addition, Curve B may be used for ASME Section XI inservice leakage and hydrostatic testing, but not for ASME Section Ill Design Hydrostatic Tests performed at unsaturated reactor conditions.

Heatup and cooldown rates are limited to 100°F in a one-hour period when using Curves B and C. This limits the thermal gradient through the vessel wall, which is used to calculate the thermal stresses in the vessel wall. Thus, the LCO for the rate of coolant temperature change limits the thermal stresses and ensures the validity of the PIT curves. The vessel belt-line fracture analysis assumes a 100°F/hr coolant heatup or cooldown rate in the beltline area. The 100°F limit in a one-hour period applies to the coolant in the beltline region, and takes into account the thermal inertia of the vessel

wall. Steam dome saturation temperature (TsAT), as derived from steam dome pressure, should be monitored to determine the beltline temperature change rate at temperatures above 212°F. At temperatures below 212°F, the recirculation loop suction line temperatures should be monitored.

During heatups and cooldowns, the reactor vessel could experience a vacuum (negative pressure) at low temperatures (unsaturated conditions) and low rates of temperature change. Under a vacuum, the vessel wall would experience a uniform compressive loading, which would counteract the tensile stress due to any thermal gradients through the vessel wall. To ensure the margin to brittle fracture is no less than at any other pressure, Curves A, B, and C require a minimum vessel metal temperature of 70°F when the reactor vessel is at a negative pressure.

SUSQUEHANNA - UNIT 2 TS I B 3.4-52 (continued)

Revision 3

Rev.5 RCS PIT Limits

BASES LCO (continued)

B 3.4.10 Violation of the limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCS components. The consequences depend on several factors, as follows:

a. The severity of the departure from the allowable operating pressure temperature regime or the severity of the rate of change of temperature;

b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and

c. The existences, sizes, and orientations of flaws in the vessel material.

APPLICABILITY The potential for violating a PIT limit exists at all times. For example, PIT limit violations could result from ambient temperature conditions that result in the reactor vessel metal temperature being less than the minimum allowed temperature for boltup. Therefore, this LCO is applicable even when fuel is not loaded in the core.

ACTIONS A.1 and A.2 Operation outside the PIT limits while in MODES 1, 2, and 3 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.

The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.

Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed if continued operation is desired. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.

SUSQUEHANNA - UNIT 2 TS I B 3.4-52a (continued)

Revision O

Rev. 5 RCS PIT Limits

BASES ACTIONS A.1 and A.2 (continued}

B 3.4.10 ASME Code,Section XI, Appendix E (Ref. 6), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable to accomplish the evaluation of a mild violation. More severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed if continued operation is desired.

Condition A is modified by a Note requiring Required Action A.2 be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have

affected the RCPB integrity.

B.1 and B.2 If a Required Action and associated Completion Time of Condition A are not

met, the plant must be placed in a lower MODE because eith~r the RCS remained in an unacceptable PIT region for an extended period of increased stress, or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. With the reduced pressure and temperature conditions, the possibility of propagation of undetected flaws is decreased.

SUSQUEHANNA - UNIT 2 TS I B 3.4-53 (continued)

Revision 2

Rev. 5 RCS PIT Limits

BASES ACTIONS B.1 and B.2 (continued)

Pressure and temperature are reduced by placing the plant in at least B 3.4.10 MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 Operation outside the PIT limits in other than MODES 1, 2, and 3 (including defueled conditions) must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses. The Required Action must be initiated without delay and continued until the limits are restored.

Besides restoring the PIT limit parameters to within limits, an evaluation is required to determine if RCS operation is allowed. This evaluation must verify that the RCPB integrity is acceptable and must be completed before approaching criticality or heating up to > 200°F. Several methods may be used, including comparison with pre-analyzed transients, new analyses, or inspection of the components. ASME Code,Section XI, Appendix E (Ref. 6),

may be used to support the evaluation; however, its use is restricted to evaluation of the beltline .

SURVEILLANCE SR 3.4.10.1 REQUIREMENTS Verification that operation is within limits (i.e., to the right of the applicable curves in Figures 3.4.10-1 through 3.4.10-3) is required when RCS pressure and temperature conditions are undergoing planned changes. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Surveillance for heatup, cooldown, or inservice leakage anc:I hydrostatic testing may be discontinued when the criteria given in the relevant plant procedure for ending the activity are satisfied.

This SR has been modified with a Note that requires this Surveillance to be performed only during system heatup and cooldown operations and inservice leakage and hydrostatic testing.

Notes to the acceptance criteria for heatup and cooldown rates ensure that more restrictive limits are applicable when the PIT limits associated with hydrostatic and inservice testing are being applied.

SUSQUEHANNA- UNIT 2 TS I B 3.4-54 (continued)

Revision 3

Rev.5 RCS Prr Limits

BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.10.2 A separate limit is used when the reactor is approaching criticality.

B 3.4.10 Consequently, the RCS pressure and temperature must be verified within the appropriate limits (i.e., to the right of the criticality curve in Figure 3.4.10-3) before withdrawing control rods that will make the reactor critical.

Performing the Surveillance within 15 minutes before control rod withdrawal for the purpose of achieving criticality provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of reactor criticality. Although no Surveillance Frequency is specified, the requirements of SR 3.4.10.2 must be met at all times when the reactor is critical.

SR 3.4.10.3 and SR 3.4.10.4 Differential temperatures within the applicable limits ensure that thermal stresses resulting from the startup of an idle recirculation pump will not exceed design allowances. In addition, compliance with these limits ensures that the assumptions of the analysis for the startup of an idle recirculation loop (Ref. 1O) are satisfied .

Performing the Surveillance within 15 minutes before starting the idle recirculation pump provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the idle pump start.

An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.10.4 *is to compare the temperatures of the operating recirculation loop and the idle loop. If both loops are idle, compare the temperature difference between the reactor coolant within the idle loop to be started and coolant in the reactor vessel.

SR 3.4.10.3 has been modified by a Note that requires the Surveillance to be performed only in MODES 1, 2, 3, and 4. In MODE 5, the overall stress on limiting components is lower. Therefore, Lff limits are not-required. The Note also states the SR is only required to be met during a recirculation pump start-up, because this is when the stresses occur.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-55 Revision 2

Rev. 5 RCS PIT Limits

BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.10.5 and SR 3.4.10.6 B 3.4.10 Differential temperatures within the applicable limits ensure that thennal stresses resulting from increases in THERMAL POWER or recirculation loop flow during single recirculation loop operation will not exceed design allowances. Performing the Surveillance within 15 minutes before beginning such an increase in power or flow rate provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the change in operation.

An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.10.6 is to compare the temperatures of the operating recirculation loop and the idle loop.

Plant specific startup test data has determined that the bottom head is not subject to temperature stratification at power levels > 27% of RTP and with single loop flow rate~ 21,320 gpm (50% of rated loop flow). Therefore, SR 3.4.10.5 and SR 3.4.10.6 have been modified by a Note that requires the Surveillance to be met only under these conditions. The Note for SR 3.4.10.6 further limits the requirement for this Surveillance to exclude comparison of the idle loop temperature if the idle loop is isolated from the RPV since the water in the loop can not be introduced into the remainder of

the Reactor Coolant System .

SR 3.4.10.7, SR 3.4.10.8, and SR 3.4.10.9 Limits on the reactor vessel flange and head flange temperatures are generally bounded by the other PIT limits during system heatup and cooldown. However, operations approaching MODE 4 from MODE 5 and in MODE 4 with RCS temperature less than or equal to certain specified values require assurance that these temperatures meet the LCO limits.

The flange temperatures must be verified to be above the limits before and while tensioning the vessel head bolting studs to ensure that once the head is tensioned the limits are satisfied. When in MODE 4 with RCS temperature

5: 80°F, checks of the flange temperatures are required because of the reduced margin to the limits. When in MODE 4 with RCS temperature

5: 100°F, monitoring of the flange temperature is required to ensure the temperature is within the specified limits.

The Surveillance Fre_quency is controlled under the Surveillance Frequency Control Program . I

SUSQUEHANNA - UNIT 2 TS I 8 3.4-56 (continued)

Revision 3

Rev. 5 RCS PIT Limits

BASES (continued)

REFERENCES 1. 10 CFR 50, Appendix G.

2. ASME, Boiler and Pressure Vessel Code,Section XI, Appendix G.

B 3.4.10

3. ASTM E 185-73

4. 10 CFR 50, Appendix H.

5. Regulatory Guide 1.99, Revision 2, May 1988.

6. ASME, Boiler and Pressure Vessel Code,Section XI, Appendix E.

7. Licensed Topical Reports:

a. Structural Integrity Associates Report No. SIR-05-044, Revision 1-A, "Pressure-Temperature Limits Report Methodology for Boiling Water Reactors," June 2013.

b. Structural Integrity Associates Report No. 0900876.401, Revision 0-A, "Linear Elastic Fracture Mechanics Evaluation of GE BWR Water Level Instrument Nozzles for Pressure-Temperature Curve Evaluations," May 2013.

8. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132).

9. PPL Calculation EC-062-0573, "Study to Support the Bases Section of Technical Specification 3.4.10."

10. FSAR, Section 15.4.4.

11. Regulatory Guide 1.190, March 2001.

12 FSAR, Section 4.1.4.5.

SUSQUEHANNA - UNIT 2 TS I B 3.4-57 Revision 3

Rev.1 Reactor Steam Dome Pressure

83.4 B 3.4.11 REACTOR COOLANT SYSTEM (RCS)

Reactor Steam Dome Pressure B 3.4.11 BASES BACKGROUND The reactor steam dome pressure is an assumed initial condition of design basis accidents and transients and is also an assumed value in the determination of compliance with reactor pressure vessel overpressure protection criteria.

APPLICABLE The reactor steam dome pressure of:::; 1050 psig is an initial condition of SAFETY the vessel overpressure protection analysis of Reference 1. This analysis ANALYSES assumes an initial maximum reactor steam dome pressure and evaluates the response of the pressure relief system, primarily the safety/relief valves, during the limiting pressurization transient. The determination of compliance with the overpressure criteria is dependent on the initial reactor steam dome pressure; therefore, the limit on this pressure ensures that the assumptions of the overpressure protection analysis are conserved .

LCO Reactor steam dome pressure satisfies the requirements of Criterion 2 of the NRC Policy Statement (Ref. 3).

The specified reactor steam dome pressure limit of :5: 1050 psig ensures the plant is operated within the assumptions of the transient analyses.

Operation above the limit may result in a transient response more severe than analyzed.

APPLICABILITY In MODES 1 and 2, the reactor steam dome pressure is required to be less than or equal to the limit. In these MODES, the reactor may be generating significant steam and the design basis accidents and transients are bounding.

In MODES 3, 4, and 5, the limit is not applicable because the reactor is shut down. In these MODES, the reactor pressure is well below the required (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.4-58 Revision 1

Rev. 1 Reactor Steam Dome Pressure

BASES B 3.4.11 APPLICABILITY limit, and no anticipated events will challenge the overpressure limits.

(continued)

ACTIONS A.1 With the reactor steam dome pressure greater than the limit, prompt action should be taken to reduce pressure to below the limit and return the reactor to operation within the bounds of the analyses. The 15 minute Completion Time is reasonable considering the importance of maintaining the pressure within limits. This Completion Time also ensures that the probability of an accident occurring while pressure is greater than the limit is minimized. If the operator is unable to restore the reactor steam dome pressure to below the limit, then the reactor should be placed in MODE 3 to be operating within the assumptions of the transient analyses.

If the reactor steam dome pressure cannot be restored to within the limit within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS SR 3 .4* 1 1*1 Verification that reactor steam dome pressure is s 1050 psig ensures that the initial conditions of the over-pressurization analysis are met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SUSQUEHANNA - UNIT 2 TS I B 3.4-59 (continued)

Revision 2

Rev. 1 Reactor Steam Dome Pressure

BASES (continued)

B 3.4.11 REFERENCES 1. FSAR, Section 5.2.2.1.

2. FSAR, Section 15.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.4-60 Revision 1

Rev.5 ECCS-Operating

B 3.5 B 3.5.1 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM ECCS-Operating B 3.5.1 BASES BACKGROUND The ECCS is designed, in conjunction with the primary and secondary containment, to limit the release of radioactive materials to the environment following a loss of coolant accident (LOCA). The ECCS uses two independent methods (flooding and spraying) to cool the core during a LOCA. The ECCS network consists of the High Pressure Coolant Injection (HPCI) System, the Core Spray (CS) System, the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR)

System, and the Automatic Depressurization System (ADS). The suppression pool provides the required source of water for the ECCS.

Although no credit is taken in the safety analyses for the condensate storage tank (CST), it is capable of providing a source of water for the HPCI and CS systems.

On receipt of an initiation signal, ECCS pumps automatically start; simultaneously, the system aligns and the pumps inject water, taken either from the CST or suppression pool, into the Reactor Coolant System (RCS) as RCS pressure is overcome by the discharge pressure of the ECCS pumps. Although the system is initiated, ADS action is delayed, allowing the operator to interrupt the timed sequence if the system is not needed.

The HPCI pump discharge pressure quickly exceeds that of the RCS, and the pump injects coolant into the vessel to cool the core. If the break is small, the HPCI System will maintain coolant inventory as well as vessel level while the RCS is still pressurized. If HPCI fails, it is backed up by ADS in combination with LPCI and CS. In this event absent operator action, the ADS timed sequence would time out and open the selected safety/relief valves (S/RVs) depressurizing the RCS, thus allowing the LPCI and CS to overcome RCS pressure and inject coolant into the vessel. If the break is large, RCS pressure initially drops rapidly and the.

LPCI and CS cool the core.

Water from the break returns to the suppression pool where it is used again and again. Water in the suppression pool is circulated through a heat exchanger cooled by the RHR Service Water System. Depending on the location and size of the break, portions of the ECCS may be ineffective; (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-1 Revision 1

Rev.5 EGGS-Operating

BASES B 3.

5.1 BACKGROUND

however, the overall design is effective in cooling the core (continued) regardless of the size or location of the piping break. Although no credit is taken in the safety analysis for the RCIC System, it performs a similar function as HPCI, but has reduced makeup capability. Nevertheless, it will maintain inventory and cool the core while the RCS is still pressurized following a reactor pressure vessel (RPV) isolation.

All ECCS subsystems are designed to ensure that no single active component failure will prevent automatic initiation and successful operation of the minimum required ECCS equipment.

The CS System (Ref. 1) is composed of two independent subsystems. Each subsystem consists of two motor driven pumps, a spray sparger above the core, and piping and valves to transfer water from the suppression pool to the sparger. The CS System is designed to provide cooling to the reactor core when reactor pressure is low. Upon receipt of an initiation signal, the CS pumps in both subsystems are automatically started when AC power is available. When the RPV pressure drops sufficiently, CS System flow to the RPV begins. A full flow test line is provided to route water from and to the suppression pool to allow testing of the CS System without spraying water in the RPV.

LPCI is an independent operating mode of the RHR System.

There are two LPCI subsystems (Ref. 2), each consisting of two motor driven pumps and piping and valves to transfer water from the suppression pool to the RPV via the corresponding recirculation loop. The two LPCI subsystems can be interconnected via the RHR System cross tie valves; however, at least one of the two cross tie valves is maintained closed with its power removed to prevent loss of both LPCI subsystems during a LOCA. The LPCI subsystems are designed to provide core cooling at low RPV pressure. Upon receipt of an initiation signal, all four LPCI pumps are automatically started. RHR System valves in the LPCI flow path are automatically positioned to ensure the proper flow path for water from the suppression pool to inject into the recirculation* loops. When the RPV pressure drops sufficiently, the LPCI flow to the RPV, via the corresponding recirculation loop, begins. The water then enters the reactor through the jet pumps.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-2 Revision 1

Rev.5 EGGS-Operating

B 3.5.1 BASES BACKGROUND Full flow test lines are provided for each LPCI subsystem to route water (continued) from the suppression pool, to allow testing of the LPCI pumps without injecting water into the RPV. These test lines also provide suppression pool cooling capability, as described in LCO 3.6.2.3, "RHR Suppression Pool Cooling."

The HPCI System (Ref. 3) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the feedwater system line, where the coolant is distributed within the RPV through the feedwater sparger. Suction piping for the system is provided from the CST and the suppression pool. Pump suction for HPCI is normally aligned to the CST source to minimize injection of suppression pool water into the RPV. Whenever the CST water supply is low, an automatic transfer to the suppression pool water source ensures an adequate suction head for the pump and an uninterrupted water supply for continuous operation of the HPCI System. The steam supply to the HPCI turbine is piped from a main steam line upstream of the associated inboard main steam isolation valve .

The HPCI System is designed to provide core cooling for a wide range of reactor pressures (165 psia to 1225 psia). Upon receipt of an initiation signal, the HPCI turbine stop valve and turbine control valve open and the turbine accelerates to a specified speed. As the HPCI flow increases, the turbine control valve is automatically adjusted to maintain design flow.

Exhaust steam from the HPCI turbine is discharged to the suppression pool. A full flow test line is provided to route water to the CST to allow testing of the HPCI System during normal operation without injecting water into the RPV.

The EGGS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open to prevent pump damage due to overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, all ECCS pump discharge lines are filled with water. The HPCI, LPCI and CS System discharge lines are kept full of water using a "keep fill" system that is supplied using the condensate transfer system.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-3 Revision 2

Rev.5 ECCS-Operating B 3.5.1 BASES BACKGROUND The ADS (Ref. 4) consists of 6 of the 16 S/RVs. It is designed to provide (continued) depressurization of the RCS during a small break LOCA if HPCl fails or is unable to maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating pressure range of the low pressure ECCS subsystems (CS and LPCI), so that these subsystems can provide coolant inventory makeup. Each of the S/RVs used for automatic depressurization is equipped with two gas accumulators and associated inlet check valves. The accumulators provide the pneumatic power to actuate the valves.

APPLICABLE The ECCS performance is evaluated for the entire spectrum of break sizes SAFETY for a postulated LOCA. The accidents for which ECCS operation is required ANALYSES are presented in References 5, 6, and 7. The required analyses and assumptions are defined in Reference 8. The results of these analyses are also described in Reference 9.

This LCO helps to ensure that the following acceptance criteria for the ECCS, established by 10 CFR 50.46 (Ref. 10), will be met following a LOCA, assuming the worst case single active component failure in the ECCS:

a. Maximum fuel element cladding temperature is s 2200°F;

b. Maximum cladding oxidation is s 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is s 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. The core is maintained in a coolable geometry; and

e. Adequate long term cooling capability is maintained.

SPC performed LOCA calculations for the SPC ATRIUM'-10 fuel design.

The limiting single failures for the SPC analyses are discussed in Reference 11. The LOCA calculations examine both recirculation pipe and non-recirculation pipe breaks. For the recirculation pipe breaks, breaks on both the discharge and suction side of the recirculation pump are performed for two geometries; double-ended guillotine break and split break. The LOCA calculations demonstrate that the most limiting (highest PCT) break is a double-ended guillotine break in the recirculation pump suction piping. The limiting single failure is the failure of the LPCI injection valve in the intact recirculation loop to open.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-4 Revision 2

Rev. 5 ECCS-Operating

8 3.5.1 BASES APPLICABLE SAFETY One ADS valve failure is analyzed as a limiting single failure for events ANALYSES requiring ADS operation. The remaining OPERABLE ECCS subsystems (continued) provide the capability to adequately cool the core and prevent excessive fuel damage.

The ECCS satisfy Criterion 3 of the NRC Policy Statement (Ref. 15).

LCO Each ECCS injection/spray subsystem and six ADS valves are required to be OPERABLE. The ECCS injection/spray subsystems are defined as the two CS subsystems, the two LPCI subsystems, and one HPCI System.

The low pressure ECCS injection/spray subsystems are defined as the two CS subsystems and the two LPCI subsystems.

With less than the required number of ECCS subsystems OPERABLE, the potential exists that during a limiting design basis LOCA concurrent with the worst case single failure, the limits specified in Reference 1o could be exceeded. All ECCS subsystems must therefore be OPERABLE to satisfy the single failure criterion required by.Reference 10 .

LPCI subsystems may be considered OPERABLE during alignment and operation for decay heat removal when below the actual RHR cut in permissive pressure in MODE 3, if capable of being manually realigned (remote or local) to the LPCI mode and not otherwise inoperable. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling when necessary.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-5 Revision 3

Rev.5 ECCS-Operating

BASES APPLICABILITY All ECCS subsystems are required to be OPERABLE during MODES 1, 2, and 3, when there is considerable energy in the reactor core and core B 3.5.1 cooling would be required to prevent fuel damage in the event of a break in the primary system piping. In MODES 2 and 3, when reactor steam dome pressure is :-s; 150 psig, ADS and HPCI are not required to be OPERABLE because the low pressure ECCS subsystems can provide sufficient flow below this pressure. ECCS requirements for MODES 4 and 5 are specified in LCO 3.5.2, ECCS-Shutdown."

ACTIONS . A Note prohibits the application of LCO 3.0.4.b to an inoperable HPCI subsystem. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable HPCI subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance .

If any one low pressure ECCS injection/spray subsystem is inoperable for reasons other than Condition B, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced, because a single failure in one of the remaining OPERABLE subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 12) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

If one LPCI pump in one or both LPCI subsystems is inoperable, the

. inoperable LPCI pumps must be restored to OPERABLE status within 7 days.

In this Condition, the remaining OPERABLE LPCI pumps and at least one CS subsystem provide adequate core cooling during a LOCA.

However, overall ECCS reliability is reduced, because a single failure in one of the remaining OPERABLE subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function. A 7 day Completion Time is based on a reliability study cited in Reference 12 and has been found to be acceptable through operating experience .

(continued)

SUSQUEHANNA- UNIT 2 TS I B 3.5-6 Revision 2

Rev. 5 ECCS-Operating

B 3.5.1 BASES ACTIONS C.1 and C.2 (continued)

If the inoperable low pressure ECCS subsystem or LPCI pump(s) cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1 and D.2 If the HPCI System is inoperable and the RCIC System is verified to be OPERABLE, the HPCI System must be restored to OPERABLE status within 14 days. In this Condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with ADS. Also, the RCIC System will automatically provide makeup water at most reactor operating pressures. Verification of RCIC OPERABILITY is therefore required when HPCI is inoperable. This may be performed as an administrative check by examining logs or other information to determine if RCIC is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. If the OPERABILITY of the RCIC System cannot be verified, however, Condition H must be immediately entered. If a single active component fails concurrent with a design basis LOCA, there is a potential, depending on the specific failure, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on a reliability study cited in Reference 12 and has been found to be acceptable through operating experience.

E.1 and E.2 If Condition A or Condition B exists in addition to an inoperable HPCI System, the inoperable low pressure ECCS injection/spray subsystem or the LPCI pump(s) or the HPCI System must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, adequate core cooling is ensured by the OPERABILITY of the ADS and the remaining low pressure ECCS subsystems. However, the overall ECCS reliability is significantly reduced because a single failure in one of the remaining OPERABLE subsystems (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-7 Revision 1

Rev.5 ECCS-Operating B 3.5.1 BASES ACTIONS E.1 and E.2 (continued) concurrent with a design basis LOCA may result in the ECCS not being able to perform its intended safety function. Since.both a high pressure system (HPCI) and a low pressure subsystem are inoperable, a more restrictive Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is required to restore either the HPCI System or the low pressure ECCS injection/spray subsystem to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 12 and has been found to be acceptable through operating experience.

The LCO requires six ADS valves to be OPERABLE in order to provide the ADS function. Reference 11 contains the results of an analysis that evaluated the effect of one ADS valve being out of service. Per this analysis, operation of only five ADS valves will provide the required depressurization. However, overall reliability of the ADS is reduced, because a single failure in the OPERABLE ADS valves could result in a

reduction in depressurization capability. Therefore, operation is only allowed for a limited time. The 14 day Completion Time is based on a reliability study cited in Reference 12 and has been found to be acceptable through operating experience.

G.1 and G.2 If Condition A or Condition B exists in addition to one inoperable ADS valve, adequate core cooling is ensured by the OPERABILITY of HPCI and the remaining low pressure ECCS injection/spray subsystem.

However, overall ECCS reliability is reduced because a single active component failure concurrent with a design basis LOCA could result in the minimum required ECCS equipment not being available. Since both a high pressure system (ADS) and a low pressure subsystem are inoperable, a more restrictive Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is required to restore either the low pressure ECCS subsystem or the ADS valve to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 12 and has been found to be acceptable through operating experience.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-8 Revision 1

Rev.5 ECCS-Operating

BASES ACTIONS H.1 and H.2 B 3.5.1 (continued)

If any Required Action and associated Completion Time of Condition D, E, F, or G is not met, or if two or more ADS valves are inoperable, the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reactor steam dome pressure reduced to:;:; 150 psig within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

When multiple ECCS subsystems are inoperable, as stated in Condition I, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3 *5

1* 1 REQUIREMENTS The flow path piping has the potential to develop voids and pockets of entrained air. Maintaining the pump discharge lines of the HPCI System, CS System, and LPCI subsystems full of water ensures that the ECCS will perform properly, injecting its full capacity into the RCS upon demand.

This will also prevent a water hammer following an ECCS initiation signal.

One acceptable method of ensuring that the lines are full is to vent at the high points. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.1.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these were verified to be in the correct position prior locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in (continued)

SUSQUEHANNA - UNIT 2 TS/ B 3.5-9 Revision 2

Rev.5 ECCS-Operating

BASES B 3.5.1 SURVEILLANCE REQUIREMENTS SR 3.5.1.2 (continued) the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the HPCI System, this SR also includes the steam flow path for the turbine and the flow controller position.

The Surveillance Frequency is controlled under th.e Surveillance Frequency Control Program.

This SR is modified by a Note that allows LPCI subsystems to be considered OPERABLE during alignment and operation for decay heat removal with reactor steam dome pressure less than the RHR cut in permissive pressure in MODE 3, if capable of being manually realigned (remote or local) to the LPCI mode and not otherwise inoperable. This allows operation in the RHR shutdown cooling mode during MODE 3, if necessary.

SR 3.5.1.3 Verification that ADS gas supply header pressure is ~ 135 psig ensures adequate gas pressure for reliable ADS operation. The accumulator on each ADS valve provides pneumatic pressure for valve actuation. The design pneumatic supply pressure requirements for the accumulator are such that, following a failure of the pneumatic supply to the accumulator, at least one valve actuations can occur with the drywell at 70% of design .

pressure.

The EGGS safety analysis assumes only one actuation to achieve the depressurization required for operation of the low pressure ECCS. This minimum required pressure of~ 135 psig is provided by the containment instrument gas system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-10 Revision 2

Rev.5 ECCS-Operating

BASES B 3.5.1 SURVEILLANCE SR 3.5.1.4 REQUIREMENTS (continued) Verification that at least one RHR System cross tie valve is closed and power to its operator is disconnected ensures that each LPCI subsystem remains independent and a failure of the flow path in one subsystem will not affect the flow path of the other LPCI subsystem. Acceptable methods of removing power to the operator include opening the breaker, or racking out the breaker, or removing the breaker. If both RHR System cross tie valves are open or power has not been removed from at least one closed valve operator, both LPCI subsystems must be considered inoperable. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.1.5 Verification that each 480 volt AC swing bus transfers automatically from the normal source to the alternate source on loss of power while supplying its respective bus demonstrates that electrical power is available to ensure proper operation of the associated LPCI inboard injection and minimum flow valves and the recirculation pump discharge and bypass valves.

Therefore, each 480 volt AC swing bus must be OPERABLE for the associated LPCI subsystem to be OPERABLE.. The test is performed by actuating the load test switch or by disconnecting the preferred power source to the transfer switch and verifying that swing bus automatic transfer is accomplished. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.1.6 Cycling the recirculation pump discharge and bypass valves through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and provides assurance that the valves will close when required to ensure the proper LPCI flow path is established. Upon initiation of an automatic LPCI subsystem injection signal, these valves are required to be closed to ensure full LPCI subsystem flow injection in the reactor via the recirculation jet pumps. De-energizing the valve in the closed position will also ensure the proper flow path for the LPCI subsystem. Acceptable methods of de-energizing the valve include opening the breaker, or racking out the breaker, or removing the breaker.

SUSQUEHANNA- UNIT 2 TS I B 3.5-11 (continued)

Revision 3

Rev.5 ECCS-Operating

BASES SURVEILLANCE SR 3.5.1.6 (continued)

B 3.5.1 REQUIREMENTS The specified Frequency is once during reactor startup before THERMAL POWER is > 25% RTP. However, this SR is modified by a Note that states the Surveillance is only required to be performed if the last performance was more than 31 days ago. Therefore, implementation of this Note requires this test to be performed during reactor startup before exceeding 25% RTP. Verification during reactor startup prior to reaching

> 25% RTP is an exception to the normal lnservice Testing Program generic valve cycling Frequency, but is considered acceptable due to the demonstrated reliability of these valves. If the valve is inoperable and in the open position, the associated LPCI subsystem must be declared inoperable.

SR 3.5.1.7, SR 3.5.1.8, and SR 3.5.1.9 The performance requirements of the low pressure ECCS pumps are determined through application of the 10 CFR 50, Appendix K criteria (Ref. 8). This periodic Surveillance is performed (in accordance with the ASME OM Code requirements for the EGGS pumps} to verify that the EGGS pumps will develop the flow rates required by the respective analyses. The low pressure ECCS pump flow rates ensure that adequate core cooling is provided to satisfy the acceptance criteria of Reference 10.

The pump flow rates are verified against a system head equivalent to the RPV pressure expected during a LOCA. The total system pump outlet pressure is adequate to overcome the elevation head pressure between the pump suction and the vessel discharge, the piping friction losses, and RPV pressure present during a LOCA. These values may be established during preoperational testing.

The flow tests for the HPCI System are performed at tWo different pressure ranges such that system capability to provide rated flow is tested at both the higher and lower operating ranges of the system. Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the HPCI System diverts steam flow. Reactor steam pressure is considered .

adequate when ~ 920 psig to perform SR 3.5.1.8 and ~ 150 psig to perform SR 3.5.1.9. However, the requirements of SR 3.5.1.9 are met by a successful performance at any pressure.::: 165 psig. Adequate steam flow is represented by at least 1.25 turbine bypass valves open.

Therefore, sufficient time is allowed after adequate pressure and flow are achieved to perform these tests. Reactor startup is allowed prior to performing the low pressure Surveillance test because the reactor pressure is low and the time allowed to satisfactorily

SUSQUEHANNA - UNIT 2 TS I B 3.5-12 (continued}

Revision 3

Rev. 5 ECCS-Operating

BASES B 3.5.1 SURVEILLANCE SR 3.5.1.7, SR 3.5.1.8. and SR 3.5.1.9 (continued)

REQUIREMENTS perform the Surveillance test is short. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure test has been satisfactorily completed and there is no indication or reason to believe that HPCI is inoperable.

Therefore, SR 3.5.1.8 and SR 3.5.1.9 are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the reactor steam pressure and flow are adequate to perform the test.

The Frequency for SR 3.5.1.7 and SR 3.5.1.8 is in accordance with the lnservice Testing Program requirements. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.1.10 The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCI, CS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup and actuation of all automatic valves to their required positions. This functional test includes the LPCI and CS interlocks between Unit 1 and Unit 2 and specifically requires the following:

A functional test of the interlocks associated with the LPCI and CS pump starts in response to an automatic initiation signal in Unit 1 followed by a false automatic initiation signal in,Unit 2; A functional test of the interlocks associated with the LPCI and CS pump starts in response to an automatic initiation signal in Unit 2 followed by a false automatic initiation signal in Unit 1; and

SUSQUEHANNA - UNIT 2 TS I B 3.5-13 (continued)

Revision 2

Rev.5 ECCS-Operating

BASES B 3.5.1 SURVEILLANCE REQUIREMENTS SR 3.5.1.10 (continued)

A functional test of the interlocks associated with the LPCI and CS pump starts in response to simultaneous occurrences of an automatic initiation signal in both Unit 1 and Unit 2 and a loss of Offsite power condition affecting both Unit 1 and Unit 2.

The purpose of this functional test (preferred pump logic) is to assure that if a false LOCA signal were to be received on one Unit simultaneously with an actual LOCA signal on the second Unit, the preferred LPCI and CS pumps are started and the non-preferred LPCI and CS pumps are tripped for each Unit. This functional test is performed by verifying that the non-preferred LPCI and CS pumps are tripped. The verification that preferred LPCI and CS pumps start is performed under a separate surveillance test. Only one division of LPCI preferred pump logic is required to be OPERABLE for each Unit, because no additional failures needs to be postulated with a false LOCA signal. If the preferred or non-preferred pump logic for CS is inoperable, the associated CS pumps shall be declared inoperable and the pumps should not be operated to ensure that the opposite Unit's CS pumps or4.16 kV ESS Buses are protected.

This SR also ensures that the HPCI System will' automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the CST to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlaps this Surveillance.

This SR can be accomplished by any series of sequential overlapping or total steps such that the entire channel is tested.

The Surveillance Frequency is controlled under the Surveillance Freque*ncy Control Program.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-14 Revision 2

Rev. 5 ECCS-Operating

BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3 *5 *1*1 1 The ADS designated S/RVs are required to actuate automatically upon B 3.5.1 receipt of specific initiation signals. A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,

solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.12 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes valve actuation. This prevents an RPV pressure blowdown.

SR 3.5.1.12 A manual actuation of each ADS valve actuator is performed to verify that the valve and solenoid are functioning properly. This is demonstrated by

the method described below. Proper operation of the valve tailpipes is ensured through the use of foreign material exclusion during maintenance.

Valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements, prior to valve installation.

SUSQUEHANNA - UNIT 2 TS I B 3.5-15 (continued)

Revision 4

Rev.5 EGGS-Operating

BASES SURVEILLANCE REQUIREMENT s

SR 3.5.1.12 (continued)

B 3.5.1 Manual actuation of the actuator at atmospheric temperature and pressure during cold shutdown is performed. Proper functioning of the valve actuator and solenoid is demonstrated by visual observation of actuator movement. The ADS actuator will be disconnected from the valve to ensure no damage is done to the valve seat or to the valve internals. Each valve shall be bench-tested prior to reinstallation. The bench-test along with the test on the ADS actuator establishes the OPERABILITY of the valves.

SR 3.5.1.11 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SR 3.5.1.13 This SR ensures that the ECCS RESPONSE TIME for each ECCS injection/spray subsystem is less than or equal to the maximum value assumed in the accident analysis. Response Time testing acceptance criteria are included in Reference 13. This SR is modified by a Note that allows the instrumentation portion of the response time to be assumed to be based on historical response time data and therefore, is excluded from the EGGS RESPONSE TIME testing. This is allowed since the instrumentation response time is a small part of the ECCS RESPONSE TIME (e.g., sufficient margin exists in the diesel generator start time when compared to the instrumentation response time) (Ref. 14) .

SUSQUEHANNA - UNIT 2 TS I B 3.5-16 (continued)

Revision 4

Rev. 5 ECCS-Operating

BASES B 3.5.1 SURVEILLANCE SR 3.5.1.13 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.3.2.2.3.

2. FSAR, Section 6.3.2.2.4.

3. FSAR, Section 6.3.2.2.1.

4. FSAR, Section 6.3.2.2.2.

5. FSAR, Section 15.2.8.

6. FSAR, Section 15.6.4.

7.

8.

9.

FSAR, Section 15.6.5.

10 CFR 50, Appendix K.

FSAR, Section 6.3.3.

10. 10 CFR 50.46.

11. FSAR, Section 6.3.3.

12. Memorandum from R.L. Baer (NRC) to V. Stello, Jr. (NRC),

"Recommended Interim Revisions to LCOs for ECCS Components,"

December 1, 1975.

13. FSAR, Section 6.3.3.3.

14. NEDO 32291-A, "System Analysis for the Elimination of Selected Response Time Testing Requirements, October 1995.

15. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.5-17 Revision 4

Rev. 5 ECCS-Operating

B 3.5.1 THIS PAGE INTENTIONALLY LEFT BLANK

SUSQUEHANNA - UNIT 2 TS I B 3.5-18 Revision 1

Rev. 3 EGGS-Shutdown

B 3.5 B 3.5.2 EMERGENCY CORE COOLING SYSTEMS (EGGS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM EGGS-Shutdown B 3.5.2 BASES BACKGROUND A description of the Core Spray (CS) System and the Low Pressure Coolant Injection (LPCI) mode of the Residual Heat Removal (RHR)

System is provided in the Bases for LCO 3.5.1, "EGGS-Operating."

APPLICABLE The EGGS performance is evaluated for the entire spectrum of break SAFETY sizes for a postulated loss of coolant accident (LOCA). The long term ANALYSES cooling analysis following a design basis LOCA (Reference 1) demonstrates that only one low pressure EGGS injection /spray subsystem is required, post LOCA, to maintain adequate reactor vessel water level in the event of an inadvertent vessel draindown. It is reasonable to assume, based on engineering judgement, that while in MODES 4 and 5, one low pressure ECCS injection/spray subsystem can maintain adequate reactor vessel water level. To provide redundancy, a minimum of two low pressure EGGS injection/spray subsystems are required to be OPERABLE in MODES 4 and 5.

The low pressure EGGS subsystems satisfy Criterion 3 of the NRG Policy Statement (Ref. 2).

LCO Two low pressure ECCS injection/spray subsystems are required to be OPERABLE. The low pressure ECCS injection/spray subsystems consist of two CS subsystems and two LPCI subsystems. Each CS subsystem consists of two motor driven pumps, piping, and valves to transfer water from the suppression pool or condensate storage tank (CST) to the reactor pressure vessel (RPV). Each LPCI subsystem consists of one of the two motor driven pumps, piping, and valves to transfer water from the suppression pool to the RPV. Only a single LPCI pump is required per subsystem because of the larger injection capacity in relation to a CS subsystem. In MODES 4 and 5, the RHR System cross tie valves are not required to be closed.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-19 Revision 1

Rev.3 EGGS-Shutdown

BASES LCO LPCI subsystems may be aligned for decay heat removal and considered B 3.5.2 (continued) OPERABLE for the ECCS function, if they can be manually realigned (remote or local) to the LPCI mode and are not otherwise inoperable.

Because of low pressure and low temperature conditions in MODES 4 and 5, sufficient time will be available to manually align and initiate LPCI subsystem operation to provide core cooling prior to postulated fuel uncovery.

APPLICABILITY OPERABILITY of the low pressure ECCS injection/spray subsystems is required in MODES 4 and 5 to ensure adequate coolant inventory and sufficient heat removal capability for the irradiated fuel in the core in case of an inadvertent draindown of the vessel. Requirements for EGGS OPERABILITY during MODES 1, 2, and 3 are discussed in the Applicability section of the Bases for LCO 3.5.1. EGGS subsystems are not required to be OPERABLE during MODE 5 with the spent fuel storage pool gates removed and the water level maintained at ~ 22 ft. above the RPV flange. This provides sufficient coolant inventory to allow operator action to terminate the inventory loss prior to fuel uncovery in case of an inadvertent draindown .

The Automatic Depressurization System is not required to be OPERABLE to be OPERABLE during MODES 4 and 5 because the RPV pressure is

s; 150 psig, and the CS System and the LPCI subsystems can provide core cooling without any depressurization of the primary system.

The High Pressure Coolant Injection System is not required to be OPERABLE during MODES 4 and 5 since the low pressure EGGS injection/spray subsystems can provide sufficient flow to the vessel.

ACTIONS A.1 and B.1 If any one required low pressure ECCS injection/spray subsysten:i is inoperable, the inoperable subsystem must be restored to OPERABLE status in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . In this Condition, the remaining OPERABLE subsystem can provide sufficient vessel flooding capability to recover from an inadvertent (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-20 Revision 1

Rev.3 ECCS-Shutdown

BASES ACTIONS A.1 and B.1 (continued)

B 3.5.2 Vessel draindown. However, overall system reliability is reduced because a single failure in the remaining OPERABLE subsystem concurrent with a vessel draindown could result in the ECCS not being able to perform its intended function. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time for restoring the required low pressure ECCS injection/spray subsystem to OPERABLE status is based on engineering judgement that considered the remaining available subsystem and the low probability of a vessel draindown event.

With the inoperable subsystem not restored to OPERABLE status in the required Completion Time, action must be immediately initiated to suspend operations with a potential for draining the reactor vessel (OPDRVs) to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

C.1. C.2, 0.1, D.2. and D.3 With both of the required ECCS injection/spray subsystems inoperable, all coolant inventory makeup capability may be unavailable. Therefore, actions must immediately be initiated to suspend OPDRVs to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

One ECCS injection/spray subsystem must also be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

If at least one low pressure ECCS injection/spray subsystem is not restored to OPERABLE status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time, additional actions are required to minimize any potential fission product release to the environment. This includes ensuring secondary containment is OPERABLE; one standby gas treatment subsystem is OPERABLE; and secondary containment isolation capability (i.e., one isolation valve and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability) in each secondary containment penetration flow path not isolated and required to be isolated to mitigate radioactivity releases. OPERABILITY may be verified by an administrative check, or by examining logs or other information, to determine whether the components are out of (continued)

SUSQUEHANNA- UNIT 2 TS/ B 3.5-21 Revision 1

Rev.3 ECCS-Shutdown

BASES ACTIONS C.1. C.2. D.1. 0.2. and D.3 (continuedl B 3.5.2 service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the Surveillance may need to be performed to restore the component to OPERABLE status.

Actions must continue until all required components are OPERABLE.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time to restore at least one low pressure ECCS injection/spray subsystem to OPERABLE status ensures that prompt action will be taken to provide the required cooling capacity or to initiate actions to place the plant in a condition that minimizes any potential fission product release to the environment.

SURVEILLANCE REQUIREMENTS SR 3.5.2.1 and SR 3.5.2.2 The minimum water level of 20 ft. O inches required for the suppression pool is periodically verified to ensure that the suppression pool will provide adequate net positive suction head (NPSH) for the CS System and LPCI subsystem pumps, recirculation volume, and vortex prevention. With the suppression pool water level less than the required limit, all ECCS injection/spray subsystems are inoperable unless they are aligned to an OPERABLE CST.

When suppression pool level is < 20 ft. O inches, the CS System is considered OPEABLE only if it can take suction from the CST, and the CST water level is sufficient to provide the required NPSH for the CS pump. Therefore, a verification that either the suppression pool water level is ;::: 20 ft. 0 inches or that CS is aligned to take suction from the CST and the CST contains ;::: 135,000 gallons of water, equivalent to 49% of capacity, ensures that the CS System can supply at least 135,000 gallons of makeup water to the RPV. However, as noted, only one required CS subsystem may take credit for the CST option during OPDRVs. During OPDRVs, the volume in the CST may not provide adequate makeup if the RPV were completely drained. Therefore, only one CS subsystem is allowed to use the CST. This ensures (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-22 Revision 2

Rev.3 ECCS-Shutdown

BASES SURVEILLANCE REQUIREMENTS SR 3.5.2.1 and SR 3.5.2.2 (continued)

B 3.5.2 the other required ECCS subsystem has adequate makeup volume.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.3, SR 3.5.2.5, SR 3.5.2.6, and SR 3.5.2.7 The Bases provided for SR 3.5.1.1, SR 3.5.1. 7, SR 3.5.1.10, and SR 3.5.1.13 are applicable to SR 3.5.2.3, SR 3.5.2.5, SR 3.5.2.6 and SR 3.5.2.7, respectively.

SR 3.5.2.4 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

In MODES 4 and 5, the RHR System may operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. Therefore, RHR valves that are required for LPCI (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-23 Revision 2

Rev. 3 EGGS-Shutdown

BASES SURVEILLANCE SR 3.5.2.4 (continued)

B 3.5.2 REQUIREMENTS subsystem operation may be aligned for decay heat removal. Therefore, this SR is modified by a Note that allows LPCI subsystems of the RHR System to be considered OPERABLE for the ECCS function if all the required valves in the LPCI flow path can be manually realigned (remote or local) to allow injection into the RPV, and the systems are not otherwise inoperable. This will ensure adequate core cooling if an inadvertent RPV draindown should occur.

REFERNCES 1. FSAR, Section 6.3.2.

2. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 B 3.5-24 Revision O

Rev.4 RCIC System B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.3 RCIC System BASES BACKGROUND The RCIC System is not part of the ECCS; however, the RCIC System is included with the ECCS section because of their similar functions.

The RCIC System is designed to operate either automatically or manually following reactor pressure vessel (RPV) isolation accompanied by a loss of coolant flow from the feedwater system to provide adequate core cooling and control of the RPV water level. Under these conditions, the High Pressure Coolant Injection (HPCI) and RCIC systems perform similar functions. The RCIC System design requirements ensure that the criteria of Reference 1 are satisfied.

The RCIC System (Ref. 2) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the feedwater system line, where the coolant is distributed within the RPV through the feedwater sparger. Suction piping is provided from the condensate storage tank (CST) and the suppression pool. Pump suction is normally aligned to the CST to minimize injection of suppression pool water into the RPV. However, if the CST water supply is low, an automatic transfer to the suppression pool water source ensures an adequate suction head for the pump and an uninterrupted water supply for continuous operation of the RCIC System. The steam to the turbine is piped from a main steam line upstream of the associated inboard main steam line

isolation valve.

The RCIC System is designed to provide core cooling for a wide range of reactor pressures (165 psia to 1225 psia). Upon receipt of an initiation signal, the RCIC turbine accelerates to a specified speed. As the RCIC flow

increases, the turbine control valve is automatically adjusted to maintain design flow. Exhaust steam from the RCIC turbine is discharged to the suppression pool. A full flow test line is provided to route water to the CST to allow testing of the RCIC System during normal operation without injecting water into the RPV.

(continued)

SUSQUEHANNA - UNIT 2 TS/ B 3.5-25 Revision 1

Rev. 4 RCIC System B 3.5.3 BASES BACKGROUND The RCIC pump is provided with a minimum flow bypass line, which (continued) discharges to the suppression pool. The valve in this line automatically opens to prevent pump damage due to overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the RCIC System discharge piping is kept full of water. The RCIC System is normally aligned to the CST. The RCIC discharge line is kept full of water using a "keep fill" system supplied by the condensate transfer system.

APPLICABLE The function of the RCIC System is to respond to transient events by SAFETY ANALYSES providing makeup coolant to the reactor. The RCIC System is not an Engineered Safety Feature System and no credit is taken in the Design Basis Loss of Coolant Accident (LOCA) safety analysis for RCIC System operation. The RCIC System is credited in other accident analyses (See Chapter 15 of the FSAR). Based on its contribution to the reduction of overall plant risk,* however, the system is included in the Technical Specifications, as required by the NRC Policy Statement (Ref. 4).

LCO The OPERABILITY of the RCIC System provides adequate core cooling such that actuation of any of the low pressure ECCS subsystems is not required in the event of RPV isolation accompanied by a loss of feedwater flow. The RCIC System has sufficient capacity for

APPLICABILITY maintaining RPV inventory during an isolation event.

The RCIC System is required to be OPERABLE during MODE 1, and MODES 2 and 3 with reactor steam dome pressure >150 psig, since RCIC is the primary non-ECCS water source for core cooling when the reactor is isolated and pressurized. In MODES 2 and 3 with reactor steam dome pressure~ 150 psig, and in MODES 4 and 5, RCIC is not required to be OPERABLE since the low pressure ECCS injection/spray subsystems can provide sufficient flow to the RPV.

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable RCIC system. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable RCIC system and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

(continued)

SUSQUEHANNA - UNIT 2 TS/ 8 3.5-26 Revision 2

Rev.4 RCIC System

BASES ACTIONS (continued)

A.1 and A.2 B 3.5.3 If the RCIC System is inoperable during MODE 1, or MODE 2 or 3 with reactor steam dome pressure >150 psig, and the HPCI System is verified to be OPERABLE, the RCIC System must be restored to OPERABLE status within 14 days. In this Condition, loss of the RCIC System will not affect the overall plant capability to provide makeup inventory at high reactor pressure since the HPCI System is the only high pressure system assumed to function during a loss of coolant accident (LOCA). OPERABILITY of HPCI is therefore verified immediately when the RCIC System is inoperable. This may be peJformed as an administrative check, by examining logs or other information, to determine if HPCI is out of service for maintenance or other reasons. It does not mean it is necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the HPCI System. If the OPERABILITY of the HPCI System cannot be verified, however, Condition B must be immediately entered. For transients and certain abnormal events with no LOCA, RCIC (as opposed to HPCI) is the preferred source of makeup coolant because of its relatively small capacity, which allows easier control of the RPV water

level. Therefore, a limited time is allowed to restore the inoperable RCIC to OPERABLE status.

The 14 day Completion Time is based on a reliability study (Ref. 3) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (AOTs). Because of similar functions of HPCI and RCIC, the AOTs (i.e., Completion Times) determined for HPCI are also applied to RCIC.

B.1 and B.2 If the RCIC System cannot be restored to OPERABLE status within the associated Completion Time, or if the HPCI System is simultaneously inoperable, the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reactor steam dome pressure red.uced to :-: :; 150 psig within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-27 Revision 2

Rev. 4 RCIC System B 3.5.3 BASES ACTIONS B.1 and B.2 (continued)

Are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The flow path piping has the potential to develop voids and pockets of entrained air. Maintaining the pump discharge line of the RCIC System full of water ensures that the system will perform properly, injecting its full

capacity into the ReactorCoolant System upon demand. This will also prevent a water hammer following an initiation signal. One acceptable method of ensuring the line is full is to vent at the high points. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.3.2

Verifying the correct alignment for manual, power operated, and automatic valves in the RCIC flow path provides assurance that the proper flow path will exist for RCIC operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing.

A valve that receives an initiation signal is allowed to be in a non-accident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the RCIC System, this SR also includes the steam flow path for the turbine and the flow controller position.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

SUSQUEHANNA - UNIT 2 TS/ B 3.5-28 Revision 1

Rev. 4 RCIC System

BASES SURVEILLANCE 8 3.5.3 REQUIREMENTS SR 3.5.3.3 and SR 3.5.3.4 The RCIC pump flow rates ensure that the system can maintain reactor coolant inventory during pressurized conditions with the RPV isolated.

The flow tests for the RCIC System are performed at two different pressure ranges such that system capability to provide rated flow is tested both at the higher and lower operating ranges of the system. Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the RCIC System diverts steam flow. Reactor steam pressure is considered adequate when ~ 920 psig to perform SR 3.5.3.3 and ;:::: 150 psig to perform SR 3.5.3.4. However, the requirements of SR 3.5.3.4 are met by a successful performance at any pressure ~ 165 psig. Adequate steam flow is represented by at least 1.25 turbine bypass valves open.

Therefore, sufficient time is allowed after adequate pressure and flow are achieved to perform those SRs. Reactor startup is allowed prior to performing the low pressure Surveillance because the reactor pressure is low and the time allowed to satisfactorily perform the Surveillance is short.

The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure Surveillance has been

.satisfactorily completed and there is no indication or reason to believe that RCIC is inoperable. Therefore, these SRs are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the reactor steam pressure and flow are adequate to perform the test.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

SUSQUEHANNA - UNIT 2 TS/ B 3.5-29 Revision 2

Rev. 4 RCIC System

BASES SURVEILLANCE B 3.5.3 REQUIREMENTS SR 3.5.3.5 The RCIC System is required to actuate automatically in order to verify its design function satisfactorily. This Surveillance verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of the RCIC System will cause the system to operate as designed, including actuation of the system throughout its emergency operating sequence; that is, automatic pump startup and actuation of all automatic valves to their required positions. This test also ensures the RCIC System will automatically restart on a n RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the CST to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.2 overlaps this Syrveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

This SR is modified by a Note that excludes vessel injection during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 33.

2. FSAR, Section 5.4.6.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.5-30 Revision 2

Rev. 4 RCIC System B 3.5.3 BASES REFERENCES 3. Memorandum from R.L. Baer (NRC) to V. Stello, Jr. (NRC),

(continued) "Recommended Interim Revisions to LCOs for ECCS Components,"

December 1, 1975.

4. Final Policy Statement on Technical Specifications Improvements,*

July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS/ B 3.5-31 Revision 1

Rev. 6 Primary Containment B 3.6.1.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.1 Primary Containment BASES BACKGROUND The function of the primary containment is to isolate and contain fission products released from the Reactor Primary System following a Design Basis Loss of Coolant Accident confine the postulated release of radioactive material. The primary containment consists of a steel lined, reinforced concrete vessel, which surrounds the Reactor Primary System and provides an essentially leak tight barrier against an uncontrolled release of radioactive material to the environment.

The isolation devices for the penetrations in the primary containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier:

a. All penetrations required to be closed during accident conditions are either:

1. capable of being closed by an OPERABLE automatic containment isolation system, or

2. closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)";

b. The primary containment air lock is OPERABLE, except as provided in LCO 3.6.1.2, "Primary Containment Air Lock";

and

c. All equipment hatches are closed.

Several instruments connect to the primary containment atmosphere and are considered extensions of the primary containment. The leak rate tested instrument isolation valves identified in the Leakage Rate Test Program should be used as the primary containment boundary when the instruments are isolated and/or vented. Table B 3.6.1.1-1 contains the listing of the instruments and isolation valves .

SUSQUEHANNA - UNIT 2 TS I B 3.6-1 (continued)

Revision 2

Rev.6 Primary Containment B 3.6.1.1 BA~ES BACKGROUND The H20 2 Analyzer lines beyond the PCIVs, up to and including (continued) the components within the H20 2 Analyzer panels, are extensions of primary containment (i.e., closed system}, and are required to be leak rate tested in accordance with the Leakage Rate Test Program. The H202 Analyzer closed system boundary is identified in the Leakage Rate Test Program, and consists of components, piping, tubing, fittings, and valves, which meet the design guidance of Reference 7. Within the H20 2 Analyzer panels, the boundary ends at the first normally closed valve. The closed system boundary between PASS and the H202 Analyzer system ends at the Seismic Category I boundary between the two systems. This boundary occurs at the process sampling solenoid operated isolation valves (SV-22361, SV-22365, SV-22366, SV-22368, and SV-22369). These solenoid operated isolation valves do not fully meet the guidance of Reference 7 for closed system boundary valves in that they are not powered from a Class 1E power source. Based upon a risk determination, operating these valves as closed system boundary valves is not risk significant.

These normally closed valves are required to be leakage rate tested in accordance with the Leakage Rate Test Program, since they form part of the closed system boundary for the H202 Analyzers. These valves are "closed system boundary valves"

and may be opened under administrative control, as delineated in Technical Requirements Manual (TRM) Bases 3.6.4. Opening of these valves to permit testing of PASS in Modes 1, 2, and 3 is permitted in accordance with TRO 3.6.4.

When the H202 Analyzer panels are isolated and/or vented, the panel isolation valves identified in the Leakage Rate Test Program should be used as the boundar}I of the extension of primary containment. Table B 3.6.1.1-2 contains a listing of the affected H202 Analyzer penetrations and panel isolation valves.

This Specification ensures that the performance of the primary containment, in the event of a Design Basis Accident (DBA),

meets the assumptions used in the safety analyses of References 1 and 2. SR 3.6.1.1.1 leakage rate requirements are in conformance with 10 CFR 50, Appendix J, Option Band supporting documents (Ref. 3, 4 and 5), as modified by approved exemptions .

SUSQUEHANNA- UNIT 2 TS I B 3.6-1a (continued)

Revision 4

Rev. 6 Primary Containment B 3.6.1.1 BASES (continued)

APPLICABLE The safety design basis for the primary containment is that it SAFETY ANALYSES must withstand the pressures and temperatures of the limiting OBA without exceeding the design leakage rate.

The DBA that postulates the maximum release of radioactive material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE such that release of fission products to the environment is controlled by the rate of primary containment leakage.

Analytical methods and assumptions involving the primary containment are presented in References 1 and 2. The safety analyses assume a nonmechanistic fission product release following a OBA, which forms the basis for determination of offsite and control room doses. The fission product release is, in tum, based on an assumed leakage rate from the primary containment. OPERABILITY of the primary containment ensures that the leakage rate assumed in the safety analyses is not exceeded.

The maximum allowable leakage rate for the primary

containment (La) is 1.0% by weight of the containment air per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at the design basis LOCA maximum peak containment pressure (Pa) of 48.6 psig.

Primary containment satisfies Criterion 3 of the NRG Policy Statement. (Ref. 6)

LCO Primary containment OPERABILITY is maintained by limiting leakage to :::;1.0 La, except prior to each startup after performing a required Primary Containment Leakage Rate Testing Program leakage test. At this time, applicable leakage limits must be met. Compliance with this LCO will ensure a primary containment configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analyses.

Individual leakage rates specified for the primary containment air lock are addressed in LCO 3.6.1.2.

Leakage requirements for MSIVs and Secondary containment bypass are addressed in LCO 3.6.1.3 .

SUSQUEHANNA - UNIT 2 TS/ B 3.6-2 (continued)

Revision 4

Rev. 6 Primary Containment

BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a OBA could cause a release of B 3.6.1.1 radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, primary containment is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment.

ACTIONS In the event primary containment is inoperable, primary containment must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining primary containment OPERABILITY during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring primary containment OPERABILITY) occurring during periods where primary containment is inoperable is minimal.

8.1 and B.2

If primary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.\

SURVEILLANCE SR 3.6.1.1.1 REQUIREMENTS Maintaining the primary containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Primary Containment Leakage Rate Testing Program. The primary containment concrete visual examinations may be performed during either power operation, e.g., performed concurrently with other primary containment inspection-related activities, or during a maintenance or refuel outage.

SUSQUEHANNA - UNIT 2 TS/ B 3.6-3 .

(continued)

Revision 3

Rev.6 Primary Containment

BASES SURVEILLANCE REQUIREMENTS SR 3.6.1.1.1 (continued)

B 3.6.1.1 The visual examinations of the steel liner plate inside primary containment are performed during maintenance or refueling outages since this is the only time the liner plate is fully accessible.

Failure to meet air lock leakage testing (SR 3.6.1.2.1) or resilient seal primary containment purge valve leakage testing (SR 3.6.1.3.6) does not necessarily result in a failure of this SR.

The impact of the failure to meet these SRs must be evaluated against the Type A, B, and C acceptance criteria of the Primary Containment Leakage Rate Testing Program. As left leakage prior to each startup after performing a required leakage test is required to be < 0.6 La for combined Type B and C leakage, and s 0.75 La for overall Type A leakage. At all other times between required leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of s 1.0 La. Ats 1.0 La the offsite and control room dose consequences are bounded by the assumptions of the safety analysis. The Frequency is required by the Primary Containment Leakage Rate Testing Program .

SR Frequencies are as required by the Primary Containment Leakage Rate Testing Program. These periodic testing requirements verify that the primary containment leakage rate does not exceed the leakage rate assumed in the safety analysis.

As noted in Table B 3.6.1.3-1, an exemption to Appendix J is provided that isolation barriers which remain filled or a water seal remains in the line post-LOCA are tested with water and the leakage is not included in the Type B and C 0.60 La test.

SR 3.6.1.1.2 Maintaining the pressure suppression function of primary containment requires limiting the leakage from the drywall to the suppression chamber. Thus, if an event were to occur that pressurized the drywell, the steam would be directed. through the downcomers into the suppression pool. This SR measures drywall to suppression chamber leakage to ensure that the leakage paths that would bypass the suppression pool are within allowable limits.

SUSQUEHANNA - UNIT 2 TS I B 3.6-4 (continued)

Revision 4

Rev.6 Primary Containment

BASES SURVEILLANCE REQUIREMENTS SR 3.6.1.1.2 (continued) 83.6.1.1 The allowable limit is 10% of the acceptable SSES AJ...Jk design value. For SSES, the AJ../k design value is .0535 ft2

Satisfactory performance of this SR can be achieved by establishing a known differential pressure between the drywell and the suppression chamber and determining the leakage. The leakage test is performed when the 10 CFR 50, Appendix J, Type A test is performed in accordance with the Primary Containment Leakage Rate Testing Program. This testing Frequency was developed considering this test is performed in conjunction with the Integrated Leak rate test and also in view of the fact that component failures that might have affected this test are identified by other primary containment SRs. Two consecutive test failures, however, would indicate unexpected primary containment degradation; in this event, as the Note indicates, increasing the Frequency to once every 24 months is required until the situation is remedied as evidenced by passing two consecutive tests .

SR 3.6.1.1.3 Maintaining the pressure suppression function of primary containment requires limiting the leakage from the drywell to the suppression chamber. Thus, if an event were to occur that pressurized the drywell, the steam would be directed through downcomers into the suppression pool. This SR measures suppression chamber-to-drywell vacuum breaker leakage to ensure the leakage paths that would bypass the suppression pool are within allowable limits. The total allowable leakage limit is 30% of the SR 3.6.1.1.2 limit. The allowable leakage per set is 12% of the SR 3.6.1.1.2 limit.

SUSQUEHANNA - UNIT 2 TS/ B 3.6-5 (continued)

Revision 3 I

Rev.6 Primary Containment

BASES SURVEILLANCE REQUIREMENTS SR 3.6.1.1.3 (continued)

B 3.6.1.1 The leakage is determined by establishing a 4.3 psi differential pressure across the drywell-to-suppression chamber vacuum breakers and verifying the leakage. Suiveillance Frequency is controlled under the Suiveillance Frequency Control Program. A Note is provided which allows this Surveillance not to be performed when SR 3.6.1.1.2 is performed. This is acceptable because SR 3.6.1.1.2 ensures the OPERABILITY of the pressure suppression function including the suppression chamber-to-dryweil vacuum breakers.

REFERENCES 1. FSAR, Section 6.2.

2. FSAR, Section 15.

3. 10 CFR 50, Appendix J, Option B.

4. Nuclear Energy Institute, 94-01.

5.

6.

7.

ANSI/ANS 56.8-1994 .

Final Policy Statement on Technical Specifications Improvements July 22, 1993 (58 FR 39132).

Standard Review Plan 6.2.4, Rev. 1, September 1975.

SUSQUEHANNA - UNIT 2 TS/ B 3.6-6 Revision 5

Rev. 6 Primary Containment

TABLE B 3.6.1.1m1 B 3.6.1.1 INSTRUMENT ISOLATION VALVES (Page 1of2)

PENETRATION INSTRUMENT ISOLATION INSTRUMENT NUMBER VALVE X-38 PSH-C72-2N002A IC-PSH-2N002A PSH L C72-2N004 IC-PSHL-2N004 PS-E11-2N010A IC-PS-2N010A PS-E11-2N011A IC-PS-2N011A PSH-C72-2N0028 IC-PSH-2N002B PS-E11-2N010C IC-PS-2N010C PS-E11-2N011C IC-PS-2N011 C PSH-25120C IC-PSH-25120C X-32A PSH-C72-2N002D IC-PSH-2N002D PS-E11-2N010B IC-PS-2N0108 PS-E11-2N0118 IC-PS-2N011 B PSH-C72-2N002C IC-PSH-2N002C PS-E11-2N010D IC-PS-2N010D PS-E11-2N011 D IC-PS-2N011 D PSH-251200 IC-PSH-251200 X-39A FT-25120A .IC-FT-25120A HIGH and IC-FT-25120A LOW X-398 FT-251208 IC-FT-251208 HIGH and IC-FT-251208 LOW X-90A PT-25709A IC-PT-25709A PT-25710A IC-PT-25710A PT-25728A1 IC-PT-25728A 1 X-900 PT-257098 IC-PT-257098 PT-257108 IC-PT-257108 PT-25728A IC-PT-25728A

SUSQUEHANNA - UNIT 2 TS I B 3.6-6a Revision 4

Rev.6 Primary Containment B 3.6.1.1 TABLE 8 3.6.1.1-1 INSTRUMENT ISOLATION VALVES (Page 2 of 2)

PENETRATION INSTRUMENT INSTRUMENT ISOLA 1ION NUMBER VALVE X-204A/205A FT-25121A IC-FT-25121A HIGH and IC-FT-25121A LOW X-2048/2058 FT-251218 IC-FT-251218 HIGH and IC-FT-251218 LOW X-219A LT-25775A IC-LT-25775A REF and IC-LT-25775A VAR LSH-E41-2N015A 255027 and 255031 LSH-E41-2N0158 255029 and 255033 X-223A PT-25702 IC-PT-25702 X-232A LT-25776A IC-LT-25776A REF and

- X234A X-235A PT-25729A LT-257758 LT-257768 IC-LT-25776A VAR IC-PT-25729A IC-LT-257758 REF and IC-LT-257758 VAR IC-LT-257768 REF and IC-LT-257768 VAR PT-257298 IC-PT-257298 Ll-2577682 IC-Ll-2577682 REF and IC-Ll-2577682 VAR

SUSQUEHANNA- UNIT 2 TS I B 3.6-6b Revision 3

Rev. 6 Primary Containment B 3.6.1.1 TABLE B 3.6.1.1-2 H2 0 2 ANALVZER PANEL ISOLATION VALVES PENETRATION NUMBER PANEL ISOLATION VALVElaJ I

X-60A, X-888, X-221A, X-238A 257138 257139 257140 257141 257142 X-80C, X-2218, X-2388 257149 257150 257151 257152 257153

(a) Only those valves listed in this table with current leak rate test results, as identified in the Leakage Rate Test Program, may be used as isolation valves .

SUSQUEHANNA- UNIT 2 TS I B 3.6-6c Revision 0

Rev. 2 Primary Containment Air Lock

B 3.6 CONTAINMENT SYSTEMS B 3.6.1.2 Primary Containment Air Lock BASES B 3.6.

1.2 BACKGROUND

One double door primary containment air lock has been built into the primary containment to provide personnel access to the drywell and to provide primary containment isolation during the process of personnel entering and exiting the drywell. The air lock is designed to withstand the same loads, temperatures, and peak design internal and external pressures as the primary containment (Ref. 1). As part of the primary containment, the air lock limits the release of radioactive material to the environment during normal unit operation and through a range of transients and accidents up to and including postulated Design Basis Accidents (DBAs).

Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a OBA in primary containment. Each of the doors contains double gasketed seals and local leakage rate testing capability to ensure pressure integrity. To effect a leak tight seal, the air lock design uses pressure seated doors (i.e., an increase in primary containment internal pressure results in increased sealing force on each door).

The air lock is an 8 ft 7 inch inside diameter cylindrical pressure vessel with doors at each end that are interlocked to prevent simultaneous opening. During periods when primary containment is not required to be OPERABLE, the air lock interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent primary containment entry is necessary. Under some conditions as allowed by this LCO, the primary containment may be accessed through the air lock, when the interlock mechanism has failed, by manually performing the interlock function.

The primary containment air lock forms part of the primary containment pressure boundary. As such, air lock integrity and leak tightness are essential for maintaining primary containment leakage rate to within limits in the event of a OBA. Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the unit safety analysis .

SUSQUEHANNA- UNIT 2 B 3.6-7 (continued)

Revision O

Rev.2 Primary Containment Air Lock

BASES (continued)

APPLICABLE SAFETY ANALYSES B 3.6.1.2 The DBA that postulates the maximum release of radioactive material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE, such that release of fission products to the environment is controlled by the rate of primary containment leakage. The primary containment is designed with a maximum allowable leakage rate (La) of 1.0% by weight of the containment air per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at the calculated maximum peak containment pressure (Pa) of 48.6 psig (Ref. 3). This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air lock.

Primary containment air lock OPERABILITY is also required to minimize the amount of fission product gases that may escape primary containment through the air lock and contaminate and pressurize the secondary containment.

The primary containment air lock satisfies Criterion 3 of the NRC Policy Statement. (Ref. 4)

LCO As part of primary containment pressure boundary, the air lock's safety function is related to control of containment leakage rates following a DBA. Thus, the air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

The primary containment air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door to be opened at a time. This provision ensures that a gross breach of primary containment does not exist when primary containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry or exit from primary containment.

SUSQUEHANNA - UNIT 2 TS I B 3.6-8 (continued)*

Revision 1

Rev.2 Primary Containment Air Lock B 3.6.1.2 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a relec:ise of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the primary containment air lock is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment.

ACTIONS The ACTIONS are modified by Note 1, which allows entry and exit to perform repairs of the affected air lock component. If the outer door is inoperable, then it may be easily accessed to repair. If the inner door is the one that is inoperable, however, then a short time exists when the containment boundary is not intact (during access through the outer door). The ability to open the OPERABLE door, even if it means the primary containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the primary containment during the short time in which the OPERABLE door is expected to be open. The OPERABLE door must be immediately closed after each entry and exit.

The ACTIONS are modified by a second Note, which ensures appropriate remedial measures are taken when necessary. This is an exception to LCO 3.0.6 which would not require action, even if primary containment is exceeding its leakage limit. Therefore, the Note is added to require ACTIONS for LCO 3.6.1.1, "Primary Containment," to be taken in this event.

A.1. A.2, and A.3 With one primary containment air lock door inoperable, the OPERABLE door must be verified closed (Required Action A.1) in the air lock. This ensures that a leak tight primary containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, which requires that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

In addition, the air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months

(continued)

SUSQUEHANNA - UNIT 2 B 3.6-9 Revision 0

Rev. 2 Primary Containment Air Lock

BASES ACTIONS A.1, A.2, and A.3 (continued)

B 3.6.1.2 Completion Time. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is considered reasonable for locking the OPERABLE air lock door, considering that the OPERABLE door is being maintained closed.

Required Action A.3 ensures that the air lock with an inoperable door has been isolated by the use of a locked closed OPERABLE air lock door. This ensures that an acceptable primary containment leakage boundary is maintained. The Completion Time of once per 31 days .is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls. Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas or areas with limited access due to inerting and allows these doors to be verified locked closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small. *

The Required Actions have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. With both doors in the air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls. This 7 day limit is an accumulated limit that applies to the total combined time for all entries and exits. Primary containment entry may be required to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on equipment inside primary containment that are required by TS or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e.,

non-TS-related activities) if the primary containment was entered, using the inoperable air lock, to perform an

(continued)

SUSQUEHANNA- UNIT 2 B 3.6-10 Revision O

Rev.2 Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS A.1. A.2, and A.3 (continued) allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize the primary containment during the short time that the OPERABLE door is expected to be open.

B.1. B.2. and B.3 With an air lock interlock mechanism inoperable, the Required Actions and associated Completion Times are consistent with those specified in Condition A.

The Required Actions have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. With both doors in the air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from the primary containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock).

Required Action 8.3 is modified by a Note that applies to air lock doors located in high radiation areas or areas with limited access due to inerting and that allows these doors to be verified locked closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.

C.1. C.2, and C.3 If the air lock is inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be immediately initiated to evaluate containment overall leakage rates using current air lock leakage test results. An evaluation is acceptable since it is overly conservative to immediately declare the primary containment inoperable if both doors in an air lock have failed a seal

(continued)

SUSQUEHANNA - UNIT 2 B 3.6-11 Revision 0

Rev.2 Primary Containment Air Lock

BASES ACTIONS C.1, C.2, and C.3 (continued)

B 3.6.1.2 test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed); primary containment remains OPERABLE, yet only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (according to LCO 3.6.1.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.

Required Action C.2 requires that one door in the primary containment air lock must be verified closed. This action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1.1, which require that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, the air lock must be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable for restoring an inoperable air lock to OPERABLE status considering that at least one door is maintained closed in the air lock.

D.1 and D.2 If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.2.1 REQUIREMENTS Maintaining primary containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Primary Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with respect to air lock leakage (Type B leakage tests). The acceptance

(continued)

SUSQUEHANNA - UNIT 2 8 3.6-12 Revision O

Rev.2 Primary Containment Air Lock

BASES SURVEILLANCE REQUIREMENTS SR 3.6.1.2.1 (continued)

B 3.6.1.2 criteria were established based on engineering judgement and industry operating experience. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall

primary containment leakage rate. The Frequency is required by the Primary Containment Leakage Rate Testing Program.

The SR has been modified by two Notes, Note 1 states that an inoperable air lock door does not invalidate the previous su.ccessful performance of the overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a OBA. Note 2 requires the results of airlock leakage tests be evaluated against the acceptance criteria of the Primary Containment Leakage Testing Program, 5.5.12. This ensures that the airlock leakage is properly accounted for in determining the combined Type B and C primary containment leakage.

SR 3.6.1.2.2 The air lock interlock mechanism is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident primary containment pressure, closure of either door will support primary containment OPERABILITY. Thus, the interlock feature supports primary containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment.

Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.6-13 Revision 1

Rev. 2 Primary Containment Air Lock

BASES SURVEILLANCE REQUIREMENTS B 3.6.

1.2 REFERENCES

1. FSAR, Section 3.8.2.1.2.

2. 10 CFR 50, Appendix J, Option B.

3. FSAR, Section 6.2.

4. Final Policy Statement on Technical Specifications Improvements July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.6-14 Revision 1 I

Rev. 15 PC IVs B 3.6.1.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.3 Primary Containment Isolation Valves (PCIVs)

BASES BACKGROUND The function of the PCIVs, in combination with other accident mitigation systems, including secondary containment bypass valves that are not PCIVs is to limit fission product release during and following postulated Design Basis Accidents (DBAs) to within limits. Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a OBA.

The OPERABILITY requirements for PCIVs help ensure that an adequate primary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. Therefore, the OPERABILITY requirements provide assurance that primary containment function assumed in the safety analyses will be maintained. For PCIVs, the primary containment isolation function is that the valve must be able to close (automatically or manually) and/or remain closed, and maintain leakage within that assumed in the OBA LOCA Dose Analysis. These isolation devices are either passive or active (automatic). Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), blind flanges, and closed systems are considered passive devices. The OPERABILITY requirements for closed systems are discussed in Technical Requirements Manual (TRM) Bases 3.6.4. Check valves, or other automatic valves designed to close without operator action following an accident, are considered active devices. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses. One of these barriers may be a closed system.

For each division of H202 Analyzers, the lines, up to anq including the first normally closed valves within the H202 *

SUSQUEHANNA - UNIT 2 TS I B 3.6-15 (continued)

Revision 4

Rev. 15 PC IVs B 3.6.1.3 BASES BACKGROUND Analyzer panels, are extensions of primary containment (continued) (i.e., closed system), and are required to be leak rate tested in accordance with the Leakage Rate Test Program. The H202 Analyzer closed system boundary is identified in the Leakage Rate Test Program. The closed system boundary consists of those components, piping, tubing, fittings, and valves, which meet the guidance of Reference 6. The closed system provides a secondary barrier in the event of a single failure of the PCIVs, as described below. The closed system boundary between PASS and the H20 2 Analyzer system ends at the process sampling solenoid operated isolation valves between the systems (SV-22361, SV-22365, SV-22366, SV-22368, and SV-22369). These solenoid operated isolation valves do not fully meet the guidance of Reference 6 for closed system boundary valves in that they are not powered from a Class 1E power source. However, based upon a risk determination, operating these valves as closed system boundary valves is not risk significant. These valves also form the end of the Seismic Category I boundary between the systems. These process sampling solenoid operated isolation valves are normally closed and are required to be leak rate tested in accordance with the

Leakage Rate Test Program as part of the closed system for the H20 2 Analyzer system. These valves are "closed system boundary valves" and may be opened under administrative control, as delineated in Technical Requirements Manual (TRM)

Bases 3.6.4. Opening of these valves to permit testing of PASS in Modes 1, 2, and 3 is permitted in accordance with TRO 3.6.4.

Each Hz02 Analyzer Sampling line penetrating primary containment has two PCIVs, iocated just outside primary containment. While two PCIVs are provided on each line, a single active failure of a relay in the control circuitry for these valves could result in both valves failing to close or failing to remain closed. Furthermore, a single failure (a hot short in the common raceway to all the valves) could simultaneously affect all of the PCIVs within a H202 Analyzer division. Therefore, the containment isolation barriers for these penetrations consist of two PCIVs and a closed system. For situations where one or both PCIVs are inoperable, the ACTIONS to be taken are similar to the ACTIONS for a single PCIV backed by a closed system .

SUSQUEHANNA - UNIT 2 TS I B 3.6-15a (continued)

Revision 0

Rev. 15 PC IVs B 3.6.1.3 BASES BACKGROUND The drywell vent and purge lines are 24 inches in diameter; the (continued) suppression chamber vent and purge lines are 18 inches in diameter. The containment purge valves are normally maintained closed in MODES 1, 2, and 3 to ensure the primary containment boundary is maintained. The outboard isolation valves have 2 inch bypass lines around them for use during normal reactor operation.

The RHR Shutdown Cooling return line containment penetrations

{X-13A(B)}are provided with a normally closed gate valve

{HV-251 F015A(B)} and a normally open globe valve

{HV-251 F017A(B)} outside containment and a testable check valve {HV-251 FOSOA(B)} with a normally closed parallel air operated globe valve {HV-251 F122A(B)} inside containment.

The gate valve is manually opened and automatically isolates upon a containment isolation signal from the Nuclear Steam Supply Shutoff System or RPV low level 3 when the RHR System is operated in the Shutdown Cooling Mode only. The LPCI subsystem is an operational mode of the RHR System and uses the same injection lines to the RPV as the Shutdown Cooling Mode.

The design of these containment penetrations is unique in that some valves are containment isolation valves while others perform the function of pressure isolation valves. In order to meet the 10 CFR 50 Appendix J leakage testing requirements, the HV-251F015A(B) and the closed system outside containment are the only barriers tested in accordance with the Leakage Rate Test Program. Since these containment penetrations {X-13A and X-138} include a containment isolation valve outside containment that is tested in accordance with 10 CFR 50 Appendix J requirements and a closed system outside containment that meets the requirements of USNRC Standard Review Plan 6.2.4 (September 1975), paragraph 11.3.e, the containment isolation provisions for these penetrations provide an acceptable alternative to the explicit requirements of 10 CFR 50, Appendix A, GDC 55.

Containment penetrations X-13A(B) are also high/low pressure system interfaces. In order to meet the requirements to have two (2) isolation valves between the high pressure and low pressure systems, the HV-251 F050A(B), HV-251 F122A(B), 251130, and HV-251 F015A(B) valves are used to meet this requirement and are tested in accordance with the pressure test program .

SUSQUEHANNA - UNIT 2 TS I B 3.6-15b (continued)

Revision 3

Rev. 15 PCIVs

BASES APPLICABLE SAFETY ANALYSES The PCIVs LCO was derived from the assumptions related to minimizing the loss of reactor coolant inventory, and establishing the primary containment boundary during major B 3.6.1.3 accidents. As part of the primary containment boundary, PCIV OPERABILITY supports leak tightness of primary containment.

Therefore, the safety analysis of any event requiring isolation of primary containment is applicable to this LCO.

The DBAs that result in a release of radioactive material within primary containment are a LOCA and a main steam line break (MSLB). In the analysis for each of these accidents, it is assumed that PCIVs are either closed or close within the required isolation times following event initiation. This ensures that potential paths to the environment through PClVs (including primary containment purge valves) and secondary containment bypass valves that are not PCIVs are minimized. The closure time of the main steam isolation valves (MSIVs) for a MSLB outside primary containment is a significant variable from a radiological standpoint. The MSlVs are required to close within 3 to 5 seconds since the 5 second closure time is assumed in the analysis. The safety analyses assume that the purge valves were closed at event initiation. Likewise, it is assumed that the

primary containment is isolated such that release of fission products to the environment is controlled.

The OBA analysis assumes that within the required isolation time leakage is terminated, except for the maximum allowable leakage rate, La.

The single failure criterion required to be imposed in the conduct of unit safety analyses was considered in the original design of the primary containment purge valves. Two valves in series on each purge line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred.

The primary containment purge valves may be unable to close in the environment following a LOCA. Therefore, each of the purge valves is required to remain closed during MODES 1, 2, and 3 except as permitted under Note 2 of SR 3.6.1.3.1. In this case, the single failure criterion remains applicable to the primary containment purge valve

SUSQUEHANNA - UNIT 2 TS I B 3.6-16 (continued)

Revision 3

Rev. 15 PCIVs

B 3.6.1.3 BASES APPLICABLE due to failure in the control circuit associated with each valve.

SAFETY ANALYSIS The primary containment purge valve design precludes a single (continued) failure from compromising the primary containment boundary as long as the system is operated in accordance with this LCO.

Both H20 2 Analyzer PCIVs may not be able to close given a single failure in the control circuitry of the valves. The single failure is caused by a "hot short in the cables/raceway to the PCIVs that causes both PCIVs for a given penetration to remain open or to open when required to be closed. This failure is required to be considered in accordance with IEEE-279 as discussed in FSAR Section 7.3.2a. However, the single failure criterion for containment isolation of the Hz02 Analyzer penetrations is satisfied by virtue of the combination of the associated PCIVs and the closed system formed by the H20 2 Analyzer piping system as discussed in the BACKGROUND section above.

The closed system boundary between PASS and the H20 2 Analyzer system ends at the process sampling solenoid operated isolation valves between the systems (SV-22361, SV-22365, SV-22366, SV-22368, and SV-22369). The closed system is not fully

qualified to the guidance of Reference 6 in that the closed system boundary valves between the H20 2 system and PASS are not powered from a Class 1E power source. However, based upon a risk determination, the use of these valves is considered to have no risk significance. This exemption to the requirement of Reference 6 for the closed system boundary is documented in License Amendment No. 170.

PCIVs satisfy Criterion 3 of the NRC Policy Statement. (Ref. 2)

LCO PCIVs form a part of the primary containment boundary, or in the case of SCBL valves limit leakage from the primary containment.

The PCIV safety function is related to minimizing the loss of reactor coolant inventory and establishing the primary containment boundary during a OBA.

The power operated, automatic isolation valves are required to have isolation times within limits and actuate on an

SUSQUEHANNA - UNIT 2 TS I B 3.6-17 (continued)

Revision 3

Rev. 15 PC IVs B 3.6.1.3 BASES LCO automatic isolation signal. The valves covered by this LCO are (continued) listed in Table B 3.6.1.3-1 and Table B 3.6.1.3-2.

The normally closed PCIVs, including secondary containment bypass valves listed in Table B 3.6.1.3-2 that are not PCIVs are considered OPERABLE when manual valves are closed or open in accordance with appropriate administrative controls, automatic valves are in their closed position, blind flanges are in place, and closed systems are intact. These passive isolation valves and devices are those listed in Table B 3.6.1.3-1.

Leak rate testing of the secondary containment bypass valves listed in Table 3.6.1.3-2 is permitted in Modes 1, 2 & 3 as described in the Primary Containment Leakage Rate Testing Program.

Purge valves with resilient seals, secondary containment bypass valves, including secondary containment bypass valves listed in Table B 3.6: 1.3-2 that are not PCIVs, MSIVs, and hydrostatically tested valves must meet additional leakage rate requirements.

Other PCIV leakage rates are addressed by LCO 3.6.1.1, "Primary Containment," as Type B or C testing .

This LCO provides assurance that the PCIVs will perform their designed safety functions to minimize the *loss of reactor coolant inventory and establish the primary containment boundary during accidents.

APPLICABILITY In MODES 1, 2, and 3, a OBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, most PCIVs are not required to be

SUSQUEHANNA - UNIT 2 TS I B 3.6-17a (continued)

Revision 1

Rev. 15 PC IVs B 3.6.1.3 BASES APPLICABILITY OPERABLE and the primary containment purge valves are not (continued) required to be closed in MODES 4 and 5. Certain valves, however, are required to be OPERABLE to prevent inadvertent reactor vessel draindown. These valves are those whose associated instrumentation is required to be OPERABLE per LCO 3.3.6.1, "Primary Containment Isolation Instrumentation."

(This does not include the valves that isolate the associated instrumentation.)

ACTIONS The ACTIONS are modified by a Note allowing penetration flow path(s) to be unisolated intermittently under administrative

, controls. These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated.

A second Note has been added to provide clarification that, for the purpose of this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable PCIV. Complying with the Required Actions may allow for continued operation, and subsequent inoperable PCIVs are governed by subsequent Condition entry and application of associated Required Actions.

The ACTIONS are modified by Notes 3 and 4. Note 3 ensures that appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable PCIV (e.g., an Emergency Core Cooling System subsystem is inoperable due to a failed open test return valve). Note 4 ensures i;tppropriate remedial actions are taken when the primary containment leakage limits are exceeded. Pursuant to LCO 3.0.6, these actions are not required even when the associated LCO is not met. Therefore, Notes 3 and 4 are added to require the proper actions be taken.

A.1 and A.2 With one or more penetration flow paths with one PCIV inoperable except for purge valve leakage not within limit,

SUSQUEHANNA - UNIT 2 TS I B 3.6-18 (continued)

Revision 1

Rev. 15 PC IVs B 3.6.1.3 BASES ACTIONS A.1 and A.2 (continued) the affected penetration flow paths must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured.

For a penetration isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available valve to the primary containment. The Required Action must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time (8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for main steam lines). The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable considering the time required to isolate the penetration and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3. For main steam lines, an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is allowed. The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for the main steam lines allows a period of time to restore the MSIVs to OPERABLE status given the fact that MSIV closure will result in isolation of the main steam line(s) and a potential for plant shutdown.

For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration flow path(s) must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident, and no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those devices outside containment and capable of potentially being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside primary containment" is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low. For the devices inside primary containment, the time period specified "prior to entering MODE 2 or 3 from MODE 4, if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the devices and other administrative controls ensuring that device misalignment is an unlikely possibility.

SUSQUEHANNA - UNIT 2 TS I B 3.6-19 (continued)

Revision 1

Rev. 15 PCIVs B 3.6.1.3 BASES ACTIONS A.1 and A.2 (continued)

Condition A is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two PCIVs except for the H20 2 Analyzer penetrations. For penetration flow paths with one PCIV, Condition C provides the appropriate Required Actions. For the H20 2 Analyzer penetrations, Condition D provides the appropriate Required Actions.

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas, and allows them to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is low.

With one or more penetration flow paths with two PCIVs inoperable except for purge valve leakage not within limit, either the inoperable PCIVs must be restored to OPERABLE status or the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.1.

Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two PCIVs except for the H202 Analyzer penetrations. For penetration flow paths with one PCIV, Condition C provides the appropriate Required Actions. For the H20 2 Analyzer penetrations, Condition D provides the appropriate Required Actions.

C.1 and C.2 With one or more penetration flow paths with one PCIV inoperable, the inoperable valve must be restored to

SUSQUEHANNA - UNIT 2 TS I B 3.6-20 (continued)

Revision 2

Rev. 15 PC IVs B 3.6.1.3 BASES ACTIONS C.1 and C.2 (continued)

OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the

affected penetration. Required Action C.1 must be completed within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2; and 3. The closed system must meet the requirements of Reference 6. For conditions where the PCIV and the closed system are inoperable, the Required Actions of TRO 3.6.4, Condition B apply. For the Excess Flow Check Valves (EFCV), the Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable considering the instrument and the small pipe diameter of penetration (hence, reliability) to act as a penetration isolation boundary and the small pipe diameter of the affected penetrations. In the event the affected penetration flow

path is isolated in accordance with Required Action C.1, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration is isolated is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low.

Condition C is modified by a Note indicating that this Condition is only applicable to penetration flow paths with only one PCIV. For penetration flow paths with two PCIVs and the H202 Analyzer penetration,. Conditions A, B, and D provide the appropriate Required Actions.

Required Action C.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically

SUSQUEHANNA - UNIT 2 TS I B 3.6-21 (continued)

Revision 3

Rev. 15 PC IVs

B 3.6.1.3 BASES ACTIONS C.1 and C.2 (continued) restricted. Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is low.

D.1 and D.2 With one or more Hz02 Analyzer penetrations with one or both PCIVs inoperable, the inoperable valve(s) must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. Required Action D.1 must be completed within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is reasonable considering the unique design of the H2 0 2 Analyzer penetrations. The containment isolation barriers for these penetrations consist of two PCIVs and a closed system. In addition, the Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is reasonable

considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting primary containment*

OPERABILITY during MODES 1, 2, and 3. In the event the affected penetration flow path is isolated in accordance with Required Action D.1, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration is isolated is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low.

When an Hz02 Analyzer penetration PCIV is to be closed and deactivated in accordance with Condition D, this must be accomplished by pulling the fuse for the power supply, and either determinating the power cables at the solenoid valve, or jumpering of the power side of the solenoid to ground .

SUSQUEHANNA - UNIT 2 TS I B 3.6-21a (continued)

Revision 0

Rev. 15 PC IVs B 3.6.1.3 BASES ACTIONS D.1 and D.2 (continued)

The OPERABILITY requirements for the closed system are discussed in Technical Requirements Manual (TRM)

Bases 3.6.4. In the event that either one or both of the PCIVs and the closed system are inoperable, the Required Actions of TRO 3.6.4, Condition B apply.

Condition D is modified by a Note indicating that this Condition is only applicable to the H202 Analyzer penetrations .

SUSQUEHANNA - UNIT 2 TS I B 3.6-21b (continued)

Revision 0

Rev. 15 PC IVs B 3.6.1.3 BASES ACTIONS (continued)

With the secondary containment bypass leakage rate not within limit, the assumptions of the safety analysis may not be met.

Therefore, the leakage must be restored to within limit within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Restoration can be accomplished by isolating the penetration that caused the limit to be exceeded by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. When a penetration is isolated, the leakage rate for the isolated penetration is assumed to be the actual pathway leakage through the isolation device. If two isolation devices are used to isolate the. penetration, the leakage rate is assumed to be the lesser actual pathway leakage of the two devices. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable considering the time required to restore the leakage by isolating the penetration and the relative importance of secondary containment bypass leakage to the overall containment function.

In the event one or more containment purge valves are not within the purge valve leakage limits, purge valve leakage must be restored to within limits. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable, considering that one containment purge valve remains closed, except as controlled by SR 3.6.1.3.1 so that a gross breach of containment does not exist.

G.1 and G.2 If any Required Action and associated Completion Time cannot be met in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems .

SUSQUEHANNA - UNIT 2 TS I B 3.6-22 (continued)

Revision 2

Rev. 15 PC IVs B 3.6.1.3 BASES ACTIONS (continued) H.1 and H.2 If any Required Action and associated Completion Time cannot be met, the unit must be placed in a condition in which the LCO does not apply. If applicable, action must be immediately initiated to suspend operations with a potential for draining the reactor vessel (OPDRVs) to minimize the probability of a vessel draindown and subsequent potential for fission product release.

Actions must continue until OPDRVs are suspended or valve(s) are restored to OPERABLE status. If suspending an OPDRV would result in closing the residual heat removal (RHR) shutdown cooling isolation valves, an alternative Required Action is provided to immediately initiate action to restore the valve(s) to OPERABLE status. This allows RHR to remain in service while actions are being taken to restore the valve.

SURVEILLANCE REQUIREMENTS SR 3.6.1.3.1 This SR ensures that the primary containment purge valves are

closed as required or, if open, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed, it is not considered to have leakage outside of limits. The SR is also modified by Note 1, stating that primary containment purge valves are only required to be closed in MODES 1, 2, and 3. If a LOCA inside primary containment occurs in these MODES, the purge valves may not be capable of closing before the pressure pulse affects systems downstream of the purge valves, or the release of radioactive material will exceed limits prior to the purge valves closing. At other times when the purge valves are required to be capable of closing (e.g., during handling of irradiated fuel), pressurization concerns are not present and the purge valves are allowed to be open. The* SR is modified by Note 2 stating that the SR is not required to be met when the purge valves are open for the stated reasons. The Note states that these valves may be opened for inerting, de-inerting, pressure control, ALARA or air quality considerations for personnel entry, or Surveillances that require the valves to be open. The vent and purge valves are capable of closing in the environment following

SUSQUEHANNA - UNIT 2 TS I B 3.6-23 (continued)

Revision 2

Rev. 15 PC IVs B 3.6.1.3 BASES SURVEILLANCE REQUIREMENTS SR 3.6.1 ~3.1 (continued) a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The Surveillance Frequency is controlle*d under the Surveillance Frequency Control Program.

SR 3.6.1.3.2 This SR verifies that each primary containment isolation manual valve and blind flange that is located outside primary containment and not locked, sealed, or otheiwise secured and is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits.

This SR does not require any testing or valve manipulation.

Rather, it involves verification that those PCIVs outside plimary containment, and capable of being mispositioned, are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Two Notes have been added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be velified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these PCIVs, once they have been verified to be in the proper position, is low. A second Note has been included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open.

This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

SR 3.6.1.3.3 This SR verifies that each primary containment manual isolation valve and blind flange that is located inside

SUSQUEHANNA - UNIT 2 TS I B 3.6-24 (continued)

Revision 2

Rev. 15 PC IVs B 3.6.1.3 BASES SURVEILLANCE REQUIREMENTS SR 3.6.1.3.3 (continued) primary containment and not locked, sealed, or otherwise secured and is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits. For PCIVs inside primary containment, the Frequency defined as "prior to entering MODE 2 or 3 from MODE 4 if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is appropriate since these PCIVs are operated under administrative controls and the probability of their misalignment is low. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing. Two Notes have been added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since the primary containment is inerted and access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA

reasons. Therefore, the probability of misalignment of these PCIVs, once they have been verified to be in their proper position, is low. A second Note has been included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open.

SR 3.6.1.3.4 The traversing incore probe (TIP) shear isolation valves are actuated by explosive charges. Surveillance of explosive charge continuity provides assurance that TIP valves will actuate when required. Other administrative controls, such as those that limit the shelf life of the explosive charges, must be followed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.5 Verifying the isolation time of each power operated and each automatic PCIV is within limits is required to demonstrate

SUSQUEHANNA - UNIT 2 TS I B 3.6-25 (continued)

Revision 2

Rev. 15 PC IVs

BASES SURVEILLANCE REQUIREMENTS SR 3.6.1.3.5 (continued)

B 3.6.1-.3 OPERABILITY. MSIVs may be excluded from this SR since MSIV full closure isolation time is demonstrated by SR 3.6.1.3.7.

The isolation time test ensures that the valve will isolate in a time period less than or equal to that assumed in the Final Safety Analyses Report. The isolation time and Frequency of this SR are in accordance with the requirements of the lnservice Testing Program.

SR 3.6.1.3.6 For primary containment purge valves with resilient seals, the Appendix J Leakage Rate Test Interval is sufficient. The acceptance criteria for these valves is defined in the Primary Containment Leakage Rate Testing Program, 5.5.12.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The SR is modified by a Note stating that the primary

containment purge valves are only required to meet leakage rate testing requirements in MODES 1, 2, and 3. If a LOCA inside primary containment occurs in these MODES, purge valve leakage must be minimized to ensure offsite radiological release is within limits. At other times when the purge valves are required to be capable of closing (e.g., during handling of irradiated fuel), pressurization concerns are not present and the purge valves are not required to meet any specific leakage criteria.

SR 3.6.1.3. 7 Verifying that the isolation time of each MSIV is within the specified limits is required to demonstrate OPERABILITY. The isolation time test ensures that the MSIV will isolate in a time period that does not exceed the times assumed in the OBA analyses. This ensures that the calculated radiological consequences of these events remain within regulatory limits .

SUSQUEHANNA - UNIT 2 TS I B 3.6-26 (continued)

Revision 4

Rev. 15 PC IVs

BASES SURVEILLANCE REQUIREMENTS SR 3.6.1.3.7 (continued)

B 3.6.1.3 The Frequency of this SR is in accordance with the requirements of the lnservice Testing Program.

SR 3.6.1.3.8 Automatic PCIVs close on a primary containment isolation signal to prevent leakage of radioactive material from primary containment following a OBA. This SR ensures that each automatic PCIV will actuate to its isolation position on a primary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.1.5 overlaps this SR to provide complete testing of the safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.9 This SR requires a demonstration that a representative sample of reactor instrumentation line excess flow check valves (EFCV) are OPERABLE by verifying that the valve actuates to check flow on a simulated instrument line break. As defined in FSAR Section 6.2.4.3.5 (Reference 4), the conditions under which an EFCV will

isolate, simulated instrument line breaks are at flow rates, which develop a differential pressure of between 3 psid and 1O psid. This SR provides assurance that the instrumentation line EFCVs will perform its design function to check flow. No specific valve leakage limits are specified because no specific leakage limits are defined in the FSAR. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The represen~ative sample consists of an approximate equal number of EFCVs such that each EFCV is tested at least once every 10 years (nominal). The nominal 10 year interval is based on other performance-based testing programs, such as lnservice Testing (snubbers) and Option B to 10 CFR 50, Appendix J. In addition, the EFCVs in the sample are representative of the various plant configurations, models, sizes and operating environments. This ensures that any potential common problem with a specific type or application of EFCV is

SUSQUEHANNA - UNIT 2 TS I B 3.6-27 (continued)

Revision 4

Rev. 15 PC IVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.9 (continued)

REQUIREMENTS detected at the earliest possible time. EFCV failures will be evaluated to determine if additional testing in that test interval is warranted to ensure overall reliability and that failures to isolate are very infrequent.

Therefore, testing of a representative sample was concluded to be acceptable from a reliability standpoint (Reference 7).

SR 3.6.1.3.10 The TIP shear isolation valves are actuated by explosive charges. An in place functional test is not possible with this design. The explosive squib is removed and tested to provide assurance that the valves will actuate when required. The replacement charge for the explosive squib shall be from the same manufactured batch as the one fired or from another batch that has been certified by having one of the batch successfully fired. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.11 This SR ensures that the leakage rate of secondary containment bypass leakage paths is less than the specified leakage rate. This provides assurance that the assumptions in the radiological evaluations of Reference 4 are met. The secondary containment leakage pathways and Frequency are defined by the Primary Containment Leakage Rate Testing Program. This SR simply imposes additional acceptance criteria. A note is added to this SR, which states that these valves are only required to meet this leakage limit in MODES 1, 2, and 3. In the other MODES, the Reactor Coolant System is not pressurized and specific primary containment leakage limits are not required.

SR 3.6.1.3.12 The analyses in References 1 and 4 are based on the specified leakage rate. Leakage through each MSIV must be~ 100 scfh for anyone MSIV and ~ 300 scfh for total leakage through the MSIVs combined with the Main Steam Line Drain Isolation Valve, HPCI Steam Supply Isolation Valve and the RCIC Steam Supply Isolation Valve. The MSIVs can be tested at either~ Pt (24.3 psig) or Pa (48.6 psig). Main Steam Line Drain Isolation, HPCI and RCIC Steam Supply Line Isolation Valves, are tested at Pa (48.6 psig). A note is added to this SR, which states that these valves are only required to meet this leakage limit in MODES 1, 2, and 3. In the other

SUSQUEHANNA - UNIT 2 TS I B 3.6-28 (continued)

Revision 8

Rev. 15 PC IVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.12 (continued)

REQUIREMENTS conditions, the Reactor Coolant System is not pressurized and specific primary containment leakage limits are not required. The Frequency is required by the Primary Containment Leakage Rate Testing Program.

SR 3.6.1.3.13 Surveillance of hydrostatically tested lines provides assurance that the calculation assumptions of Reference 2 are met. The acceptance criteria for the combined leakage of all hydrostatically tested lines is 3.3 gpm when tested at 1.1 Pa, (53.46 psig). The combined leakage rates must be demonstrated in accordance with the leakage rate test Frequency required by the Primary Containment Leakage Testing Program.

As noted in Table B 3.6.1.3-1, PCIVs associated with this SR are not Type C tested. Containment bypass leakage is prevented since the line terminates below the minimum water level in the suppression chamber. These valves are tested in accordance with the IST Program. Therefore, these valves leakage is not

included as containment leakage .

This SR has been modified by a Note that states that these valves are only required to meet the combined leakage rate in MODES 1, 2, and 3, since this is when the Reactor Coolant System is pressurized and primary containment is required. In some instances, the valves are required to be capable of automatically closing during MODES other than MODES 1, 2, and 3. However, specific leakage limits are not applicable in these other MODES or conditions.

REFERENCES 1. FSAR, Chapter 15.

2. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132).

3. 10 CFR 50, Appendix J, Option B.

4. FSAR, Section 6.2.

5. NED0-30851-P-A, "Technical Specification Improvement Analyses for BWR Reactor Protection System," March 1988.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.6-29 Revision 5

Rev. 15 PC IVs B 3.6.1.3 BASES REFERENCES (continued) 6. Standard Review Plan 6.2.4, Rev. 1, September 1975.

7. NED0-32977-A, "Excess Flow Check Valve Testing Relaxation," June 2000.

SUSQUEHANNA - UNIT 2 TS I B 3.6-29a Revision O

Rev. 15 PC IVs B 3.6.1.3 Table B 3.6.1.3-1 Primary Containment Isolation Valve

!Paae 1 of 1Q)

Isolation Signal LCO 3.3.6.1 Function No.

Plant System Valve Number Valve Description Type of Valve (Maximum Isolation Time (Seconds})

Containment 2-57-199 (d) ILRT Manual N/A Atmospheric 2-57-200 (d) ILRT Manual NIA Control HV-25703 Containment Purge Automatic Valve 2.b, 2.d, 2.e (15)

HV-25704 Containment Purge Automatic Valve 2.b, 2.d, 2.e (15)

HV-25705 Containment Purge Automatic Valve 2.b, 2.d, 2.e (15)

HV-25711 Containment Purae Automatic Valve 2.b, 2.d, 2.e (15)

HV-25713 Containment Purge Automatic Valve 2.b, 2.d, 2.e (15)

HV-25714 Containment Purge Automatic Valve 2.b, 2.d, 2.e (15)

HV-25721 Containment Purge Automatic Valve 2.b, 2.d, 2. e (15)

HV-25722 Containment Purge Automatic Valve 2.b, 2.d, 2.e (15)

HV-25723 Containment Purge Automatic Valve 2.b, 2.d, 2. e (15)

HV-25724 Containment Purge Automatic Valve 2.b, 2.d, 2.e (15)

HV-25725 Containment Purge Automatic Valve 2.b, 2.d, 2.e (15)

HV-25766 (a) Suppression Pool Cleanup Automatic Valve 2.b, 2.d (35)

HV-25768 (a) Suppression Pool Cleanup Automatic Valve 2.b, 2.d (30)

SV-257100A Containment Radiation Detection Automatic Valve 2.b, 2.d, 2.f Svst SV-257100 B Containment Radiation Detection Automatic Valve 2.b, 2.d, 2.f Syst SV-257101 A Containment Radiation Detection Automatic Valve 2.b, 2.d, 2.f Svst .

SV-257101 B Containment Radiation Detection Automatic Valve 2.b, 2.d, 2.f Syst SV-257102A Containment Radiation Detection Automatic Valve 2.b, 2.d, 2.f Svst SV-257102 B Containment Radiation Detection Automatic Valve 2.b, 2.d, 2.f Syst SV-257103 A Containment Radiation Detection Automatic Valve 2.b, 2.d, 2.f Syst SV-257103 B Containment Radiation Detection Automatic Valve 2.b, 2.d, 2.f Syst SV-257104 Containment Radiation Detection Automatic Valve 2.b, 2.d, 2.f Syst SV-257105 Containment Radiation Detection Automatic Valve 2;b, 2.d, 2.f Syst SV-257106 Containment Radiation Detection Automatic Valve 2.b, 2.d, 2.f Syst SV-257107 Containment Radiation Detection Automatic Valve 2.b, 2.d, 2.f Syst SV-25734 A (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25734 B (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25736 A (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25736 B (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25737 Nitrogen Makeup Automatic Valve 2.b, 2.d, 2.e

SUSQUEHANNA - UNIT 2 TS I B 3.6-30 Revision 2

Rev. 15 PC IVs

B 3.6.1.3 Table B 3.6.1.3-1 Primary Containment Isolation Valve (PaQe 2 of 10)

Isolation Signal LCO 3.3.6.1 Function No.

Plant System Valve Number Valve Description Type of Valve (Maximum Isolation Time ISecondsn Containment SV-25738 Nitrogen Makeup Automatic Valve 2.b, 2.d, 2.e Atmospheric SV-25740 A (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d Control SV-25740 B (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d (continued) SV-25742 A (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25742 B (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25750 A (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25750 B (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25752 A (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25752 B (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25767 Nitrogen Makeup Automatic Valve 2.b, 2.d, 2.e SV-25774 A (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25774 B (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25776 A (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25776 B (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25780 A (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25780 B (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25782 A (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25782 B (e) Containment Atmosphere Sample Automatic Valve 2.b, 2.d SV-25789 Nitrogen Makeup Automatic Valve 2.b, 2.d, 2.e Containment 2-26-072 (d) Containment Instrument Gas Manual Check NIA Instrument Gas 2-26-074 (d) Containment Instrument Gas Manual Check NIA 2-26-152 (d) Containment Instrument Gas Manual Check NIA 2-26-154 (d) Containment Instrument Gas Manual Check NIA 2-26-164 (d) Containment Instrument Gas Manual Check NIA HV-22603 Containment Instrument Gas Automatic Valve 2.c, 2.d (20)

SV-22605 Containment Instrument Gas Automatic Valve 2.c,2.d SV-22651 Containment Instrument Gas Automatic Valve 2.c, 2.d SV-22654A Containment Instrument Gas Power Operated NIA SV-22654 B Containment Instrument Gas Power Operated NIA SV-22661 Containment Instrument Gas Automatic Valve 2.b, 2.d SV-22671 Containment Instrument Gas Automatic Valve 2.b, 2.d Core Spray HV-252F001 A (b)(c) CS Suction Power Operated NIA HV-252F001 B (b)(c) CS Suction Power Operated NIA HV-252F005 A CS Injection Power Operated NIA HV-252F005 B CS Injection Power Operated NIA Air Operated HV-252F006 A CS Injection NIA Check Valve Air Operated HV-252F006 B CS Injection N/A Check Valve HV-252F015 A (b)(c) CS Test Automatic Valve 2.c, 2.d (80)

HV-252F015 B (b)(c) CS Test Automatic Valve 2.c, 2.d (80)

HV-252F031 A (b)(c) CS Minimum Recirculation Flow Power Operated NIA HV-252F031 B (b)(c) CS Minimum Recirculation Flow Power Operated NIA

SUSQUEHANNA - UNIT 2 TS I B 3.6-31 Revision 3

Rev. 15 PC IVs B 3.6.1.3 Table B 3.6.1.3-1 Primary Containment Isolation Valve f Paae 3 of 1Q)

Isolation Signal LCO 3.3.6.1 Function No.

Plant System Valve Number Valve Description Type of Valve (Maximum Isolation Time (Seconds))

Core Spray HV-252F037 A CS Injection Power Operated N/A (continued) (Air)

HV-252F037 B CS Injection Power Operated N/A (Air)

XV-252F018 A Core Spray Excess Flow N/A Check Valve XV-252F018 B Core Spray Excess Flow N/A Check Valve Demin Water 2-41-017 (d) Demineralized Water Manual N/A 2-41-018 (d) Demineralized Water Manual NIA HPCI 2-55-038 (d) HPCI Injection Manual NIA 255F046 (b) (c) (d) HPCI Minimum Recirculation Flow Manual Check NIA 255F049 (a) (d) HPCI Manual Check NIA HV-255F002 HPCI Steam Supply Automatic Valve 3.a, 3.b, 3.c, 3.e, 3.f, 3.a, (50)

HV-255F003 HPCI Steam Supply Automatic Valve 3.a, 3.b, 3.c, 3.e, 3.f, 3.g, (50)

HV-255F006 HPCI Injection Power Operated NIA HV-255F012 (b) (c) HPCI Minimum Recirculation Flow Power Ooerated NIA HV-255F042 (b) (c) HPCI Suction Automatic Valve 3.a, 3.b, 3.c, 3.e, 3.f, 3.g, (115)

HV-255F066 (a) HPCI Turbine Exhaust Power Operated N/A HV-255F075 HPCI Vacuum Breaker Automatic Valve 3.b, 3.d, (15)

HV-255F079 HPCI Vacuum Breaker Automatic Valve 3.b, 3.d, (15)

HV-255F100 HPCI Steam Supply Automatic Valve 3.a, 3.b, 3.c, 3.e, 3.f, 3.g, (6)

XV-255F024 A HPCI Excess Flow NIA Check Valve XV-255F024 B HPCI Excess Flow NIA Check Valve XV-255F024 C HPCI Excess Flow NIA Check Valve XV-255F024 D HPCI Excess Flow NIA Check Valve Liquid Radwaste HV-26108 A1 Liquid Radwaste Automatic Valve 2.b, 2.d (15)

Collection HV-26108A2 Liauid Radwaste Automatic Valve 2.b, 2.d (15)

HV-26116 A1 Liauid Radwaste Automatic Valve 2.b, 2.d (15)

HV-26116 A2 . Liquid Radwaste Automatic Valve 2.b, 2.d (15)

Nuclear Boiler 241F010 A (d) Feedwater Manual Check NIA 241F010 B (d) Feedwater Manual Check NIA 241 F039 A (d) Feedwater Isolation Valve Manual Check NIA 241F039 B (d) Feedwater Isolation Valve Manual Check N/A 241818 A (d) Feedwater Isolation Valve Manual Check NIA 241818 B (d) Feedwater Isolation Valve Manual Check NIA

SUSQUEHANNA - UNIT 2 TS I B 3.6-32 Revision 2

Rev. 15 PC IVs B 3.6.1.3 Table 8 3.6.1.3-1 Primary Containment Isolation Valve f Paae 4 of 10)

Isolation Signal LCO 3.3.6.1 Function No.

Plant System Valve Number Valve Description Type of Valve (Maximum Isolation Time (Seconds))

Nuclear Boiler HV-241F016 MSL Drain Automatic Valve 1.a, 1.b, 1.c, 1.d, 1.e (continued) (10)

HV-241 F019 MSL Drain Automatic Valve 1.a, 1.b, 1.c, 1.d, 1.e (15)

HV-241 F022 A MSIV Automatic Valve 1.a, 1.b, 1.c, 1.d, 1.e (5)

HV-241 F022 B MSIV Automatic Valve 1.a, 1.b, 1.c, 1.d, 1.e (5)

HV-241 F022 C MSIV Automatic Valve 1.a, 1.b, 1.c, 1.d, 1.e (5)

HV-241 F022 D MSIV Automatic Valve 1.a, 1.b, 1.c, 1.d, 1.e (5)

HV-241 F028 A MSIV Automatic Valve 1.a, 1.b, 1.c, 1.d, 1.e (5)

HV-241 F028 B MSIV Automatic Valve 1.a, 1.b, 1.c, 1.d, 1.e (5)

HV-241 F028 C MSIV Automatic Valve 1.a, 1.b, 1.c, 1.d, 1.e (5)

HV-241 F028 D MSIV Automatic Valve 1.a, 1.b, 1.c, 1.d, 1.e (5)

HV-241 F032 A Feedwater Isolation Valve Power Operated NIA Check Valves HV-241 F032 B Feedwater Isolation Valve Power Operated NIA Check Valves XV-241F009 Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241 F070 A Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241 F070 B Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241 F070 C Nuclear Boiler EFCV Excess Flow N/A Check Valve XV-241 F070 D Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241F071 A Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241 F071 B Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241 F071 C Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241 F071 D Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241 F072 A Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241 F072 B Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241 F072 C Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241 F072 D Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241 F073 A Nuclear Boiler EFCV Excess Flow NIA Check Valve

SUSQUEHANNA - UNIT 2 TS/ B 3.6-33 Revision 2

Rev. 15 PC IVs B 3.6.1.3 Table B 3.6.1.3-1 Primary Containment Isolation Valve (Page 5 of 10)

Isolation Signal LCO Plant System 3.3.6.1 Function No.

Valve Number Valve Description Type of Valve (Maximum Isolation Time (Seconds))

Nuclear Boiler XV-241F073 B Nuclear Boiler EFCV Excess Flow NIA (continued) Check Valve XV-241 F073 C Nuclear Boiler EFCV Excess Flow NIA Check Valve XV-241 F073 D Nuclear Boiler EFCV Excess Flow NIA Check Valve Nuclear Boiler XV-24201 Nuclear Boiler Vessel Instrument Excess Flow NIA Vessel Check Valve Instrumentation XV-24202 Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F041 Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F043 A Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F043 B Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F045 A Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F045 B Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F047 A Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F047B Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F051 A Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F051 B Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F051 C Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F051 D Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F053 A Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F053 B Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F053 C Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F053 D Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F055 Nuclear Boiler Vessel Instrument Excess Flow N/A Check Valve XV-242F057 Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F059 A Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F059 B Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve

SUSQUEHANNA - UNIT 2 TS I B 3.6-34 Revision 1

Rev. 15 PC IVs B 3.6.1.3 Table B 3.6.1.3-1 Primary Containment Isolation Valve (Paae 6 of 10)

Isolation Signal LCO 3.3.6.1 Function No.

Plant System Valve Number Valve Description Type of Valve (Maximum Isolation Time (Seconds))

Nuclear Boiler XV-242F059 C Nuclear Boiler Vessel Instrument Excess Flow N/A Vessel Check Valve Instrumentation XV-242F059 D Nuclear Boiler Vessel Instrument Excess Flow N/A (continued) Check Valve XV-242F059 E Nuclear Boiler Vessel Instrument Excess Flow N/A Check Valve XV-242F059 F Nuclear Boiler Vessel Instrument Excess Flow N/A Check Valve XV-242F059 G Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F059 H Nuclear Boiler Vessel Instrument Excess Flow N/A Check Valve XV-242F059 L Nuclear Boiler Vessel Instrument Excess Flow N/A Check Valve XV-242F059 M Nuclear Boiler Vessel Instrument Excess Flow N/A Check Valve XV-242F059 N Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F059 P Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F059 R Nuclear Boiler Vessel Instrument Excess Flow N/A Check Valve XV-242F059 S Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F059 T Nuclear Boiler Vessel Instrument Excess Flow NIA Check Valve XV-242F059 U Nuclear Boiler Vessel Instrument Excess Flow N/A Check Valve XV-242F061 Nuclear Boiler Vessel Instrument Excess Flow N/A Check Valve RB Chilled Water HV-28781 A1 RB Chilled Water Automatic Valve 2.c, 2.d (40)

System HV-28781 A2 RB Chilled Water Automatic Valve 2.c, 2.d (40)

HV-28781 B1 RB Chilled Water Automatic Valve 2.c, 2.d (40)

HV-28781 B2 RB Chilled Water Automatic Valve 2.c, 2.d (40)

HV-28782A1 RB Chilled Water Automatic Valve 2.c, 2.d (12)

HV-28782A2 RB Chilled Water Automatic Valve 2.c, 2.d (12)

HV-28782 81 RB Chilled Water Automatic Valve 2.c, 2.d (12)

HV-28782 B2 RB Chilled Water Automatic Valve 2.c, 2.d (12)

HV-28791 A1 RB Chilled Water Automatic Valve 2.b, 2.d (15)

HV-28791 A2 RB Chilled Water Automatic Valve 2.b, 2.d (15)

HV-28791 81 RB Chilled Water Automatic Valve 2.b, 2.d (15)

HV-28791 82 RB Chilled Water Automatic Valve 2.b, 2.d (15)

HV-28792A1 RB Chilled Water Automatic Valve 2.b, 2.d (8)

HV-28792A2 RB Chilled Water Automatic Valve 2.b, 2.d (8)

HV-28792 81 RB Chilled Water Automatic Valve 2.b, 2.d (8)

SUSQUEHANNA - UNIT 2 TS I B 3.6-35 Revision 3

Rev. 15 PC IVs B 3.6.1.3 Table B 3.6.1.3-1 Primary Containment Isolation Valve (PaQe 7 of 1O)

Isolation Signal LCO 3.3.6.1 Function No.

Plant System Valve Number Valve Description Type of Valve (Maximum Isolation Time (Seconds))

RB Chilled Water HV-28792 B2 RB Chilled Water Automatic Valve 2.b, 2.d (8)

System (continued)

RBCCW HV-21313 RBCCW Automatic Valve 2.c, 2.d (30)

HV-21314 RBCCW Automatic Valve 2.c, 2.d (30)

HV-21345 RBCCW Automatic Valve 2.c, 2.d (30)

HV-21346 RBCCW Automatic Valve 2.c, 2.d (30)

RCIC 2-4fU!20 (d) RCIC Injection Manual NIA 249F021 (b) (c) (d) RCIC Minimum Recirculation Flow Manual Check NIA 249F028 (a) (d) RCIC Vacuum Pump Discharge Manual Check NIA 249F040 (a) (d) RCIC Turbine Exhaust Manual Check NIA FV-249F019 (b) (c) RCIC Minimum Recirculation Flow Power Operated NIA HV-249F007 RCIC Steam Supply Automatic Valve 4.a, 4.b, 4.c, 4.e, 4.f, 4.g (20)

HV-249F008 RCIC Steam Supply Automatic Valve 4.a, 4.b, 4.c, 4.e, 4.f, 4.g (20)

HV-249F013 RCIC Injection Power Operated NIA HV-249F031 (b) (c) RCIC Suction Power Operated NIA HV-249F059 (a) RCIC Turbine Exhaust Power Operated NIA HV-249F060 (al RCIC Vacuum Pump Discharge Power Operated NIA HV-249F062 RCIC Vacuum Breaker Automatic Valve 4.b, 4.d (10)

HV-249F084 RCIC Vacuum Breaker Automatic Valve 4.b, 4.d (10)

HV-249F088 RCIC Steam Supply Automatic Valve 4.a, 4.b, 4.c, 4.e, 4.f, 4.g (12)

XV-249F044 A RCIC Excess Flow NIA Check Valve XV-249F044 B RCIC Excess Flow NIA Check Valve XV-249F044 C RCIC Excess Flow NIA Check Valve XV-249F044 D RCIC Excess Flow NIA Check Valve Reactor 243F013 A ( d) Recirculation Pump Seal Water Manual Check NIA Recirculation 243F013 B (d) Recirculation Pump Seal Water Manual Check NIA HV-243F019 Reactor Coolant Sample Automatic Valve 2.b (9)

HV-243F020 Reactor Coolant Sample Automatic Valve 2.b (2)

XV-243F003 A Reactor Recirculation Excess Flow N/A Check Valve XV-243F003 B Reactor Recirculation Excess Flow NIA Check Valve XV-243F004 A Reactor Recirculation Excess Flow N/A Check Valve XV-243F004 B Reactor Recirculation Excess Flow NIA Check Valve

SUSQUEHANNA - UNIT 2 TS I B 3.6-36 Revision 3

Rev. 15 PC IVs B 3.6.1.3 Table B 3.6.1.3-1 Primary Containment Isolation Valve (Page B of 10)

Isolation Signal LCO 3.3.6.1 Function No.

Plant System Valve Number Valve Description Type of Valve (Maximum Isolation Time (Seconds))

Reactor XV-243F009 A Reactor Recirculation Excess Flow N/A Recirculation Check Valve (continued) XV-243F009 B Reactor Recirculation Excess Flow N/A Check Valve XV-243F009 C Reactor Recirculation Excess Flow N/A Check Valve XV-243F009 D Reactor Recirculation Excess Flow N/A Check Valve XV-243F010 A Reactor Recirculation Excess Flow N/A Check Valve XV-243F010 B Reactor Recirculation Excess Flow N/A Check Valve XV-243F010 C Reactor Recirculation Excess Flow N/A Check Valve XV-243F010 D Reactor Recirculation Excess Flow N/A Check Valve XV-243F011 A Reactor Recirculation Excess Flow N/A Check Valve XV-243F011 B Reactor Recirculation Excess Flow N/A Check Valve XV-243F011 C Reactor Recirculation Excess Flow N/A Check Valve XV-243F011 D Reactor Recirculation Excess Flow NIA Check Valve XV-243F012 A Reactor Recirculation Excess Flow NIA Check Valve XV-243F012 B Reactor Recirculation Excess Flow N/A Check Valve XV-243F012 C Reactor Recirculation Excess Flow NIA Check Valve XV-243F012 D Reactor Recirculation Excess Flow NIA Check Valve XV-243F017 A Recirculation Pump Seal Water Excess Flow NIA Check Valve XV-243F017 B Recirculation Pump Seal Water Excess Flow N/A Check Valve XV-243F040 A Reactor Recirculation Excess Flow N/A Check Valve XV-243F040 B Reactor Recirculation Excess Flow N/A Check Valve XV-243F040 C Reactor Recirculation Excess Flow NIA Check Valve XV-243F040 D Reactor Recirculation Excess Flow NIA

check Valve XV-243F057 A Reactor Recirculation Excess Flow N/A Check Valve XV-243F057 B Reactor Recirculation Excess Flow N/A Check Valve Residual Heat HV-251 F004 A (b) (c) RHR - Suppression Pool Suction Power Ooerated NIA Removal HV-251 F004 B (b) (c) RHR - Suppression Pool Suction Power Operated NIA HV-251 F004 C (b) (c) RHR - Suppression Pool Suction Power Operated NIA

SUSQUEHANNA - UNIT 2 TS I B 3.6-37 Revision 2

Rev. 15 PC IVs

Plant System Valve Number Table B 3.6.1.3-1 Primary Containment Isolation Valve (Paae 9 of 10)

Valve Description Type of Valve B 3.6.1.3 Isolation Signal LCO 3.3.6.1 Function No.

(Maximum Isolation Time (Seconds})

Residual Heat HV-251 F004 D(b) (c) RHR- Suooression Pool Suction Power Operated N/A Removal HV-251 FOO? A (b) (c) RHR- Minimum Recirculation Power Operated NIA (continued) HV-251 FOD7 B (b) (c) RHR - Minimum Recirculation Power Operated N/A HV-251F008 RHR - Shutdown Cooling Suction Automatic Valve 6.a, 6.b, 6.c (52)

HV-251 F009 RHR - Shutdown Cooling Suction Automatic Valve 6.a, 6.b, 6.c (52)

HV-251 F011 A (b) (d) RHR - Suooression Pool Cooling Manual N/A HV-251 F011 B (bl (dl RHR - Suooression Pool Cooling Manual NIA HV-251 F015 A (f) RHR - Shutdown Cooling Power Operated NIA ReturnlLPCI Injection HV-251 F015 B (f) RHR - Shutdown Cooling Power Operated NIA Return/LPCI Injection HV-251 F016 A (b) RHR - Drywell Spray Automatic Valve 2.c, 2.d (90)

HV-251FD16 B (b) RHR - Drywell Spray Automatic Valve 2.c, 2.d (90)

HV-251F022 RHR - Reactor Vessel Head* Spray Automatic Valve 2.d, 6.a, 6.b, 6.c (30)

HV-251F023 RHR - Reactor Vessel Head Spray Automatic Valve 2.d, 6.a, 6.b, 6.c (20)

HV-251 F028 A (b) RHR - Suppression Pool Automatic Valve 2.c, 2.d (90)

Cooling/Spray HV-251 F028 B (b) RHR - Suppression Pool Automatic Valve 2.c, 2.d (90)

Cooling/Spray HV-251 F050 A (g) RHR - Shutdown Cool~ng Air Operated N/A Return/LPCI Injection Check Valve HV-251 F050 B (g) RHR - Shutdown Cooling Air Operated N/A Return/LPCI Injection Check Valve HV-251F103 A (b) RHR Heat Exchanger Vent Power Operated NIA HV-251F103 B (bl RHR Heat Excham:ier Vent Power Operated N/A HV-251F122A (g) RHR - Shutdown Cooling Power Operated NIA Return/LPCI Injection (Air)

HV-251F122 B (g) RHR- Shutdown Cooling Power Operated NIA ReturnlLPCI Injection (Air)

PSV-25106 A (b) (dl RHR- Relief Valve Discharne Relief Valve NIA PSV-25106 B (b) (d) RHR- Relief Valve Discharge Relief Valve NIA PSV-251F126 ( d) RHR- Shutdown Cooling Suction Relief Valve NIA XV-25109A RHR Excess Flow NIA Check Valve XV-25109 B RHR Excess Flow NIA Check Valve XV-25109 C RHR Excess Flow NIA Check Valve XV-25109 D RHR Excess Flow N/A Check Valve RWCU HV-244F001 (a) RWCU Suction Automatic Valve 5.a, 5.b, 5.c, 5.d, 5.f, 5.Q (30)

HV-244F004 (a) RWCU Suction Automatic Valve 5.a, 5.b, 5.c, 5.d, 5.e, 5.f, 5.g (30)

XV-24411 A RWCU Excess Flow NIA Check Valve XV-24411 B RWCU Excess Flow NIA Check Valve

SUSQUEHANNA - UNIT 2 TS I B 3.6-38 Revision 3

Rev. 15 PC IVs B 3.6.1.3 Table B 3.6.1.3-1 Primary Containment Isolation Valve (Paae 10 of 10)

Isolation Signal LCO 3.3.6.1 Function No.

Plant System Valve Number Valve Description Type of Valve (Maximum Isolation Time (Secondsll RWCU XV-24411 C RWCU Excess Flow N/A (continued) Check Valve XV-24411 D RWCU Excess Flow N/A Check Valve XV-244F046 RWCU Excess Flow N/A Check Valve HV-24182 A RWCU Return Power Operated NIA HV-24182 B RWCU Return Power Operated N/A SLCS 248F007 (a) (d) SLCS Manual Check N/A HV-248F006 (a) SLCS Power Operated NIA Check Valve TIP System C51-J004 A (Ball TIP Ball Valves Automatic Valve 7.a, 7.b (5)

Valve)

C51-J004 B (Ball TIP Ball Valves Automatic Valve 7.a, 7.b (5)

Valve)

C51-J004 C (Ball Tl P Ball Valves Automatic Valve 7.a, 7.b (5)

Valve)

C51-J004 D (Ball TIP Ball Valves Automatic Valve 7.a, 7.b (5)

Valve)

C51-J004 E (Ball Tl P Ball Valves Automatic Valve 7.a, 7.b (5)

Valve)

TIP System C51-J004 A (Shear TIP Shear Valves Squib Valve NIA (continued) Valve)

C51-J004 B (Shear TIP Shear Valves Squib Valve N/A Valve)

C51-J004 C (Shear TIP Shear Valves Squib Valve NIA Valve)

C51-J004 D (Shear TIP Shear Valves Squib Valve N/A Valve)

C51-J004 E (Shear TIP Shear Valves Squib Valve N/A Valve)

(a) Isolation barrier remains filled or a water seal remains in the line post-LOCA, isolation valve is tested with water.

Isolation valve leakage is not included in 0.60 La total Type B and C tests.

(b) Redundant isolation boundary for this valve is provided by the closed system whose integrity is verified by the Leakage Rate Test Program. This footnote does not apply to valve 255F046 (HPCI) when the associated PCIV, HV255F012 is closed and deactivated. Similarly, this footnote does not apply to valve 249F021 (RCIC) when it's associated PCIV, FV249F019 is closed and deactivated.

(c) Containment Isolation Valves are not Type C tested. Containment bypass leakage is prevented since the line terminates below the minimum water level in the Suppression Chamber. Refer to the IST Program.

(d) LCO 3.3.3.1, "PAM Instrumentation," Table 3.3.3.1-1, Function 6, (PCIV Position) does not apply since these are relief valves, check valves, manual valves or deactivated and closed.

(e) The containment isolation barriers for the penetration associated with this valve consists of two PC IVs and a closed system. The closed system provides a redundant isolation boundary for both PCIVs, and its integrity is required to be verified by the Leakage Rate Test Program.

(f) Redundant isolation boundary for this valve is provided by the closed system whose integrity is verified by the Leakage Rate Test Program.

(g) These valves are not required to be 10 CFR 50, Appendix J tested since the HV-251 F015A(B) valves and a closed system form the 10 CFR 50, Appendix J boundary. These valves form a high/low pressure interface and are pressure tested in accordance with the pressure test program .

SUSQUEHANNA - UNIT 2 TS I B 3.6-39 Revision 7

Rev. 15 PC IVs

Table B 3.6.1.3-2 Secondary Containment Bypass Leakage Isolation Valves (Not PCIVs)

B 3.6.1.3

{Page 1 of 1)

Isolation Signal LCO 3.3.6.1 Function No.

Plant System Valve Number Valve Description Type of Valve (Maximum Isolation Time (Seconds})

Residual Heat HV-251F040 RHR - RADWASTE LINE IB ISO VLV Automatic Valve 2.a, 2.d (45)

Removal >

HV-251F049 RHR- DISCH TO RADW OB ISO VLV Automatic Valve 2.a, 2.d (20) 2-51-136 RHR - COND TRANSFER OB SCBL Check Valve N/A CHECK VALVE 2-51-137 RHR - COND TRANSFER IB SCBL Check Valve N/A CHECK VALVE

SUSQUEHANNA - UNIT 2 TS I B 3. 6-39a Revision 1

Rev. 2 Containment Pressure B 3.6.1.4 83.6 CONTAINMENT SYSTEMS B 3.6.1.4 Containment Pressure BASES BACKGROUND The containment pressure is limited during normal operations to preserve the initial conditions assumed in the accident analysis for a Design Basis Accident (OBA) or loss of coolant accident (LOCA).

APPLICABLE Primary containment performance is evaluated for the entire spectrum of SAFETY break sizes for postulated LOCAs (Ref. 1). Among the inputs to the OBA ANALYSES is the initial primary containment internal pressure (Ref. 1). Analyses assume an initial containment pressure of -1.0 to 2.0 psig. This limitation ensures that the safety analysis remains valid by maintaining the expected initial conditions and ensures that the peak LOCA containment internal pressure does not exceed the maximum allowable.

The maximum calculated containment pressure occurs during the reactor blowdown phase of the OBA, which assumes an instantaneous recirculation line break. The calculated peak containment pressure for this limiting event is 48.6 psig (Ref. 1).

The minimum containment pressure occurs during an inadvertent spray actuation. The calculated minimum drywell pressure for this limiting event is -4.72 psig. (Ref. 1)

Containment pressure satisfies Criterion 2 of the NRG Policy Statement.

(Ref. 2)

LCO In the event of a OBA, with an initial containment pressure -1.0 to 2.0 psig, the resultant peak containment accident pressure will be maintained below the containment design pressure. The containment pressure is defined to include both the drywell pressure and the suppression chamber pressure. (Ref. 1)

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.6-40 Revision 1

Rev.2 Containment Pressure

BASES (continued)

B 3.6.1.4 APPLICABILITY In MODES 1, 2, and 3, a OBA could cause a release of radioactive*

material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment pressure within limits is not required in MODE 4 or 5.

ACTIONS A.1 With containment pressure not within the limit of the LCO, containment pressure must be restored within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Required Action is necessary to return operation to within the bounds of the primary containment analysis. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, "Primary Containment," which requires that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

B.1 and B.2

If containment pressure cannot be restored to within limit within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply: To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS SR 3.6.1.4.1 Verifying that containment pressure is within limit ensures that unit operation remains within the limit assumed in the primary containment analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SUSQUEHANNA - UNIT 2 TS I B 3.6-41 (continued)

Revision 1

Rev.2 Containment Pressure

BASES (continued)

B 3.6.

1.4 REFERENCES

1. FSAR, Section 6.2.

2. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.6-42 Revision O

Rev. 2 Drywell Air Temperature

B 3.6.1.5 B3.6 CONTAINMENT SYSTEMS B 3.6.1.5 Drywell Air Temperature BASES BACKGROUND The drywell contains the reactor vessel and piping, which add heat to the airspace. Drywell coolers remove heat and maintain a suitable environment. The average airspace temperature affects the calculated response to postulated Design Basis Accidents (DBAs). The limitation on the drywell average air temperature was developed as reasonable, based on operating experience. The limitation on drywell air temperature is used in the Reference 1 safety analyses.

APPLICABLE Primary containment performance is evaluated for a spectrum of SAFETY ANALYSES break sizes for postulated loss of coolant accidents (LOCAs)

(Ref. 1). Among the inputs to the design basis analysis is the initial drywall average air temperature (Ref. 1). Analyses assume an initial average drywell air temperature, which bounds the allowed drywell air temperature of 135°F. This limitation ensures that the safety analysis remains valid by maintaining the expected initial conditions and ensures that the peak LOCA drywell temperature does not exceed the maximum allowable temperature of 340°F (Ref. 1). Exceeding this design temperature may result in the degradation of the primary containment structure under accident loads. Equipment inside primary containment required to mitigate the effects of a OBA is designed to operate and be capable of operating under environmental conditions expected for the accident.

Drywell air temperature satisfies Criterion 2 of the NRC Policy

Statement. (Ref. 2)

LCO In the event of a OBA, with an initial drywell average air temperature less than or equal to the LCO temperature limit, the resultant peak accident temperature is maintained below the drywell design temperature. As a result, the ability of primary containment to perform its design function is ensured .

SUSQUEHANNA - UNIT 2 TS/ B 3.6-43 (continued)

Revision 1

Rev. 2 Drywell Air Temperature

BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a OBA could cause a release of B 3.6.1.5 radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining drywell average air temperature within the limit is not required in MODE 4 or 5.

ACTIONS A.1 With drywell average air temperature not within the limit of the LCO, drywell average air temperature must be restored within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The .Required Action is necessary to return operation to within the bounds of the primary containment analysis. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is acceptable, considering the sensitivity of the accident analysis to variations in this parameter, and provides sufficient time to correct minor problems.

B.1 and B.2

If the drywell average air temperature cannot be restored to within limit within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.5.1 REQUIREMENTS Verifying that the drywell average air temperature is within the LCO limit ensures that operation remains within the limits assumed for the primary containment analyses.

Drywell air temperature is monitored in the following areas:

SUSQUEHANNA - UNIT 2 TS I B 3.6-44 (continued)

Revision 1

Rev. 2 Drywell Air Temperature

BASES SURVEILLANCE REQUIREMENTS SR 3.6.1.5.1 (continued)

B 3.6.1.5 Temgerature Substitution Areas Access at Elevation Element Nos. Value Top 794'4" TE 25791A 150°F TE 257918 150°F Middle 752' 2" TE25790A 150°F TE25790B 150°F Bottom 719' 1" TE25798A 150°F TE25798B 150°F Pedestal 704'0" TE25799A 130°F TE 257998 130°F and is the arithmetical average of all valid temperatures from the above sensors. The location of the Drywell Temperature Elements ensures the Drywell Average Temperature is obtained. In the event a sensor becomes inoperable, the "substitution value" will be used in the calculation.

Satisfying the surveillance requirement with less than 6 of the above listed 8 sensors operable shall not be done without an engineering evaluation.

Note that inoperable sensors should also be evaluated against LCO 3.3.3.1.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.2.

2. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.6-45 Revision 3

Rev. 1 Suppression Chamber-to-Drywell Vacuum Breakers

B 3.6 CONTAINMENT SYSTEMS B 3.6.1.6 Suppression Chamber-to-Drywell Vacuum Bre~kers B 3.6.1.6 BASES BACKGROUND The function of the suppression-chamber-to-drywell vacuum breakers is to relieve vacuum in the drywell. There are five pairs of vacuum breakers. Each pair consists of two valves in series. They are attached to the capped downcomers to allow air and steam flow from the suppression chamber to the drywell when the drywell is at a negative pressure with respect to the suppression chaml;Jer.

Therefore, suppression chamber-to-drywell vacuum breakers prevent an excessive negative differential pressure across the suppression chamber drywell boundary. Each vacuum breaker is a self actuating valve, similar to a check valve, which can be remotely operated for testing purposes.

A negative differential pressure across the drywell *floor is caused by rapid depressurization of the drywell. Events that cause this

rapid depressurization are cooling cycles, inadvertent drywell spray actuation, and steam condensation from sprays or subcooled water reflood of a break in the event of a primary system rupture. Cooling cycles result in minor pressure transients in the drywell that occur slowly and are normally controlled by heating and ventilation equipment. Spray actuation or spill of subcooled water out of a break results in more significant pressure transients and becomes important in sizing the internal vacuum breakers.

In the .event of a primary system rupture, steam condensation within the drywell results in the most severe pressure transient.

Following a primary system rupture, nitrogen and non-combustibles in the drywell are purged into the suppression chamber free airspace, leaving the drywell full of steam. Subsequent condensation of the steam can be caused in two possible ways, namely, Emergency Core Cooling Systems flow from a recirculation line break, or drywall spray actuation following a loss of coolant accident (LOCA). These two cases determine the maximum depressurization rate of the drywell.

SUSQUEHANNA - UNIT 2 TS/B 3.6-46 (continued)

Revision 1

Rev. 1 Suppression Chamber-to-Drywell Vacuum Breakers

BASES (continued)

APPLICABLE SAFETY ANALYSES Analytical methods and assumptions involving the 83.6.1.6 suppression chamber-to-drywell vacuum breakers are presented in Reference 1 as part of the accident response of the primary containment systems. Suppression chamber-to-drywall vacuum breakers are provided as part of the primary containment to limit the negative differential pressure across the drywall and suppression chamber floor.

The safety analyses assume that the vacuum breakers are closed initially and are open at a differential pressure of~ 2.81 psid (Ref. *1 ). Additionally, one of the five vacuum breaker pairs is assumed to fail in a closed position (Ref. 1). The results of the analyses show that the design pressure is not exceeded even under the worst case accident scenario. Design Basis Accident (DBA) analyses require the vacuum breakers to be closed initially and to remain closed and leak tight, with the suppression pool at a positive pressure relative to the drywall.

The suppression chamber-to-drywell vacuum breakers satisfy Criterion 3 of the NRC Policy Statement. (Ref. 2) c LCO All suppression chamber-to-drywell vacuum breakers are required to be OPERABLE and closed (except during testing or when the vacuum breakers are performing their intended design function).

The vacuum breaker OPERABILITY requirement provides assurance that the drywell-to-suppression chamber negative differential pressure remains below the design value. The requirement that the vacuum breakers be closed ensures that there is no excessive. bypass leakage should ~ LOCA occur.

APPLICABILITY In MODES 1, 2, and 3, excessive negative pressure inside the drywell could occur due to inadvertent actuation of containment spray. The vacuum breakers, therefore, "are required to be OPERABLE in MODES 1, 2, and 3, to mitigate the effects of inadvertent actuation of containment spray.

SUSQUEHANNA- UNIT 2 TS/B 3.6-47 (continued)

Revision 1

Rev. 1 Suppression Chamber-to-Drywell Vacuum Breakers

BASES APPLICABILITY (continued)

Also, in MODES 1, 2, and 3, a OBA could result in excessive B 3.6.1.6 negative differential pressure across the drywell floor, caused by the rapid depressurization of the drywell. The event that results in the limiting rapid depressurization of the drywell is the primary system rupture that purges the drywell of air and fills the drywell free airspace with steam. Subsequent condensation of the steam would result in depressurization of the drywell. The limiting pressure and temperature of the primary system prior to a OBA occur in MODES 1, 2, and 3.

In MODES 4 and 5, the probability and consequences of these events are reduced by the pressure and temperature limitations in these MODES; therefore, maintaining suppression chamber-to-drywell vacuum breakers OPERABLE is not required in MODE 4 or5.

ACTIONS With one of the vacuum breaker pairs inoperable for opening (e.g.,

the vacuum breaker is not open and may be stuck closed or not within its opening setpoint limit, so that it would not function as designed during an event that depressurized the drywall), the remaining four OPERABLE vacuum breaker pairs are capable of providing the vacuum relief function. However, overall system reliability is reduced because a single failure in one of the remaining vacuum breaker pairs could result in an excessive suppression chamber-to-drywell differential pressure during a limiting plant event. Therefore, with one of the five vacuum breaker pairs inoperable, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to restore the inoperable vacuum breaker pairs to OPERABLE status so that plant conditions are consistent with those assumed for the design basis analysis.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is considered acceptable due to the low probability of an event in which the remaining vacuum breaker capability would not be adequate.

8.1and8.2 With one of the two suppression chamber-to-drywell vacuum breakers in a pair not closed, the remaining closed vacuum breaker is capable of preventing direct communication

SUSQUEHANNA - UNIT 2 TS/B 3.6-48 (continued)

Revision 1

Rev. 1 Suppression Chamber-to-Drywell Vacuum Breakers

BASES ACTIONS 8.1 and B.2 (continued) between the drywell and the suppression chamber airspace.

B 3.6.1.6 However, overall system reliability is reduced because a single failure in the one remaining vacuum breaker could result in direct communication between the drywell and the suppression chamber airspace, and, as a result, there is the potential for suppression chamber overpressurization due to this bypass leakage if a LOCA were to occur. Therefore, with one of the two vacuum breakers in a pair not closed and the other verified closed within two hours. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to close the open vacuum breaker so that plant conditions are consistent with those assumed for the design basis analysis. If the vacuum breaker position indication is not reliable, an alternate method of verifying that the vacuum breaker is closed is to verify that a differential pressure of 0.5 psid between the drywell and suppression chamber is maintained for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months without make-up. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is considered acceptable due to the low probability of an event in which the remaining vacuum breaker capability would not be adequate .

Two open vacuum breakers in a vacuum breaker pair allows communication between the drywell and suppression chamber airspace, and, as a result, there is the potential for containment overpressurization due to the loss of the pressure suppression function. Therefore, one open vacuum breaker must be closed. A short time is allowed to close the vacuum breaker due to the low probability of an event that would pressurize primary containment.

If vacuum breaker position indication is not reliable, an alternate method of verifying that the vacuum breakers are closed is to verify that a differential pressure of 0.5 psid between the suppression chamber and drywell is maintained for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months without makeup. The required 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is considered adequate to perform this test.

D.1 and D.2 If the inoperable suppression chamber-to-drywell vacuum breaker cannot be closed or restored to OPERABLE status within the required Completion Time, the plant must be

SUSQUEHANNA - UNIT 2 TS/B 3.6-49 (continued)

Revision 1

Rev. 1 Suppression Chamber-to-Drywell Vacuum Breakers

BASES ACTIONS D.1 and D.2 (continued) brought to a MODE in which the LCO does not apply. To B 3.6.1.6 achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.6.1 REQUIREMENTS Each vacuum breaker is verified closed to ensure that this potential large bypass leakage path is not present. This Surveillance is performed by observing the vacuum breaker position indication or by verifying that a differential pressure of 0.5 psid between the suppression chamber and drywell is maintained for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months without makeup. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This verification is also required within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after discharge of steam to the suppression chamber from safety/relief valve operation.

A Note is added to this SR which allows suppression chamber-to-drywell vacuum breakers opened in conjunction with the performance of a Surveillance to not be considered as failing this SR. These periods of opening vacuum breakers are controlled by plant procedures and do not represent inoperable vacuum breakers.

SR 3.6.1.6.2 Each required vacuum breaker must be cycled to ensure that it opens adequately to perform its design function and returns to the fully closed position. This ensures that the safety analysis assumptions are valid. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA- UNIT 2 TS/B 3.6-50 (continued)

Revision2

Rev. 1 Suppression Chamber-to-Drywell Vacuum Breakers

BASES SURVEILLANCE REQUIREMENTS SR 3.6.1.6.2 (continued)

B 3.6.1.6 In addition, this functional test is required within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after either a discharge of steam to the suppression chamber from safety/relief valve operation or after an operation that causes any of the vacuum breakers to open.

SR 3.6.1.6.3 Verification of the vacuum breaker opening setpoint is necessary to ensure that the safety analysis assumption regarding vacuum breaker open differential. pressure setpoint is valid. The Surveillance Frequency is controlled .under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.2.

2. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS/B 3.6-51 Revision 3

Rev.3 Suppression Pool Average Temperature

B 3.6 B 3.6.2.1 CONTAINMENT SYSTEMS Suppression Pool Average Temperature B 3.6.2.1 BASES BACKGROUND The primary containment utilizes a Mark II over/under pressure suppression configuration consisting of a dryvvell and suppression chamber. The drywell is a steel-lined concrete truncated cone located above the steel-lined concrete cylindrical pressure suppression chamber containing a volume of water called the suppression pool. The suppression pool is designed to absorb the decay heat and sensible energy released during a reactor blowdown from safety/relief valve discharges or from Design Basis Accidents (DBAs). The suppression pool must quench all the steam released through the downcomer lines during a loss of coolant accident (LOCA). This is the essential mitigative feature of a pressure suppression containment that ensures that the peak containment pressure is maintained below the maximum allowable pressure for containment (53 psig) (Ref. 1). The suppression pool must also condense steam from steam exhaust lines in the turbine driven systems (i.e., the High Pressure Coolant Injection System and Reactor Core Isolation Cooling System). Suppression pool average temperature (along with LCO 3.6.2.2, "Suppression Pool Water Level") is a key indication of the capacity of the suppression pool to fulfill these requirements.

The technical concerns that lead to the development of suppression pool average temperature limits are as follows:

a. Complete steam condensation;

b. Primary containment peak pressure and temperature;

c. Condensation oscillation loads; and

d. Chugging loads.

APPLICABLE The postulated OBA against which the primary containment performance SAFETY is evaluated is the entire spectrum of postulated pipe breaks within the ANALYSES primary containment. Inputs to the safety analyses include initial suppression pool water volume and suppression pool temperature

SUSQUEHANNA - UNIT 2 TS I B 3.6-52 (continued)

Revision 0

Rev. 3 Suppression Pool Average Temperature B 3.6.2.1 BASES APPLICABLE (Reference 1 for LOCAs and Reference 2 for the pool temperature SAFETY analyses required by Reference 3). An initial pool temperature of 90°F is ANALYSES assumed for the Reference 1 and Reference 2 analyses. Reactor (continued) shutdown at a pool temperature of 110°F and vessel depressurization at a pool temperature of 120°F are assumed for the Reference 2 analyses.

The limit of 105°F, at which testing is terminated, is not used in the safety analyses because DBAs are assumed to not initiate during unit testing.

Suppression pool average temperature satisfies Criteria 2 and 3 of the NRC Policy Statement. (Ref. 4)

LCO A limitation on the suppression pool average temperature is required to provide assurance that the containment conditions assumed for the safety analyses are met. This limitation subsequently ensures that peak primary containment pressures and temperatures do not exceed maximum allowable values during a postulated OBA or any transient resulting in heatup of the suppression pool. The LCO requirements are:

a. Average temperature .s::; 90°F when any OPERABLE intermediate range monitor (IRM) channel is> 25/40 divisions of full scale on Range 7 with IRMs fully inserted and no testing that adds heat to the suppression pool is being performed. This requirement ensures that licensing bases initial conditions are met.

b. Average temperature :s;; 105°F when any OPERABLE IRM channel is

> 25/40 divisions of full scale on Range 7 with IRMs fully inserted and testing that adds heat to the suppression pool is being performed.

This required value ensures that the unit has testing flexibility, and was selected to provide margin below the 110°F limit at which reactor shutdown is required. When testing ends, temperature must be restored to :s;; 90°F within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months according to Required Action A.2.

Therefore, the time period that the temperature is > 90°F is short enough not to cause a significant increase in unit risk.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.6-53 Revision O

Rev.3 Suppression Pool Average Temperature

BASES B 3.6.2.1 LCO c. Average temperatures 110°F when all OPERABLE IRM channels are (continued) s 25/40 divisions of full scale on Range 7 with IRMs fully inserted. This requirement ensures that the unit will be shut down at> 110°F. The pool is designed to absorb decay heat and sensible heat but could be heated beyond design limits by the steam generated if the reactor is not shut down.

Note that 25/40 divisions of full scale on lRM Range 7 is a convenient measure of when the reactor is producing power essentially equivalent to 1% RTP. At this power level, heat input is approximately equal to normal sy~tem heat losses.

APPLICABILITY In MODES 1, 2, and 3, a OBA could cause significant heatup of the suppression pool. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining suppression pool average temperature within limits is not required in MODE 4 or 5.

ACTIONS A.1 and A.2 With the suppression pool average temperature above the specified limit when not performing testing that adds heat to the suppression pool and when above the specified power indication, the initial conditions exceed the conditions assumed for the References 1 and 2 analyses. However, primary containment cooling capability still exists, and the primary containment pressure suppression function will occur at temperatures well above those assumed for safety analyses. Therefore, continued operation is allowed for a limited time. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is adequate to allow the suppression pool average temperature to be restored below the limit. Additionally, when suppression pool temperature is > 90°F, increased monitoring of the suppression pool temperature is required to ensure that it remains s 110°F. The once per hour Completion Time is adequate'based on past experience, which has shown that pool temperature increases relatively slowly except when testing

SUSQUEHANNA - UNIT 2 TS/ B 3.6-54 (continued)

Revision O

Rev. 3 Suppression Pool Average Temperature B 3.6.2.1 BASES ACTIONS A.1 and A.2 (continued) that adds heat to the suppression pool is being performed. Furthermore, the once per hour Completion Time is considered adequate in view of other indications in the control room, including alarms, to alert the operator to an abnormal suppression pool av~rage temperature condition.

If the suppression pool average temperature cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the power must be reduced to < 25/40 divisions of full scale on Range 7 for all OPERABLE IRMs within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to reduce power from full power conditions in an orderly manner and without challenging plant systems.

Suppression* pool average temperature is allowed to be > 90°F when any OPERABLE IRM channel is> 25/40 divisions of full scale on Range 7, and when testing that adds heat to the suppression pool is being performed. However, if temperature is> 105°F, all testing must be immediately suspended to preserve the heat absorption capability of the suppression pool. With the testing suspended, Condition A is entered and the Required Actions and associated Completion Times are applicable.

D.1, D.2 and D.3 Suppression pool average temperature > 110°F requires that the reactor be shut down immediately. This is accomplished by placing the reactor mode switch in the shutdown position. Further cooldown to Mode 4 is required at normal cooldown rates (provided pool temperature remains ::;;:

120°F). Additionally, when suppression pool temperature is> 110°F, increased monitoring of pool temperature is required to (continued)

SUSQUEHANNA*- UNIT 2 TS/ B 3.6-55 Revision O

Rev.3 Suppression Pool Average Temperature

BASES B 3.6.2.1 ACTIONS D.1. D.2 and D.3 (continued) ensure that it remains :s; 120°F. The once per 30 minute Completion Time is adequate, based on operating experience. Given the high suppression pool average temperature in this Condition, the monitoring Frequency is increased to twice that of Condition A Furthermore, the 30 minute Completion Time is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.

If suppression pool average temperature cannot be maintained at

s; 120°F, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the reactor pressure must be reduced to

< 20.0 psig within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and the plant must be brought to at least MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months from the time the plant entered Condition D. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Continued addition of heat to the suppression pool with suppression pool temperature> 120°F could result in exceeding the design basis maximum allowable values for primary containment temperature or pressure.

Furthermore, if a blowdown were to occur when the temperature was

> 120°F, the maximum allowable bulk and local temperatures could be exceeded very quickly.

SURVEILLANCE SR 3.6.2.1.1 REQUIREMENTS Three averages of suppression pool temperature are calculated:

SPOTMOS average temperature, bottom average temperature, and bulk pool temperature. SPOTMOS average temperature is a simple average of the eight upper-level RTDs. This average is valid if at least six of the eight upper-level RTDs are OPERABLE with at least one sensor in each quadrant. Bottom average temperature is a simple average of the four bottom-level RTDs. This average is valid if at least three of the four bottom-level RTDs are OPERABLE. Bulk pool temperature is a weighted (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.6-56 Revision 2

Rev.3 Suppression Pool Average Temperature B 3.6.2.1 BASES SURVEILLANCE SR 3.6.2.1.1 (continued)

REQUIREMENTS average of the SPOTMOS average temperature and the bottom average temperature. Bulk pool temperature is valid when both SPOTMOS average temperature and bottom average temperature are valid.

Additionally, the SPOTMOS electronic units send bulk pool temperature to PICSY for display.

For the purpose of monitoring Suppression Pool Average Temperature, both SPOTMOS average temperature and bulk pool temperature, displayed by the SPOTMOS electronic units or PICSY, are acceptable.

However, bulk pool temperature should be the primary indicator, when available, since it provides a more accurate representation of Suppression Pool Average Temperature and reduces the frequency of suppression pool cooling operation. The bottom sensors are not qualified for service following a LOCA or seismic event, and as a result, neither the bottom

sensors nor the bulk pool temperature should be used following a LOCA or seismic event. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. However, when heat is being added to the suppression pool by testing, more frequent monitoring of suppression pool temperature is necessary. The five minute frequency during testing is justified by the rates at which testing will heat up the suppression pool, has been shown to be acceptable based on operating experience, and provides assurance that allowable pool temperatures are not exceeded. The frequency is further justified in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.

REFERENCES 1. FSAR, Section 6.2.

2. FSAR, Section 15.2.

3. NUREG-0783.

4. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132} .

SUSQUEHANNA - UNIT 2 TS I B 3.6-57 Revision 3

Rev. 1 Suppression Pool Water Level

B 3.6 B 3.6.2.2 CONTAINMENT SYSTEMS Suppression Pool Water Level 8 3.6.2.2 BASES BACKGROUND The primary containment utilizes a Mark II over/under pressure suppression configuration consisting of a drywell and suppression chamber. The drywell is a steel-lined concrete truncated cone located above the steel-lined concrete cylindrical pressure suppression chamber containing a volume of water called the suppression pool. The suppression pool is designed to absorb the energy associated with decay heat and sensible heat released during a reactor blowdown from safety/relief valve (S/RV) discharges or from a Design Basis Accident (DBA). The suppression pool must qt..Jench all the steam released through the downcomer lines during a loss of coolant accident (LOCA). This is the essential mitigative feature of a pressure suppression containment, which ensures that the peak containment pressure is maintained below the maximum allowable pressure for containment (53 psig). The suppression pool must also condense steam from the steam exhaust lines in the turbine driven systems (i.e., High Pressure Coolant Injection (HPCI)

System and Reactor Core Isolation Cooling (RCIC) System) and provides the main emergency water supply source for the reactor vessel. The suppression pool volume ranges between 122,410 ft3 at the low water 3

level limit of 22 ft O inches and 133,540 ft at the high water level limit of 24 ft O inches.

If the suppression pool water level is too low, an insufficient amount of water would be available to adequately condense the steam from the S/RV quenchers, downcomers, or HPCI and RCIC turbine exhaust lines.

Low suppression pool water level could also result in an inadequate emergency makeup water source to the Emergency Core Cooling System.

The lower volume would also absorb less steam energy before heating up excessively. Therefore, a minimum suppression pool water level is specified.

If the suppression pool water level is too high, it could result in excessive clearing loads from S/RV discharges and excessive pool swell loads during a DBA LOCA. Therefore, a maximum pool water level is specified.

This LCO specifies an acceptable range to prevent the suppression pool water level from being either too high or too low.

SUSQUEHANNA - UNIT 2 B 3.6-58 (continued)

Revision O

Rev. 1 Suppression Pool Water Level

BASES (continued)

B 3.6.2.2 APPLICABLE Initial suppression pool water level affects suppression pool temperature SAFETY response calculations, calculated drywell pressure during vent clearing for ANALYSES a OBA, calculated pool swell loads for a OBA LOCA, and calculated loads due to S/RV discharges. Suppression pool water level must be maintained within the limits specified so that the safety analysis of Reference 1 remains valid.

Suppression pool water level satisfies Criteria 2 and 3 of the NRC Policy Statement. (Ref. 2)

LCO A limit that suppression pool water level be~ 22 ft 0 inches and

24 ft O inches is required to ensure that the primary containment conditions assumed for the safety analyses are met. Either the high or low water level limits were used in the safety analyses, depending upon which is more conservative for a particular calculation .

APPLICABILITY In MODES 1, 2, and 3, a OBA would cause significant loads on the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. The requirements for maintaining suppression pool water level within limits in MODE 4 or 5 is addressed in LCO 3.5.2, "ECCS-Shutdown."

ACTIONS A.1 With suppression pool water level outside the limits, the conditions assumed for the safety analyses are not met. If water level is below the minimum level, th.e pressure suppression function still exists as long as downcomers are covered, HPCI and RCIC turbine exhausts are covered, and S/RV quenchers are covered. If suppression pool water level is above the maximum level, protection against overpressurization still exists due to the margin in the peak containment pressure analysis and the capability of the Drywell Spray System. Therefore, continued operation fora

SUSQUEHANNA- UNIT 2 B 3.6-59 (continued)

Revision O

Rev. 1 Suppression Pool Water Level

BASES B 3.6.2.2 ACTIONS A.1 (continued) limited time is allowed. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is sufficient to restore suppression pool water level to within limits. Also, it takes into account the low probability of an event impacting the suppression pool water level occurring during this interval.

B.1 and B.2 If suppression pool water level cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems .

SURVEILLANCE REQUIREMENTS ~R 3 *6 *2 *2 *1 Verification of the suppression pool water level by at least one water level indicator is to ensure that the required limits are satisfied. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.2.

2. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.6-60 Revision 1 I

Rev. 2 RHR Suppression Pool Cooling

B 3.6 B 3.6.2.3 CONTAINMENT SYSTEMS Residual Heat Removal (RHR) Suppression Pool Cooling B 3.6.2.3 BASES BACKGROUND Following a Design Basis Accident (OBA), the RHR Suppression Pool Cooling System removes heat from the suppression pool. The suppression pool is designed to absorb the sudden input of heat from the primary system. In the long term, the pool continues to absorb residual heat generated by fuel in the reactor core. Some means must be provided to remove heat from the suppression pool so that the temperature inside the primary containment remains within design limits.

This function is provided by two redundant RHR suppression pool cooling subsystems. The purpose of this LCO is to ensure that both subsystems are OPERABLE in applicable MODES.

Each RHR subsystem contains either one of the two RHR pumps and a flow path capable of recirculating water from the suppression chamber through an RHR heat exchanger and is manually initiated and independently controlled. The two subsystems perform the suppression pool cooling function by circulating water from the suppression pool through the RHR heat exchangers *and returning it to the suppression pool. RHR service water, circulating through the tube side of the heat exchangers, exchanges heat with the suppression pool water and discharges this heat to the external heat sink.

The heat removal capability of one RHR pump in one subsystem is sufficient to meet the overall OBA pool cooling requirement for loss of coolant accidents (LOCAs) and transient events such as a turbine trip or stuck open safety/relief valve (S/RV). S/RV leakage and High Pressure Coolant Injection and Reactor Core Isolation Cooling System testing increase suppression pool temperature more slowly. The RHR Suppression Pool Cooling System is also used to lower the suppression pool water bulk temperature following such events.

APPLICABLE Reference 1 contains the results of analyses used to predict primary SAFETY containment pressure and temperature following large and small break ANALYSES LOCAs. The intent of the analyses is to demonstrate that the heat removal capacity of the RH R (continued)

SUSQUEHANNA - UNIT 2 B 3.6-61 Revision O

Rev.2 RHR Suppression Pool Cooling

BASES APPLICABLE Suppression Pool Cooling System is adequate to maintain the primary B 3.6.2.3 SAFETY containment conditions within design limits. The suppression pool ANALYSES temperature is calculated to remain below the design limit.

(continued)

The RHR Suppression Pool Cooling System satisfies Criterion 3 of the NRC Policy Statement. (Ref. 3)

LCO During a DBA, a minimum of one RHR suppression pool cooling subsystem is required to maintain the primary containment peak pressure and temperature below design limits (Ref. 1). To ensure that these requirements are met, two RHR suppression pool cooling subsystems must be OPERABLE. Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure.

An RHR suppression pool cooling subsystem is OPERABLE when one of the pumps, the heat exchanger, and associated piping, valves, instrumentation, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment and cause a heatup and pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, the RHR Suppression Pool Cooling System is not required to be OPERABLE in MODE4 ors.

ACTIONS A.1 With one RHR suppression pool cooling subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining RHR suppression pool cooling subsystem is adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in loss of primary containment cooling capability. The 7 day Completion Time is acceptable in light of the redundant RHR suppression (continued)

SUSQUEHANNA - UNIT 2 B 3.6-62 Revision O

Rev.2 RHR Suppression Pool Cooling

BASES ACTIONS A.1 (continued)

B 3.6.2.3 pool cooling capabilities afforded by the OPERABLE subsystem and the low probability of a OBA occurring during this period.

With two RHR suppression pool cooling subsystems inoperable, one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this condition, there is a substantial loss the of primary containment pressure and temperature mitigation function. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a OBA and the potential avoidance of a plant shutdown transient that could result in the need for the RHR suppression pool cooling subsystems to operate.

C.1 and C.2 If the Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS SR 3 *6 *2 *3* 1 Verifying the correct alignment for manual, power operated, and automatic valves in the RHR suppression pool cooling mode flow path provides assurance that the proper flow path exists for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position provided it can be aligned to the accident position within the time assumed in the accident analysis. This is acceptable since the RHR suppression pool cooling mode is manually initiated. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

SUSQUEHANNA - UNIT 2 TS I B 3.6-63 (continued)

Revision 1

Rev.2 RHR Suppression Pool Cooling

BASES B 3.6.2.3 SURVEILLANCE REQUIREMENTS SR 3.6.2.3.1 (continued)

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.2.3.2 Verifying that each RHR pump develops a flow rate;;::: 9750 gpm while operating in the suppression pool cooling mode with flow through the associated heat exchanger ensures that pump performance has not degraded during the cycle. Flow is a normal test of centrifugal pump performance required by ASME OM Code (Ref. 2). This test confirms one point on the pump design curve, and the results are indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the lnservice Testing Program .

REFERENCES 1. FSAR, Section 6.2.

2. ASME Operation and Maintenance Code.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.6-64 Revision 2

Rev.1 RHR Suppression Pool Spray B 3.6.2.4

B 3.6 CONTAINMENT SYSTEMS B 3.6.2.4 Residual Heat Removal (RHR) Suppression P9ol Spray BASES BACKGROUND Following a Design Basis Accident (OBA), the RHR Suppression Pool Spray System removes heat from the suppression chamber airspace. The suppression pool is designed to absorb the sudden input of heat from the primary system from a OBA or a rapid depressurization of the reactor pressure vessel (RPV) through safety/relief valves. The heat addition to the suppression pool results in increased steam in the suppression chamber, which increases primary containment pressure. Steam blowdown from a OBA can also bypass the suppression pool and end up in the suppression chamber airspace. Some means must be provided to remove heat from the suppression chamber so that the pressure and temperature inside primary containment remain within analyzed design limits. This function is provided by two redundant RHR suppression pool spray subsystems. The purpose of this LCO is to ensure that both subsystems are OPERABLE in applicable MODES .

Each of the two RHR suppression pool spray subsystems includes either one of the two RHR pumps and a flow path capable of recirculating water from the suppression chamber through the RHR heat exchanger, and is manually initiated and independently controlled. The two subsystems perform the suppression pool spray function by circulating water from the suppression pool through the RHR heat exchangers and returning it to the suppression pool spray spargers. The spargers only accommodate a small portion of the total RHR pump flow; the remainder of the flow normally returns to the suppression pool through the suppression pool cooling return line. Thus, both suppression pool cooling and suppression pool spray functions are normally performed when the Suppression Pool Spray System is initiated. RHR service water, circulating through the tube side of the heat exchangers, exchanges heat with the suppression pool water and discharges this heat to the external heat sink. Either RHR suppression pool spray subsystem is sufficient to condense the steam from small bypass leaks from the drywell to the suppression chamber airspace during the postulated OBA

SUSQUEHANNA- UNIT 2 B 3.6-65 (continued)

Revision 0

Rev. 1

RHR Suppression Pool Spray B 3.6.2.4 BASES (continued)

APPLICABLE Reference 1 contains the results of analyses used to predict primary SAFETY containment pressure and temperature following large and small break ANALYSES loss of coolant accidents. The intent of the analyses is to demonstrate that the pressure reduction capacity of the RHRSuppression Pool Spray System is adequate to maintain the primary containment conditions within design limits. The time history for primary containment pressure is calculated to demonstrate that the maximum pressure remains below the design limit.

, The RHR Suppression Pool Spray System satisfies Criterion 3 of the NRC Policy Statement. (Ref. 2)

LCO In the event of a OBA, a minimum of one RHR suppression pool spray subsystem is required to mitigate potential bypass leakage paths and maintain the primary containment peak pressure below the design limits (Ref. 1). To ensure that these requirements are met, two RHR

suppression pool spray subsystems must be OPERABLE. Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR suppression pool spray subsystem is OPERABLE when one of the pumps*, the heat exchanger, and associated piping, valves, instrumentation, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a OBA could cause pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining RHR suppression pool spray subsystems OPERABLE is not required in MODE 4 or 5.

ACTIONS A.1 With one RHR suppression pool spray subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE RHR suppression pool spray subsystem is adequate to perform the primary containment bypass leakage mitigation function .

SUSQUEHANNA - UNIT 2 B 3.6-66 (continued)

Revision 0

Rev. 1 RHR Suppression Pool Spray B 3.6.2.4 BASES ACTIONS A.1 (continued)

However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced primary containment bypass mitigation capability. The 7 day Completion Time was chosen in light of the redundant RHR suppression pool spray capabilities afforded by the OPERABLE subsystem and the low probability of a OBA occurring during this period.

With both RHR suppression pool spray subsystems inoperable, at least one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this Condition, there is a substantial loss of the primary containment bypass leakage mitigation function. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a OBA and alternate means to remove heat from primary containment are available .

C.1 and C.2 If the inoperable RHR suppression pool spray subsystem cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS SR 3 *6 *2 .4* 1 Verifying the correct alignment for manual, power operated, and automatic valves in the RHR suppression pool spray mode flow path provides assurance that the proper flow paths will exist for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A

SUSQUEHANNA- UNIT 2 B 3.6-67 (continued)

Revision 0

Rev. 1 RHR Suppression Pool Spray B 3.6.2.4 BASES SURVEILLANCE SR 3.6.2.4.1 (continued)

REQUIREMENTS valve is also allowed to be in the nonaccident position provided it can be aligned to the accident position within the time assumed in the accident analysis. This is acceptable since the RHR suppression pool cooling mode is manually initiated. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.2.4.2 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.2 .

2. Final Policy Statement on Technical Specifications Improvements,.

July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS/ B 3.6-68 Revision 1 I

Rev.2 Drywell Air Flow System

B 3.6 CONTAINMENT SYSTEMS B 3.6.3.2 B 3.6.3.2 Drywell Air Flow System BASES BACKGROUND The Drywell Cooling fans in low speed ensure a uniformly mixed post accident primary containment atmosphere (Ref. 1), thereby minimizing the potential for local hydrogen burns due to a pocket of hydrogen above the flammable concentration.

The Drywell Cooling fans are an Engineered Safety Feature and are designed to withstand a loss of coolant accident (LOCA) in post accident environments without loss of function. The system consists of three required pairs of fans with each pair consisting of two. independent fans.

The three required Drywell Cooling fan pairs are as follows:

a. Drywell Unit Cooler fans 2V414A/2V414B;

b. Drywell Unit Cooler fans 2V416A/21V416B;

c. Recirculation fan 2V418A/2V418B.

The fans are initiated manually since flammability limits would not be reached until several days after a LOCA. Each fan in a pair is powered from a separate emergency power supply. Since one fan in each pair can provide 100% of the mixing requirements, the system will provide its design function with a worst case single active failure.

APPLICABLE The Drywell Cooling fans provide the capability for reducing the local SAFETY hydrogen concentration to approximately the bulk average concentration ANALYSES following a Design Basis Accident (OBA). The limiting OBA relative to hydrogen generation is a LOCA.

Hydrogen may accumulate in primary containment following a LOCA as a result of:

a. A metal steam reaction between the zirconium fuel rod cladding and the reactor coolant; or (continued)

SUSQUEHANNA- UNIT 2 B 3.6-75 Revision O

Rev. 2 Drywell Air Flow System

B 3.6.3.2 BASES APPLICABLE b. Radiolytic decomposition of water in the Reactor Coolant System.

SAFETY ANALYSES To evaluate the potential for hydrogen accumulation in primary (continued) containment following a LOCA, the hydrogen generation as a function of time following the initiation of the accident is calculated. Conservative .

assumptions recommended by Reference 2 are used to maximize the amount of hydrogen calculated.

The Reference 3 calculations show that hydrogen assumed to be released to the drywell following a OBA LOCA raises drywell hydrogen concentration to over 2.5 volume percent (v/o) within 1.2 days. Although natural circulation phenomena reduces the gradient concentration differences in containment, a containment mixing system provides further means of preventing local hydrogen gas buildups in containment post-accident.

The Drywell Cooling fans satisfy Criterion 3 of the NRC Policy Statement.

(Ref. 4)

LCO Three required Drywall Cooling fan pairs must be OPERABLE in low speed to ensure operation of at least one fan in each of the required pairs in the event of a worst case single active failure. The three required Drywell Cooling fan pairs are as follows:

a. Drywell Unit Cooler fans 2V414A/2V414B;

b. Drywell Unit Cooler fans 2V416A/2V416B;

c. Recirculation fan 2V418A/2V418B.

Operation with at least one fan in each required pair provides the capability of controlling the bulk hydrogen concentration in primary containment without exceeding the flammability limit.

APPLICABILITY In MODES 1 and. 2, the three Drywall Cooling fan pairs ensure the capability to prevent localized hydrogen concentrations (continued)

SUSQUEHANNA - UNIT 2 B 3.6-76 Revision O

Rev.2 Drywell Air Flow System

BASES B 3.6.3.2 APPLICABILITY above the flammability limit of 4.0 v/o in drywell, assuming a worst case (continued) single active failure.

In MODE 3, both the hydrogen production rate and the total hydrogen produced after a LOCA would be less than that calculated for the OBA LOCA. Also, because of the limited time in this MODE, the probability of an accident requiring the Drywell Cooling fans is low. Therefore, the Drywell Cooling fans are not required in MODE 3.

In MODES 4 and 5, the probability and consequences of a LOCA are reduced due to the pressure and temperature limitations in these MODES.

Therefore, the Drywell Cooling fans are not required in these MODES.

ACTIONS With one required Drywell Cooling fan in one or more pairs inoperable, the inoperable fan must be restored to OPERABLE status within 30 days. In this Condition, th~ remaining OPERABLE fan is adequate to perform the hydrogen mixing function. However, the overall reliability is reduced because a single failure in the OPERABLE fan could result in reduced hydrogen mixing capability. The 30 day Completion Time is based on the availability of the second fan, the low probability of the occurrence of a LOCA that would generate hydrogen in amounts capable of exceeding the flammability limit, the amount of time available after the event for operator action to prevent exceeding this limit, and the availability of the Primary Containment Hydrogen Recombiner System.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.6-77 Revision 1

Rev. 2 Drywell Air Flow System

B 3.6.3.2 BASES ACTIONS B.1 and B. 2 (continued)

With two required Drywell Cooling fans .in one or more pairs inoperable, the ability to perform the hydrogen control function via alternate capabilities must be verified by administrative means within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The alternate hydrogen control capabilities are provided by the containment nitrogen purge system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time allows a reasonable period of time to verify that a loss of hydrogen control function does not exist. In addition, the alternate hydrogen control system capability must be verified once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter to ensure its continued availability. Both the initial verification and all subsequent verifications may be performed as an administrative check by examining logs or other information to determine the availability of the alternate hydrogen control system. It does not mean to perform the Surveillances needed to demonstrate OPERABILITY of the alternate hydrogen control system. If the ability to perform the hydrogen control function is maintained, continued operation is permitted with two Drywell Cooling fans in one or more pairs inoperable for up to 7 days. Seven days is a reasonable time to allow two Drywell Cooling fans in one or more pairs to be inoperable because the hydrogen control function is maintained and because of the low probability of the occurrence of a LOCA that would generate hydrogen in amounts capable of exceeding the flammability limit.

If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS SR 3 *6 *3 *2 *1 Operating each required Drywell Cooling fan in low speed from the control room for z 15 minutes ensures that each (continued)

SUSQUEHANNA - UNIT 2 B 3.6-78 Revision 0

Rev. 2 Drywell Air Flow System

B 3.6.3.2 BASES SURVEILLANCE SR 3.6.3.2.1 (continued)

REQUIREMENTS subsystem is OPERABLE and that all associated controls are functioning properly. Since required fans are operated at high speed during normal operations this SR ensures the low speed motor circuits operate. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES .1. FSAR 9.4.5

2. Regulatory Guide 1. 7, Revision 1.

3. FSAR, Section 6.2.5.

4. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.6-79 Revision 1 I

Rev. 2 Primary Containment Oxygen Concentration

B 3.6 B 3.6.3.3 CONTAINMENT SYSTEMS Primary Containment Oxygen Concentration B 3.6.3.3 BASES BACKGROUND All nuclear reactors must be designed to withstand events that generate hydrogen either due to the zirconium metal water reaction in the core or due to radiolysis. The primary method to control hydrogen is to inert the primary containment. With the primary containment inert, that is, oxygen concentration< 4.0 volume percent (v/o), a combustible mixture cannot be present in the primary containment for any hydrogen concentration. The capability to inert the primary containment and maintain oxygen < 4.0 v/o works together with the Hydrogen Recombiner System and the Drywell Air Flow System (LCO 3.6.3.2, "Drywell Air Flow System") to provide redundant and diverse methods to mitigate events that produce hydrogen.

For example, an event that rapidly generates hydrogen from zirconium metal water reaction will result in excessive hydrogen in primary containment, but oxygen concentration will remain < 4.0 v/o and no combustion can occur. Long term generation of both hydrogen and oxygen from radiolytic decomposition of water may eventually result in a combustible mixture in primary containment, except that the hydrogen recombiners remove hydrogen and oxygen gases faster than they can be produced from radiolysis and again no combustion can occur. This LCO ensures that oxygen concentration does not exceed 4.0 v/o during operation in the applicable conditions.

APPLICABLE The Reference 1 calculations assume that the primary containment is SAFETY inerted when a Design Basis Accident loss of coolant accident occurs.

ANALYSES Thus, the hydrogen assumed to be released to the primary containment as a result of metal water reaction in the reactor core will not produce combustible gas mixtures in the primary containment. Oxygen, which is subsequently generated by radiolytic decomposition of water, is recombined by the hydrogen recombiners more rapidly than_ it is produced.

Primary containment oxygen concentration satisfies Criterion 2 of the NRC Policy Statement. (Ref. 2)

SUSQUEHANNA - UNIT 2 TS/ B 3.6-80 (continued)

.Revision 1

Rev. 2 Primary Containment Oxygen Concentration

BASES (continued)

B 3.6.3.3 LCO The primary containment oxygen concentration is maintained< 4.0 v/o to ensure that an event that produces any amount of hydrogen does not result in a combustible mixture inside primary containment.

APPLICABILITY The primary containment oxygen concentration must be within the specified limit when primary containment is inerted, except as allowed by the relaxations during startup and shutdown addressed below. The primary containment must be inert in MODE 1, since this is the condition with the highest probability of an event that could produce hydrogen.

lnerting the primary containment is an operational problem because it prevents containment access without an appropriate breathing apparatus.

Therefore, the primary containment is inerted as late as possible in the plant startup and de-inerted as soon as possible in the plant shutdown.

As long as reactor power is< 15% RTP, the potential for an event that generates significant hydrogen is low and the primary containment need not be inert. Furthermore, the probability of an event that generates hydrogen occurring within the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of a startup, or within the last 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months before a shutdown, is low enough that these "windows," when the primary containment is not inerted, are also justified. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months time period is a reasonable amount of time to allow plant personnel to perform inerting or de-inerting.

ACTIONS If oxygen concentration is ~ 4.0 v/o at any time while operating in MODE 1, with the exception of the relaxations allowed during startup and shutdown, oxygen concentration must be restored to < 4.0 v/o within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is allowed when oxygen concentration is ; : : 4.0 v/o because of the availability of other hydrogen mitigating systems (e.g., hydrogen recombiners) and the low probability and long duration of an event that would generate significant amounts of hydrogen occurring during this period .

SUSQUEHANNA - UNIT 2 TS I B 3.6-81 (continued)

Revision 0

_J

Rev. 2 Primary Containment Oxygen Concentration

BASES B 3.6.3.3 ACTIONS B.1 (continued)

If oxygen concentration cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, power must be reduced to :::;; 15% RTP within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable, based on operating experience, to reduce reactor power from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS SR 3 *6*3 *3 *1 The primary containment must be determined to be inert by verifying that oxygen concentration is < 4.0 v/o. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.2.5 .

2. Final Policy Statement on Technical Specifications Improvements July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS/ 3.6-82 Revision 1

Rev. 13 Secondary Containment

B 3.6 B 3.6.4.1 CONTAINMENT SYSTEMS Secondary Containment B 3.6.4.1 BASES BACKGROUND The secondary containment structure completely encloses the primary containment structure such that a dual-containment design is utilized to limit the spread of radioactivity to the environment to within limits. The function of the secondary containment is to contain, dilute, and hold up fission products that may leak from primary containment into secondary containment following a Design Basis Accident (OBA). In conjunction with operation of the Standby Gas Treatment (SGT) System and closure of certain valves whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be OPERABLE, or that take place outside primary containment (Ref. 1).

The secondary containment is a structure that completely encloses the primary containment and reactor coolant pressure boundary components .

This structure forms a control volume that serves to hold up and dilute the fission products. It is possible for the pressure in the control volume to rise relative to the environmental pressure (e.g., due to pump and motor heat load additions).

The secondary containment boundary consists of the reactor building structure and associated removable walls and panels, hatches, doors, dampers, sealed penetrations and valves. Certain plant piping systems (e.g., Service Water, RHR Service Water, Emergency Service Water, Feedwater, etc.) penetrate the secondary containment boundary. The intact piping within secondary containment provides a passive barrier which maintains secondary containment requirements. Breaches of these piping systems within secondary containment will be controlled to maintain secondary containment requirements. The secondary containment is divided into Zone I, Zone II and Zone Ill, each of which must be OPERABLE depending on plant status and the alignment of the secondary containment boundary. Specifically, the Unit 1 secondary containment boundary can be modified to exclude Zone II. Similarly, the Unit2 secondary containment boundary can be modified to exclude Zone I. Secondary containment may consist of only Zone Ill when in MODE 4 or 5 during CORE ALTERATIONS, or during handling of irradiated fuel within the Zone Ill secondary containment boundary .

SUSQUEHANNA- UNIT 2 TS I B 3.6-83 (continued)

Revision 4

__J

Rev.13 Secondary Containment

BASES BACKGROUND (continued)

B 3.6.4.1 To prevent ground level exfiltration while allowing the secondary containment to be designed as a conventional structure, the secondary containment requires support systems to maintain the control volume pressure at less than the external pressure. Requirements for the safety related systems are specified separately in LCO 3.6.4.2, "Secondary Containment Isolation Valves (SCIVs)," and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System."

When one or more zones are excluded from secondary cor.itainment, the specific requirements for support systems will also change (e.g., required secondary containment isolation valves).

APPLICABLE There are two principal accidents for which credit is taken for secondary SAFETY containment OPERABILITY. These are a loss of coolant accident (LOCA)

ANALYSES (Ref. 2) and a fuel handling accident inside secondary containment (Ref. 3).

The secondary containment performs no active function in response to either of these limiting events; however, its leak tightness is required to ensure that the release of radioactive materials from the primary containment is restricted to those leakage paths and associated leakage rates assumed in the accident analysis and that fission products entrapped within the secondary containment structure will be treated by the SGT System prior to discharge to the environment.

Secondary containment satisfies Criterion 3 of the NRC Policy Statement (Ref. 4).

LCO An OPERABLE secondary containment provides a control volume into which fission products that bypass or leak from primary containment, or are released from the reactor coolant pressure boundary components located in secondary containment, can be diluted and processed prior to release to the environment. For the secondary containment to be considered OPERABLE, it must have adequate leak tightness to ensure that the required vacuum can be established and maintained. The leak tightness of secondary containment must also ensure that the release of radioactive materials to the e*nvironment is restricted to those leakage paths and associated leakage rates assumed in the accident analysis. For example, secondary containment bypass leakage must be restricted to the leakage rate required by LCO 3.6.1.3. The secondary containment boundary required to be OPERABLE is dependent on the operating status of both units, as well as the configuration of walls, doors, hatches, SCIVs, and available flow paths to the SGT System .

SUSQUEHANNA - UNIT 2 TS I B 3.6-84 (continued)

Revision 2

Rev. 13 Secondary Containment

BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a LOCA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, B 3.6.4.1 secondary containment OPERABILITY is required during the same operating conditions that require primary containment OPERABILITY.

In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES.

Therefore, maintaining secondary containment OPERABLE is not required in MODE 4 or 5 to ensure a control volume, except for other situations for which significant releases of radioactive material can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs),

during CORE ALTERATIONS, or during movement of irradiated fuel assemblies in the secondary containment ACTIONS If secondary containment is inoperable, it must be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring secondary containment OPERABILITY) occurring during periods where secondary containment is inoperable is minimal.

A temporary (one-time) Completion Time is connected to the Completion Time Requirements above (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) with an "OR" connector. The Temporary Completion Time is 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months and applies to the replacement of the Reactor Building Recirculating Fan Damper Motors. The Temporary Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months may only be used once, and expires on December 31, 2005.

B.1 and B.2 If secondary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems .

SUSQUEHANNA - UNIT 2 TS I B 3.6-85 (continued)

Revision 4

Rev. 13 Secondary Containment

BASES ACTIONS (continued)

C.1, C.2, and C.3 B 3.6.4.1 Movement of irradiated fuel assemblies in the secondary containment, CORE ALTERATIONS, and OPDRVs can be postulated to cause fission product release to the secondary containment. In such cases, the secondary containment is the only barrier to release of fission products to the environment. CORE ALTERATIONS and movement of irradiated fuel assemblies must be immediately suspended if the secondary containment is inoperable.

Suspension of these activities shall not preclude completing an action that involves moving a component to a safe position. Also, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release.

Actions must continue until OPDRVs are su$pended.

Required Action C.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.6.4.1.1 REQUIREMENTS This SR ensures that the secondary containment boundary is sufficiently leak tight to preclude exfiltration under expected wind conditions. Expected wind conditions are defined as sustained wind speeds of less than or equal to 16 mph at the 60m meteorological tower or less than or equal to 11 mph at the 1Om meteorological tower if the 60m tower wind speed is not available.

Changes in indicated reactor building differential pressure observed during periods of short-term wind speed gusts above these sustained speeds do not by themselves impact secondary containment integrity. However, if secondary containment integrity is known to be compromised, the LCO must be entered regardless of wind speed .

SUSQUEHANNA - UNIT 2 TS I B 3.6-86 (continued)

Revision 2

Rev. 13 Secondary Containment

BASES SURVEILLANCE REQUIREMENTS SR 3.6.4.1.1 (continued)

B 3.6.4.1 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.4.1.2 and SR 3.6.4.1.3 Verifying that secondary containment equipment hatches, removable walls and one access door in each access opening required to be closed are closed ensures that the infiltration of outside air of such a magnitude as to prevent maintaining the desired negative pressure does not occur.

Verifying that all such openings are closed also provides adequate assurance that exfiltration from the secondary containment will not occur.

In this application, the term "sealed" has no connotation of leak tightness.

An access opening typically contains one inner and one outer door.

Maintaining secondary containment OPERABILITY requires verifying one door in each access opening to secondary containment zones is closed .

In some cases (e.g., railroad bay), secondary containment access openings are shared such that a secondary containment barrier may have multiple inner or multiple outer doors. The intent is to maintain the secondary containment barrier intact, which is achieved by maintaining the inner or outer portion of the barrier closed at all times. However, all secondary containment access doors are normally kept closed, except when the access opening is being used for entry and exit or when maintenance is being p'erformed on an access opening.

When the railroad bay door (No. 101) is closed; all Zone I and Ill hatches, removable walls, dampers, and one door in each access opening connected to the railroad access bay are closed; or, only Zone I removable walls and/or doors are open to the railroad access shaft; or, only Zone Ill hatches and/or dampers are open to the railroad access shaft. When the railroad bay door (No. 101) is open; all Zone I and Ill hatches, removable walls, dampers, and one door in each access opening connected to the railroad access bay are closed. The truck bay hatch is closed and the truck bay door (No. 102) is closed unless Zone II is isolated from Zones I and Ill.

SUSQUEHANNA - UNIT 2 TS I B 3.6-87 (continued)

Revision 3

Rev.13 Secondary Containment

BASES SURVEILLANCE REQUIREMENTS SR 3:6.4.1.2 and SR 3.6.4.1.3 (continued)

B 3.6.4.1 When an access opening between required secondary containment zones is being used for exit and entry, then at least one door (where two doors are provided) must remain closed. The access openings between secondary containment zones which are not provided with two doors are administratively controlled to maintain secondary containment integrity during exit and entry. This Surveillance is modified by a Note that allows access openings with a single door (i.e., no airlock) within the secondary containment boundary (i.e., between required secondary containment zones) to be opened for entry and exit. Opening of an access door for entry and exit allows sufficient administrative control by individual personnel making the entries and exits to assure the secondary containment function is not degraded. When one of the zones is not a zone required for secondary containment OPERABILITY, the Note allowance would not apply.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I 8 3.6-87a (continued)

Revision 4

Rev. 13 Secondary Containment

BASES SURVEILLANCE REQUIREMENTS SR 3.6.4.1.4 and SR 3.6.4.1.5 B 3.6.4.1 (continued) The SGT System exhausts the secondary containment atmosphere to the environment through appropriate treatment equipment. To ensure that all fission products are treated, SR 3.6.4.1.4 verifies that the SGT System will rapidly establish and maintain a pressure in the secondary containment that is less than the pressure external to the secondary containment boundary.

This is confirmed by demonstrating that one SGT subsystem will draw down the secondary containment to 2".: 0.25 inches of vacuum water gauge in less than or equal to the maximum time allowed. This cannot be accomplished if the secondary containment boundary is not intact. SR 3.6.4.1.5 demonstrates that one SGT subsystem can maintain ~ 0.25 inches of vacuum water gauge for at least 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months at less than or equal to the maximum flow rate pennitted for the secondary containment configuration that is operable. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months test period allows secondary containment to be in thennal equilibrium at steady state conditions. As noted, both SR 3.6.4.1.4 and SR 3.6.4.1.5 acceptance limits are dependent upon the secondary containment configuration when testing is being performed. The acceptance criteria for the SRs based on secondary containment configuration is defined as follows:

SECONDARY CONTAINMENT TEST CONFIGURATION Group 1 MAXIMUM DRAWDOWN TIME(SEC)

(SR 3.6.4.1.4 ACCEPTANCE CRITERIA)

MAXIMUM FLOW RATE (CFM)

(SR 3.6.4.1.5 ACCEPTANCE CRITERIA)

Zones I, II and Ill (Unit 1 s 300 Seconds s5400 CFM Railroad Bay aligned to (Zones!, II, and Ill) (From Zones I, 11, and Ill)

Secondary Containment).

Zones II and Ill (Unit 1 s 300 Seconds s 4000 CFM Railroad Bay aligned to (Zones fl and Ill) (From Zones If and Ill)

Zone Ill).

Group 2 Zones I, II and Ill (Unit 1 s 300 Seconds s5300 CFM Railroad Bay not aligned to (Zones I, II, and Ill) (From Zones I, II, and Ill)

Secondary Containment).

Zones II and Ill (Unit 1 s 300 Seconds s3900 CFM Railroad Bay not aligned to (Zones II and 111) (From Zones II and Ill)

Secondary Containment).

Only one of the above listed configurations needs to be tested to confinn secondary containment OPERABILITY.

SUSQUEHANNA - UNIT 2 TS I B 3.6-88 (continued)

Revision 6

Rev. 13 Secondary Containment

BASES SURVEILLANCE REQUIREMENTS SR 3.6.4.1.4 and SR 3.6.4.1.5 (continued)

B 3.6.4.1 A Note also modifies the Frequency for each SR. This Note identifies that each configuration is to be tested every 60 months. Testing each configuration every 60 months assures that the most limiting configuration is tested every 60 months. The 60 month Frequency is acceptable because operating experience has shown that these components usually pass the Surveillance and all active components are tested more frequently.

Therefore, these tests are used to ensure secondary containment boundary integrity.

The secondary containment testing configurations are discussed in further detail to ensure the appropriate configurations are tested. Three zone testing (Zones, I, II and Ill aligned to the recirculation plenum) should be performed with the Railroad Bay aligned to secondary containment and another test with the Railroad Bay not aligned to secondary containment.

Each test should be performed with each division on a STAGGERED TEST BASIS.

Two zone testing (Zones II and Ill aligned to the recirculation plenum) should be performed with the Railroad Bay aligned to secondary containment and another test with the Railroad Bay not aligned to secondary containment.

Each test should be performed with each division on a STAGGERED TEST BASIS. The normal operating fans of the non-tested HVAC zone (Zone I fans 1V202A&B, 1V205A&B and 1V206A&B) should not be in operation.

Additionally, a controlled opening of adequate size should be maintained in Zone I Secondary Containment during testing to assure that atmospheric conditions are maintained in that zone.

The Unit 1 Railroad Bay can be aligned as a No Zone (isolated from secondary containment) or as part of secondary containment (Zone I or Ill).

Due to the different leakage pathways that exist in the Railroad Bay, the Railroad Bay should be tested when aligned to secondary containment and also not aligned to secondary containment. It is preferred to align the Railroad Bay to Zone Ill when testing with the Railroad Bay aligned to secondary containment since Zone 111 *is included in all possible secondary containment isolation alignments. Note that when performing the three zone testing (Zones I, II and Ill aligned to the recirculation plenum) aligning the Railroad Bay to either Zone I or Ill is acceptable since either zone is part of secondary containment. When performing the Zone II & Ill testing with the Railroad Bay aligned to secondary containment, the Unit 1 Railroad Bay must be aligned to Zone Ill.

SUSQUEHANNA - UNIT 2 TS I B 3.6-89 (continued)

Revision 4

Rev. 13 Secondary Containment

BASES SURVEILLANCE REQUIREMENTS SR 3.6.4.1.4 and SR 3.6.4.1.5 (continued) 8 3.6.4.1 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.2.3.

2. FSAR, Section 15.6.

3. FSAR, Section 15.7.4.

4. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.6-89a (continued)

Revision 1

Rev. 11 SC IVs B 3.6.4.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.2 Secondary Containment Isolation Valves (SCIVs)

BASES BACKGROUND The function of the SCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Ref. 1). Secondary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that fission products that leak from primary containment into secondary containment following a DBA, or that are released during certain operations when primary containment is not required to be OPERABLE or take place outside primary containment, are maintained within the secondary containment boundary.

The OPERABILITY requirements for SCIVs help ensure that an adequate secondary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. These isolation devices consist of either passive devices or active (automatic) devices. Manual valves or dampers, de-activated automatic valves or dampers secured in

their closed position (including check valves with flow through the valve secured), and blind flanges are considered passive devices.

Automatic SCIVs close on a secondary containment isolation signal to establish a boundary for untreated radioactive material within secondary containment following a DBA or other accidents.

Other non-sealed penetrations which cross a secondary containment boundary are isolated by the use of valves in the closed position or blind flanges.

APPLICABLE The SCIVs must be OPERABLE to ensure the secondary containment SAFETY barrier to fission product releases is established. The principal accidents for ANALYSES which the secondary containment boundary is required are a loss of coolant accident (Ref. 1) and a fuel handling accident inside secondary containment (Ref. 2). The secondary containment performs no active function in response to either of these limiting events, but the boundary (continued)

SUSQUEHANNA- UNIT 2 TS I B 3.6-90 Revision 3

Rev. 11 SCI Vs

BASES APPLICABLE SAFETY B 3.6.4.2 established by SCIVs is required to ensure that leakage from the primary containment is processed by the Standby Gas Treatment (SGT) System ANALYSES before being released to the environment.

(continued)

Maintaining SCIVs OPERABLE with isolation times within limits ensures that fission products will remain trapped inside secondary containment so that they can be treated by the SGT System prior to discharge to the environment.

SCIVs satisfy Criterion 3 of the.NRC Policy Statement (Ref. 3).

LCO SCIVs that form a part of the secondary containment boundary are required to be OPERABLE. Depending on the configuration of the secondary containment only specific SCIVs are required. The SCIV safety function is related to control of offsite radiation releases resulting from DBAs.

The automatic isolation valves are considered OPERABLE when their isolation times are within limits and the valves actuate on an automatic isolation signal. The valves covered by this LCO, along with their associated stroke times, are listed in Table B 3.6.4.2-1.

The normally closed isolation valves or blind flanges are considered OPERABLE when manual valves are closed or open in accordance with appropriate administrative controls, automatic SCIVs are deactivated and secured in their closed position, or blind flanges are in place. These passive isolation valves or devices are listed in Table 83.6.4.2-2. Penetrations closed with sealants are considered part of the secondary containment boundary and are not considered penetration flow paths.

Certain plant piping systems (e.g., Service Water, RHR Service Water, Emergency Service Water, Feedwater, etc.) penetrate the secondary containment boundary. The intact piping within secondary containment provides a passive barrier which maintains secondary containment requirements. When the SOHR and temporary chiller system piping is connected and full of water, the piping forms the secondary containment .

boundary and the passive devices in TS Bases Table 83.6.4.2-2 are no longer required for these systems since the piping forms the barrier. During certain plant evolutions, piping systems may be drained and breached within secondary containment. During the pipe breach, system isolation valves can be used to provide secondary containment isolation. The isolation valve alignment will be controlled when the piping system is

breached.

SUSQUEHANNA - UNIT 2 TS I B 3.6-91 (continued)

Revision 3

Rev. 11 SC IVs

BASES (continued)

APPLICABILITY B 3.6.4.2 In MODES 1, 2, and 3, a OBA could lead to a fission product release to the primary containment that leaks to the secondary containment. Therefore, the OPERABILITY of SCIVs is required.

In MODES 4 and 5, the probability and consequences of these events are reduced due to pressure and temperature limitations in these MODES.

Therefore, maintaining SCIVs OPERABLE is not required in MODE 4 or 5, except for other situations under which significant radioactive releases can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs), during CORE ALTERATIONS, or during movement of irradiated fuel assemblies in the secondary containment.

Moving irradiated fuel assemblies in the secondary containment may also occur in MODES 1, 2, and 3.

ACTIONS The ACTIONS are modified by three Notes. The first Note allows penetration flow paths to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated.

The second Note provides clarification that for the purpose of this LCO separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SCIV. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SCIVs are governed by subsequent Condition entry and application of associated Required Actions.

The third Note ensures appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable SCIV.

A.1 and A:2 In the event that there are one or more required penetration flow paths with one required SCIV inoperable, the affected penetration flow path(s) must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and de-activated automatic SCIV, a closed manual valve, and a blind flange. For penetrations isolated in

SUSQUEHANNA - UNIT 2 TS I B 3.6-92 (continued)

Revision 2

I I

Rev. 11 SC IVs

BASES ACTIONS A.1 and A.2 (continued)

B 3.6.4.2 accordance with Required Action A.1, the device used to isolate the penetration should be the closest available device to secondary containment. The Required Action must be completed within the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time. The specified time period is reasonable considering the time required to isolate the penetration, and the probability of a OBA, which requires the SCIVs to close, occurring during this short time is very low.

For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that secondary containment penetrations required to be isolated following an accident, but

no longer capable of being automatically isolated, will be in the isolation position should an event occur. The Completion Time of once per 31 days is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low. This Required Action does not require any testing or device manipulation. Rather, it involves verification that the affected penetration remains isolated.

Condition A is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two SCIVs. For penetration flow paths with one SCIV, Condition C provides the appropriate Required Actions.

Required Action A.2 is modified by a Note that applies to devices located in high radiation areas and allows them to be verified closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted.

Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.

With two SCIVs in one or more penetration flow paths inoperable, the affected penetration flow path must be isolated within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The method of isolation must

SUSQUEHANNA - UNIT 2 TS I B 3.6-93 (continued)

Revision 1

Rev. 11 SC IVs

BASES ACTIONS 8.1 (continued)

B 3.6.4.2 include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable considering the time required to isolate the penetration and the probability of a OBA, which requires the SCIVs to close, occurring during this short time, is very low.

The Condition has been modified by a Note stating that Condition B is only applicable to penetration flow paths with two isolation valves. For penetration flow paths with one SCIV, Condition C provides the appropriate Required Actions.

C.1 and C.2 With one or more required penetration flow paths with one required SCIV inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. Required Action C.1 must be completed within.the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time. The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable considering the relative stability of the system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting secondary containment OPERABILITY during MODES 1, 2, and 3.

In the event the affected penetration flow path is isolated in accordance with Required Action C.1, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that secondary containment penetrations required to be isolated following an accident are isolated.

The Completion Time of once per 31 days for verifying each affected penetration is isolated is appropriate because the

SUSQUEHANNA - UNIT 2 TS I 8 3.6-94 (continued)

Revision 1

Rev. 11 SC IVs

BASES ACTIONS C.1 and C.2 (continued)

B 3.6.4.2 valves are operated under administrative controls and the probability of their misalignment is low.

Condition C is modified by a Note indicating that this Condition is only applicable to penetration flow paths with only one SCIV. For penetration flow paths with two SCIVs, Conditions A and B provide the appropriate Required Actions.

Required Action C.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and allows them to. be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted.

Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is low.

D.1 and 0.2 If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.1. E.2. and E.3 If any Required Action and associated Completion Time are not met, the plant must be placed in a condition in which the LCO does not apply. If applicable, CORE ALTERATIONS and the movement of irradiated fuel assemblies in the secondary containment must be immediately suspended.

Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be immediately initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

SUSQUEHANNA - UNIT 2 TS I B 3.6-95 (continued)

Revision 1

Rev. 11

SC IVs

BASES ACTIONS E.1, E.2, and E.3 (continued)

B 3.6.4.2 Required Action E.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving fuel while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.

Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.6.4.2.1 REQUIREMENTS This SR verifies that each secondary containment manual isolation valve and blind flange that is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the secondary containment boundary is within design limits. This SR does not require any testing or valve manipulation.

Rather, it involves verification (typically visual) that those required SCIVs in secondary containment that are capable of being mispositioned are in the correct position.

The Surveillance Frequency is controlled under the Surveillance Frequency' Control Program.

Two Notes have been added to this SR. The first Note applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification ~y administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these SCIVs, once they have been verified to be in the proper position, is low.

A second Note has been included to clarify that SCIVs that are open under administrative controls are not required to meet the SR during the time the SCIVs are open.

SUSQUEHANNA - UNIT 2 TS I B 3.6-96 (continued)

Revision 3

Rev. 11 SC IVs B 3.6.4.2 BASES SURVEILLANCE SR 3.6.4.2.2 REQUIREMENTS (continued) SCIVs with maximum isolation times specified in Table B 3.6.2.4-1 are tested to verify that the isolation time is within limits to demonstrate OPERABILITY. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Automatic SCIVs without maximum isolation times specified in Table B 3.6.4.2-1 are tested under the requirements of SR 3.6.4.2.3. The isolation time test ensures that the SCIV will isolate in a time period less than or equal to that assumed in the

. safety analyses.

SR 3.6.4.2.3 Verifying that each automatic required SCIV closes on a secondary containment isolation signal is required to prevent leakage of radioactive material from secondary containment following a OBA or other accidents.

This SR ensures that each automatic SCIV will actuate to the isolation position on a secondary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.2.5 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.2.

2. FSAR, Section 15.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA- UNIT 2 TS I B 3.6-97 Revision 2

Rev. 11 SC IVs

Table B 3.6.4.2-1 Secondary Containment Ventilation System Automatic Isolation Dampers (Page 1 of 1)

B 3.6.4.2 Maximum Reactor Valve Number Valve Description Type of Valve Isolation Building Time Zone (Seconds)

I HD-17586 A&B Supply System Dampers Automatic Isolation Damper 10.0 I HD-17524 A&B Filtered Exhaust System Dampers Automatic Isolation Damper 10.0 I HD-17576A&B Unfiltered

.... _ Exhaust System Automatic Isolation Damper 10.0 II HD-27586 A&B Supply System Dampers Automatic Isolation Damper 10.0 II HD-27524 A&B Filtered Exhaust System Dampers Automatic Isolation Damper 10.0 II HD-27576 A&B Unfiltered Exhaust System Automatic Isolation Damper 10.0 Ill HD-17564 A&B Supply System Dampers Automatic Isolation Damper 14.0 Ill HD-17514 A&B Filtered Exhaust System Dampers Automatic Isolation Damper 6.5 Unfiltered Exhaust System Ill HD-17502 A&B Automatic Isolation Damper 6.0 Ill HD-27564 A&B Supply System Dampers Automatic Isolation Damper 14.0 Ill HD-27514 A&B Filtered Exhaust System Dampers Automatic Isolation Damper 6.5 Ill HD-27502 A&B Unfiltered Exhaust System Automatic Isolation Damper 6.0 NIA HD-17534A Zone 3 Airlock 1-606 Automatic Isolation Damper NIA NIA HD-175348 Zone 3 Airlock 1-611 Automatic Isolation Damper NIA NIA HD-17534D Zone 3 Airlock 1-803 Automatic Isolation Damper NIA NIA HD-17534E Zone 3 Airlock 1-805 Automatic Isolation Damper NIA NIA HD-17534F Zone 3 Airlock 1-617 Autamatic Isolation Damper NIA NIA HD-17534H Zone 3 Airlock 1-618 Automatic Isolation Damper NIA NIA HD-27534A Zone 3 Airlock 11-606 Automatic Isolation Damper NIA NIA HD-275340 Zone 3 Airlock 11-803 Automatic Isolation Damper NIA NIA HD-27534E Zone 3 Airlock 11-805 Automatic Isolation Damper NIA NIA HD-27534G Zone 3 Airlock C-806 Automatic Isolation Damper NIA NIA HD-27534H Zone 3Airlock11-618 Automatic Isolation Damper N/A N/A HD-275341 Zone 3 Airlock 11-609 Automatic Isolation Damper N/A

SUSQUEHANNA- UNIT 2 TS I B 3.6-98 Revision 2

Rev. 11 SC IVs

Table B 3.6.4.2-2 Secondary Containment Ventilation System Passive Isolation Valves or Devices (Page 1 of 4)

B 3.6.4.2 Device Number Device Description Area/Elev. Required Position I Notes X-29-2-44 SOHR Svstem to Fuel Pool Coolina Yard/670 Blind Flanaed I Note 1 X-29-2-45 SOHR System to Fuel Pool CoolinQ Yard/670 Blind Flanged I Note 1 110176 SOHR Supply Drain Viv 29/670 Closed Manual lso Valve I Note 1 110186 SOHR Discharge Drain Viv 29/670 Closed Manual lso Valve I Note 1 110180 SOHR Supply Vent Viv 291749 Closed Manual lso Valve I Note 1 110181 SOHR Discharae Fill Viv 271749 Closed Manual lso Valve I Note 1 110182 SOHR Discharqe Vent Viv 271749 Closed Manual lso Valve I Note 1 110187 SOHR Supply Fill Viv 291749 Closed Manual lso Valve I Note 1 210186 SOHR Supply Drain Viv 331749 Closed Manual lso Valve I Note 1 210187 SOHR Supolv Vent Viv 331749 Closed Manual lso Valve I Note 1 210191 SOHR Discharge Vent Viv 301749 Closed Manual lso Valve I Note 1 210192 SOHR Discharqe Drain Viv 301749 Closed Manual lso Valve I Note 1 210193 SOHR Discharae Vent Viv 331749 Closed Manual lso Valve I Note 1 X-29-2-46 Temporary Chiller to RBCW Yard/670 Blind Flanged I Note 2 X-29-2-47 Temoorarv Chiller to RBCW Yard/670 Blind Flanqed I Note 2 X-29-5-95 Temporary Chiller to Unit 1 RBCW 291749 Blind Flanged I Note 2 X-29-5-96 Temporarv Chiller to Unit 1 RBCW 291749 Blind FlanQed I Note 2 X-29-5-91 Temoorarv Chiller to Unit 2 RBCW 33/749 Blind Flanaed I Note 2 X-29-5-92 Temporary Chiller to Unit 2 RBCW 331749 Blind FlanQed I Note 2 187388 RBCW Temo Chiller Discharae lso Viv 29/670 Closed Manual lso Valve I Note 2 187389 RBCW Temp Chiller Supply Isa Viv 29/670 Closed Manual lso Valve I Note 2 187390 RBCW Temp Chiller SUPPIV Drain Viv 29/670 Closed Manual lso Valve I Note 2 187391 RBCW Temp Chiller DischarQe Drain Viv 29/670 Closed Manual lso Valve I Note 2 X-28-2-3000 Utilitv Penetration to Unit 1 East Stairwell Yard/670 Blind FlanQed I Note 3 X-29-2-48 Utility Penetration to Unit 1 RR Bay Yard/670 Caooed I Note 5 X-33-2-3000 Utility Penetration to Unit 2 East Stairwell Yard/670 Blind Flanged I Note 4 X-28-2-3000 Utilitv Penetration to Unit 1 East Stairwell 28/670 Blind Flanaed I Note 3 X-29-2-48 Utility Penetration to Unit 1 RR Bay 29/670 Capped I Note 5 X-33-2-3000 Utilitv Penetration to Unit 2 East Stairwell 33/670 Blind Flanaed I Note 4 X-29-3-54 Utility Penetration to Unit 1 RBCCW HxArea 27/683 Blind Flanged I Note 6 X-29-3-55 Utilitv Penetration to Unit 1 RBCCW Hx Area 27/683 Blind Flanaed I Note 6 Utility Penetration from Unit 1 RR Bay to Unit 2 X-29-5-97 33/749 Capped Elev. 749

X-27-6-92 Instrument Tubing Stubs 27ITT9' Capped X-29-7-4 1* Spare Conduit Threaded Plue 29/818' Installed X-30-6-72 Instrument Tubing Stubs 30ITT9' Ca coed X-30-6-1002 Stairwell #214 Rupture Disc 30ITT9' Installed Intact X-30-6-1003 Airlock 11-609 Ruoture Disc 30ITT9' Installed Intact X-25-6-1008 Airlock 1-606 Rupture Disc 25ITT9' Installed Intact X-29-4-01-B Penetration at Door 4330 291719' Blind FlanQe Installed X-29-4-01 -A Penetration at Door 4330 291719' Blind Flanae Installed X-29-4-01-B Penetration at Door 404 33/719' Blind Flanae Installed X-29-4-01-A Penetration at Door 404 331719' Blind Flange Installed

SUSQUEHANNA - UNIT 2 TS I 8 3.6-99 Revision 8

Rev. 11 SC IVs

Table B 3.6.4.2-2 Secondary Containment Ventilation System Passive Isolation Valves or Devices (Page 2 of 4)

B 3.6.4.2 Device Number Device Description Area/Elev. Required Position I Notes HD17534C Airlock 1-707 Blind Flani:ie 281799' Blind Flani:ie Installed HD27534C Airlock 11-707 Blind Flanae 33/799' Blind Flanae Installed XD-17513 Isolation damper for Railroad Bay Zone Ill HVAC 291799' Position is dependent on Railroad Suoolv Bav alii:inment XD-17514 Isolation damper for Railroad Bay Zone Ill HVAC 291719' Position is dependent on Railroad Exhaust Bav alianment XD-12301 PASS Air Flow Damper 111729' Closed Damper XD-22301 PASS Air Flow Damper 221729' Closed Damper 161827 HPCI Blowout Steam Vent Drain Valve 25/645' Closed Manual Iso Valve I Note 3 161828 RCIC Blowout Steam Vent Drain Valve 28/645' Closed Manual lso Valve I Note 3 161829 'A' RHR Blowout Steam Vent Drain Valve 29/645' Closed Manual lso Valve I Note 3 161830 'B' RHR Blowout Steam Vent Drain Valve 28/645' Closed Manual lso Valve I Note 3 261820 RCIC Blowout Steam Vent Drain Valve 33/645' Closed Manual lso Valve I Note 4 261821 'A' RHR Blowout Steam Vent Drain Valve 34/645' Closed Manual Iso Valve I Note 4 261822 'B' RHR Blowout Steam Vent Drain Valve 33/645' Closed Manual lso Valve I Note 4 2LRW1810L Zone Ill Floor Drain 34-818 Pluaaed I Note 7 2LRWl810M Zone Ill Floor Drain 34-818 Plugaed I Note 7 2LRWl810N Zone 111 Floor Drain 34-818 Plui:iaed I Note 7 2LRWl810R Zone Ill Floor Drain 34-818 Pluaaed I Note 7 2LRWl810S Zone Ill Floor Drain 34-818 Plugged I Note 7 2LRWl703A Zone Floor Drain 34-799 Pluaaed I Note 7 2LRWI615A Zone Floor Drain 34-779 Plugged I Note 7 2LRWl100A Zone Floor Drain 34-670 Plugaed I Note 7 2LRWl100B Zone Floor Drain 34-670 Pluaaed I Note 7 2LRWl100C Zone Floor Drain 34-670 Plugaed I Note 7 2LRWl100D Zone Floor Drain 34-670 Pluaaed I Note 7 2LRWl100E Zone Floor Drain 34-670 Plui:iged I Note 7 2LRWl100F Zone Floor Drain 34-670 Pluaaed I Note 7 2LRWl100G Zone II Floor Drain 34-670 Plugged I Note 7

SUSQUEHANNA - UNIT 2 TS I B 3.6-99a Revision 6

Rev. 11 SCI Vs

Table B 3.6.4.2-2 Secondary Containment Ventilation System Passive Isolation Valves or Devices (Page 3 of 4)

B 3.6.4.2 Device Number Device Description Area/Elev. Required Position I Notes 1LRWl810U Zone Ill Floor Drain 29-818 Plugged I Note 7 1LRWl1810V Zone Ill Floor Drain 29-818 Plugged I Note 7 1LRWl1810W Zone Ill Floor Drain 29-818 Pluaaed I Note 7 1LRWl810X Zone-Ill Floor Drain 29-818 Pluaaed I Note 7 1LRWl810Y Zone Ill Floor Drain 29-818 Pluaaed I Note 7 1LRWl810Z Zone Ill Floor Drain 29-818 Pluaaed I Note 7 1LRWl810FF Zone Ill Floor Drain 29-818 Plugged I Note 7 1LRWl810GG Zone Ill Floor Drain 29-818 Plugaed I Note 7 1LRWl810HH Zone Ill Floor Drain 29-818 Plugged I Note 7 1LRWl810JJ Zone Ill Floor Drain 29-818 Pluaaed I Note 7 1LRWl810KK Zone Ill Floor Drain 29-818 Pluaaed I Note 7 1LRWl615A Zone I, Zone Ill, or No Zone Floor Drain 29-779 Pluaaed I Note 7 1LRWl100A Zone I, Zone Ill or No Zone Floor Drain 29-670 Plugaed I Note 7 1LRWl100B Zone I, Zone Ill, or No Zone Floor Drain 29-670 PluaQed I Note 7 1LRWl100C Zone I, Zone Ill, or No Zone Floor Drain 29-670 Pluaaed I Note 7 1LRWl100D Zone I, Zone Ill, or No Zone Floor Drain 29-670 Plugged I Note 7 1LRWl100E Zone I, Zone Ill, or No Zone Floor Drain 29-670 Pluaaed I Note 7 1LRWl100F Zone I, Zone Ill, or No Zone Floor Drain 29-670 Plunoed I Note 7 1LRWl100G Zone I, Zone Ill, or No Zone Floor Drain 29-670 Plurmed I Note 7

SUSQUEHANNA - UNIT 2 TS I B 3.6-99b Revision 4

Rev. 11 SC IVs

Table 8 3.6.4.2-2 Secondary Containment Ventilation System Passive Isolation Valves or Devices B 3.6.4.2 (Page 4 of 4)

Note 1: The two blind flanges on the SOHR penetrations (blind flanges for device number X-29-2-44 and X-29-2-45) and all the closed manual valves for the SOHR system (110176, 110186, 110180, 110181, 110182, 110187, 210186, 210187, 210191, 210192, 210193) can each be considered as a separate secondary containment isolation device for the SD HR penetrations. If one or both of the blind flanges is removed and all the above identified manual valves for the SOHR system are closed, the appropriate LCO should be entered for one inoperable SCIV in a penetration flow path with two SC IVs. With the blind flange removed, the manual valves could be opened intermittently under administrative controls per the Technical Specification Note. When both SOHR blind flanges are installed, opening of the manual valves for the SOHR system will be controlled to prevent cross connecting ventilation zones. When the manual valves for the SOHR system are open in this condition, the appropriate LCO should be entered for one inoperable SCIV in a penetration flow path with two SC IVs. When the SOHR system piping is connected and full of water, the piping forms the secondary containment boundary and the above listed SCIVs in Table B3.6.4.2-2 are no longer required for this system since the piping forms the barrier.

Note 2: Due to the multiple alignments of the RBCW temporary chiller, different devices will perform the SCIV function depending on the RBCW configuration. There are three devices/equipment that can perform the SCIV function for the RBCW temporary chiller supply penetration. The first SCIV for the RBCW temporary chiller supply penetration is the installed blind flange on penetration X-29-2-47. The second SCIV for the RBCW temporary chiller supply penetration is isolation valve 187389. The third SCIV for the temporary RBCW chiller supply penetration is closed drain valve 187390 and an installed blind flange on penetrations X-29-5-92 and/or X-29-5-96. Since there are effectively three SCIVs, any two can be used to define the SCIV for the penetration. Removal of one of the two required SC IVs requires entry into the appropriate LCO for one inoperable SCIV in a penetration flow path with two SCIVs. Opening of drain valve 187390 and operation of blank flanges X-29-5-96 and X-29-5-92 will be controlled to prevent cross connecting ventilation zones. These three SCIVs prevent air inleakage into secondary containment. The isolation of the penetration per the Technical Specification requirement is to assure that one of the above SC IVs is closed so that there is no air inleakage into secondary containment.

There are three devices/equipment that can perform the SCIV function for the RBCW temporary chiller return penetration. The first SCIV for the RBCW temporary chiller return penetration is the installed blind flange on penetration X-29-2-46. The second SCIV for the RBCW temporary chiller return penetration is isolation valve 187388. The third SCIV for the temporary RBCW chiller return penetration is closed drain valve 187391 and an installed blind flange on penetrations X-29-5-91 and/or X-29-5-95. Since there are effectively three SCIVs, any two can be used to define the SCIV for the penetration. Removal of one of the two required SC IVs requires entry into the appropriate LCO for one inoperable SCIV in a penetration flow path with two SC IVs. Opening of drain valve 187391 and operation of blank flanges X-29-5-91 and X-29-5-95 will be controlled to prevent cross connecting ventilation zones. These three SCIVs prevent air inleakage into secondary containment. The isolation of the penetration per the Technical Specification requirement is to assure that one of the above SCIVs is closed so that there is no air inleakage into secondary containment.

When the RBCW temporary chiller piping is connected and full of water, the piping inside secondary containment forms the secondary containment boundary and the above listed SCIVs in Table 83.6.4.2-2 are no longer required for this system.

Note 3: These penetrations connect Secondary Containment Zone I to a No-Zone. When Secondary Containment Zone I is isolated from the recirculation plenum, the above listed SCIVs in Table B3.6.4.2-2 are no longer required.

Note 4: These penetrations connect Secondary Containment Zone II to a No-Zone. When Secondary Containment Zone II is isolated from the recirculation plenum, the above listed SCIVs in Table B3.6.4.2-2 are no longer required.

Note 5: These penetrations connect the Railroad Bay to a No-Zone. When the Railroad Bay is a No-Zone, the above listed SCIVs in Table B3.6.4.2-2 are no longer required.

Note 6: These penetrations connect Secondary Containment Zone I to the Railroad Bay. The above listed SC IVs in Table B3.6.4.2-2 are not required if the Railroad Bay is a No-Zone and Zone I is isolated from the recirculation plenum OR if the Railroad Bay is aligned to Zone I.

Note 7: Due to drain header containing multiple floor drains in different ventilation zones, drain plugs were installed in all of the drain header floor drains. To provide the passive Secondary Containment boundary, only drain plugs in one ventilation zone are required to be installed. *

SUSQUEHANNA - UNIT 2 TS I B 3.6-99c Revision O

Rev. 5 SGT System

B 3.6

B 3.6.4.3 CONTAINMENT SYSTEMS Standby Gas Treatment (SGT) System B 3.6.4.3 BASES BACKGROUND The SGT System is required by 1 O CFR 50, Appendix A, GDC 41, "Containment Atmosphere Cleanup" (Ref. 1). The safety function of the SGT System is to ensure that radioactive materials that leak from the primary containment into the secondary containment following a Design Basis Accident (OBA) are filtered and adsorbed prior to exhausting to the environment.

The SGT System consists of two redundant subsystems, each with its own set of dampers, filter train, and a reactor building recirculation fan and associated dampers and controls.

Each filter train consists of (components listed in order of the direction of the air flow):

a . A demister;

b. An electric heater;

c. A prefilter;

d. A high efficiency particulate air (HEPA) filter;

e. A charcoal adsorber;

f. A second HEPA filter; and

g. A centrifugal fan.

The sizing of the SGT System equipment and components is based on handling an incoming air mixture at a maximum of 125°F. The internal pressure of the secondary containment is maintained at a negative pressure of 0.25 inches water gauge when the system is in operation.

Maintenance of a negative pressure precludes direct outleakage.

The demister is provided to remove entrained water in the air, while the electric heater reduces the_ relative humidity of the airstream to less than 70% (Ref. 2). The prefilter removes large particulate matter, while the HEPA filter

SUSQUEHANNA - UNIT 2 TS I B 3.6-100 (continued)

Revision 1

Rev.5 SGT System

BASES B 3.6.

4.3 BACKGROUND

removes fine particulate matter and protects the charcoal from fouling.

(continued) The charcoal adsorber removes gaseous elemental iodine and organic iodides, and the final HEPA filter collects any carbon fines exhausted from the charcoal adsorber.

The SGT System automatically starts and operates in response to actuation signals indicative of conditions or an accident that could require operation of the system. Following initiation in each division, the associated filter train fan starts. Upon verification that both subsystems are operating, the redundant subsystem may be shut down.

The SGT System also contains a cooling function to remove heat generated by fission product decay on the HEPA filters and charcoal adsorbers during shutdown of an SGT subsystem. The cooling function consists of two separate and independent filter cooling modes per SGT subsystem. The two cooling modes are:

1) Outside air damper and the filter cooling bypass damper open, allowing outside air to flow through the shutdown SGT subsystem's filter train and exit via the opposite SGT subsytem's exhaust fan.

2) Outside air damper opens and the SGT exhaust fan of the shutdown SGT subsystem starts. This configurations draws outside air through the shutdown SGT subsystem's filter train and exits via the associated SGT subsystem's exhaust fan.

APPLICABLE The design basis for the SGT System is to mitigate the.consequences of a SAFETY loss of coolant accident and fuel handling accidents (Ref. 2). For all ANALYSES events analyzed, the SGT System is shown to be automatically initiated to reduce, via filtration and adsorption, the radioactive material released to the environment.

The SGT System satisfies Criterion 3 of the NRG.Policy Statement (Ref. 3).

LCO Following a OBA, a minimum of one SGT subsystem is required to maintain the secondary containment at a negative pressure with respect to the environment and to process gaseous releases. Meeting the LCO requirements for two OPERABLE subsystems ensures operation of at least

SUSQUEHANNA - UNIT 2 TS I B 3.6-101 (continued)

Revision 1

Rev. 5 SGT System

BASES B 3.6.4.3 LCO one SGT subsystem in the event of a single active failure. A SGT (continued) subsystem is considered OPERABLE when it has an OPERABLE set of dampers, filter train, one reactor building recirculation fan and associated dampers, and associated controls, including instrumentation. (The reactor building recirculation fans and associated dampers are not dedicated to either SGT subsystem. As a result, when any one reactor building recirculation division is not OPERABLE, one arbitrarily determined SGT subsystem is not operable. This interpretation only applies if both divisions of Secondary Containment Isolation logic are operable). This includes the components required for at least one of the two SGTS filter cooling modes.

APPLICABILITY In MODES 1, 2, and 3, a OBA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, SGT System OPERABILITY is required during these MODES.

In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES .

Therefore, maintaining the SGT System in OPERABLE status is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs), during CORE ALTERATIONS, or during movement of irradiated fuel assemblies in the secondary containment.

ACTIONS With one SGT subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status in 7 days. In this Condition, the remaining OPERABLE SGT subsystem is adequate to perform the required radioactivity release control function. However, the overall system reliability is reduced because a single failure in the OPERABLE subsystem could result in the radioactivity release control function not being adequately performed. The 7 day Completion Time is based on consideration of such factors as the availability of the OPERABLE redundant SGT System and the low probability of a DBA occurring during this period.

SUSQUEHANNA - UNIT 2 TS I B 3.6-102 (continued)

Revision 2

Rev.5 SGT System

BASES B 3.6.4.3 ACTIONS B.1 and B.2 (continued If the SGT subsystem cannot be restored to OPERABLE status within the required Completion Time in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1, C.2.1, C.2.2, and C.2.3 During movement of irradiated fuel assemblies., in the secondary containment, during CORE ALTERATIONS, or during OPDRVs, when Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE SGT filter train should immediately be placed in operation. This action ensures that the remaining filter train is OPERABLE, that no failures that could prevent automatic actuation have occurred, and that any other failure would be readily detected.

An alternative to Required Action C.1 is to immediately suspend activities that represent a potential for releasing radioactive material to the secondary containment, thus placing the plant in a condition that minimizes risk. If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies must immediately be suspended .. Susp~nsion of these activities must not preclude completion of movement of a component to a safe position. Also, if applicable, actions must immediately be initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

The Required Actions of Condition C have been.modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action.

If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

SUSQUEHANNA - UNIT 2 TS I B 3.6-103 (continued)

Revision 2

Rev.5 SGT System

BASES B 3.6.4.3 ACTIONS D.1 (continued)

If both SGT subsystems are inoperable in MODE 1, 2, or 3, the SGT system may not be capable of supporting the required radioactivity release control function. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining the SGT System contribution to secondary containment during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring SGT OPERABILITY) occurring during periods where SGT is inoperable is minimal.

A temporary (one-time) Completion Time is connected to the Completion Time Requirements above (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) with an "OR" connector. The Temporary Completion Time is 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months and applies to the replacement of the Reactor Building Recirculating Fan Damper Motors. The Temporary Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months may only be used once, and expires on December 31, 2005.

E.1 and E.2 If at least one SGT subsystem cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

F.1, F.2, and F.3 When two SGT subsystems are inoperable, if applicable, CORE ALTERA TIONS and movement of irradiated fuel assemblies in secondary containment must immediately be suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must immediately be initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended .

SUSQUEHANNA- UNIT 2 TS I B 3.6-104 (continued)

Revision 3

Rev.5 SGT System

BASES (continued)

B 3.6.4.3 ACTIONS F.1. F.2. and F.3 (continued)

Required Action F. 1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require* a reactor shutdown.

SURVEILLANCE SR 3.6.4.3.1 REQUIREMENTS Operating each SGT filter train for;;::: 10 continuous hours ensures that both filter train are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. Oper~tion with the heaters on (automatic heater cycling to maintain temperature) for;;::: 10 continuous hours every 31 days eliminates moisture on the adsorbers and HEPA filters. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.4.3.2 This SR verifies that the required SGT filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). Specific test frequencies and additional information are discussed in detail in the VFTP.

SR 3.6.4. 3.3 This SR verifies that each SGT subsystem starts on receipt of an actual or simulated initiation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SUSQUEHANNA - UNIT 2 TS I B 3.6-105 (continued)

Revision 3

Rev.5 SGT System

BASES SURVEILLANCE SR 3.6.4.3.4 B 3.6.4.3 REQUIREMENTS (continued) This SR verifies that both cooling modes for each SGT subsystem are available. Although both cooling modes are tested, only one cooling mode for each SGT subsystem is required for an SGT subsystem to be considered OPERABLE. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 41.

2. FSAR, Section 6.5.1

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132).

4. Regulatory Guide 1.52, Rev. 1.

SUSQUEHANNA - UNIT 2 TS I B 3.6-106 Revision 4

Rev.6 RHRSW System and UHS

B 3.7 B 3.7.1 PLANT SYSTEMS Residual Heat Removal Service Water (RHRSW) System and the Ultimate Heat Sink (UHS) 83.7.1 BASES BACKGROUND The RHRSW System is designed to provide cooling water for the Residual Heat Removal (RHR) System heat exchangers, required for a safe reactor shutdown following a Design Basis Accident (OBA) or transient. The RHRSW System is operated whenever the RHR heat exchangers are required to operate in the shutdown cooling mode or in the suppression pool cooling or spray mode of the RHR System.

The RHRSW System consists of two independent and redundant subsystems. Each subsystem is made up of a header, one pump, a suction source, valves, piping, heat exchanger, and associated instrumentation. Either of the tvvo subsystems is capable of providing the required cooling capacity to maintain safe shutdown conditions. The two subsystems are separated so that failure of one subsystem will not affect the OPERABILITY of the other subsystem. One Unit 1 RHRSW subsystem and the associated (same division) Unit 2 RHRSW subsystem constitute a single RHRSW loop. The two RHRSW pumps in a loop can each, independently, be aligned to either Unit's heat exchanger. The RHRSW System is designed with sufficient redundancy so that no single active component failure can prevent it from achieving its design function.

The RHRSW System is described in the FSAR, Section 9.2.6, Reference 1.

Cooling water is pumped by the RHRSW pumps from the UHS through the tube side of the RHR heat exchangers. After removing heat from the RHRSW heat exchanger, the water is discharged to the spray pond (UHS) by way of the UHS return loops. The UHS return loops direct the return flow to a network of sprays that dissipate the heat to the atmosphere or directly to the UHS via a bypass header.

The system is initiated manually from the control room except for the

spray array bypass manual valves that are operated locally in the event of a failure of the spray array bypass valves. The system can be started any time the LOCA signal is manually overridden or clears.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.7-1 Revision 3

Rev. 6 RHRSW System and UHS

BASES BACKGROUND (continued)

The ultimate heat sink (UHS) system is composed of approximately 3,300,000 cubic foot spray pond and associated piping and spray risers.

Each UHS return loop contains a bypass line, a large spray array and a B 3.7.1 small spray array. The purpose of the UHS is to provide both a suction source of water and a return path for the RHRSW and ESW systems.

The function of the UHS is to provide water to the RHRSW and ESW systems at a temperature less than the 97°F design temperature of the RHRSW and ESW systems. UHS temperature is maintained less than the design temperature by introducing the hot return fluid from the RHRSW and ESW systems into the spray loops and relying on spray cooling to maintain temperature. The UHS is designed to supply the RHRSW and ESW systems with all the cooling capacity required during a combination LOCA/LOOP for thirty days without fluid addition. The UHS is described in the FSAR, Section 9.2.7 (Reference 1).

APPLICABLE The RHRSW System removes heat from the suppression pool to limit the SAFETY suppression pool temperature and primary containment pressure following ANALYSES a LOCA. This ensures that the primary containment can perform its function of limiting the release of radioactive materials to the environment following a LOCA. The ability of the RHRSW System to support long term cooling of the reactor or primary containment is discussed in the FSAR, Chapters 6 and 15 (Refs. 2 and 3, respectively). These.analyses_ explicitly assume that the RHRSW System will provide adequate cooling support to the equipment required for safe shutdown. These analyses include the evaluation of the long term primary containment response after a design basis LOCA.

The safety analyses for long term cooling were performed for various RHRSW and UHS configurations combinations of RHR System failures.

As discussed in the FSAR, Section 6.2.2 (Ref. 2) for these analyses, manual initiation of the OPERABLE RHRSW subsystem and the associated RHR System is required. The maximum suppression chamber water temperature and pressure are analyzed to be below the design temperature of 220°F and maximum allowable pressure of 53 psig.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.7-2 Revision 4

Rev.6 RHRSW System and UHS

BASES APPLICABLE SAFETY ANALYSES The UHS design takes into account the cooling efficiency of the spray arrays and the evaporation losses during design basis environmental B 3.7.1 conditions. The spray array bypass header provides the flow path for the (continued) ESW and RHRSW system to keep the spray array headers from freezing.

The small and/or large spray arrays are placed in service to dissipate heat returning from the plant. The UHS return header is comprised of the spray array bypass header, the large spray array, and the small spray array.

The spray array bypass header is capable of passing full flow from the RHRSVV and ESVV systems in each loop. The large spray array is capable of passing full flow from the RHRSW and ESW systems in each loop. The small spray array supports heat dissipation when low system flows are required.

The RHRSW System, together with the UHS, satisfy Criterion 3 of the NRC Policy St~tement. (Ref. 4)

LCO Two RHRSW subsystems are required to be OPERABLE to provide the required redundancy to ensure that the system functions to remove post accident heat loads, assuming the worst case single active failure occurs

coincident with the loss of offsite power.

An RHRSW subsystem is considered OPERABLE when:

a. One pump is OPERABLE; and

b. An OPERABLE flow path is capable of taking suction from the UHS and transferring the water to the RHR heat exchanger and returning it to the UHS at the assumed flow rate, and

c. An.OPERABLE UHS.

The OPERABILITY of the UHS is based on having a minimum water level at the overflow weir of 678 feet 1 inch above mean sea level and a maximum water temperature of 85°F; unless either unit is in MODE 3. If a unit enters MODE 3, the time of entrance into this condition determines the appropriate maximum ultimate heat sink fluid temperature. If the earliest unit to enter MODE 3 has been in that condition for less than twelve (12) hours, the peak temperature to maintain OPERABILITY of the ultimate heat sink remains at 85°F. If either unit has been in MODE 3 for more than twelve .(12) hours but less than twenty-four (24) hours, the OPERABILITY temperature of the ultimate heat sink becomes 87°F. If either unit has been in MODE 3 for twenty-four (24) hours or more, the OPERABILITY temperature of the ultimate heat sink becomes 88°F.

SUSQUEHANNA- UNIT 2 TS I B 3.7-3 (continued)

Revision 3

Rev. 6 RHRSW System and UHS

BASES LCO (continued)

In addition, the OPERABILITY of the UHS is based on having sufficient spray capacity in the UHS return loops. Sufficient spray capacity is B 3.7.1 defined as one large and one small spray array in one loop.

This OPERABILITY definition is supported by analysis and evaluations performed in accordance with the guidance given in Regulatory Guide 1.27.

APPLICABILITY In MODES 1, 2, and 3, the RHRSW System and the UHS are required to be OPERABLE to support the OPERABILITY of the RHR System for primary containment cooling (LCO 3.6.2.3, "Residual Heat Removal (RHR)

Suppression Pool Cooling," and LCO 3.6.2.4, "Residual Heat Removal (RHR) Suppression Pool Spray") and decay heat removal (LCO 3.4.8, "Residual Heat Removal (RHR) Shutdown Cooling System-Hot Shutdown"). The Applicability is therefore consistent with the requirements of these systems.

In MODES 4 and 5, the OPERABILITY requirements of the RHRSW System are determined by the RHR shutdown cooling subsystem(s) it supports (LCO 3.4.9, "Residual Heat Removal (RHR) Shutdown Cooling System - Cold Shutdown"; LCO 3.9.7, "Residual Heat Removal (RHR) -

High Water Level"; and LCO 3.9.8, "Residual Heat Removal (RHR) - Low Water Level").

In MODES 4 and 5, the OPERABILITY requirements of the UHS is determined by the systems it supports.

ACTIONS The ACTIONS are modified by a Note indicating that the applicable Conditions of LCO 3.4.8, be entered and Required Actions taken if the inoperable RHRSW subsystem results in inoperable RHR shutdown cooling (SDC) (i.e., both the Unit 1 and Unit 2 RHRSW pumps in a loop are inoperable resulting in the associated RHR SDC system being inoperable). This is an exception to LCO 3.0.6 because the Required Actions of LCO 3. 7.1 do not adequately compensate for the loss of RHR SDC Function (LCO 3.4.8).

Condition A is modified by a separate note to allow separate Condition entry for each valve. This is acceptable since the Required Action for this Condition provide appropriate compensatory actions.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.7-4 Revision 3

Rev.6 RHRSVV System and UHS

BASES ACTIONS (continued)

A.1. A.2 and A.3 With one spray loop bypass valve not capable of being closed on B 3.7.1 demand, the associated Unit 1 and Unit 2 RHRSW subsystems cannot use the spray cooling function of the affected UHS return loop. As a result, the associated RHRSW subsystem must be declared inoperable.

With one spray loop bypass valve not capable of being opened on demand, a return flow path is not available. As a result, the associated RHRSW subsystems must be declared inoperable.

With one spray array bypass manual valve not capable of being closed, the associated Unit 1 and Unit 2 RHRSW subsystems cannot use the spray cooling function of the affected UHS return path if the spray array bypass valve fails to close. As a result, the associated RHRSW subsystems must be declared inoperable.

With one spray array bypass manual valve not open, a return flow path is not available. As a result, the associated RHRSW subsystems must be declared inoperable.

With one large spray array valve not capable of being opened on demand, the associated Unit 1 and Unit 2 RHRSW subsystems cannot use the full required spray cooling capability of the affected UHS return path. With one large spray array valve not capable of being closed on demand, the associated Unit 1 and Unit 2 RHRSW subsystems cannot use the small spray array when loop flows are low as the required spray nozzle pressure is not achievable for the small spray array. As a result, the associated RHRSW subsystems must be declared inoperable.

With one small spray array valve not capable of being opened on demand, the associated Unit 1 and Unit 2 RHRSW subsystems cannot use the spray cooling function of the affected UHS return path for low loop flow rates. For a single failure of the large spray array valve in the closed positio_n, design bases LOCNLOOP calculations assume that flow is reduced on the affected loop within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months after the event to allow use of the small spray array. With one small spray array valve not capable of being closed on demand, the associated Unit 1 and Unit 2 RHRSW subsystems cannot use the large spray array for a flow path as the required nozzle pressure is not achievable for the large spray array. As a result, the associated RHRSW subsystems must be declared inoperable.

SUSQUEHANNA - UNIT 2 TS I B 3.7-5 (continued)

Revision 3

Rev. 6 RHRSW System and UHS

BASES ACTIONS A.1. A.2 and A.3 (continued)

B 3.7.1 With any UHS return path valve listed in Tables 3.7.1-1, 3.7.1-2, or 3.7.1-3 inoperable, the UHS return path is no longer single failure proof.

.For combinations of inoperable valves in the same loop, the UHS spray capacity needed to support the OPERABILITY of the associated Unit 1 and Unit 2 RHRSW subsystems is affected. As a result, the associated RHRSW subsystems must be declared inoperable.

The 8-hour completion time to establish the flow path provides sufficient time to open a path and de-energize the appropriate valve in the open position.

The 72-hour completion time is based on the fact that, although adequate UHS spray loop capability exists during this time period, both units are affected and an additional single failure results in a system configuration that will not meet design basis accident requirements.

The Completion Time has been extended to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months in order to complete the modifications in Unit 1 associated with the Multiple Fire-Induced Spurious Operations issue. This is a temporary extension of the Completion Time and is applicable during the 1A201 and 1A202 bus modifications. In order to cope with the consequences of a LOOP, a LOCA in Unit 2 and the shutdown of Unit 1 during the extended Completion Time, the following compensatory actions are required: 1) the affected loop's spray array bypass valves are in the open position and 2) the affected loop's spray array valves are closed. Upon completion of the MSO modifications on all four Unit 1 4.16 kV buses, this temporary extension is no longer applicable and will expire on May 31, 2012.

If an additional RHRSW subsystem on either Unit is inoperable, cooling capacity less than the minimum required for response to a design basis event would exist. Therefore, an 8-hour Completion Time is appropriate.

The 8-hour Completion Time provides sufficient time to restore inoperable equipment and there is a low probability that a design basis event would occur during this period.

Required Action B.1 is intended to ensure that appropriate actions are taken if one Unit 2 RHRSW subsystem is inoperable. Although designated and operated as a unitized system, the associated Unit 1 subsystem is directly connected to a common header which can supply the associated RHR heat

SUSQUEHANNA - UNIT 2 TS I B 3.7-Sa (continued)

Revision 2

Rev.6 RHRSW System and UHS

BASES ACTIONS B.1 (continued)

B 3.7.1 exchanger in either unit. The associated Unit 1 subsystem is considered capable of supporting the associated Unit 2 RHRSW subsystem when the Unit 1 subsystem is OPERABLE and can provide the assumed flow to the Unit 2 heat exchanger. A Completion time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , when the associated Unit 1 RHRSW subsystem is not capable of supporting the associated Unit 2 RHRSW subsystem, is allowed to restore the Unit 2 RHRSW subsystem to OPERABLE status. In this configuration, the remaining OPERABLE Unit 2 RHRSW subsystem is adequate to perform the RHRSW heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE RH RSW subsystem could result in loss of RHRSW function. The Completion Time is based on the redundant RHRSW capabilities afforded by the OPERABLE subsystem and the low probability of an event occurring requiring RHRSW during this period.

The Completion Time to restore the Unit 2 RHRSW subsystem as been extended to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months in order to complete the modifications in Unit 1 associated with the Multiple Fire-Induced Spurious Operations issue. This is a temporary extension of the Completion Time and is applicable during the 1A201 and 1A202 bus modifications. The Unit 2 RHRSW subsystem

remains functional since the subsystem has an operable pump, operable flow path and an operable UHS. Upon completion of the MSO modifications on all four Unit 1 4.16 kV buses, this temporary extension is no longer applicable and will expire on May 31, 2012.

With one RHRSW subsystem inoperable, and the respective Unit 1 RHRSW subsystem capable of supporting the respective Unit 2 RHRSW subsystem, the design basis cooling capacity for both units can still be maintained even considering a single active failure. However, the configuration does reduce the overall reliability of the RHRSW System.

Therefore, provided the associated Unit 1 subsystem remains capable of supporting its respective Unit 2 RHRSW subsystem, the inoperable RHRSW subsystem must be restored to OPERABLE status within 7 days.

The 7-day Completion Time is based on the remaining RHRSW System heat removal capability.

Required Action C.1 is intended to ensure that appropriate actions are taken if both Unit 2 RHRSW subsystems are inoperable. Although designated and operated as a unitized system, the associated Unit 1 subsystem is directly connected to a common header which can supply the associated RHR heat

SUSQUEHANNA- UNIT 2 TS I B 3.7-6 (continued)

Revision 4

Rev.6 RHRSW System and UHS

BASES ACTIONS C.1 (continued) exchanger in either unit. With both Unit 2 RHRSW subsystems B3.7.1 inoperable, the RHRSW system is still capable of performing its intended design function. However, the loss of an additional RHRSW subsystem on Unit 1 results in the cooling capacity to be less than the minimum required for response to a design basis event. Therefore, the 8-hour Completion Time is appropriate. The 8-hour Completion Time for restoring one RHRSW subsystem to OPERABLE status, is based on the Completion Times provided for the. RHR suppression pool spray function.

With both Unit 2 RHRSW subsystems inoperable, and both of the Unit 1 RHRSW subsystems capable of supporting their respective Unit 2 RHRSW subsystem, if no additional failures occur which impact the RHRSW System, the remaining OPERABLE Unit 1 subsystems and flow paths provide adequate heat removal capacity following a design basis .

LOCA. However, capability for this alignment is not assumed in long term containment response analysis and an additional single failure in the RHRSW System could reduce the system capacity below that assumed in the safety analysis.

Therefore, continued operation is permitted only for a limited time. One inoperable subsystem is required to be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time for restoring one inoperable RHRSW subsystem to OPERABLE status is based on the fact that the alternate loop is capable of providing the required cooling capability during this time period.

D.1 and D.2 If the RHRSW subsystems cannot be restored to OPERABLE status within the associated Completion Times, or the UHS is determined to be inoperable, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.1.1 REQUIREMENTS This SR verifies the water level to be sufficient for the proper operation of the RHRSW pumps (net positive suction head and pump vortexing are considered in determining this limit). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SUSQUEHANNA - UNIT 2 TS I B 3.7-6a (continued)

Revision 4

Rev. 6 RHRSW System and UHS

BASES SURVEILLANCE REQUIREMENTS SR 3.7.1.2 B 3.7.1 Verification of the UHS temperature, which is the arithmetical average of the UHS temperature near the surface, middle and bottom levels, ensures that the heat removal capability of the ESW and RHRSW Systems are within the assumptions of the OBA analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.1.3 Verifying the correct alignment for each manual, power operated, and automatic valve in each RHRSW subsystem flow path provides assurance that the proper flow paths will exist for RHRSW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position, and yet considered in the correct position, provided it can be realigned to its accident position. This is acceptable because the RHRSW System is a manually initiated system.

This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.1.4 The UHS spray array bypass valves are required to actuate to the closed position for the UHS to perform its design function. These valves receive an automatic signal to open upon emergency service water (ESW) or residual heat removal service water (RHRSW) system pump start and are required to be operated from the control room or the remote shutdown panel. A spray bypass valve is considered to be inoperable when it cannot be closed on

SUSQUEHANNA- UNIT 2 TS/ B 3.7-6b (continued)

Revision 3 L_

Rev.6 RHRSW System and UHS

BASES SURVEILLANCE REQUIREMENTS SR 3.7.1.4 (continued) demand. Failure of the spray bypass valve to close on demand puts the UHS B 3.7.1 at risk to exceed its design temperature. The failure of the spray bypass valve to open on demand makes one return path unavailable, and therefore the associated RHRSW subsystems must be declared inoperable. This SR .

demonstrates that the valves will move to their required positions when required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.1.5 The UHS return header large spray array valves are required to open in order for the UHS to perform its design function. These valves are manually actuated from either the control room or the remote shutdown panel, under station operating procedure, when the RHRSW system is required to remove energy from the reactor vessel or suppression pool. This SR demonstrates that the valves will move to their required positions when required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.1.6 The small spray array valves HV-01224A2and 82 are required to operate in order for the UHS to perform its design function. These valves are manually actuated from the control room or the remote shutdown panel, under station operating procedure, when the RHRSW system is required to remove energy from the reactor vessel or suppression pool. This SR demonstrates that the valves will move to their required positions when required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.1.7 The spray array bypass manual valves 012287A and Bare required to operate in the event of a failure of the spray array bypass valves to close in order for the UHS to perform its design function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 9.2.

2. FSAR, Chapter 6.

3. FSAR, Chapter 15.

4. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS/ B 3.7-6c Revision 4

Rev. 3 ESWSystem

B 3.7 B 3.7.2 PLANT SYSTEMS Emergency Service Water (ESW) System B 3.7.2 BASES BACKGROUND The ESW System is designed to provide cooling water for the removal of heat from equipment, such as the diesel generators (DGs), residual heat removal (RHR) pump coolers, and room coolers for Emergency Core Cooling System equipment, required for a safe reactor shutdown following a Design Basis Accident (OBA) or transient. Upon receipt of a loss of offsite power or loss of coolant accident (LOCA) signal, ESW pumps are automatically started after a time delay.

The ESW System consists of two independent and redundant subsystems. Each of the two ESW subsystems is made up of a header, two pumps, a suction source, valves, piping and associated instrumentation. The two subsystems are separated from each other so an active single.failure in one subsystem will not affect the OPERABILITY of the other subsystem. A continuous supply of water is provided to ESW from the Service Water System for the keepfifl system. This supply is not required for ESW operability.

Cooling water is pumped from the Ultimate Heat Sink (UHS) by the ESW pumps to the essential components through the two main headers. After removing heat from the components, the water is discharged to the spray pond (UHS) by way of a network of sprays that dissipate the heat to the atmosphere or direct!y to the UHS via a bypass header.

APPLICABLE Sufficient water inventory is available for all ESW System post LOCA SAFETY cooling requirements for a 30 day period with no additional makeup water ANALYSES source available. The ability of the ESW System to support long term cooling is assumed in evaluations of the equipment required for safe reactor shutdown presented in the FSAR, Chapters 4 anq 6 (Refs. 1 and 2, respectively).

The ability of the ESW System to provide adequate cooling to the identified safety equipment is an implicit assumption for the safety analyses evaluated in References 1 and 2. The ability to provide onsite emergency AC power is dependent on the ability of the ESW System to cool the DGs. The long term cooling capability of the RHR and core spray pumps is also dependent on .the cooling provided by the ESW System.

The ESW System satisfies Criterion 3 of the NRC Policy Statement. (Ref.

3)

(continued)

SUSQUEHANNA - UNIT 2 . TS I B 3.7-7 Revision 3

Rev. 3 ESWSystem

BASES LCO The ESW subsystems are independent of each other to the degree that B 3.7.2 each has separate controls, power supplies, and the operation of one does not depend on the other. In the event of a DBA, one subsystem of ESW is required to provide the minimum heat removal capability assumed in the safety analysis for the system to which it supplies cooling water. To ensure this requirement is met, two subsystems of ESW must be OPERABLE. At least one subsystem will operate, if the worst single active failure occurs coincident with the loss of offsite power.

A subsystem is considered OPERABLE when it has two OPERABLE pumps, and an OPERABLE flow path capable of taking suction from the UHS and transferring the water to the appropriate equipment and returning flow to the UHS. If individual loads are isolated, the affected components may be rendered inoperable, but it does not necessarily affect the OPERABILITY of the ESW System; Because each ESW subsystem supplies all four required DGs, an ESW subsystem is considered OPERABLE if it supplies at least three of the four DGs provided no single DG does not have an ESW subsystem capable of supplying flow .

An adequate suction source is not addressed in this LCO since the minimum net positive suction head of the ESW pumps is bounded by the Residual Heat Removal Service Water System requirements (LCO 3. 7 .1, "Residual Heat Removal System and Ultimate Heat Sink (UHS)").

The ESW return loop requirement, in terms of operable UHS return paths or UHS spray capacity, is also not addressed in this LCO. UHS operability, in terms of the return loop and spray capacity is addressed in

. the RHRSW/ UHS Technical Specification (LCO 3.7:1, "Residual Heat Removal Service Water System and Ultimate Heat Sink (UHS)).

APPLICABILITY In MODES 1, 2, and 3, the ESW System is required to be OPERABLE to support OPERABILITY of the equipment serviced by the ESW System.

Therefore, the ESW System is required to be OPERABLE in these MODES.

In MODES 4 and 5, the OPERABILITY requirements of the ESW System is determined by the systems it supports .

SUSQUEHANNA - UNIT 2 TS/ B 3.7-8 (continued)

Revision 2

Rev.3 ESWSystem

BASES (continued)

B 3.7.2 ACTIONS The ACTIONS are modified by a Note indicating that the applicable Conditions of LCO 3.8.1, be entered and Required Actions taken if the inoperable ESW subsystem results in inoperable DGs (i.e., the supply from both subsystems of ESW is secured tq the same DG). This is an exception to LCO 3.0.6 because the Required Actions of LCO 3.7.2 do not adequately compensate for the loss of a DG (LCO 3.8.1) due to loss of ESWflow.

With one ESW pump inoperable in each subsystem, both inoperable pumps must be restored to OPERABLE status within 7 days. With the unit in this condition, the remaining OPERABLE ESW pumps are adequate to perform the ESW heat removal function; however, the overall reliability is reduced because a single failure could result in loss of ESW function. The 7 day Completion Time is based on the remaining ESW heat removal capability and the low probability of an event occurring during this time period .

With one or both ESW subsystems not capable of supplying ESW flow to two or more DGs, the capability to supply ESW to at least three DGs from each ESW subsystem must be restored within 7 days. With the units in this condition, the remaining ESW flow to DGs is adequate to maintain the full capability of all DGs; however, the overall reliability is reduced because a single failure could result in loss of the multiple DGs. The 7 day Completion Time is based on the fact that all DGs remain capable of responding to an event occurring during this time period.

With one ESW subsystem inoperable for reasons other than Condition B, the ESW subsystem must be restored to OPERABLE status within 7 days.

With the unit in this condition, the remaining OPERABLE ESW subsystem is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE ESW subsystem could result in loss of ESW function.

(continued)

SUSQUEHANNA - UNIT 2 B 3.7-9 Revision 0

Rev. 3 ESWSystem

BASES B 3.7.2 ACTIONS C.1 (continued)

The 7 day Completion Time is based on the redundant ESW System capabilities afforded by the OPERABLE subsystem, the low probability of an accident occurring during this time period, and is consistent with the allowed Completion Time for restoring an inoperable Core Spray Loop, LPCI Pumps and Control Structure Chiller.

D.1 and D.2 If the ESW subsystem cannot be restored to OPERABLE status within the associated Completion Time, or both ESW subsystems are inoperable for reasons other than Condition A and B (i.e., three ESW pumps inoperable),

the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems .

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS Verifying the correct alignment for each manual, power operated, and automatic valve in each ESW subsystem flow path provides assurance that the proper flow paths will exist for ESW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position, and yet considered in the correct position, provided it can be automatically realigned to its accident position within the required time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

This SR is modified by a Note indicating that isolation of the ESW System to components or systems may render those (continued)

SUSQUEHANNA - UNIT 2 B 3.7-10 Revision 0

Rev.3 ESWSystem

BASES B 3.7.2 SURVEILLANCE SR 3.7.2.1 (continued)

REQUIREMENTS components or systems inoperable, but does not necessarily affect the OPERABILITY of the ESW System. As such, when all ESW pumps, valves, and piping are OPERABLE, but a branch connection off the main header is isolated, the ESW System is still OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.2.2 This SR verifies that the automatic valves of the ESW System will automatically switch to the safety or emergency position to provide cooling water exclusively to the safety related equipment during an accident event. This is demonstrated by the use of an actual or simulated initiation signal. This SR also verifies the automatic start capability of the ESW pumps in each subsystem .

REFERENCES The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

1. FSAR, Chapter 4.

2. FSAR, Chapter 6.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132)

SUSQUEHANNA- UNIT 2 TS I B 3.7-11 Revision 1 I

Rev. 2 CREOAS System

B 3. 7 PLANT SYSTEMS B 3.7.3 Control Room Emergency Outside Air Supply (CREOAS) System B 3.7.3 BASES BACKGROUND The CREOAS System provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals, or smoke. This radiologically controlled environment is termed the Control Room Envelope (CRE) and is comprised of Control Structure floor elevations 697'-0" through 783'-0" including the stairwells as described in FSAR Section 6.4 (Ref.

5).

The safety related function of the CREOAS System includes two independent and redundant high efficiency air filtration subsystems for emergency treatment of outside supply air and a CRE boundary that limits the inleakage of unfiltered air. Each CREOAS subsystem consists of an electric heater, a prefilter, an upstream high efficiency particulate c;1ir (HEPA) filter, an activated charcoal adsorber section, a downstream HEPA filter, a CREOAS fan, a control structure heating and ventilation fan, a control room floor cooling fan, a computer room floor cooling fan, and the associated ductwork, valves or dampers, doors, barriers, and instrumentation. Prefilters and HEPA filters remove particulate matter, which may be radioactive. The charcoal adsorbers provide a holdup period for gaseous iodine, allowing time for decay.

With the exception of the CREOAS fan, all other CREOAS subsystem fans operate continuously to maintain the affected compartments environment These other ventilation fans operate independently of the CREOAS fans and are required to operate to ensure a positive pressure in the control structure is maintained utilizing filtered outside air supplied by the CREOAS fans.

The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and

SUSQUEHANNA - UNIT 2 TS I B 3.7-12 (continued)

Revision 2

Rev. 2 CREOAS System

BASES BACKGROUND (continued) equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of B 3.7.3 unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (OBA) consequences to CRE occupants. The *CRE and its boundary are defined in the Control Room Envelope Habitability Program.

Upon receipt of the initiation signal(s) (indicative of conditions that could result in radiation exposure to CRE occupants), the CREOAS System automatically switches to the pressurization/filtration mode of operation to minimize infiltration of contaminated air into the CRE. A system of dampers aligns the outside air intake to the CREOAS fan suction and filter train. Outside air is taken in at the normal ventilation intake and passed through one of the charcoal adsorber filter subsystems. The filtered air leaving the CREOAS filtration train is routed to the inlet of the other ventilation fans for distribution.

One of the CREOAS System design requirements is to maintain a habitable environment in the CRE for a 30 day continuous occupancy after a OBA without exceeding 5 rem whole body dose or its equivalent

to any part of the body. A single CREOAS subsystem operating at a flow rate of:::= 5810 cfm with an intact CRE will pressurize the CRE (which includes the control room) to greater than or equal to 0.125 inches water gauge relative to external. areas adjacent to the CRE boundary to minimize infiltration of air from all surrounding areas adjacent to the CRE boundary. CREOAS System operation in maintaining CRE habitability is discussed in the FSAR, Chapters 6 and 9, (Refs. 1 and 2, respectively).

APPLICABLE The ability of the CREOAS System to maintain the habitability of the SAFETY ANALYSIS CRE is an explicit assumption for the safety analyses presented in the FSAR, Chapters 6 and 15 (Refs. 1 and 3, respectively). The pressurization/ filtration mode of the CREOAS System is assumed to operate following a OBA as discussed in the FSAR, Section 6.4.1 (Ref. 4). The radiological doses to the CRE occupants as a result of the various DBAs are summarized in-Reference 3. No single active failure will cause the loss of outside or recirculated air from the CRE.

SUSQUEHANNA - UNIT 2 TS I B 3.7-13 (continued)

Revision 2

Rev .. 2 CREOAS System

BASES APPLICABLE SAFETY The CREOAS System provides protection from smoke and hazardous chemicals to the CRE occupants. The analysis of hazardous chemical B 3.7.3 ANALYSES releases demonstrates that the toxicity limits are not exceeded in the (continued) CRE following a hazardous chemical release (Ref. 5). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the CRE occupants to control the reactor either from the control room or from the remote shutdown panels (Ref. 6).

The CREOAS System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two redundant subsystems of the CREOAS System are required to be OPERABLE to ensure that at least one is available, if a single active failure disables the other subsystem. Total CREOAS System failure, such as from a loss of both ventilations subsystems or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem whole body or equivalent to the CRE occupants in the event of a OBA.

Each CREOAS subsystem is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE. Both subsystems are considered OPERABLE_when:

a. Both filter trains each consisting of a CREOAS fan, heater, a HEPA filter, and charcoal adsorber which is not excessively restricting flow is OPERABLE; and

b. Both Control Structure Heating and Ventilation fans, Computer Room Floor Cooling fans, and Control Room Floor Cooling fans are OPERABLE; and

c. Ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

d. Neither Smoke Removal Fan (OV104A/B) is in operation.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.7-14 Revision 3

Rev. 2 CREOAS System

BASES LCO (continued)

One subsystem is considered OPERABLE when:

B 3.7.3

a. One filter train consisting of a CREOAS fan, heater, a HEPA filter, and charcoal adsorber which is not excessively restricting flow is OPERABLE; and

b. The 'A' Control Structure Heating and Ventilationfan (OV103A) and the 'A' Computer Room Floor Cooling fan (OV115A) and the 'A' Control Room Floor Cooling fan (OV117A) are OPERABLE OR The 'B' Control Structure Heating and Ventilation fan (OV103B) and the 'B' Computer Room Floor Cooling fan (OV115B) and the

'B' Control Room Floor Cooling fan (OV117B) are OPERABLE (These fans are not dedicated to either CREOAS subsystem. As a result when any one set of fans is not OPERABLE, one arbitrarily determined CREOAS subsystem is not OPERABLE);

and

c.

d.

Ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

Neither Smoke Removal Fan (OV104A/B) is in operation.

In order for the CREAOS subsystems to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.

Note the CRE can not be maintained with a smoke removal fan (OV104A or OV1048) in operation .

SUSQUEHANNA - UNIT 2 TS I B 3.7-15 (continued)

Revision 3

Rev. 2 CREOAS System

BASES LCO (continued)

The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls. This Note only B 3.7.3 applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area.

For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.

APPLICABILITY In MODES 1, 2, and 3, the*CREOAS System must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA, since the DBA could lead to a fission product release.

In MODES 4 and 5, the probability and consequences of a DBA are reduced because of the pressure and temperature limitations in these

MODES. Therefore, maintaining the CREOAS System OPERABLE is not required in MODE 4 or 5, except for the following situations under which significant radioactive releases can be postulated:

a. During operations with a potential fo~ draining the reactor vessel (OPDRVs);

b. During CORE ALTERA TIONS; and

c. During movement of irradiated fuel assemblies in the secondary containment.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.7-16 Revision 3

Rev. 2 CREOAS System

BASES (continued)

ACTIONS B3.7.3 With one CREOAS subsystem inoperable, for reasons other than an inoperable CRE boundary, the inoperable CREOAS subsystem must be I.

restored to OPERABLE status within 7 days. With the unit in this

condition, the remaining OPERABLE CREOAS subsystem is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE subsystem could result in loss of the CREOAS System function. The 7 day Completion Time is based on the low probability of a OBA occurring during this time period, and that the remaining subsystem can provide the required capabilities.

B.1. B.2. and B.3 If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of OBA consequences (allowed to be up to 5 rem whole body or its equivalent to any part of the body), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.

During the period that the CRE boundary is considered inoperable,

action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to verify that in the event of a OBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are ta,)<en to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion

SUSQUEHANNA - UNIT 2 TS I B 3.7-17 (continued)

Revision 3

Rev. 2 CREOAS System

BASES ACTIONS B.1, 8.2, and B.3 (continued) 83.7.3 Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a OBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.

C.1 and C.2 In MODE 1, 2, or 3, if the inoperable CREOAS subsystem or the CRE boundary cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed CompletionTimes are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an

orderly manner and without challenging unit systems .

SUSQUEHANNA - UNIT 2 TS I B 3.7-18 (continued)

Revision 3

Rev. 2 CREOAS System

BASES ACTIONS (continued) 0.1, 0.2.1, 0.2.2, and D.2.3 B 3.7.3 The Required Actions of Condition D are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require either an entry into LCO 3.0.3 or a reactor shutdown in accordance with LCO 3.0.3.

During movement of irradiated fuel assemblies in the secondary containment, during CORE ALTERATIONS, or during OPDRVs, if the inoperable CREOAS subsystem cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE CREOAS subsystem may be placed in the pressurization/filtration mode. This action ensures that the remaining subsystem is OPERABLE, that no failures that would prevent automatic actuation will occur, and that any active failure will be readily detected.

An alternative to Required Action D.1 is to immediately suspend activities that present a potential for releasing radioactivity that might

require isolation of the CRE. This places the unit in a condition that minimizes the accident risk.

If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment must be suspended immediately. Suspension of these activities shall not preclude I

completion of movement of a component to a safe position. Also, if applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended.

If both CREOAS subsystems are inoperable in MODE 1, 2, or 3, for reasons other than an inoperable CRE boundary (i.e., Condition B) the CREOAS System may not be capable of performing the intended function and the unit is in a condition outside of the accident analyses.

Therefore, LCO 3.0.3 must be entered immediately.

SUSQUEHANNA - UNIT 2 TS I B 3.7-18A (continued)

Revision 1

Rev. 2 CREOAS System

BASES ACTIONS (continued)

F.1. F.2, and F.3 B 3.7.3 The Required Actions of Condition F are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore,* inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require either an entry into LCO 3.0.3 or a reactor shutdown in accordance with LCO 3.0.3.

During movement of irradiated fuel assemblies in the secondary containment, during CORE ALTERA TIONS, or during OPDRVs, with two CREOAS subsystems inoperable or with one or more CREOAS subsystems inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that present a potential for releasing radioactivity that might require pressurization of the CRE.

This places the unit in a condition that minimizes the accident risk.

If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment must be suspended immediately. Suspension of these activities shall not preclude

completion of movement of a component to a safe position. If applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended.

SURVEILLANCE SR 3.7.3.1 REQUIREMENTS This SR verifies that a CREOAS fan in a standby mode starts on demand from the control room and continues to operate with flow through the HEPA filters and charcoal adsorbers. Standby systems should be checked periodically to ensure that they start and function properly. As the environmental and normal operating conditions of this system are not severe, testing each subsystem once every month provides an adequate check on this system. Monthly heater operation dries out any moisture that has accumulated in the charcoal as a result of humidity in the ambient air. Systems with heaters must be operated for~ 10 continuous hours with the heaters energized. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.7-188 (continued)

Revision 1

__J

Rev. 2 CREOAS System

BASES SURVEILLANCE REQUIREMENTS SR 3.7.3.2 B 3.7.3 (continued) This SR verifies that the required CREOAS testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations).

Specific test Frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.3.3 This SR verifies that on i3n actual or simulated initiation signal, each CREOAS subsystem starts and operates. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.7.1.5 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.3.4 This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.

The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of OBA consequences is no more than 5 rem whole body or its equivalent to any part of the body and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of OBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered. Required Action 8.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2. 7 .3, (Ref. 7) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 8). These compensatory measures may also be used as mitigating actions as required by Required Action B.2 .

SUSQUEHANNA - UNIT 2 TS I B 3.7-18C (continued)

Revision 1

Rev. 2 CREOAS System

BASES SURVEILLANCE REQUIREMENTS Temporary analytical methods may also be used as compensatory B 3.7.3 measures to restore OPERABILITY (Ref. 9). Options for restoring the (continued) CRE boundary to OPERABLE status include changing the licensing basis OBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.

REFERENCES 1. FSAR, Chapter 6.

2. FSAR, Chapter 9.

3. FSAR, Chapter 15.

4. FSAR, Section 6.4.1.

5 . FSAR, Section 6.4.

6. FSAR, Section 9.5.

7. Regulatory Guide 1.196.

8. NEI 99-03, "Control Room Habitability Assessment," June 2001 .

SUSQUEHANNA - UNIT 2 TS I B 3.7-180 Revision 0 i

Rev. 2 CREOAS System

BASES REFERENCES (continued)

B 3.7.3

9. Letter from Eric J. Leeds (NRG) to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." (ADAMS Accession No. ML040300694) .

SUSQUEHANNA - UNIT 2 TS I B 3.7-18E Revision O

Rev. 1 Control Room Floor Cooling System

B 3.7 PLANTSYSTEMS B 3. 7.4 Control Room Floor Cooling System B 3.7.4 BASES BACKGROUND The Control Room Floor Cooling System provides temperature control for the control room. The control room floor cooling fans are also needed for pressure control of the habitability envelope.

The Control Room Floor Cooling System consists of two independent, redundant subsystems that provide cooling of recirculated control room air. Each subsystem consists of cooling coils, fans, chillers, compressors, ductwork, dampers, and instrumentation and controls to provide for control room temperature control.

The Control Room Floor Cooling System is designed to provide a controlled environment under both normal and accident conditions. A .

single subsystem provides the required temperature control to maintain a suitable control room environment. The design conditions for the control room environment are 75 (+/- 5}°F and 50 (+/- 5)%

relative humidity. The Control Room Floor Cooling System operation in maintaining the control room temperature is discussed in the FSAR, Section 6.4 (Ref. 1)

APPLICABLE The design basis of the Control Room Floor Cooling System is to SAFETY ANALYSES maintain the control room temperature for a 30 day continuous occupancy. The control room floor cooling fans are also needed for pressure control of the habitability envelope.

The Control Room Floor Cooling System components are arranged in redundant safety related subsystems. During emergency operation, the Control Room Floor Cooling System maintains a habitable environment and ensures the OPERABILITY of components in the control room. A single failure of a component of the Control Room Floor Cooling System, assuming a loss of offsite power, does not impair the ability of the system to perform its design function.

Redundant detectors and controls are provided for control room temperature control. The Control Room Floor Cooling System is designed in accordance with Seismic Category I requirements. The Control Room Floor Cooling System is capable of removing sensible and latent heat loads from the control room, including consideration of equipment heat loads and personnel occupancy requirements to ensure equipment OPERABILITY.

SUSQUEHANNA - UNIT 2 TS I B 3.7-19 (continued)*

Revision 1

Rev. 1 Control Room Floor Cooling System

. B 3.7.4 BASES APPLICABLE The Control Room Floor Cooling System satisfies Criterion 3 of the SAFETY ANALYSES NRC Policy Statement. (Ref. 2)

(continued)

LCO Two independent and redundant subsystems of the Control Room Floor Cooling System are required to be OPERABLE to ensure that at least one is available, assuming a single failure disables the other subsystem. Total system failure could result in the equipment operating temperature exceeding limits.

The Control Room Floor Cooling System is considered OPERABLE when the individual components necessary to maintain the control room temperature are OPERABLE in both subsystems. These components include the cooling coils, fans, chillers, compressors, ductwork, dampers, and associated instrumentation and controls. The Control Room Floor Cooling System fans, ductwork, and dampers are also addressed by LCO 3.7.3, "Control Room Emergency Outside Air Supply System".

APPLICABILITY In MODE 1, 2, or 3, the Control Room Floor Cooling System must be OPERABLE to ensure that the control room temperature will not exceed equipment OPERABILITY limits following habitability envelope isolation.

In MODES 4 and 5, the probability and consequences of a Design Basis Accident are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the Control Room Floor Cooling System OPERABLE is not required in MODE 4 or 5, except for the following situations under which significant radioactive releases can be postulated:

a. During operations with a potential for draining the reactor vessel (OPDRVs);

b. During CORE ALTERATIONS; and

c. During movement of irradiated fuel assemblies in the secondary containment.

SUSQUEHANNA - UNIT 2 TS I B 3.7-20 (continued)

Revision 1

Rev. 1 Control Room Floor Cooling System

BASES ACTIONS B 3.7.4 With one control room floor cooling subsystem inoperable, the inoperable control room floor cooling subsystem must be restored to OPERABLE status within 30 days. With the unit in this condition, the remaining OPERABLE control room floor cooling subsystem is adequate to perform the control room air conditioning function.

However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in loss of the control room air conditioning function. The 30 day Completion Time is based on the low probability of an event occurring requiring habitability envelope isolation, the consideration that the remaining subsystem can provide the required protection, and the availability of alternate safety and nonsafety cooling methods. Since nonsafety alternate cooling methods are available, this Action is less restrictive than 3.7.3, where an alternate method of maintaining the habitability envelope at a positive pressure is not available.

B.1 and B.2 In MODE 1, 2, or 3, if the inoperable control room floor cooling subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE that minimizes risk. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1, C.2.1. C.2.2. and C.2.3 The Required Actions of Condition C are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require entry into LCO 3.0.3 or a reactor shutdown in accordance with LCO 3.0.3.

During movement of irradiated fuel assemblies in the secondary containment, during CORE ALTERATIONS, or during OPDRVs, if Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE control room floor cooling subsystem may be

SUSQUEHANNA - UNIT 2 TS I B 3.7-21 (continued)

Revision 1

Rev. 1 Control Room Floor Cooling System

BASES ACTIONS C.1, C.2.1. C.2.2. and C.2.3 (continued)

B 3.7.4 placed immediately in operation. This action ensures that the remaining subsystem is OPERABLE, that no failures that would prevent actuation will occur, and that any active failure will be readily detected.

An alternative to Required Action C.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the habitability envelope. This places the unit in a condition that minimizes risk.

If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended .

If both control room floor cooling subsystems are inoperable in MODE 1, 2, or 3, the Control Room Floor Cooling System may not be capable of performing the intended function. Therefore, LCO 3.0.3 must be entered immediately.

E.1. E.2, and E.3 The Required Actions of Condition E are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.

Therefore, inability to suspend movement of irradiated fuel assemblies is not a sufficient reason to require entry into LCO 3.0.3 or a reactor shutdown in accordance with LCO 3.0.3.

During movement of irradiated fuel assemblies in the secondary containment, during CORE ALTERA TIONS, or during OPDRVs, with two control room floor cooling subsystems inoperable, action must be taken*

SUSQUEHANNA- UNIT 2 TS I B 3.7-22 (continued)

Revision 1

Rev.1 Control Room Floor Cooling System

BASES ACTIONS E.1, E.2, and E.3 (continued)

B 3.7.4 immediately to suspend activities that present a potential for releasing radioactivity that might require isolation of.the habitability envelope.

This places the unit in a condition that minimizes risk.

If applicable, CORE ALTERATIONS and handling of irradiated fuel in the secondary containment must be suspended immediately.

Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended.

SURVEILLANCE SR 3.7.4.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to remove the control room heat load assumed in the safety analyses. The SR consists of a combination of testing and calculation .

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.4

2. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS/ B 3.7-23 Revision 2

Rev.2 Main Condenser Offgas

B 3.7 B 3.7.5 PLANT SYSTEMS Main Condenser Offgas B 3.7.5 BASES BACKGROUND During unit operation, steam from the low pressure turbine is exhausted directly into the condenser. Air and noncondensible gases are collected in the condenser, then exhausted through the steam jet air ejectors (SJAEs) to the Main Condenser Offgas System. The offgas from the main condenser normally includes radioactive gases.

The Main Condenser Offgas System has been incorporated into the unit design to reduce the gaseous radwaste emission. This system uses a catalytic recombiner to recombine radiolytically dissociated hydrogen and oxygen. The gaseous mixture is cooled by the offgas condenser; the water and condensibles are stripped out by the offgas condenser and moisture separator. The radioactivity of the remaining gaseous mixture (i.e., the offgas recombiner effluent) is monitored downstream of the moisture separator prior to entering the holdup line.

APPLICABLE SAFETY ANALYSES The main condenser offgas radioactivity rate is an initial condition of the Main Condenser Offgas System failure event, discussed in the FSAR, Section 15.7.1 (Ref. 1). The analysis assumes a gross failure in the Main Condenser Offgas System that results in the rupture of the Main Condenser Offgas System pressure boundary. The radioactivity rate of the specified noble gases (Xe-133, Xe-135, Xe-138, Kr-85m, Kr-87, and Kr-88) is controlled to ensure that, during the event, the calculated offsite doses will be well within regulatory limits or the NRC staff approved licensing basis.

The main condenser offgas limits satisfy Criterion 2 of the NRC Policy Statement. (Ref. 3)

LCO To ensure compliance with the assumptions of the Main Condenser Offgas System failure event (Ref.1), the fission product release rate should be consistent with a specified noble gas release to the reactor coolant of

- SUSQUEHANNA - UNIT 2 TS I B 3.7-24 (continued)

Revision 1

Rev. 2 Main Condenser Offgas

BASES B 3.7.5 LCO 100 µCi/MWt-second. The LCO is established consistent with this (continued) requirement (3293 MWtx 100 µCi/MWt-second =330 mCi/second), and is based on the original licensed rated thermal power.

APPLICABILITY The LCO is applicable when steam is being exhausted to the main condenser and the resulting noncondensibles are being processed via the Main Condenser Offgas System. This occurs during MODE 1, and during MODES 2 and 3 with any main steam line not isolated. In MODES 4 and 5, steam is not being exhausted to the main condenser and the requirements are not applicable.

ACTIONS If the offgas radioactivity rate limit is exceeded, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to restore the radioactivity rate to within the limit. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on engineering judgment, the time required to complete the Required Action, the large margins associated with permissible dose and exposure limits, and the low probability of a Main Condenser Offgas System rupture.

B.1. B.2.1. and 8.2.2 If the radioactivity rate is not restored to within the limits in the associated Completion Time, all main steam lines must be isolated. This isolates the Main Condenser Offgas System from the source of the radioactive steam.

The main steam lines are considered isolated if at least one main steam isolation valve in each main steam line is closed, and at least one main steam line drain valve is closed. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to perform the actions from full power conditions in an orderly manner and without challenging unit systems.

An alternative to Required Action B.1 is to place the unit in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed (continued)

SUSQUEHANNA - UNIT 2 TS/ B 3.7-25 Revision O

Rev.2 Main Condenser Offgas

BASES B 3.7.5 ACTIONS B.1. B.2.1. and B.2.2 (continued)

Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE REQUIREMENTS SR 3 *7 *5

1 This SR requires that the radioactivity rate be determined, which is an isotopic analysis of an offgas sample, to ensure that the required limits are satisfied. The specified noble gases to be sampled are Xe-133, Xe-135, Xe-138, Kr-85m, Kr-87, and Kr-88. If the nominal steady state fission gas release as indicated by the condenser offgas pretreatment radioactivity monitor increases significantly (by ; : : 50% after correcting for expected increases due to changes in THERMAL POWER), an isotopic analysis is also performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the increase is noted, to ensure that the increase is not indicative of a sustained increase in the radioactivity rate. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note indicating that the SR is not required to be performed until 31 days after any main steam line is not isolated. During this period it is improbable that radioactive gases will be in the main condenser offgas system at significant rates and any potential problem will be detected by the condenser offgas pretreatment radioactivity monitor.

REFERENCES 1. FSAR, Section 15.7 .1.

2. 10 CFR 100.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS/ B 3.7-26 Revision 1

Rev. 4 Main Turbine Bypass System

B 3.7 B 3.7.6 PLANT SYSTEMS Main Turbine Bypass System B 3.7.6 BASES BACKGROUND The Main Turbine Bypass System is designed to control steam pressure when reactor steam generation exceeds turbine requirements during unit startup, sudden load reduction, and cooldown. It allows excess steam flow from the reactor to the condenser without going through the turbine.

The full bypass capacity of the system is approximately 22% of the Nuclear Steam Supply System rated steam flow. Sudden load reductions within the. capacity of the steam bypass can be accommodated without reactor scram. The Main Turbine Bypass System consists of five valves connected to the main steam lines between the main steam isolation valves and the turbine stop valve bypass valve chest. Each of these five valves is operated by hydraulic cylinders. The bypass valves are controlled by the pressure regulation function of the Turbine Electro Hydraulic Control System, as discussed in the FSAR, Section 7.7.1.5 (Ref. 1). The bypass valves are normally closed, and the pressure regulator controls the turbine control valves that direct all steam flow to

the turbine. If the speed governor or the load limiter restricts steam flow to the turbine, the pressure regulator controls the system pressure by opening the bypass valves. When the bypass valves open, the steam flows from the bypass chest, through connecting piping, to the pressure breakdown assemblies, where a series of orifices are used to further reduce the steam pressure before the steam enters the condenser.

APPLICABLE The Main Turbine Bypass System has two modes of operation. A fast SAFETY opening mode is assumed to function during the turbine generator load ANALYSES rejection, turbine trip, and feedwater controller failure transients as discussed in FSAR Sections 15.2.2, 15.2.3, and 15.1.2 (Refs. 2, 3, and 4). A pressure regulation mode is assumed to function during the control rod withdrawal error and recirculation flow controller failure transients as discussed in FSAR Sections 15.4.2 and 15.4.5 (Refs. 5 and 6). Both modes of operation are assumed to function for all bypass valves assumed in the applicable safety analyses. Opening the bypass valves during the above transients mitigates the increase in reactor vessel pressure, which affects both MCPR and LHGR during the event. An inoperable Main Turbine Bypass System may result in a MCPR and I or LHGR penalty.

The Main Turbine Bypass System satisfies Criterion 3 of the NRC Policy Statement. (Ref. 7)

SUSQUEHANNA- UNIT 2 TS I B 3.7-27 (continued)

Revision 4

Rev.4 Main Turbine Bypass System

BASES (continued)

B 3.7.6 LCO The Main Turbine Bypass System fast opening and pressure regulation modes are required to be OPERABLE to limit the pressure increase in the main steam lines and reactor pressure vessel during transients that cause a pressurization so that the Safety Limit MCPR and LHGR are not exceeded. With the Main Turbine Bypass System inoperable, modifications to the MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and LHGR limits (LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)") may be applied to allow this LCO to be met. The MCPR and LHGR limits for the inoperable Main Turbine Bypass System are specified in the COLR. An OPERABLE Main Turbine Bypass System requires the bypass valves to open in response to increasing main steam line pressure. Licensing analyses credit an OPERABLE Main Turbine Bypass System as having both the bypass valve fast opening mode and pressure regulation mode. The fast opening mode is required for transients initiated by a turbine control valve or turbine stop valve closure. The pressure regulation mode is required for transients where the power increase exceeds the capability of the turbine control valves.

The cycle specific safety analyses assume a certain number of OPERABLE main turbine bypass valves as an input (i.e., one through five).

Therefore, the Main Turbine Bypass System is considered OPERABLE when the number of OPERABLE bypass valves is greater than or equal to the number assumed in the safety analyses. The number of bypass valves assumed in the safety analyses is specified in the COLR. This response is within the assumptions of the applicable analysis (Refs. 2 - 6).

APPLICABILITY The Main Turbine Bypass System is required to be OPERABLE at

~ 23% RTP to ensure that the fuel cladding integrity Safety Limit is not violated during all applicable transients. As discussed in the Bases for LCOs 3.2.2 and 3.2.3, sufficient margin to these limits exists at

< 23% RTP. Therefore, these requirements are only necessary when operating at or above this power level.

ACTIONS If the Main Turbine Bypass System is inoperable and the MCPR and LHGR limits for an inoperable Main Turbine Bypass System, as specified in the COLR, are not applied, the assumptions of the design basis transient analysis may not be met.

SUSQUEHANNA - UNIT 2 TS I B 3.7-28

{continued)

Revision 3

Rev.4 Main Turbine Bypass System B 3.7.6 BASES ACTIONS A.1 (continued)

Under such circumstances, prompt action should be taken to restore the Main Turbine Bypass System to OPERABLE status or adjust the MCPR and LHGR limits accordingly. The 2-hour Completion Time is reasonable, based on the time to complete the Required Action and the low probability of an event occurring during this period requiring the Main Turbine Bypass System.

If the Main Turbine Bypass System cannot be restored to OPERABLE status or the MCPR and LHGR limits for an inoperable Main Turbine Bypass System are not applied, THERMAL POWER must be reduced to

< 23% RTP. As discussed in the Applicability section, operation at

< 23% RTP results in sufficient margin to the required limits, and the Main Turbine Bypass System is not required to protect fuel integrity during the applicable transients. The 4-hour Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.6.1 REQUIREMENTS Cycling each required main turbine bypass valve through one complete cycle of full travel (including the fast opening feature) demonstrates that the valves are mechanically OPERABLE and.will function when required.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.6.2 The Main Turbine Bypass System is required to actuate automatically to perform its design function. This SR demonstrates that, with the required system initiation signals (simulate automatic actuation), the valves will actduatehto Stheir ~e quiredFposition. Tche Su rvpeillance Frequency is controlled 1

un er t e urver ance requency ontro 1 rogram .

I*

SUSQUEHANNA - UNIT 2 TS I B 3.7-29 (continued)

Revision 4

Rev. 4 Main Turbine Bypass System

BASES B 3.7.6 REQUIREMENTS SR 3.7.6.3 This SR ensures that the TURBINE BYPASS SYSTEM RESPONSE TIME is in compliance with the assumptions of the appropriate safety analysis. The response time limits are specified in unit.specific documentation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 7.7.1.5.

2. FSAR, Section 15.2.2.

3. FSAR, Section 15.2.3

4. FSAR, Section 15.1.2

5. FSAR, Section 15.4.2

e. FSAR, Section 15.4.5

7. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.7-30 Revision 2

Rev.2 Spent Fuel Storage Pool Water Level

B 3.7 B 3.7.7 PLANT SYSTEMS Spent Fuel Storage Pool Water Level B 3.7.7 BASES BACKGROUND The minimum water level in the spent fuel storage pool meets the assumptions of iodine decontamination factors following a fuel handling accident.

A general description of the spent fuel storage pool design is found in the FSAR, Section 9.1 (Ref. 1). The assumptions of the fuel handling accident are found in the FSAR, Section 15.7.4 (Ref. 2).

APPLICABLE The water level above the irradiated fuel assemblies is an explicit SAFETY assumption of the fuel handling accident. A fuel handling accident is ANALYSES evaluated to ensure that the radiological consequences (calculated doses

. at the exclusion area and low population zone boundaries) are within the regulatory limits of 10 CFR 50.67 (Ref. 4). A fuel handling accident could release a fraction of the fission product inventory by breaching the fuel rod cladding as discussed in the Regulatory Guide 1.183 (Ref. 5) .

The fuel handling accident is evaluated for the dropping of an irradiated fuel assembly onto the reactor core. With an assumed minimum water level of 21 ft and a minimum decay time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months prior to fuel handling, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water and that offsite and control room doses are maintained within allowable limits (Ref. 2). The consequences of a fuel handling accident over the spent fuel storage pool are no more severe than those of the fuel handling accident over the reactor core, as discussed in the FSAR, Section 15.7.4 (Ref. 2). The water level in the spent fuel storage pool provides for absorption of water soluble fission product gases and transport delays of soluble and insoluble gases that must pass through the water before being released to the secondary containment atmosphere. This absorption and transport delay reduces the potential radioactivity of the release during a fuel handling accident.

The spent fuel storage pool water level satisfies Criteria 2 and 3 of the NRC Policy Statement (Ref. 6) .

SUSQUEHANNA - UNIT 2 TS I B 3.7-31 (continued)

Revision 1

Rev.2 Spent Fuel Storage Pool Water Level

BASES (continued) 8 3.7.7 LCO The specified water level preserves the assumptions of the fuel handling accident analysis (Ref. 2). As such, it is the minimum required for fuel movement within the spent fuel storage pool.

APPLICABILITY This LCO applies during movement of irradiated fuel assemblies in the spent fuel storage pool since the potential for a release of fission products exists.

ACTIONS A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not a sufficient reason to require a reactor shutdown.

When the initial conditions for an accident cannot be met, action must be taken to preclude the accident from occurring. If the spent fuel storage pool level is less than required, the movement of irradiated fuel assemblies in the spent fuel storage pool is suspended immediately.

Suspension of this activity shall not preclude completion of movement of an irradiated fuel assembly to a safe position. This effectively precludes a spent fuel handling accident from occurring.

SURVEILLANCE REQUIREMENTS SR 3*7 *7 *1 This SR verifies that sufficient water is available in the event of a fuel handling accident. The water level in the spent fuel storage pool must be checked periodically. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.7-32 (continued)

Revision 1

Rev.2 Spent Fuel Storage Pool Water Level

BASES (continued)

B 3.

7.7 REFERENCES

1. FSAR, Section 9.1.

2. FSAR, Section 15.7.4.

3. Deleted.

4. 10 CFR 50.67.

5. Regulatory Guide 1.183, July 2000.

6. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS/ B 3.7-33 Revision 1

I I Rev. 1 Main Turbine Pressure Regulation System

B3.7 B3.7.8 BASES PLANT SYSTEMS Main Turbine Pressure Regulation System B 3.

7.8 BACKGROUND

The Main Turbine Pressure Regulation System is designed to control main steam pressure. The Main Turbine Pressure Regulation System contains two pressure regulators which are provided to maintain primary system pressure control. They independently sense pressure just upstream of the main turbine stop valves and compare it to two separate setpoints to create proportional error signals that produce each regulator's output. The outputs of both regulators feed into a high value gate. The regulator with the highest output controls the main turbine control valves. The lowest pressure setpoint gives the largest pressure error and thereby the largest regulator output. The backup regulator is nominally set 3 psi higher giving a slightly smaller error and a slightly smaller effective output of the controller. The main turbine pressure regulation function of the Turbine Electro Hydraulic Control System is discussed in the FSAR, Sections 7. 7.1.5 (Ref. 1) and 15.2.1 (Ref. 2).

APPLICABLE A downscale failure of the primary or controlling pressure regulator as SAFETY discussed in FSAR, Section 15.2.1 (Ref. 2) will cause the turbine control ANALYSES valves to begin to close momentarily. The pressure will increase, because the reactor is still generating the initial steam flow. The backup regulator will reposition the valves and re-establish steady-state operation above the initial pressure equal to the setpoint difference which is nominally 3 psi. Provided that the backup regulator takes control, the disturbance is mild, similar to a pressure setpoint change and no significant reduction in fuel thermal margins occur.

Failure of the backup pressure regulator is also discussed in FSAR, Section 15.2.1. If the backup pressure regulator fails downscale or is out of service when the primary regulator fails downscale, the turbine control valves (TCVs) will close in the servo or normal operating mode. Since the TCV closure is not a fast closure, there is no loss of EHC pressure to provide an anticipatory scram. The reactor pressure will increase to the point that a high neutron flux or a high reactor pressure scram is initiated to shut down the reactor. The increase in flux and pressure affects both MCPR and LHGR during the event. An inoperable Main Turbine Pressure Regulation System may result in a MCPR and/or LHGR penalty.

The Main Turbine Pressure Regulation System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) .

SUSQUEHANNA - UNIT 2 TS I B 3.7-34 (continued)

Revision 0

Rev. 1 Main Turbine Pressure Regulation System

BASES (continued)

LCO Both Main Turbine Pressure Regulators are required to be OPERABLE to limit the pressure increase in the main steam lines and reactor pressure

.B 3.7.8 vessel during a postulated failure of the controlling pressure regulator so that the Safety Limit MCPR and LHGR are not exceeded. With one Main Turbine Pressure Regulator inoperable, modifications to the MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and LHGR limits (LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)") may be applied to allow this LCO to be met. The MCPR and LHGR limits for the inoperable Main Turbine Pressure Regulation System are specified in the COLR. An OPERABLE Main Turbine Pressure Regulation System requires that both Main Turbine Pressure Regulators be available so that if the controlling regulator fails downscale (i.e., in the direction of reduced control valve demand) a backup regulator is available to regain pressure control before fuel thermal margins can be significantly affected. An OPERABLE Main Turbine Pressure Regulation System causes the event where the controlling regulator fails downscale to be a non-limiting event from a thermal margin standpoint.

APPLICABILITY The Main Turbine Pressure Regulation System is required to be OPERABLE at ~ 23% RTP to ensure that the fuel cladding integrity Safety Limit is not violated during all applicable transients. As discussed in the Bases for LCOs .3.2.2 and 3.2.3, sufficient margin to these limits exists at < 23% RTP.

Therefore, these requirements are only necessary when operating at or above this power level.

. ACTIONS A.1 If one Main Turbine Pressure Regulator is inoperable and the MCPR and LHGR limits for an inoperable Main Turbine Pressure Regulation System, as specified in the COLR, are not applied, the assumptions of the design basis transient analysis may not be met. Under such circumstances, prompt action should be taken to restore the Main Turbine Pressure Regulation System to OPERABLE status or adjust the MCPR and LHGR to be within the applicable limits accordingly. The 2-hour Completion Time is reasonable, based on the time to complete the Required Action and the low probability of a downscale failure of a Main Turbine Pressure Regulator.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.7-35 Revision 0

Rev. 1 Main Turbine Pressure Regulation System

BASES ACTIONS B.1 B 3.7.8 If the Main Turbine Pressure Regulation System cannot be restored to OPERABLE status or the MCPR and LHGR limits for an inoperable Main Turbine Pressure Regulation System are not applied, THERMAL POWER must be reduced to< 23% RTP. As discussed in the Applicability section, operation at < 23% RTP results in sufficient margin to the required limits, and the Main Turbine Pressure Regulation System is not required to protect fuel integrity during the applicable transients.

The 4-hour Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.8.1 REQUIREMENTS Verifying that both Main Turbine Pressure Regulators can be independently used to control pressure demonstrates that the Main Turbine Pressure Regulation System is OPERABLE and will function as required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. .

SR 3.7.8.2 The Main Turbine Pressure Regulators are designed so that a downscale

failure of the controlling regulator will result in the backup regulator automatically assuming control. This SR demonstrates that, with the failure of the controlling pressure regulator, the backup pressure regulator will assume control. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program, (continued)

SUSQUEHANNA - UNIT 2 TS/ B 3.7-36 Revision 1

Rev. 1 Main Turbine Pressure Regulation System

B 3.

7.8 REFERENCES

1. FSAR, Section 7.7.1.5.

2. FSAR, Section 15.2.1 .

SUSQUEHANNA- UNIT 2 TS I B 3.7-37 Revision 0

Rev. 10 AC Sources-Operating

B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources-Operating B 3.8.1 BASES BACKGROUND The unit Class 1E AC Electrical Power Distribution System AC sources consist of two offsite power sources (preferred power sources, normal and alternate), and the onsite standby power sources (diesel generators (DGs) A, B, C and D). A fifth diesel generator, DG E, can be used as a substitute for any one of the four DGs A, B, C or D. As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.

The Class 1E AC distribution system is* divided into redundant load groups, so loss of any one group does not prevent the minimum safety functions from being performed. Each load group has connections to two preferred offsite power supplies and a single DG.

The two qualified circuits between the offsite transmission network and the onsite Class 1 E AC Electrical Power Distribution System are supported by two independent offsite power sources. A 230 kV line from the Susquehanna T1 O 230 kV switching station feeds start-up transformer No. 1O; and, a 230 kV tap from the 500-230 kV tie line feeds the startup transformer No. 20. The term "qualified circuits", as used within TS 3.8.1, is synonymous with the term "physically independenf'.

The two independent offsite power sources are supplied to and are shared by both units. These two electrically and physically separated circuits provide AC power, through startup transformers (ST) No. 1O and ST No. 20, to the four 4.16 kV Engineered Safeguards System (ESS) buses (A, B, C and D) for both Unit 1 and Unit 2. A detailed description of the offsite power network and circuits to the onsite Class 1E ESS buses is found in the FSAR, Section 8.2 {Ref. 2).

An offsite circuit consists of all breakers, transformers, switches, automatic tap changers, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class 1 E ESS bus or buses.

SUSQUEHANNA- UNIT 2 TS I B 3.8-1 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES BACKGROUND (continued)

ST No. 1O and ST No. 20 each provide the normal source of power to two of the four 4.16 kV ESS buses in each Unit and the alternate B 3.8.1 source of power to the remaining two 4.16 kV ESS buses in each Unit.

If any 4.16 kV ESS bus loses power, an automatic transfer from the nonTlal to the alternate occurs after the normal supply breaker trips.

When off-site power is available to the 4.16 kV ESS Buses following a LOCA signal, the required ESS loads will be sequenced onto the 4.16 kV ESS Buses in order to compensate for voltage drops in the onsite power system when starting large ESS motors.

The onsite standby power source for 4.16 kV ESS buses A, B, C and D consists of five DGs. DGs A, B, C and D are dedicated to ESS buses A, B, C and D, respectively. DG E can be used as a substitute for any one of the four DGs (A, B, C or D) to supply the associated ESS bus. Each DG provides standby power to two 4.16 kV ESS buses-one associated with Unit 1 and one associated with Unit 2.

The four "required" DGs are those aligned to a 4.16 kV ESS bus to provide onsite standby power for both Unit 1 and Unit 2.

A DG, when aligned to an ESS bus, starts automatically on a loss of coolant accident (LOCA) signal (i.e., low reactor water level signal or high drywell pressure signal) or on an ESS bus degraded voltage or undervoltage signal. After the DG has started, it automatically ties to its respective bus after offsite power is tripped as a consequence of ESS bus undervoltage or degraded voltage, independent of or coincident with a LOCA signal. The DGs also start and operate in the standby mode without tying to the ESS bus on a LOCA signal alone.

Following the trip of offsite power, non-penTlanent loads are stripped from the 4.16 kV ESS Buses. When a DG is tied to the ESS Bus, loads are then sequentially connected to their respective ESS Bus by individual load timers. The individual load timers control the starting penTlissive signal to motor breakers to prevent overloading the associated DG.

In the event of loss of nonTlal and alternate offsite power supplies, the 4.16 kV ESS buses will shed all loads except the 480 V load centers and the standby diesel generators will connect to the ESS busses. When a DG is tied to its respective ESS bus, loads are then sequentially connected to

SUSQUEHANNA - UNIT 2 B 3.8-2 (continued)

Revision O i

J

Rev. 10 AC Sources-Operating

BASES BACKGROUND (continued) 8 3.8.1 the ESS bus by individual load timers which control the permissive and starting signals to motor breakers to prevent overloading the.DG.

In the event of a loss of normal and alternate offsite power supplies, the ESS electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (OBA) such as a LOCA.

Certain required plant loads are returned to service in a predetermined sequence in order to prevent overloading of the DGs in the process.

Within 286 seconds after the initiating signal is received, all automatic and permanently connected loads needed to recover the unit or maintain it in a safe condition are returned to service. Ratings for the DGs satisfy the requirements of Regulatory Guide 1.9 (Ref. 3).

DGs A, B, C and D have the following ratings:

a. 4000 kW-continuous,

b. 4700 kW-2000 hours, DG E has the following ratings:

a. 5000 kW-continuous,

b. 5500 kW-2000 hours.

APPLICABLE The initial conditions of OBA and transient analyses in the FSAR, SAFETY ANALYSES Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume ESF systems are OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.

The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit and supporting safe shutdown of the other unit. This includes

maintaining the onsite or offsite AC sources

SUSQUEHANNA-UNIT2 B 3.8-3 (continued)

Revision O

Rev. 10 AC Sources-Operating

BASES APPLICABLE SAFETY ANALYSES OPERABLE during accident conditions in the event of an assumed B 3.8.1 loss of all offsite power or all onsite AC power; and a worst case single (continued) failure.

AC sources satisfy Criterion 3 of the NRG Policy Statement {Ref. 6).

LCO , Two qualified circuits between the offsite transmission network and the onsite Class 1 E Distribution System and four separate and independent DGs (A, B, C and D) ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated OBA. DG E can be used as a substitute for any one of the four DGs A, 8, C or D.

Qualified offsite circuits are those that are described in the FSAR, and are part of the licensing basis for the unit. In addition, the required automatic load timers for each ESF bus shall be OPERABLE.

The Safety Analysis for Unit 2 assumes the OPERABILITY of some equipment that receives power from Unit 1 AC Sources. Therefore, Unit 2 Technical Specifications establish requirements for the

.OPERABILITY of the DG(s) and qualified offsite circuits needed to

support the Unit 1 onsite Class 1E AC electrical power distribution subsystem(s) required by LCO 3.8.7, Distribution Systems-Operating.

Each offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ESS buses.

One OPERABLE offsite circuit exists when all of the following conditions are met:

1. An energized ST. No. 10 transformer with the load tap changer (LTC) in automatic operation.

2. The respective circuit path including energized ESS transformers 101 and 111 and feeder breakers capable of supplying three of the four 4.16kV ESS Buses.

SUSQUEHANNA- UNIT 2 TS I 8 3.8-4 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES LCO (continued)

3. Acceptable offsite grid voltage, defined as a voltage that is within the grid voltage requirements established for SSES. The B 3.8.1 grid voltage requirements include both a minimum grid voltage and an allowable grid voltage drop during normal operation, and for a predicted voltage for a trip of the unit.

The Regional Transmission Operator (PJM), and/or the Transmission Power System Dispatcher, PPL EU, determine, monitor and report actual and/or contingency voltage (Predicted voltage) violations that occur for the SSES monitored offsite 230kV and SOOkV buses:

The offsite circuit is inoperable for any actual voltage violation, or a contingency voltage violation that occurs for a trip of a SSES unit, as reported by*the transmission RTO or Transmission Power System Dispatcher.

The offsite circuit is operable for any other predicted grid event (i.e., loss of the most critical transmission line or the largest supply) that does not result from the generator trip of a SSES unit. These conditions do not represent an impact on SSES

operation that has been caused by a LOCA and subsequent generator trip. The design basis does nc:it require entry into LCOs for predicted grid conditions that cannot result in a LOCA, delayed LOOP.

The other offsite circuit is Operable when all the following conditions are met:

1. "An energized ST. No. 20 transformer with the load tap changer (LTC) in automatic operation.

2. The respective circuit path including energized ESS transformers 201 and 211 and feeder breakers capable of supplying three of the four 4.16kV ESS Buses.

3. Acceptable offsite grid voltage, defined as a voltage that is within the grid voltage requirements established for SSES.

The grid voltage requirements include both a minimum grid voltage and an allowable grid voltage drop during normal operation, and for a predicted voltage for a trip of the unit.

SUSQUEHANNA - UNIT 2 TS I B 3.8-4a (continued)

Revision O

Rev. 10 AC Sources-Operating

BASES LCO (continued)

The Regional Transmission Operator (PJM), and/or the Transmission Power System Dispatcher, PPL EU, B 3.8.1 determine, monitor and report actual and/or contingency voltage (Predicted voltage) violations that occur for the SSES monitored offsite 230kV and 500kV buses.

The offsite circuit is inoperable for any actual voltage violation, or a contingency voltage violation that occurs for a trip of a SSES unit, as reported by the transmission RTO or Transmission Power System Dispatcher.

The offsite circuit is operable for any other predicted grid event (i.e., loss of the most critical transmission line or the largest supply) that does not result from the generator trip of a SSES unit. These conditions do not represent an impact on SSES operation that has been caused by a LOCA and subsequent generator trip. The design basis does not require entry into LCOs for predicted grid conditions that cannot result in a LOCA, delayed LOOP.

Both offsite circuits are OPERABLE provided each meets the criteria described above and provided that no 4.16kV ESS Bus has less than one OPERABLE offsite circuit

SUSQUEHANNA - UNIT 2 TS I B 3.8-4b (continued}

Revision O

Rev. 10 AC Sources-Operating

BASES LCO (continued) capable of supplying the required loads. If no OPERABLE offsite circuit is capable of supplying any of the 4.16 kV ESS Buses, one B 3.8.1 offsite source shall be declared inoperable. Unit 2 also requires Unit 1 offsite circuits to be OPERABLE.

If a Unit 1 4.16 kV bus is de-energized solely for the purpose of performing maintenance, it is not required to declare an offsite source or diesel generator inoperable.

Four of the five DGs are required to be Operable to satisfy the initial assumptions of the accident analyses. Each required DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESS bus on detection of bus undervoltage after the normal and alternate supply breakers open. This sequence must be accomplished within 1O seconds. If a Unit 1 4.16 kV bus is isolated from its DG solely for the performance of bus maintenance, the DG is not required to be declared inoperable. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the ESS buses. These capabilities are required to be met from a variety of initial conditions, such as DG in standby with the engine hot and DG in normal standby conditions. Normal standby conditions for a DG mean that the diesel engine oil is being continuously circulated and engine coolant is circulated as necessary to maintain temperature consistent with manufacturer recommendations. Additional DG capabilities must be demonstrated to meet required Surveillances, e.g., capability of the DG to revert to standby status on an ECCS signal while operating in parallel test mode.

Although not normally aligned as a required DG, DG E is normally maintained OPERABLE (i.e., Surveillance Testing completed) so that it can be used as a substitute for any one of the four DGs A, B, C or D.

Proper sequencing of loads, including tripping of nonessential loads, is a required function for DG OPERABILITY.

The AC sources must be separate and independent (to the extent possible) of other AC sources. For the DGs, the separation and independence are complete. For the offsite AC sources, the separation and independence are to the extent practical. A circuit may be connected to more than one ESS bus, with automatic transfer capability to the other circuit OPERABLE, and not violate separation criteria. A circuit that is not connected to an ESS bus is required to

SUSQUEHANNA - UNIT 2 TS/ B 3.8-5 (continued)

Revision 3

Rev. 10 AC Sources-Operating B 3.8.1 BASES LCO have OPERABLE automatic transfer interlock mechanisms to each (continued) ESS bus to support OPERABILITY of that offsite circuit. If a Unit 1 -

4.16 kV bus is de-energized solely for the purpose of performing maintenance, automatic transfer interlock mechanisms for the de-energized bus are not required to be operable.

APPLICABILITY The AC sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated OBA.

The AC power requirements for MODES 4 and 5 are covered in LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG.

There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

The ACTIONS are modified by a Note which allows entry into associated Conditions and Required Actions to be delayed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months when an OPERABLE diesel generator is placed in an inoperable status for the alignment of diesel generator E to or from the Class 1E distribution system. Use of this allowance requires both offsite circuits to be OPERABLE. Entry into the appropriate Conditions and Required Actions shall be made immediately upon the determination that substitution of a required diesel generator will not or can not be completed.

When Note 3 is in effect, the following restrictions (Reference 14) shall occur:

SUSQUEHANNA - UNIT 2 TS I B 3.8-6 (continued)

Revision 3

Rev. 10 AC Sources-Operating

BASES ACTIONS (continued) 1.) No maintenance or testing that affects the reliability of the remaining OPERABLE Unit 1 and Unit 2 4160 V subsystems B 3.8.1 shall be scheduled. If any testing or maintenance activities must be performed during this time, an evaluation shall be performed in accordance with Title 10 to the Code of Federal Regulations (10 CFR) Section 50.65(a)(4).

2.) The required systems, subsystems, trains, components, and devices that depend on the remaining 4160 V buses shall be verified OPERABLE.

3.) The Unit 2 safety-related HPCI and RCIC pumps shall be controlled as "protected equipment" and not taken out of service for planned maintenance while a Unit 1 4160 V bus is out of service for extended maintenance.

Note 3 modifies the ACTIONS by allowing a Unit 1 4160 V subsystem (4.16 kV bus) to be de-energized for bus maintenance when Unit 1 is in Modes 4 or 5 and Unit 2 is in Modes 1, 2, or 3 without requiring either offsite circuit or the associated diesel generator to be declared inoperable. Only entry into LCO 3.8.7 Condition C is required for this maintenance activity. While in this configuration, immediate entry into LCO 3.8.1 is required for any offsite circuit or DG that becomes inoperable. Note 3 no longer applies.

To ensure a highly reliable power source remains with one offsite circuit inoperable, it is necessary to verify the availability of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action not met.

However, if a second required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.

SUSQUEHANNA - UNIT 2 TS I B 3.8-6a (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES ACTIONS (continued)

B 3.8.1 Required Action A.2, which only applies if one 4.16 kV ESS bus cannot be powered from any offsite source, is intended to provide assurance that an event with a coincident single failure of the associated DG does not result in a complete loss of safety function of critical systems. These features (e.g., system, subsystem, division, component, or device) are designed to be powered from redundant safety related 4.16 kV ESS buses. Redundant required features failures consist of inoperable features associated with an emergency bus redundant to the emergency bus that has no offsite power. The Completion Time for Required Action A.2 is intended to allow time for the operator to evaluate and repair any discovered inoperabilities.

This Completion Time also allows an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. A 4.16 kV ESS bus has no offsite power supplying its loads; and

b. A redundant required feature on another 4.16 kV ESS bus is inoperable.

If, at any time during the existence of this Condition (one offsite circuit inoperable) a required feature subsequently becomes inoperable, this Completion Time would begin to be tracked.

Discovering no offsite power to one 4.16 kV ESS bus on the onsite Class 1E Power Distribution System coincident with one or more inoperable required support or supported features, or both, that are associated with any other emergency bus that has offsite power, results in starting the Completion Times for the Required Action.

Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before the unit is subjected to transients associated with shutdown.

The remaining OPERABLE offsite circuits and DGs are.

adequate to supply electrical power to the onsite Class 1 E Distribution System. Thus, on a component basis, single failure protection may have been lost for the required feature's function; however, function is not lost. The 24

SUSQUEHANNA - UNIT 2 B 3.8-7 (continued)

Revision O

Rev. 10 AC Sources-Operating B 3.8.1 BASES ACTIONS A.2 (continued) hour Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a OBA occurring during this period.

According to Regulatory Guide 1.93 (Ref. 7), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a OBA occurring during this period.

The second Completion Time for Required Action A.2 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition A is entered while, for instance, a DG is inoperable, and that DG is subsequently returned OPERABLE, the LCO may already have been not met for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This situation could lead to a total of 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months , since initial failure to meet the LCO, to restore the offsite circuit. At this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (for a total of 9 days) allowed prior to complete restoration of the LCO. The 6 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A

SUSQUEHANNA - UNIT 2 B 3.8-8 (continued)

Revision O

Rev. 10 AC Sources-Operating

BASES ACTIONS A.3 (continued)

B 3.8.1 and B are entered concurrently. The "AND" connector between the 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 6 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

As in Required Action A.2, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This exception results in establishing the "time zero" at the time the LCO was initially not met, instead of at the time that Condition A was entered.

To ensure a highly reliable power source remains with one required DG inoperable, it is necessary to verify the availability of the required offsite circuits on a more frequent basis. Since the Required Action only specifies "pe'rform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions must then be entered.

Required Action 8.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e.,

single division systems are not included). Redundant required features failures consist of inoperable features associated with a division redundant to the division that has an inoperable DG.

SUSQUEHANNA- UNIT 2 TS I B 3.8-9 (continued)

Revision 2

Rev. 10 AC Sources-Operating

BASES ACTIONS B.2 (continued)

B 3.8.1 The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action the Completion Time only begins on discovery that both:

a. An inoperable DG exists; and

b. A required feature powered from another diesel generator (Division 1 or 2) is inoperable.

If, at any time during the existence of this Condition (one required DG inoperable), a required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

Discovering one required DG inoperable coincident with one or more inoperable required support or supported features, or both, that are associated with the OPERABLE DGs results in starting the Completion

- Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.

The remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1 E Distribution System.

Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a OBA occurring during this period.

B.3.1 and B.3.2 Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DGs. If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG, SR 3.8.1. 7 does not have to be performed. If the cause of inoperability exists on other DG(s), they are declared inoperable upon discovery, and Condition E of

SUSQUEHANNA - UNIT 2 TS I B 3.8-10 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES ACTIONS B.3.1 and B.3.2 (continued)

B 3.8.1 LCO 3.8.1 is entered. Once the failure is repaired, and the common cause failure no longer exists, Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be determined not to exist on the remaining DG(s), performance of SR 3.8.1. 7 suffices to provide assurance of continued OPERABILITY of those DGs. However, the second Completion Time for Required Action B.3.2 allows a performance of SR 3.8.1.7 completed up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months prior to entering Condition B to be accepted as demonstration that a DG is not inoperable due to a common cause failure.

In the event the inoperable DG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, the plant corrective action program will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B.

According to Generic Letter 84-15 (Ref. 8), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is a reasonable time to confirm that the OPERABLE DGs are not affected by the same problem as the inoperable DG.

According to Regulatory Guide 1.93 (Ref. 7), operation may continue in Condition B for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In Condition B, the remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1 E Distribution System. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a OBA occurring during this period.

The second Completion Time for Required Action B.4 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently restored OPERABLE, the LCO may already have been not met for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This situation could lead to a total of 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months , since initial failure of the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (for a total of 9 days) allowed prior to

SUSQUEHANNA- UNIT 2 TS I B 3.8-11 (continued)

Revision 1

I I

Rev. 10 AC Sources-Operating

BASES ACTIONS 8.4 (continued) 8 3.8.1 complete restoration of the LCO. The 6 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and 8 are entered concurrently. The "AND" connector between the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 6 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive must be met.

As in Required Action 8.2, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This exception results in establishing the "time zero" at the time that the LCO was initially not met, instead of the time that Condition B was entered.

Required Action C.1 addresses actions to be taken in the event of concurrent inoperability of two offsite circuits. The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

According to Regulatory Guide 1.93 (Ref. 7), operation may continue in Condition C for a period that should not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This level of degradation means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.

Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable. However, two factors tend to decrease the severity of this degradation level:

a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and

SUSQUEHANNA - UNIT 2 B 3.8-12 (continued)

Revision O

Rev. 10 AC Sources-Operating

BASES ACTIONS C.1 (continued)

B 3.8.1

b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a OBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis.

Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria. According to Regulatory Guide 1.93 (Ref. 7), with the available offsite AC sources two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If two offsite sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue. If only one offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance with Condition A

D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System Actions would not be entered even if all AC sources to it were inoperable, resulting in de-energization. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered with no AC source to any ESS bus, Actions for LCO 3.8.7, "Distribution Systems-Operating," must be immediately entered. This allows Condition D to provide requirements for the loss of the offsite circuit

, and one DG without regard to whether a division is de-energized. LCO 3.8.7 provides the appropriate restrictions for a de-energized bus.

According to Regulatory Guide 1.93 (Ref. 7), operation may continue in Condition D for a period that should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the

SUSQUEHANNA - UNIT 2 B 3.8-13 (continued)

Revision O

Rev. 10 AC Sources-Operating B 3.8.1 BASES ACTIONS D.1 and D.2 (continued) reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

With two or more DGs inoperable and an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for the majority of ESF equipment at this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown. (The immediate shutdown could cause grid instability, which could result in a total loss

of AC power.) Since any inadvertent unit generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

According to Regulatory Guide 1.93 (Ref. 7), with two or more DGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

F.1 and F.2 If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are

SUSQUEHANNA- UNIT 2 B 3.8-14 (continued)

Revision 0

Rev. 10 AC Sources-Operating

BASES ACTIONS F.1 and F.2 (continued)

B 3.8.1 reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Condition G corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. Af this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.

SURVEILLANCE The AC sources are designed to permit inspection and testing of all REQUIREMENTS important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, GDC 18 (Ref. 9). Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions). The SRs for demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of Regulatory Guide 1.9 (Ref. 3), and Regulatory Guide 1.137 (Ref. 11), as addressed in the FSAR.

The Safety Analysis for Unit 2 assumes the OPERABILITY of some equipment that receives power from Unit 1 AC Sources. Therefore, Surveillance requirements are established for the Unit 1 onsite Class 1E AC electrical power distribution subsystem(s) required to support Unit 2 by LCO 3.8.7, Distribution Systems-Operating. As Noted at the beginning of the SRs, SR 3.8.1.1 through SR 3.8.1.20 are applicable to the Unit 2 AC sources and SR 3.8.1.21 is applicable to the Unit 1 AC sources.

Where the SRs discussed herein specify voltage and frequency tolerances, the following summary is applicable. The minimum steady state output voltage of 3793 V is the value assumed in the degraded voltage analysis and is approximately 90% of the nominal 4160 V output voltage. This value allows for voltage drop to the terminals of

SUSQUEHANNA- UNIT 2 B 3.8-15 (continued)

Revision 0

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS 4000 V motors whose minimum operating voltage is specified as 90%

or 3600 V. It also allows for voltage drops to motors and other B 3.8.1 (continued) equipment down through the 120 V level where minimum operating voltage is also usually specified as 90% of name plate rating. The specified maximum steady state output voltage of 4400 V is equal to the maximum operating voltage specified for 4000 V motors. It ensures that for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors is no more than the maximum rated operating voltages. The specified minimum and maximum frequencies of the DG are 58.8 Hz and 61.2 Hz, respectively. These values are equal to +/- 2% of the 60 Hz nominal frequency and are derived from the recommendations found in Regulatory Guide 1.9 (Ref. 3). The lower Frequency Limit is necessary to support the LOCA analysis assumptions for low pressure ECCS pump flow rates. (Reference 12)

The Surveillance Table has been modified by a Note, to clarify the testing requirements associated with DG E. The Note is necessary to define the intent of the Surveillance Requirements associated with the integration of DG E. Specifically, the Note defines that a DG is only considered OPERABLE and required when it is aligned to the Class 1 E distribution system. For example, if DG A does not meet the requirements of a specific SR, but DG E is substituted for DG A and aligned to the Class 1E distribution system, DG E is required to be OPERABLE to satisfy the LCO requirement of 4 DGs and DG A is not required to be OPERABLE because it is not aligned to the Class 1E distribution system. This is acceptable because only 4 DGs are assumed in the event analysis. Furthermore, the Note identifies when the Surveillance Requirements, as modified by SR Notes, have been met and performed, DG E can be substituted for any other DG and declared OPERABLE after performance of two SRs which verify switch alignment. This is acceptable because the testing regimen defined in the Surveillance Requirement Table ensures DG E is fully capable of performing all DG requirements.

SR 3.8.1.1 This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its

SUSQUEHANNA - UNIT 2 B 3.8-16 (continued)

Revision O

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.1 (continued)

B 3.8.1 correct position to ensure that distribution buses and loads are connected to an Operable offsite power source and that appropriate independence of offsite circuits is maintained. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.2 Not Used.

SR 3.8.1.3 This Surveillance verifies that the DGs are capable of synchronizing and accepting greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source.

Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation to ensure circulating currents are minimized. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

Note 1 modifies this Surveillance to indicate that diesel engine runs for this Surveillance may include gradual loading, as recommended by the Cooper Bessemer Service Bulletin 728, so that mechanical stress and wear on the diesel engine are minimized.

Note 2 modifies this Surveillance by stating that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients do not invalidate the test.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.8-17 Revision 1

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.3 (continued)

B 3.8.1 Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.

Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.

Note 5 provides the allowance that DG E, when not aligned as substitute for DG A, B, C and D but being maintained available, may use the test facility to satisfy loading requiremE?nts in lieu of synchronization with an ESS bus.

Note 6 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units, with the DG synchronized to the 4.16 kV ESS bus of Unit 1 for one periodic test and synchronized to the 4.16 kV ESS bus of Unit 2 during the next periodic test. This is acceptable because the purpose of the test is to demonstrate the ability of the DG to operate at its continuous rating (with the exception of DG E which is only required to be tested at the continuous rating of DGs A thru D) and this attribute is tested at the required Frequency.

Each unit's circuit breakers and breaker control circuitry, which are only being tested every second test (due to the staggering of the tests),

historically have a very low failure rate. If a DG fails this Surveillance, the DG should be considered inoperable for both units, unless _the cause of the failure can be directly related to only one unit. In addition, if the test is scheduled to be performed on the other Unit, and the other Unit's TS allowance that provides an exception to performing the test is used (i.e., the Note to SR 3.8.2.1 for the other Unit provides an exception to performing this test when the other Unit is in MODE 4 or 5, or moving irradiated fuel assemblies in the secondary containment),

or it is not possible to perform the test due to equipment availability, then the test shall be performed synchronized to this Unit's 4.16 kV ESS bus. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SUSQUEHANNA - UNIT 2 TS I B 3.8-18 (continued)

Revision 1 I

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.4 B 3.8.1 (continued) This SR verifies the level of fuel oil in the engine mounted day tank is at or above the level at which fuel oil is automatically added. The level is expressed as an equivalent volume in gallons, and is selected to ensure adequate fuel oil for a minimum of 55 minutes of DG A-D and 62 minutes of DG E operation at DG continuous rated load conditions.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must liave a water environment in order to survive. Removal of water from the engine-mounted day tanks periodically eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation.

Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SUSQUEHANNA - UNIT 2 TS I B 3.8-19 (continued)

Revision 2

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS

SR 3.8.1.6 B 3.8.1 (continued) This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. It is required to support continuous operation of standby power sources. This Surveillance provides assurance_that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.7 This SR helps to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, this SR has been modified by Note 1 to indicate that all DG starts for these Surveillances may be preceded by

8n engine prelube period (which for DGs A through D includes operation of the lube oil system to ensure the DG's turbo charger is sufficiently prelubicated to prevent undo wear and tear).

For the purposes of this testing, the DGs are started from standby conditions. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.

SUSQUEHANNA - UNIT 2 TS I B 3.8-20 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.7 (continued)

B 3.8.1 The DG starts from standby conditions and achieves the minimum required voltage and frequency within 1 O seconds and maintains the required voltage and frequency when steady state conditions are reached. The ten second start requirement support the assumptions in the design bases LOCA analysis of FSAR Section 6.3 (Ref. 12)

To minimize testing of the DGs, Note 2 allows a single test to satisfy the requirements for both units (instead of two tests, one for each unit). This is acceptable because this test is intended to demonstrate attributes of the DG that are not associated with either Unit. If the DG fails this Surveillance, the DG should be considered inoperable for both units, unless the cause of the failure can be directly related to one unit.

The time for the DG to reach steady state operation is periodically monitored and the trend evaluated to identify degradation.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SR 3.8.1.8 Transfer of each 4.16 kV ESS bus power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit distribution network to power the shutdown loads. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The reason for the Note is that, during operation with the reactor critical, performance of the automatic transfer of unit power supply could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a

SUSQUEHANNA- UNIT 2 TS I B 3.8-21 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.8 (continued)

B 3.8.1 result, plant safety systems. The manual transfer of unit power supply should not result in any perturbation to the electrical distribution system, therefore, no mode restriction is specified. This Surveillance tests the applicable logic associated with Unit 2. The comparable test specified in Unit 1 Technical Specifications tests the applicable logic associated with Unit 1. Consequently, a test must be performed within the specified Frequency for each unit. As the Surveillance represents separat~ tests, the Note specifying the restriction for not performing the test while the unit is in MODE 1 or 2 does not have applicability to Unit 1. The NOTE only applies to Unit 2, thus the Unit 2 Surveillance shall not be performed with Unit 2 in MODE 1 or 2.

SR 3.8.1.9 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip. The largest single load for each a DG is a residual heat removal (RHR) pump (1425 kW). This Surveillance may be accomplished by:

a. Tripping the DG output breaker with the DG carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power, or while solely supplying the bus; or

b. Tripping its associated single largest post-accident load with the DG solely supplying the bus.

As recommended by Regulatory Guide 1.9 (Ref. 3), the load rejection test is acceptable if the increase in diesel speed does not exceed 75%

of the difference between synchronous speed and the overspeed trip setpoint, or 15% above synchronous speed, whichever is lower. For DGs A, B, C, D and E, this represents 64.5 Hz, equivalent to 75% of the (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.8-22 Revision O

Rev. 10 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 (continued)

REQUIREMENTS difference betvi1een nominal speed and the overspeed trip setpoint.

The time, voltage, and frequency tolerances specified in this SR are derived from Regulatory Guide 1.9 (Ref. 3) recommendations for response during load sequence intervals. The 4.5 seconds specified is equal to 60% of the 7.5 second load sequence interval between loading of the RHR and core spray pumps during an undervoltage on the bus concurrent with a LOCA. The 6 seconds specified is equal to 80% of that load sequence interval. The voltage and frequency specified are consistent with the design range of the equipment powered by the DG. SR 3.8.1.9.a corresponds to the maximum frequency excursion, while SR 3.8.1.9.b and SR 3.8.1.9.c specify the steady state voltage and frequency values to which the system must recover following load rejection.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

To minimize testing of the DGs, a Note allows a single test to satisfy the requirements for both units (instead of two tests, one for each unit). This is acceptable because this test is intended to demonstrate attributes of the DG that are not associated with either Unit. If the DG fails this Surveillance, the DG should be considered inoperable for both units, unless the cause of the failure can be directly related to only one unit.

SR 3.8.1.10 This Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits. The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG does not trip upon loss of the load. These acceptance criteria provide DG damage protection. While the DG is not expected to experience this transient during an event, and continues to be available, this response ensures that the DG

SUSQUEHANNA - UNIT 2 TS I B 3.8-23 (continued)

Revision 2

Rev. 10 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.1 O (continued)

REQUIREMENTS is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

To minimize testing of the DGs, a Note allows a single test to satisfy the requirements for both units (instead of two tests, one for each unit). This is acceptable because this test is intended to demonstrate attributes of the DG that are not associated with either Unit. If the DG fails this Surveillance, the DG should be considered inoperable for both units, unless the cause of the failure can be directly related to only one unit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.11 As required by Regulatory Guide 1.9 (Ref. *3), this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the ESS buses and respective 4.16 kV loads from the DG. It further demonstrates the capability of the DG to automatically achieve and maintain the required voltage and frequency within the specified time.

The DG auto-start time of 1O seconds is derived from requirements of the licensed accident analysis for responding to a design basis large break LOCA. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by three Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. Note 1

SUSQUEHANNA - UNIT 2 TS I B 3.8-24 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.11 (continued)'

B 3.8.1 allows all DG starts to be preceded by an engine prelube period (which for DG's A through D includes operation of he lube oil system to ensure the DGs turbo charger is sufficiently prelubricated). For the purpose of this testing, the DGs shall be started from standby conditions that is, with the engine oil being continuously circulated and engine coolant being circulated as necessary to maintain temperature consistent with manufacturer recommendations.

The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This Surveillance tests the applicable logic associated with Unit 2. The comparable test specified in the Unit 1 Technical Specifications tests the applicable logic associated with Unit 1. Consequently, a test must be performed within the specified Frequency for each unit. As the Surveillance represents separate tests, the Note specifying the restriction for not performing the test while the unit is in MODE 1, 2, or 3 does not have applicability to Unit 1: The Note only applies to Unit 2, thus the Unit 2 Surveillances shall not be performed with Unit 2 in MODES 1, 2 or 3 .

This SR is also modified by Note 3. The Note specifies when this SR is required to be performed for the DGs and the 4.16 kV ESS Buses.

The Note is necessary because this SR involves an integrated test between the DGs and the 4.16 kV ESS Buses and the need for the testing regimen to include DG E being tested (substituteq for all DGs for both units) with all 4.16 kV ESS Buses. To ensure the necessary testing is performed, the following rotational testing regimen has been established:

UNIT IN OUTAGE DIESEL E SUBSTITUTED FOR 2 DG E not tested 1 Diesel Generator D 2 Diesel Generator A 1 DG E not tested 2 Diesel Generator B 1 Diesel Generator A 2 Diesel Generator C 1

Diesel Generator B 2 Diesel Generator D 1 Diesel Generator C

SUSQUEHANNA - UNIT 2 TS I B 3.8-25 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.11 (continued)

B 3.8.1 The specified rotational testing regimen can be altered to facilitate unanticipated events which render the testing regimen impractical to implement, but any alternative testing regimen must provide an equivalent level of testing.

This SR does not have to be performed with the normally aligned DG when the associated 4.16 kV ESS bus is tested using DG E and DG E does not need to be tested when not substituted or aligned to the Class 1E distribution system. The allowances specified in the Note are acceptable because the tested attributes of each of the five DGs and each unit's four 4.16 kV ESS buses are verified at the specified Frequency (i.e., each DG and each 4.16 kV ESS bus is tested every 24 months). Specifically, when DG Eis tested with a Unit 1 4.16 kV ESS bus, the attributes of the normally aligned DG, although not tested with the Unit 1 4.16 kV ESS bus, are tested with the Unit 2 4.16 kV ESS bus within the 24 month Frequency. The testing allowances do result in some circuit pathways which do not need to change state (i.e., cabling) not being tested on a 24 month Frequency. This is acceptable because these components are not required to change state to perform their safety function and when substituted-normal operation of DG E will ensure continuity of most of the cabling not tested.

SR 3.8.1.12 This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (10 seconds) from the design basis actuation signal (LOCA signal) and operates for :2: 5 minutes. The 5 minute period provides sufficient time to demonstrate stability. SR 3.8.1.12.d and SR 3.8.1.12.e ensure that permanently connected loads and emergency loads are energized from the offsite electrical power system on a LOCA signal without loss of offsite power.

The requirement to verify the connection and power supply of permanent and auto connected loads is intended to satisfactorily show the relationship of these loads to the loading logic for loading onto offsite power. In certain circumstances, many of these loads cannot actually be

SUSQUEHANNA- UNIT 2 TS I B 3.8-26 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.12 (continued)

B 3.8.1 connected or loaded without undue hardship or potential for undesired operation. For instance, ECCS injection valves are not desired to be stroked open, high pressure injection systems are not capable of being operated at full flow, or RHR systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of the connection and loading of these loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable.

This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

SR 3.8.1.12.a through SR 3.8.1.12.d are performed with the DG running. SR 3.8.1.12.e can be performed when the DG is not running.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. Note 1 allows all DG starts to be preceded by an engine prelube period (which for DGs A through D includes operation of the lube oil system to ensure the DG's turbo charger is sufficiently prelubricated). For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine oil being continuously circulated and engine coolant being circulated as necessary to maintain temperature consistent with manufacturer recommendations.

The reason for Note 2 is to allow DG E, when not aligned as substitute for DG A, 8, C or D, to use the test facility to satisfy loading requirements in lieu of aligning with the Class 1E distribution system.

When tested in this configuration, DG E satisfies the requirements of this test by completion of SR 3.8.1.12.a, band c only. SR 3.8.1.12.d and 3.8.1.12.e may be performed by any DG aligned with the Class 1E distribution system or by any series of sequential,

SUSQUEHANNA- UNIT 2 TS I B 3.8-27 (continued)

Revision 1

____J

Rev. 10 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.13 (continued)

REQUIREMENTS overlapping, or total steps so that the entire connection and loading sequence is verified.

This Surveillance demonstrates that DG non-critical protective functions (e.g., high jacket water temperature) are bypassed on an ECCS initiation test signal. The non-critical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately.

The DG availability to mitigate the OBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The SR is modified by two Notes. To minimize testing of the DGs, Note 1 to SR 3.8.1.13 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is acceptable because this test is intended to demonstrate attributes of the DG that are not associated with either Unit. If the DG fails this Surveillance, the DG should be considered inoperable for both units, unless the cause of the failure can be directly related to only one unit.

Note 2 provides the allowance that DG E, when not aligned as a substitute for DG A, B, C, and D but being maintained available, may use a simulated ECCS initiation signal.

SR 3.8.1.14 Regulatory Guide 1.9 (Ref. 3), requires demonstration periodically that the DGs can *start and run continuously at full load capability for an interval of not less than 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s-22 hours of which is at a load equivalent to 90% to 100% of the continuous rating of the DG, and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of which is at a load equivalent to 105% to 110% of the continuous duty rating of the DG. SSES has taken exception to this

SUSQUEHANNA - UNIT 2 TS I B 3.8-28 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.14 (continued) 83.8.1 requirement and performs the two hour run at the 2000 hour0.0231 days 0.556 hours 0.00331 weeks 7.61e-4 months rating for each DG. The requirement to perform the two hour overload test can be performed in any order provided it is performed during a single continuous time period.

The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelube discussed in SR 3.8.1.7, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.

A load band is provided to avoid routine overloading of the DG.

Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This Surveillance has been modified by four Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test.

To minimize testing of the DGs, Note 2 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units.

This is acceptable because this test is intended to demonstrate attributes of the DG that are not associated with either Unit. If the DG fails this Surveillance, the DG should be considered inoperable for both units, unless the cause of the failure can be directly related to only one unit.

Note 3 stipulates that DG E, when not aligned *as substitute for DG A, B, C or D but being maintained available may use the test facility to satisfy the specified loading requirements in lieu of synchronization with an ESS bus.

SR 3.8.1.15 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from full load temperatures and achieve the required voltage

SUSQUEHANNA - 'UNIT 2 TS I B 3.8-29 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.15 (continued)

B 3.8.1 and frequency within 1O seconds. The 1O second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by three Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The requirement that the diesel has operated for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months at full load conditions prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. The load band is provided to avoid routine overloading of the DG. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order.to maintain DG OPERABILITY.

Momentary transients due to changing bus loads do not invalidate this test.

Note 2 allows all DG starts to be preceded by an engine prelube period (which for DGs A through D includes operation of the lube oil system to ensure the DG's turbocharger is sufficiently prelubricated) to minimize wear and tear on the diesel during testing.

To minimize testing of the DGs, Note 3 allows a single test to satisfy the requirements for both units (instead of two tests, one for each unit). This is acceptable because this test is intended to demonstrate attributes of the DG that are not associated with either Unit. If the DG fails this Surveillance, the DG should be considered inoperable for both units, unless the cause of the failure can be directly related to only one unit.

SR 3.8.1.16 As required by Regulatory Guide 1.9 (Ref. 3), this Surveillance ensures that the manual synchronization and automatic load transfer from the DG to the offsite source can be made and that the DG can be returned to ready-to-load status when offsite power is restored. It also

SUSQUEHANNA - UNIT 2 TS I B 3.8-30 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.16 (continued)

B 3.8.1 ensures that the auto-start logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in ready-to-load statuswhen the DG is at rated speed and voltage, the DG controls are in isochronous and the output breaker is open.

In order to meet this Surveillance Requirement, the Operators must have the capability to manually transfer loads from the D/Gs to the offsite sources. Therefore, in order to accomplish this transfer and meet this Surveillance Requirement, the synchronizing selector switch must be functional. (See ACT-1723538).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a note to accommodate the testing regimen necessary for DG E. See SR 3.8.1.11 for the Bases of the Note.

SR 3.8.1.17

Demonstration of the test mode override ensures that the DG availability under acci_dent conditions is not compromised as the result of testing. Interlocks to the LOCA sensing circuits cause the DG to automatically reset to ready-to-load operation if an ECCS initiation signal is received during operation in the test mode. Ready-to-load operation is defined as the DG running at rated speed and voltage, the DG controls in isochronous, and the DG output breaker open. These provisions for automatic switchover are required by IEEE-308 (Ref. 10), paragraph 6.2.6(2).

The requirement to automatically energize the emergency loads with offsite power is essentially identical to that of SR 3.8.1.12. The intent in the requirements associated with SR 3.8.1.17.b is to show that the emergency loading is not affected by the DG operation in test mode.

In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the emergency loads to perform these functions is acceptable. This test is performed by verifying that after the DG is tripped, the offsite source originally in parallel with the DG, remains connected to the affected 4.16 kV ESS Bus. SR 3.8.1.12 is performed separately to verify the proper offsite loading sequence.

SUSQUEHANNA - UNIT 2 TS I B 3.8-31 (continued)

Revision 2

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.17 (continued)

B 3.8.1 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a note to accommodate the testing regimen necessary for DG E. See SR 3.8.1.11 for the Bases of the Note.

SR 3.8.1.18 Under accident conditions, loads are sequentially connected to the bus by individuai load timers which control the permissive and starting signals to motor breakers to prevent overloading of the AC Sources due to high motor starting currents. The load sequence time interval tolerance ensures that sufficient time exists for the AC Source to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated. Reference 2 provides a summary of the automatic loading of ESS buses. A list of the required timers and the associated setpoints are included in the Bases as Table B 3.8.1-1, Unit 1 and Unit 2 Load Timers. Failure of a timer identified as an offsite power timer may result in both offsite sources inoperable. Failure of any other timer may result in the associated DG being inoperable. A timer is considered failed for this SR if it will not ensure that the associated load will energize within the Allowable Value specified in Table 8 3.8.1-

1. These conditions will require entry into applicable Condition of this specification. With a load timer inoperable, the load can be rendered inoperable to restore OPERABILITY to the associated AC sources. In this condition, the Conditions and Required Actions of the associated specification shall be entered for the equipment rendered inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. '

This SR is modified by a Note that specifies that load timers associated with equipment that has automatic initiation

SUSQUEHANNA- UNIT 2 TS I B 3.8-32 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.18 (continuedl B 3.8.1 capability disabled are not required to be Operable. This is acceptable because if the load does not start automatically, the adverse effects of an improper loading sequence are eliminated. Furthermore, load timers are associated with individual timers such that a single timer only affects a single load.

SR 3.8.1.19 In the event of a OBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.

This Surveillance demonstrates DG operation, as discussed in the Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal in conjunction with an EGGS initiation signal. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified. To simulate the non-LOCA unit 4.16 kV ESS Bus loads on the DG, bounding loads are energized on the tested 4.16 kV ESS Bus after all auto connected emergency loads are energized.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by three Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. Note 1 allows all DG starts to be preceded by an engine prelube period (which for DGs A through D includes operation of the lube oil system to ensure the DG's turbo charger is sufficiently prelubricated). For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine oil being continuously circulated and

SUSQUEHANNA - UNIT 2 TS I B 3.8-33 (continued)

Revision 1

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.19 (continued)

B 3.8.1 engine coolant being circulated as necessary to maintain temperature consistent with manufacturer recommendations.

Note 2 is necessary to accommodate the testing regimen associated with DG E. See SR 3.8.1.11 for the Bases of the Note.

The reason for Note 3 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This Surveillance tests the applicable logic associated with Unit 2. The comparable test specified in the Unit 1 Technical Specifications tests the applicable logic associated with Unit 1. Consequently, a test must be performed within the specified Frequency for each unit. As the Surveillance

. represents separate tests, the Note specifying the restriction for not performing the test while the unit is in MODE 1, 2 or 3 does not have applicability to Unit 1. The Note only applies to Unit 2, thus the Unit 2 Surveillances shall not be performed with Unit 2 in MODE 1, 2 or 3.

SR 3.8.1.20 This Surveillance demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear on the DG during testing. The Note allows all DG starts to be preceded by an engine prelube period (which for DGs A through D includes operation of the lube oil system to ensure the DG's turbo charger is sufficiently prelubricated.) For the purpose of this testing, the DG's must be started from standby conditions, that is, with the engine oil continuously circulated and engine coolant being circulated as necessary to maintain temperature consistent with manufacturer recommendations.

SUSQUEHANNA - UNIT 2 TS I B 3.8-34 (continued)

Revision 1

Rev. 10 AC Sources-Operating

. B 3.8.1 BASES SURVEILLANCE SR 3.8.1.20 (continued)

REQUIREMENTS Note 2 is necessary to identify that this test does not have to be performed with DG E substituted for any DG. The allowance is acceptable based on the design of the DG E transfer switches. The transfer of control, protection, indication, and alarms is by switches at two separate locations. These switches provide a double break between DG E and the redundant system within the transfer switch panel. The transfer of power is through circuit breakers at two separate locations for each redundant system. There are four normally empty switchgear positions at DG E facility, associated with each of the four existing DGs. Only one circuit breaker is available at this location to be inserted into one of the four positions. At each of the existing DGs, there are two switchgear positions with only one circuit breaker available. This design provides two open circuits between redundant power sources. Therefore, based on the described design, it can be concluded that DG redundancy and independence is maintained regardless of whether DG E is substituted for any other DG.

SR 3.8.1.21 This Surveillance is provided to direct that the appropriate Surveillances for Unit 1 AC sources required to support Unit 2 are governed by the Unit 2 Technical Specifications. With the exception of this Surveillance, all other Surveillances of this Specification (SR 3.8.1.1 through SR 3.8.1.20) are applicable to the Unit 2 AC sources only. Meeting the SR requirements of Unit 1 LCO 3.8.1 will satisfy all Unit 2 requirements for Unit 1 AC sources. However, six Unit 1 LCO 3.8.1 SRs, if not required to support Unit 1 OPERABILITY requirements, are not required when demonstrating Unit 1 sources are capable of supporting Unit 2. SR 3.8.1.8 is not required if only one Unit 1 offsite circuit is required by the Unit 2 Specification.

SR 3.8.1.12, SR 3.8.1.13, SR 3.8.1.17, and SR 3.8.1.19 are not required since these SRs test the Unit 2 ECCS initiation signa.1, which is not needed for the AC sources to be OPERABLE on Unit 2.

SR 3.8.1.20 is: not required since starting independence is not required with the DG(s) not required to be OPERABLE.

The Frequency required by the applicable Unit 1 SR also governs performance of that SR for Unit 2.

SUSQUEHANNA- UNIT 2 TS I B 3.8-35 (continued)

Revision O

Rev. 10 AC Sources-Operating

BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.20 (continued)

B 3.8.1 As Noted, if Unit 1 is in MODE 4 or 5, the Note to Unit 1 SR 3.8.2.1 is applicable. This ensures that a Unit 2 SR will not require a Unit 1 SR to be performed, when the Unit 1 Technical Specifications do not require performance of a Unit 1 SR. (However, as stated in the Unit 2 SR 3.8.2.1 Note, while performance of an SR is not required, the SR still must be met).

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.

2. FSAR, Section 8.2.

3. Regulatory Guide 1.9.

4. FSAR, Chapter 6.

5. FSAR, Chapter 15.

6. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132).

7. Regulatory Guide 1.93.

8. Generic Letter 84-15.

9. 10 CFR 50, Appendix A, GDC 18. *

10. IEEE Standard 308.

11. Regulatory Guide 1.137.

12. FSAR, Section 6.3.

13. ASME Boiler and Pressure Vessel Code,Section XI.

14. Letter from R. V. Guzman (USN RC) to B. T. McKinney (PPL)

"Susquehanna Steam Electric Station, Unit 2 - Issuance of Amendment Re : Electrical Power Systems Technical Specification 3.8.1 (T.A.C. MD4766)", dated February 19, 2008 .

SUSQUEHANNA-UNIT2 TS I B 3.8-36 Revision 1

Rev. 10 AC Sources-Operating B 3.8.1 TABLE B 3.8.1-1 (page 1of2)

UNIT 1 AND UNIT 2 LOAD TIMERS NOMINAL DEVICE SETTING ALLOWABLE TAG NO. SYSTEM LOADING TIMER LOCATION (seconds) VALUE (seconds) 62A-20102 RHR Pump 1A 1A201 3 ;::2.7ands3.6 62A-20202 RHR PumP18 1A202 3 ;:: 2.7 ands 3.6 62A-20302 RHR Pump 1C 1A203 3 ;:: 2.7 and s 3.6 62A-20402 RHR Pump 1D 1A204 3 ;:: 2.7 ands 3.6 62A-20102 RHR Pump2A 2A201 3 ;:: 2.7 and s 3.6 62A-20202 RHR Pump28 2A202 3 * ;:: 2.7 and s 3.6 62A-20302 RHR Pump2C 2A203 3 ;:: 2.7 ands 3.6 62A-20402 RHR Pump2D 2A204 3 ;:: 2.7 and s 3.6 E11A-K2028 RHR Pump 1 C (Qffsite Power Timer) 1C618 7.0 ;:: 6.5 ands 7.5 E11A-K120A RHR Pump 1C (Offsite Power Timer) 1C617 7.0 ;:: 6.5 ands 7.5 E11A-K120B RHR Pump 1 D (Offsite Power Timer) 1C618 7.0 ;:: 6.5 ands 7.5 E11A-K202A RHR Pump 1 D (Offsite Power Timer) 1C617 7.0 ;:: 6.5 and s 7.5 E11A-K120A RHR Pump 2C (Offsite Power Timer) 2C617 7.0 ;:: 6.5 and s 7.5 E11A-K2028 RHR Pump 2C (Offsite Power Timer) 2C618 7.0 ;:: 6.5 and s 7.5 E11A-K120B RHR Pump 2D (Offsite Power Timer) 2C618 7.0 ;:: 6.5 and s 7.5 E11A-K202A RHR Pump 2D (Qffsite Power Timer) 2C617 7.0 ;:: 6.5 and s 7.5 .I E21A-K116A CS Pump 1A 1C626 10.5 ;:: 9.4and s 11.6 E21A-K1168 CS Pump 18 1C627 10.5 ;:: 9.4 and s 11.6 E21A-K125A CS Pump 1C ' 1C626 10.5 ;:: 9.4 and s 11.6 E21A-K1258 CS Pump 1D 1C627 10.5 2 9.4 and s 11.6 E21A-K116A CS Pump2A 2C626 10.5 2 9.4 and s 11.6 E21A-K116B CS Pump28 2C627 10.5 ;:: 9.4 ands 11.6 E21A-K125A CS Pump2C 2C626 10.5 ;:: 9.4 and s 11.6 E21A-K1258 CS Pump2D 2C627 10.5 2 9.4 and s 11.6 E21A-K16A CS Pump 1A (Offsite Power Timer) 1C626 15 214.0ands16.0 E21A-K168 CS Pump 18 (Offsite Power Timer) 1C627 15 ;:: 14.0 and s 16.0 E21A-K25A CS Pump 1C (Offsite Power Timer) 1C626 15 ;:: 14.0ands16.0 E21A-K258 CS Pump 1D (Offsite Power Timer) 1C627 15 ;:: 14.0and s 16.0 E21A-K16A CS Pump 2A (Offsite Power Timer) 2C626 15 ;:: 14.0ands16.0 E21A-K168 CS Pump 28 {Offsite Power Timer) 2C627 15 2 14.0 and s 16.0 E21A-K25A CS Pump 2C (Offsite Power Timer) 2C626 15 ;:: 14.0ands16.0 E21A-K258 CS Pump 2D (Offsite Power Timer) 2C627 15 214.0ands16.0 62AX2-20108 Emergency Service Water 1A201 40 >36and <44 62AX2-20208 Emeraency Service Water 1A202 40 ;:: 36 ands 44 62AX2-20303 Emergency Service Water 1A203 44 ;:: 39.6 and s 48.4 62AX2-20403 Emeraencv Service Water 1A204 48 2 43.2 and s 52.8 62X3-20404 Control Structure Chilled Water System OC8778 60 254 62X3-20304 Control Structure Chilled Water Svstem OC877A 60 >54 Emergency Switchgear Rm Cooler A & RHR 62X-20104 OC877A 60 ;::54 SW Pump H&V Fan A Emergency Switchgear Rm Cooler 8 & RHR 62X-20204 OC8778 60 254 SW Pump H&V Fan 8 62X-5653A DG Room Exhaust Fan E3 08565 60 ;::54 62X-5652A DG Room Exhausts Fan E4 08565 60 254 262X-20204 Emeraencv Switchaear Rm Cooler B OC8778 120 ;::54 262X-20104 Emen:iency Switchaear Rm Cooler A OC877A 120 254 62X-546 DG Rm Exh Fan D 08546 120 254

SUSQUEHANNA- UNIT 2* TS I B 3.8-37 (continued)

Revision O

Rev. 10 AC Sources-Operating 8 3.8.1 TABLE B 3.8.1-1 (page 2 of 2)

UNIT 1 AND UNIT 2 LOAD TIMERS NOMINAL DEVICE SETTING ALLOWABLE TAG NO. SYSTEM LOADING TIMER LOCATION (seconds) VALUE (seconds) 62X-536 DG Rm Exh Fan C 08536 120 <:54 62X-526 DG Rm Exh Fan 8 08526 120 <:54 62X-516 DG Rm Exh Fan A 08516 120 <:54 CRX-5652A DG Room Supply Fans E1 and E2 08565 120 <:54 62X2-20410 Control Structure Chilled Water Svstem

OC8768 180 <:54 62X1-20304 Control Structure Chilled Water System OC877A 180 <:54 62X2-20310 Control Structure Chilled Water Svstem OC876A 180 <:54 62X1-20404 Control Structure Chilled Water System OC8778 180 <:54 62X2-20304 Control Structure Chilled Water Svstem OC877A 210 >54 62X2-20404 Control Structure Chilled Water Svstem OC8778 210 <:54 Emergency Switchgear Rm Cooling 62X-K1188 2C82508 260 <:54 Compressor B Emergency Switchgear Rm Cooling 62X-K11A8 2C8250A 260 <:54 Compressor A

SUSQUEHANNA - UNIT 2 TS I B 3.8-38 Revision 1

Rev.5 Diesel Fuel Oil, Lube Oil, and Starting Air

B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES BACKGROUND Each diesel generator (DG) is provided with a storage tank having a fuel oil capacity sufficient to operate that DG for a period of 7 days while the DG is supplying its continuous rated capacity as discussed in FSAR, Section 9.5.4 (Ref. 1). The maximum load demand is calculated using the assumption that at least three DGs are available.

This on-site fuel oil storage tank (FOST) capacity is sufficient to operate the DGs for longer than the time to replenish the onsite supply from outside sources.

Fuel oil is transferred from storage tank to day tank by a transfer pump associated with each storage tank. Independent pumps and piping preclude the failure of one pump, or the rupture of any pipe, valve, or tank to result in the loss of more than one DG. All outside tanks, pumps, and piping are located underground.

For proper operation of the standby DGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses the recommended fuel oil practices as supplemented by ANSI N195 (Ref. 3). The fuel oil properties governed by these SRs are the water and sediment content, the kinematic viscosity, specific gravity (or API gravity) and impurity level.

The DG lubrication system is designed to provide sufficient lubrication to permit proper operation of its associated DG under all loading conditions. The system is required to circulate the lube oil to the diesel engine working surfaces and to remove excess heat generated by friction during operation. Each engine oil sump contains an inventory capable of supporting a minimum of 7 days of operation. This supply is sufficient to allow the operator to replenish lube oil from outside sources.

Each DG has an air start system with two air receivers (DG E has four air receivers) and each DG air start system provides adequate capacity for five successive start cycles on the DG without recharging the air start receivers. Each bank of two air receivers for DG E has adequate capacity for a minimum of five successive start cycles .

SUSQUEHANNA - UNIT 2 TS/ B 3.8-47 (continued)

Revision 3

Rev. 5 Diesel Fuel Oil, Lube Oil, and Starting Air

BASES (continued)

APPLICABLE SAFETY ANALYSES The initial conditions of Design Basis Accident (OBA) and transient analyses in FSAR, Chapter6 (Ref. 4), and Chapter 15 (Ref. 5), assume B 3.8.3 Engineered Safety Feature (ESF) systems are OPERABLE. The DGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.

Since diesel fuel oil, lube oil, and starting air subsystem support the operation of the standby AC power sources, they satisfy Criterion 3 of the NRC Policy Statement (Ref. 6).

LCO Stored diesel fuel oil is required to have sufficient supply for 7 days of full load operation. It is also required to meet specific standards for quality.

Additionally, sufficient lube oil supply must be available to ensure the capability to operate at full load for 7 days. This requirement, in conjunction with an ability to obtain replacement supplies within 7 days, supports the availability of DGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational occurrence (AOO) or a postulated OBA with loss of offsite power. DG day tank fuel oil requirements, as well as transfer capability from the storage tank to the day tank, are addressed in LCO 3.8.1, "AC Sources-Operating," and LCO 3.8.2, "AC Sources-Shutdown."

The starting air system is required to have a minimum capacity for five successive DG start attempts without recharging the air start receivers.

APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AOO or a postulated OBA.

Because stored diesel fuel oil, lube oil, and starting air subsystem support LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil, lube oil,

SUSQUEHANNA - UNIT 2 TS I B 3.8-48 (continued)

Revision O

Rev. 5 Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES APPLICABILITY and starting air are required to be within limits when the associated DG is (continued) required to be OPERABLE.

ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each DG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable DG subsystem. Complying with the Required Actions for one inoperable DG subsystem may allow for continued operation, and subsequent inoperable DG subsystem(s) governed by separate Condition entry and application of associated Required Actions.

In this Condition, the 7 day fuel oil supply for a DG is not available.

However, the Condition is restricted to fuel oil level reductions that maintain at least a 6 day supply. These circumstances may be caused by events such as:

a. Full load operation required for an inadvertent start while at minimum required level; or

b. Feed and bleed operations that may be necessitated by increasing particulate levels or any number of other oil quality degradations.

This restriction allows sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of the fuel oil to the tank. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration of the required level prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity(> 6 days), the fact that action will be initiated to obtain replenishment, the availability of fuel oil in the storage tank of the fifth diesel generator that is not required to be OPERABLE, and the low probability of an event during this brief period. *

SUSQUEHANNA - UNIT 2 TS I B 3.8-49 (continued)

Revision O

Rev.5 Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS (continued)

With lube oil sump level not visible in the sight glass, sufficient lube oil to support 7 days of continuous DG operation at full load conditions may not be available. Therefore, the DG is declared inoperable immediately.

This Condition is entered as a result of a failure to meet the acceptance criterion for particulates. Normally, trending of particulate levels allows sufficient time to correct high particulate levels prior to reaching the limit of acceptability. Poor sample procedures (bottom sampling), contaminated sampling equipment, and errors in laboratory analysis can produce failures that do not follow a trend. Since the presence of particulates does not mean failure of the fuel oil to bum properly in the diesel engine, since particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and since proper engine performance has been recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated DG inoperable. The 7 day Completion Time allows for further evaluation, resampling, and re-analysis of the DG fuel oil.

With the new fuel oil properties defined in the Bases for SR 3.8.3.3 not within the required limits, a period of 30 days is allowed for restoring the stored fuel oil properties. This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, or to restore the stored fuel oil properties. This restoration may involve feed and bleed procedures, filtering, or combination of these procedures. Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits, there is high likelihood that the DG would still be capable of performing its intended function.

SUSQUEHANNA - UNIT 2 TS/ B 3.8-50 (continued)

Revision O

Rev.5 Diesel Fuel Oil, Lube Oil, and Starting Air

BASES ACTIONS (continued)

B 3.8.3 With starting air receiver pressure < 240 psig in one or more air receivers, sufficient capacity for five successive DG start attempts can not be provided by the air start system. However, as long as all receiver pressures are > 180 psig, there is adequate capacity for at least one start attempt, and the DG can be considered OPERABLE while the air receiver pressure is restored to_the required limit. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration to the required pressure prior to declaring the DG inoperable. This period is acceptable based on the remaining air start capacity, the fact that most DG starts are accomplished on the first attempt, and the low probability of an event during this brief period. Entry into Condition E is not required when air receiver pressure is less than required limits following a successful start while the DG is operating.

With a Required Action and associated Completion Time of A through E not met, or the stored diesel fuel oil, lube oil, or starting air not within SR limits for reasons other than addressed by Conditions A, B, C, D or E, the associated DG may be incapable of performing its intended function and must be immediately declared inoperable.

SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the storage tanks to support each DG's operation for 7 days at continuous rated capacity which is greater than the maximum post LOCA load demand. The 7 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SUSQUEHANNA - UNIT 2 TS I B 3.8-51 (continued)

Revision 4

Rev.5 Diesel Fuel Oil, Lube Oil, and Starting Air

BASES SU RVEILIJ..NCE REQUIREMENTS SR 3.8.3.2 B 3.8.3 (continued) This Surveillance ensures that sufficient lubricating oil inventory is available to support at least 7 days of full load operation for each DG. The sump level requirement is based on the DG manufacturer's consumption values. The acceptance criteria of maintaining a visible level in the sight glass ensures adequate inventory for 7 days of full load operation without .

the level reaching the manufacturer's recommended minimum level.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. I*

SR 3.8.3.3 The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows:

a. Sample the new fuel oil following the guidelines of ASTM 04057 (Ref. 7);

b. Verify, following the guidelines of the tests specified in ASTM 0975 (Ref. 7), that the sample has:

- a Density at 15°C of;;:: 0.835 kg/Land~ 0.876 kg/Lor an API Gravity of 2 30 and ~ 38

- a Kinematic Viscosity at 40°C of;;:: 1.9 centistokes and :::; 4.1 centistokes

- A Flash Point of;;:: 52°C

SUSQUEHANNA- UNIT 2 TS I B 3.8-52 (continued)

Revision 4

Rev. 5 Diesel Fuel Oil, Lube Oil, and Starting Air

BASES SURVEILLANCE REQUIREMENTS SR 3.8.3.3 (continued)

B 3.8.3

c. Verify that the new fuel oil has a clear and bright appearance when tested following the guidelines of ASTM 04176 procedure (Ref. 7),

or has :::; 0.05% (vol) water and sediment when tested following the guidelines of ASTM 01796 (Ref. 7). Note that if dye is used in the diesel fuel oil, the water and sediment test must be performed.

Failure to meet any of the limits for key properties of new fuel oil prior to addition to the storage tank is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.

Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Specification 5.5.9 and Reference 7 are met for new fuel oil when tested following the guidelines of ASTM 0975 (Ref. 7). The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on OG operation. This Surveillance ensures the availability of high quality fuel oil for the OGs .

Fuel oil degradation during long term storage shows up as an increase in particulate, mostly due to oxidation. The presence of particulate does not mean that the fuel oil will not bum properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure.

Particulate concentrations should be determined following the guidelines of ASTM 02276 (Ref. 7), appropriately modified to increase the range to

> 10 mg/I. This method involves a gravimetric determination of total particulate concentration in the fuel oil. This limit is 10 mg/I. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing. The Frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between Frequency intervals~

SR 3.8.3.4 This Surveillance ensures that, without the aid of the refill compressor, .

sufficient air start capacity for each OG is available. The system design requirements provide for a minimum of five engine start cycles without recharging.

SUSQUEHANNA - UNIT 2 TS I B 3.8-53 (continued)

Revision 1

Rev. 5 Diesel Fuel Oil, Lube Oil, and Starting Air

. B 3.8.3 BASES SURVEILLANCE SR 3.8.3.4 (continued)

REQUIREMENTS The pressure specified in this SR is intended to reflect the lowest value at which the five starts can be accomplished. The air starting system capacity for each start cycle is calculated based on the following:

1. each cranking cycle duration should be approximately three seconds, or

2. consist of two to three engine revolutions, or

3. air start requirements per engine start provided by the engine manufacturer, whichever air start requirement is larger.

This Surveillance is modified by a Note, which does not require the SR to be met when the associated DG is running. This is acceptable because once the DG is started the safety function of the air start system is performed .

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.3.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel storage tanks periodically eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation.

Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and

SUSQUEHANNA - UNIT 2 TS/ B 3.8-54 (continued)

Revision 1

Rev.5 Diesel Fuel Oil, Lube Oil, and Starting Air

BASES SURVEILLANCE REQUIREMENTS SR 3.8.3.5 (continued)

B 3.8.3 provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 9.5.4.

2. Regulatory Guide 1.137.

3. ANSI N195, 1976.

4. FSAR, Chapter 6.

5. FSAR, Chapter 15.

6. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132).

7. ASTM Standard:* 04057; 0975; 04176; 01796; and 02276 .

SUSQUEHANNA - UNIT 2 TS/ B 3.8-55 Revision 2

Rev. 4 DC Sources-Operating

B 3.8 B 3.8.4 ELECTRICAL POWER SYSTEMS DC Sources-Operating B 3.8.4 BASES BACKGROUND The DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment. As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure.

The DC electrical power system also conforms to the recommendations of Regulatory Guide 1.6 (Ref. 2) and IEEE-308 (Ref. 3).

The Unit 2 DC power sources provide both motive and control power to selected safety related equipment, as well as circuit breaker control power for the nonsafety related 13~8 kV, 4.16 kV, and 480 V and lower AC distribution systems. Each DC subsystem is energized by one 125/250 V battery and at least 1 Class 1E battery charger. The 250 V DC batteries for division I are* supported by two full capacity chargers; the 250 V DC batteries for division II are supported by a full capacity charger; and, the 125 V DC batteries are each supported by a single full capacity charger. Each battery is exclusively associated with a single 125/250 VDC bus and cannot be interconnected with any other 125/250 VDC subsystem. The chargers are supplied from the same AC load groups for which the associated DC subsystem supplies the control power. Transfer switches provide the capability to power Unit 1 and common DC loads from Unit 2 DC sources.

Diesel Generator (DG) E DC power sources provide control and instrumentation power for DG E.

During normal operation, the DC loads are powered from the battery chargers with the batteries floating on the system. In case of loss of normal power to the battery charger, the DC loads are automatically powered from the station batteries.

The DC power distribution system is described in more detail in Bases for LCO 3.8.7, "Distribution System-Operating," and LCO 3.8.8, "Distribution System-Shutdown."

SUSQUEHANNA-UNIT2 TS I B 3.8-56 (continued)

Revision 2

Rev.4 DC Sources-Operating

BASES BACKGROUND Each battery has adequate storage capacity to meet the battery duty B 3.8.4 (continued) load profiles in the FSAR, Chapter 8 Tables (Ref. 12). The battery is designed with additional capacity above that required by the design duty cycle to allow for temperature variations and other factors.

Each subsystem, including the battery bank, chargers and DC switchgear, is located in an area separated physically and electrically from the other subsystems to ensure that a single failure in one subsystem does not cause a failure in a redundant subsystem. There is no sharing between redundant Class 1 E subsystems such as batteries, or battery chargers. --

The batteries for the electrical power subsystems are sized to produce required capacity at 80% of design rating, corresponding to warranted capacity at end of life cycles and the 100% design demand. The minimum design voltage limit is 105/210 Vat the battery terminals.

The battery cells are of flooded lead acid construction with a nominal specific gravity of 1.215. This specific gravity corresponds to an open circuit voltage of approximately 124 V for a 60 cell battery (i.e., cell voltage of 2.06 volts per cell (Vpc)). The open circuit voltage is the voltage maintained when there is no charging or discharging. Once fully charged with its open circuit voltage ~ 2.06 Vpc, the battery cell will maintain its capacity for 30 days without further charging per manufacturer's instructions. Optimal long term performance however, is obtained by maintaining a float voltage of 2.20 to 2.25 Vpc. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge. The nominal float voltage of 2.2 Vpc

corresponds to a total float voltage output of 132 V for a 60 cell battery as discussed in the FSAR, Chapter 8 (Ref. 12).

Each battery charger of DC electrical power subsystem has ample power output capacity for the steady state operation of connected loads required during normal operation, while at the same time maintaining its battery bank fully charged. Each battery charger has sufficient capacity to restore the battery from the design minimum charge to its fully charged state within design basis requirements while supplying normal steady state loads (Ref. 12) .

SUSQUEHANNA - UNIT 2 TS I B 3.8-57 (continued)

Revision 2

Rev. 4 DC Sources-Operating

BASES BACKGROUND B 3.8.4 The battery charger is normally in the float-charge mode. Float-charge is (continued) the condition in which the charger is supplying the connected loads and the battery cells are receiving adequate current to optimally charge the battery. This assures the internal losses of a battery are overcome and the battery is maintained in a fully charged state.

When desired, the charger can be placed in the equalize mode. The equalize mode is at a higher voltage than the float mode and charging current is correspondingly higher. The battery charger is operated in the equalize mode after a battery discharge or for routine maintenance.

Following a battery discharge, the battery recharge characteristic accepts current at the current limit of the battery charger (if the discharge was significant, e.g. following a battery seivice test) until the battery terminal voltage approaches the charger voltage setpoint. Charging current then reduces exponentially during the remainder of the recharge cycle. Lead-calcium batteries have recharge efficiencies of greater than 95%, so once at least 105% of the ampere-hours discharged have been returned, the battery capacity would be restored to the same condition as it was prior to the discharge. This can be monitored by direct observation of the exponentially decaying charging current or by evaluating the amp-hours discharged from the battery and amp-hours returned to the battery.

APPLICABLE The initial conditions of Design Basis Accident (OBA) and transient SAFETY ANALYSES analyses in the FSAR, Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5),

assume that Engineered Safety Feature (ESF) systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation. The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining DC sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite AC power or all onsite AC power; and

b. A worst case single failure.

The DC sources satisfy 9riterion 3 of the NRC Policy Statement (Ref. 6) .

SUSQUEHANNA - UNIT 2 TS I B 3.8-58 (continued)

Revision 2

Rev.4 DC Sources-Operating

BASES (continued)

LCO The DC electrical power subsystems are required to be OPERABLE to B 3.8.4 ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. Loss of any DC electrical power subsystem does not prevent the minimum safety function from being performed (Ref. 12).

The DC electrical power subsystems include:

a. each Unit 2 and Unit 1 DC electrical power subsystem identified in Table 3.8.4-1includinga125 volt or 250 volt DC battery bank in parallel with a battery charger and the corresponding control equipment and interconnecting cabling supplying power to the associated bus; and, /

b. the Diesel Generator E DC electrical power subsystem identified in Table 3.8.4-1 including a 125 volt DC battery bank in parallel with a battery charger and the corresponding control equipment and interconnecting cabling supplying power to the associated bus .

APPLICABILITY The DC electrical power sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure safe unit operation and to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.

The DC electrical power requirements for MODES 4 and 5 are addressed in the Bases for LCO 3.8.5, "DC Sources-Shutdown."

SUSQUEHANNA - UNIT 2 TS I B 3.8-59 (continued)

Revision 2

Rev. 4 DC Sources-Operating

(continued)

ACTIONS A.1, A.2, A.3 B 3.8.4 Condition A represents one subsystem with one (or two) battery chargers inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period.

Required Action A.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability.

A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus, there is good assurance of fully recharging the battery within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , avoiding a premature shutdown.

If established battery terminal voltage cannot be restored to greater than or equal to the minimum established float voltage within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , and the charger is not operating in the current-limiting mode, a faulty charger is indicated. A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide assurance that it can revert to and operate properly in the current limit mode that is necessary during the recovery period following a battery discharge event that the DC system is designed for.

If the charger is operating in the current limit mode after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition, in this case, is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery.

SUSQUEHANNA- UNIT 2 TS I B 3.8-60 (continued)*

Revision 3

Rev.4 DC Sources-Operating

BASES (continued)

ACTIONS A.1, A.2, A.3 * (continued)

B 3.8.4 (continued)

The charge time can be extensive, and there is not adequate assurance that it can be recharged to comply with the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time of Required Action A.2.

Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps. Float current less than 2 amps indicates that, if the battery had been discharged as the result of the inoperable battery charger, it is now fully capable of supplying the

maximum expected load requirement. The 2 amp value is based on documentation from the battery manufacturer that charging current less than 2 amps indicates a battery with a full state of charge (Reference 13). If monitoring the battery float current during the initial 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period does not verify that the current is less than or equal to 2 amps at the expiration .of the initial 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period, the battery must be declared inoperable. During subsequent 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months periods, if the battery float current is greater than 2 amps, there may be additional battery problems and the battery must be declared inoperable .

Required Action A.3 limits the restoration time for the inoperable battery charger to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger with sufficient capacity such that it is fully capable of restoring the battery voltage to the minimum acceptable limits, carrying respective DC bus loads, and maintaining the battery in a fully charged condition). The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status and is consistent with the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

Completion Time for the SSES emergency diesel generators.

Condition A is modified by a Note that states that Condition A is not applicable to the DG E DC electrical power subsystem. Condition E or F is applicable to an inoperable DG E DC electrical power subsystem.

Condition B represents one subsystem with one battery bank inoperable. With one battery bank inoperable, the DC bus is being supplied by the OPERABLE battery charger. Any event that results in a loss of the AC bus supporting the battery charger will also result in loss of DC to that subsystem. Recovery of the AC bus, especially if it is due to a loss of

SUSQUEHANNA - UNIT 2 TS I B 3.8-61 (continued)

Revision 3

Rev.4 DC Sources-Operating B 3.8.4 BASES (continued)

ACTIONS B.1 (continued)

(continued) offsite power, will be hampered by the fact that many of the components necessary for the recovery (e.g., diesel generator control and field flash, AC load shed, and diesel generator output circuit breakers, etc.) may rely upon the battery. In addition, the energization transients of any DC loads that are beyond the capability of the battery charger and normally require the assistance of the battery will not be able to be brought online. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit allows sufficient time to effect restoration of an inoperable battery bank given that the majority of the conditions that lead to battery inoperability (e.g., loss of battery charger, battery cell voltage less than 2.07 V, etc.) are identified in Specifications 3.8.4, 3.8.5, and 3.8.6 together with additional specific Completion Times.

Condition B is modified by a Note that states that Condition B is not applicable to the DG E DC electrical power subsystem. Condition E or F is applicable to an inoperable DG E DC electrical power subsystem .

Condition C represents one subsystem with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is therefore imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected division. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with the allowed time for an inoperable DC Distribution System division.

If one of the required DC electrical power subsystems is inoperable, as a result of equipm_ent other than the battery or battery charger being inoperable, the remaining DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst case single failure could, however, result in the loss of minimum necessary DC electrical subsystems to mitigate a worst case accident, continued power operation should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is based on Regulatory Guide 1.93 (Ref. 7) and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.8-62 Revision 3.

Rev.4 DC Sources-Operating

B 3.8.4 BASES (continued)

ACTIONS C.1 (continued)

(continued)

Condition C is modified by a Note that states that Condition C is not applicable to the DG E DC electrical power subsystem.

Condition E or F is applicable to an inoperable DG E DC electrical power subsystem.

D.1 and D.2 I*

If two Unit 2 DC electrical power subsystems are inoperable or if an inoperable Unit 2 DC electrical power subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based.on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. The Completion Time to bring the unit to MODE 4 is consistent with the time* required in

Regulatory Guide 1.93 (Ref. 7) .

SUSQUEHANNA - UNIT 2 TS I B 3.8-63 (continued)

Revision 3

Rev. 4 DC Sources-Operating

BASES ACTIONS B 3.8.4 (continued)

If Diesel Generator E is not aligned to the class 1E distribution system, the only supported safety function is for the ESW system. Therefore, under this condition, if Diesel Generator E DC power subsystem is not OPERABLE actions are taken to either restore the battery to OPERABLE status or shutdown Diesel Generator E and close the associated ESW valves in order to ensure the OPERABILITY of the ESW system. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with the allowed time for other inoperable DC sources and provides sufficient time to evaluate the condition of the battery and take the corrective actions.

If the Diesel Generator is aligned to the class 1E distribution system, the loss of Diesel Generator E DC power subsystem will result in the loss of a on-site Class 1E power source. Therefore, under this condition, if Diesel Generator E DC power subsystem is not OPERABLE actions are taken to either restore the battery to OPERABLE status or declare Diesel Generator E inoperable and take Actions of LCO 3.8.1. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with the allowed time for other DC sources and provides sufficient time to evaluate the condition of the battery and take the necessary corrective actions.

G.1 and G.2 With one or more DC Unit 1 DC power subsystems inoperable, the remaining DC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. However, overall reliability is reduced because a single failure in the remaining DC electrical power distribution subsystems could result in the minimum required ESF functions not being supported. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is consistent with the Completion Times associated with a loss of one or more DC distribution subsystems and will allow sufficient time to restore power.

SUSQUEHANNA - UNIT 2 TS I B 3.8-64 (continued)

Revision 3

Rev. 4 DC Sources-Operating

BASES ACTIONS G.1 and G.2 (continued)

B 3.8.4 Completion of Required Action G.1 causes Unit 1 loads to be powered from a Unit 2 DC electrical power subsystem. Although the corresponding Unit 2 DC electrical power subsystems are evaluated

for this condition, the CONDITION violates a design commitment to maintain DC power separation between units. To minimize the time this condition exists, Required Action G.2 directs power to be restored to the corresponding Unit 1 DC electrical power subsystem, which restores power to the common loads, or requires that the Unit 1 and common loads be declared inoperable. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months provides sufficient time to restore power and acknowledges the fact that the condition, although not consistent with all design requirements, maintains all required safety systems available.

If Unit 1 and common loads required to support Unit 2 cannot be transferred to corresponding Unit 2 DC electrical power subsystem when Unit 1 DC sources are inoperable; or, cannot be transferred back to a Unit 1 DC source when the Unit 1 DC source becomes OPERABLE, the associated loads may be incapable of performing their intended function and must be declared inoperable immediately.

(continued)

SUSQUEHANNA- UNIT 2 TS I B 3.8-65 Revision 4 i

I L_

Rev. 4 DC Sources-Operating

BASES (continued)

SURVEILLANCE SR 3.8.4.1 B 3.8.4 REQUIREMENTS Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the battery chargers, which support the ability of the batteries to perform their intended function.

Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state while supplying the continuous steady state loads of the associated DC subsystem. On float charge, battery cells will receive adequate current to optimally charge the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum float voltage established by the battery manufacturer.

This voltage maintains the battery plates in a condition that supports maintaining the grid life (expected to be approximately 20 years). The minimum established float voltage for OPERABILITY per SR 3.8.4.1 is 129 VDC for 125 VDC and 258 VDC for 250 VDC batteries. This voltage should be adjusted downward by 2.20 VDC for any cells jumpered out of the battery bank. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SR 3.8.4.2 This SR verifies the design capacity of the battery chargers. According to Regulatory Guide 1.32 (Ref. 9), the battery charger supply is recommended to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, irrespective of the status of the unit during these demand occurrences. The minimum required amperes and duration ensures that these requirements can be satisfied.

This SR requires that each battery charger be capable of supplying DC current to its associated battery bank at the minimum established float voltage for greater than or equal to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The ampere requirements are based on the output rating of the chargers. The voltage requirements are based on the charger voltage level after a response to a loss of AC power. The time period is sufficient for the charger temperature to have stabilized and to have been maintained for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

SUSQUEHANNA - UNIT 2 TS I B 3.8-66 (continued)

Revision 6

Rev.4 DC Sources-Operating

BASES SURVEILLANCE SR 3.8.4.2 (continued)

B 3.8.4 REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.4.3 A battery service test is a special test of the battery's capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The test can be conducted using actual or simulated loads. The discharge rate and test length corresponds to the design duty cycle requirements as specified in Reference 12.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. Note 1 allows the performance of a modified performance discharge test SR 3.8.6.6 in lieu of a service test SR 3.8.4.3 .

The reason for Note 2 is that performing the Surveillance would rel')1ove a required DC electrical power subsystem from service, perturb the Electrical Distribution System, and challenge safety systems. Credit may be taken for unplanned events that satisfy the Surveillance. Examples of unplanned events may include:

1. Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation is available; and

2. Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SUSQUEHANNA- UNIT 2 TS I B 3.8-67 (Continued)

Revision 5

Rev.4 DC Sources-Operating

BASES (continued)

SURVEILLANCE SR 3.8.4.3 (continued)

B 3.8.4 REQUIREMENTS Since the Diesel Generator E DC electrical power subsystem does not support loads other than the Diesel Generator E required loads, the mode restriction note need not be applied to the Diesel Generator E subsystem unless it is aligned to the class 1E distribution subsystem.

The note does have applicability to the Diesel Generator E subsystem when the Diesel Generator E is substituted for one of the other Diesel Generators. When the Diesel Generator E is aligned to the class 1E distribution subsystem, the Diesel Generator E subsystem is required to support operability of the Diesel Generator E. Thus when in this configuration, the note does need to be applicable since performing the Surveillance would remove a required DC electrical power subsystem from service.

SR 3.8.4.4 This Surveillance is provided to direct that Surveillances for the Unit 1 DC sources required to support Unit 2 are governed by the Unit 2 Technical Specifications. When Unit 1 DC Sources are required to be Operable to support Unit 2, the Unit 1 Surveillances must be met.

Performance of a Unit 1 Surveillance at the specified Frequency will satisfy Unit 2 requirements.

When Unit 1 is in MODE 4 or 5 or moving irradiated fuel assemblies in the secondary containment, a Note to SR 3.8.5.1 specifies that some SRs are required to be met but do not have to be performed. The Note to Unit 2 SR 3.8.5.1 states that the Note to Unit 1 SR 3.8.2.1 is applicable if Unit 1 is in MODE 4 or 5. This ensures that Unit 2 Technical Specifications do not require a Unit 1 SR to be performed, when the Unit 1 Technical Specifications does not require performance of a Unit 1 SR.

SUSQUEHANNA- UNIT 2 TS/ B 3.8-68 (continued)

Revision 4

Rev. 4 DC Sources-Operating

BASES (continued)

REFERENCES 1: 10 C.FR.50, Appendix A, GDC 17.

B 3.8.4

2. Regulatory Guide 1.6.

3. IEEE Standard 308.

4. FSAR, Chapter 6.

5. FSAR, Chapter 15.

6. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132).

7. Regulatory Guide 1.93.

8. IEEE Standard 450.

9. Regulatory Guide 1.32, February 1977.

10. Regulatory Guide 1.129, Apnl 1977, February 1978.

11. IEEE Standard 485.

12. FSAR Chapter 8, Section 8.3.2.1.1.6.

13. Letter from C&D Technologies, Inc. - Power Solutions, "Float Current Used as an Indicator of Battery Charge State", to L. R.

Casella, dated August 9, 2006 .

SUSQUEHANNA - UNIT 2 TS i B 3.8-69 Revision 5

Rev.2 Battery Parameters

B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.6 Battery Parameters B 3.8.6 BASES BACKGROUND This LCO delineates the limits on battery float current as well as electrolyte temperature, level, and float voltage for the DC electrical power subsystems batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC Sources - Operating," and LCO 3.8.5, "DC Sources - Shutdown." In addition to the limitations of this Specification, the Battery Monitoring and Maintenance Program also implements a program specified in Specification 5.5.13 for monitoring various battery parameters that is based on the recommendations of IEEE Standard 450-1995, IEEE Recommended Practice for Maintenance, Testing, and Replacement of Vented Lead-Acid Batteries for Stationary Applications" (Ref. 4).

The battery cells are of flooded lead acid construction with a nominal specific gravity of 1.215. This specific gravity corresponds to an open circuit battery voltage of approximately 124 V for a 60 cell battery (i.e., cell voltage of 2.06 volts per cell (Vpc)). The open circuit voltage is the voltage maintained when there is no charging or discharging .

Once fully charged with its open circuit voltage;;:: 2.06 Vpc, the battery cell will maintain its capacity for 30 days without further charging per manufacturer's instructions. Optimal long term performance however, is obtained by maintaining a float voltage of 2.20 to 2.25 Vpc. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge. The nominal float voltage of 2.2 Vpc corresponds to a total float voltage output of 132 V for a 60 cell battery as discussed in the FSAR, Chapter 8 (Ref. 5).

APPLICABLE The initial conditions of Design Basis Accident (OBA) and transient SAFETY ANALYSES analyses in FSAR, Chapter6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE. The DC electrical power subsystems provide normal and emergency DC electrical power for the diesel generators (DGs), emergency auxiliaries, and control and switching during all MODES of operation.

SUSQUEHANNA - UNIT 2 TS/ B 3.8-77 (continued)

Revision 1

Rev.2 Battery Parameters

BASES APPLICABLE The OPERABILITY of the DC subsystems is consistent with the initial B 3.8.6 SAFETY ANALYSES assumptions of the accident analyses and is based upon meeting the (continued) design basis of the unit. This includes maintaining DC sources identified in Table 3.8.4-1 OPERABLE during accident conditions, in the event of:

a. An assumed loss of all offsite AC or all onsite AC power; and

b. A worst case single failure.

Since battery parameters support the operation of the DC electrical power subsystems, they satisfy Criterion 3 of the NRG Policy Statement (Ref. 3).

LCO Battery parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated OBA Battery parameter limits are conservatively established, allowing continued DC electrical system function even with limits not met. Additional preventative maintenance, testing, and monitoring performed in accordance with the Battery Monitoring and Maintenance Program is conducted as specified in Specification 5.5.13, Programs and Manuals.

APPLICABILITY The battery parameters are required solely for the support of the associated DC electrical power subsystem. Therefore, battery parameters are required to be within required limits only when the associated DC power source is required to be OPERABLE. Refer to the Applicability discussions in Bases for LCO 3.8.4 and LCO 3.8.5.

SUSQUEHANNA- UNIT 2 TS I B 3.8-78 (continued)

Revision 1

Rev. 2 Battery Parameters

BASES (continued)

ACTIONS B 3.8.6 A Note has been added to provide clarification that, for the purpose of this LCO, separate Condition entry is allowed for each battery. This is acceptable, since the Required Actions for each Condition provide .

appropriate compensatory actions for each inoperable battery. Complying with the Required Actions may allow for continued operation, and subsequent inoperable batteries are governed by subsequent Condition entry and application of associated Required Actions.

A.1, A.2, and A.3 With one or more cells in one 125 voe subsystem or one 250 VDC subsystem< 2.07 V, the battery cell is degraded. Within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage (SR 3.8.4.1) and of the overall battery state of charge by monitoring the battery float charge current (SR 3.8.6.1). This assures that there is still sufficient battery capacity to perform the intended function. Therefore, the affected battery is not required to be considered inoperable solely as a result of one or more cells< 2.07 V, and continued operation is permitted for a limited period up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Since the Required Actions only specify "perform," a failure of SR 3.8.4.1 or 3.8.6.1 acceptance criteria does not result in this Required Action not met. However, if one of the SRs is failed the appropriate Condition(s),

depending on the cause of the failures, is entered. If SR 3.8.4.1 or 3.8.6.1 is failed then there is not assurance that there is still sufficient battery capacity to perform the intended function and the battery must be declared inoperable immediately.

B.1and8.2 One or more batteries in one 125 VOC subsystem or one 250 VDC subsystem with float current > 2 amps indicates that a partial discharge of the battery capacity has occurred. This may be due to a temporary loss of a battery charger or possibly due to one or more battery cells in a low voltage condition reflecting some loss of capacity. Within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage.

SUSQUEHANNA - UNIT 2 TS I B 3.8-79 (continued)

Revision 1

Rev. 2 Battery Parameters

BASES ACTIONS B.1 and B.2 (continued)

B 3.8.6 (continued)

If the terminal voltage is found to be less than the minimum established float voltage there are two possibilities, the battery charger is inoperable or is operating in the current limit mode. If the charger is operating in the current limit mode after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months that is an indication that the battery has been substantially discharged and likely cannot perform its required design functions. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (Required Action B.2). The battery must therefore be declared inoperable.

If the float voltage is found to be satisfactory but there are one or more battery cells with float voltage less than 2.07 V, the associated "OR" statement in Condition F is applicable and the battery must be declared inoperable immediately. If float voltage is satisfactory and there are no cells less than 2.07 V there is good assurance that, within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , the battery will be restored to its fully charged condition (Required Action B.2) from any discharge that might have occurred due to a temporary loss of the battery charger. A discharged battery with float voltage (the charger setpoint) across its terminals indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a-function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , avoiding a premature shutdown with its own attendant risk.

If the condition is due to one or more cells in a low voltage condition but still greater than 2.07 V and float voltage is found to be satisfactory, this is not indication of a substantially discharged battery and 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is a reasonable time prior to declaring the battery inoperable.

Since Required Action B.1 only specifies "perform," a failure of SR 3.8.4.1 acceptance criteria does not result in the Required Action not met.

However, if SR 3.8.4.1 is failed, the appropriate Condition(s), depending on the cause of the failure, is entered.

SUSQUEHANNA - UNIT 2 TS I B 3.8-80 (continued)

Revision 1

Rev.2 Battery Parameters

BASES ACTIONS C.1. C.2. and C.3 B 3.8.6 (continued)

With one 125 VDC subsystem or one 250 VOC subsystem with one or more cells electrolyte level above the top of the plates, but below the minimum established design limits, the battery still retains sufficient capacity to perform the intended function. Therefore, the affected battery is not required to be considered inoperable solely as a result of electrolyte level not met. Within 31 days the minimum established design limits for electrolyte level must be re-established.

With electrolyte level below the top of the plates there is a potential for dryout and plate degradation. Required Actions C.1 and C.2 address this potential (as well as provisions in Specification 5.5.13, Battery Monitoring and Maintenance Program). They are modified by a note that indicates they are only applicable if electrolyte level is below the top of the plates. Within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months level is required to be restored to above the top of the plates. The Required Action C.2 requirement to verify that there is no leakage by visual inspection and the Specification 5.5.13.b item to initiate action to equalize and test in

accordance with manufacturer's recommendations are taken from Annex 0 of IEEE Standard 450-1995. They are performed following the restoration of the electrolyte level to above the top of the plates.

Based on the results of the manufacturer's recommended testing the battery may have to be declared inoperable and the affected cell(s) replaced.

With one 125 voe subsystem or one 250 VDC subsystem with pilot cell temperature less than the minimum established design limits, 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is allowed to restore the temperature to within limits. A low electrolyte temperature limits the current and power available. Since the battery is sized with margin, while battery capacity is degraded, sufficient capacity exists to perform the intended function and the affected battery is not required to be considered inoperable solely as a result of the pilot cell temperature not met

SUSQUEHANNA- UNIT 2 TS I B 3.8-81 (continued)

Revision 1

Rev.2 Battery Parameters

BASES ACTIONS B 3.8.6 (continued)

With one or more batteries in redundant DC electrical subsystems with battery parameters not within limits there is not sufficient assurance that battery capacity has not been affected to the degree that the batteries can still perform their required function given that redundant batteries are involved. With redundant batteries involved, this potential could result in a total loss of function on multiple systems that rely upon the batteries. The longer completion times specified for battery parameters on non-redundant batteries not within limits are therefore not appropriate and the parameters must be restored to within limits on at least one DC Subsystem or Division within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

When any battery parameter is outside the allowances of the Required Actions for Condition A, B, C, D, or E sufficient capacity to supply the maximum expected load requirement is not ensured and the corresponding battery must be declared inoperable. Additionally, discovering one or more batteries with one or more battery cells float voltage less than 2.07 V and float current greater than 2 amps indicates that the battery capacity may not be sufficient to perform the intended functions. The battery must therefore be declared inoperable immediately.

SUSQUEHANNA - UNIT 2 TS I B 3.8-82 (continued)

Revision 1

Rev.2 Battery Parameters

BASES (continued)

SURVEILLANCE SR 3.8.6.1 B 3.8.6 REQUIREMENTS Verifying battery float current while on float charge is used to determine the state of charge of the battery. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a charged state.

The float current requirements are based on the float current indicative of a charged battery. Use of float current to determine the state of charge of the battery is consistent with IEEE-450 (Ref. 4). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that states the float qurrent requirement is not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 3.8.4.1. When this float voltage is not maintained the Required Actions of LCO 3.8.4 ACTION A are being taken, which provide the necessary and appropriate verifications of the battery condition. Furthermore, the float current limit of 2 amps is established based on the nominal float voltage value and is not directly applicable when this voltage is not maintained .

SR 3.8.6.2 and SR 3.8.6.5 Optimal long term battery performance is obtained by maintaining a float voltage greater than or equal to the minimum established design limits provided by the battery manufacturer, which corresponds to 132 V for the 125 V batteries and 264 V for the 250 V batteries at the battery terminals, or 2.2 Vpc. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge, which could eventually render the battery inoperable. Float voltages in this range or less, but greater than 2.07 Vpc, are addressed in Specification 5.5.13. SR's 3.8.6.2 and 3.8.6.5 require verification that the cell float voltages are equal to or greater than the short term absolute minimum cell voltage of 2.07 V. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SUSQUEHANNA- UNIT 2 TS I B 3.8-83 (continued)

Revision 2

Rev. 2 Battery Parameters

BASES SURVEILLANCE SR *3.8.6.3 B 3.8.6 REQUIREMENTS (continued) The limit specified for electrolyte level ensures that the plates suffer no physical damage and maintain adequate electron transfer capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.6.4 This Surveillance verifies that the pilot cell temperature is greater than or equal to the minimum established design limit (i.e., 60°F). Pilot cell electrolyte temperature is maintained above this temperature to assure the battery can provide the required current and voltage to meet the design requirements. Temperatures lower than assumed in battery sizing calculations act to inhibit or reduce battery capacity. The Surveillance Frequency is controlled under the Surveillance Frequency' Control Program.

SR 3.8.6.6

A battery performance discharge test is a test of constant current capacity of a battery, normally done in the as found condition, after having been in service, to detect any change in the capacity determined by the acceptance test.

The test is intended to determine overall battery degradation due to age and usage.

A battery modified performance discharg~ test is described in the Bases for SR 3.8.4.3. Either the battery performance discharge test or the modified performance discharge test is acceptable for satisfying SR 3.8.4.3; however, only the modified performance discharge test may be used to satisfy SR 3.8.6.6 while satisfying the requirements of SR 3~8.4.3 at the same time.

A modified performance discharge test is a test of the battery capacity and its ability to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will confirm the battery's ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for a service test.

SUSQUEHANNA - UNIT 2 TS I B 3.8-83A (continued)

Revision 1

Rev.2 Battery Parameters

SURVEILLANCE SR 3.8.6.6 (continued)

B 3.8.6 REQUIREMENTS (continued) The modified performance discharge test is a test of simulated duty cycle consisting of two different discharge rates. The first discharge rate consists of the one minute published rate for .the battery or the largest current loads of the duty cycle followed by a second discharge rate which employs the test rate for the performance discharge test. These discharge rates envelope the duty cycle of the service test. Since the ampere-hours removed by a published one minute discharge rate represent a very small portion of the battery capacity, the test rate can be changed to that for the performance discharge test without compromising the results of the performance discharge test. The battery terminal voltage for the modified performance discharge test should remain above the minimum battery terminal voltage specified in the service test.

When the battery loads after the first minute exceeds the performance test discharge rate, the modified performance discharge test is performed by first conducting the service test, than adjusting the discharge rate to the constant current value normally used for the .

performance discharge test. This test is terminated when the specified minimum battery terminal voltage is reached.

When the battery loads after the first minute exceeds the performance discharge test rate, the battery capacity is calculated as follows:

% of rated capacity at 25°C (77°F) =

K[ L (Jn) (tn) ] X 100 Rated Ampere Hours Where:

K =Temperature Correction Factor from IEEE 450-1995 In = Discharge Current in amps for n-th section Tn =Duration of n-th section discharge in hour n = Section number for each portion of the discharge, including both service test and performance test portions (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.8-838 Revision 0

Rev.2 Battery Parameters

BASES SURVEILLANCE SR 3.8.6.6 (continued)

B 3.8.6 REQUIREMENTS (continued) This % of rated capacity equation uses the temperature corrected Ampere-Hours instead of the temperature corrected discharge rates as specified in IEEE 450-1995. It is not possible to temperature correct the discharge rate without impacting the service test.

The acceptance criteria for this Surveillance is consistent with IEEE-450 (Ref. 4) and IEEE-485 (Ref. 6). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. If the battery shows degradation, or if the battery has reached 85% of its expected service life and capacity is <

100% of the manufacturer's rating, the Surveillance Frequency is reduced to 12 months. However, if the battery shows no degradation but has reached 85% of its expected service life, the Surveillance Frequency is only reduced to 24 months for batteries that retain capacity ~ 100% of the manufacturer's rating. Degradation is indicated, according to IEEE-450 (Ref. 4), when the battery capacity drops by more than 10% relative to its capacity on the previous performance test or when it is 10% below the manufacturer's rating.

All these Frequencies are consistent with the recommendations in IEEE-450 (Ref. 4).

The SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems.

SUSQUEHANNA - UNIT 2 TS I B 3.8-83C (continued)

Revision 1

Rev.2 Battery Parameters

BASES REFERENCES 1. FSAR, Chapter 6.

B 3.8.6

2. FSAR, Chapter 15.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132).

4. IEEE Standard 450.

5. FSAR, Chapter 8.

6. IEEE Standard 485.

SUSQUEHANNA- UNIT 2 TS I B 3.8-830 Revision O

Rev. 5 Distribution Systems-Operating

B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.7 Distribution Systems-Operating B 3.8.7 BASES BACKGROUND The onsite Class 1E AC and DC electrical power distribution system is divided into redundant and independent AC and DC electrical power distribution subsystems and a DG E electrical power distribution subsystem.

The primary AC distribution system consists of four 4.16 kV Engineered Safeguards System (ESS) buses each having a primary and alternate offsite source of power as well as an onsite diesel generator (DG) source that supports one 4.16 kV ESS bus in each unit. Each 4.16 kV ESS bus is normally supplied by either Startup Transformer (ST) No. 10 or ST No. 20. ST No. 10 and ST No. 20 each provide the normal source of power to two of the four 4.16 kV ESS buses in each Unit and the alternate source of power to the remaining two 4.16 kV ESS buses in each Unit. If any 4.16 kV ESS bus loses power, an automatic transfer from the normal to the alternate occurs after the normal supply breaker trips. If both offsite sources are unavailable, the onsite emergency DGs supply power to the 4.16 kV*

ESS buses.

There are two 250 VDC electrical power distribution subsystems; four 125 voe electrical power distribution subsystems; and, and one 125 VOC OGE electrical power distribution subsystem, all of which support the necessary power for ESF functions.

In addition, some components required by Unit 2 receive power through Unit 1 electrical power distribution subsystems, the Unit 1 AC and DC electrical power distribution subsystems needed to support the required equipment are addressed in Unit 2 LCO 3.8.7.

Required distribution subsystems are listed in LCO 3.8.7, Table 3.8.7-1.

APPLICABLE The initial conditions of Design Basis Accident (OBA) and SAFETY ANALYSES transient analyses in the FSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume ESF systems are OPERABLE. The AC and DC electrical power distribution systems are designed

SUSQUEHANNA - UNIT 2 B 3.8-84 (continued)

Revision 0

Rev. 5 Distribution Systems-Operating

BASES APPLICABLE SAFETY ANALYSES (continued)

. B 3.8.7 to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6 Containment Systems.

The OPERABILITY of the AC and DC electrical power distribution subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining distribution systems OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC electrical power; and

b. A worst case single failure.

The AC and DC electrical power distribution system satisfies Criterion 3 of the NRC Policy Statement (Ref. 4) .

LCO The required electrical power distribution subsystems listed in Table 3.8.7-1 ensure the availability of AC and DC electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated OBA. The AC and DC electrical power distribution subsystems are required to be OPERABLE.

Maintaining the AC and DC electrical power distribution subsystems OPERABLE ensures that the redundancy incorporated into the design of ESF is not defeated. Therefore, a single failure within any system or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor.

AC electrical power distribution subsystems require the associated buses and electrical circuits to be energized to their proper voltages. DC electrical power distribution subsystems require tt}e associated buses to be energized to their proper

. voltage from either the associated battery or charger. The AC and DC electrical power distribution

SUSQUEHANNA - UNIT 2 B 3.8-85 (continued)

Revision O

Rev.5 Distribution Systems-Operating

BASES LCO (continued) subsystem is only considered Inoperable when the subsystem is not energized to its proper voltage.

B 3.8.7 APPLICABILITY The electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated OBA.

Electrical power distribution subsystem requirements for MODES 4 and 5 are covered in the Bases for LCO 3.8.8, "Distribution Systems -

Shutdown."

ACTIONS

With one or more required Unit 2 AC buses, load centers, motor control centers, or distribution panels inoperable but not resulting in a loss of safety function, or two Unit 1 AC electrical power distribution subsystems on one Division inoperable for performance of Unit 1 SR 3.8.1.19, the remaining AC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the required AC buses, load centers, motor control centers, and distribution panels must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

The Condition A worst scenario is one division without AC power (i.e., no offsite power to the division and the associated DG inoperable). In this Condition, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operators' attention be focused on minimizing the potential for loss of power to the remaining division by stabilizing the unit, and on restoring power to the affected division. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time limit before

SUSQUEHANNA - UNIT 2 TS I B 3.8-86 (continued)

Revision 1

Rev. 5 Distribution Systems-Operating

BASES ACTIONS A.1 (continued) requiring a unit shutdown in this Condition is acceptable because:

a.

8 3.8.7 There is a potential for decreased safety if the attention of unit operators is diverted from the evaluations and actions necessary to restore power to the affected division to the actions associated with taking the unit to shutdown within this time limit.

b. The potential for an event in conjunction with a single failure of a redundant component in the division with AC power. (The redundant component is verified OPERABLE in accordance with Specification 5.5.11, "Safety Function Determination Program (SFDP).")

The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single continuous occurrence of failing to meet LCO 3.8.7. If Condition A is entered while, for instance, a DC bus is inoperable and subsequently returned OPERABLE, this LCO may already have been not met for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . This situation could lead to a total duration of 1O hours, since initial failure of the LCO, to restore the AC distribution system. At this time, a DC circuit could again become inoperable, and AC distribution could be restored OPERABLE. This could continue indefinitely.

This Completion Time allows for an exception to the norma.l "time zero" for beginning the allowed outage time "clock." This results in establishing the "time zero" at the time this LCO was initially not met, instead of at the time Condition A was entered. The 16 hour1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely. The completion time exception is not applicable to Condition F or G because Condition F and G are only applicable to DG E DC electrical power subsystem.

Condition A is modified by a Note that states that Condition A is not applicable to the DG E DC electrical power subsystem. Condition F or *I G is applicable to an inoperable DG E DC electrical power subsystem.

Required Action A.1 is modified by a Note that requires the applicable Conditions and Required Actions of LCO 3.8.4 "DC Sources -

Operating," to be entered for DC subsystems made inoperable by inoperable AC electrical power distribution subsystems. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for inoperable DC sources. lnoperability of a distribution subsystem can result in loss of charging power to batteries and eventual loss of DC power. This Note ensures that the appropriate attention is given to restoring charging power to batteries, if necessary, after loss of distribution systems.

SUSQUEHANNA - UNIT 2 TS/ B 3.8-87 (continued)

Revision 2

Rev.5 Distribution Systems-Operating

BASES ACTIONS (continued)

With one or more Unit 2 DC buses inoperable, the remaining DC B3.8.7 electrical power distribution subsystems may be capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure.

The overall reliability is reduced, however, because a single failure in one of the remaining DC electrical power distribution subsystems could result in the minimum required ESF functions not being supported.

Therefore, the required DC buses must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months by. powering the bus from the associated battery or charger.

Condition B represents one subsystem or multiple DC Buses without adequate DC power, potentially with both the battery significantly degraded and the associated charger non-functioning. In this situation, the plant is significantly more vulnerable to a loss of minimally required DC power. It is, therefore, imperative that the operator's attention focus on stabilizing the plant, minimizing the potential for loss of power to the remaining divisions, and restoring power to the affected division .

This 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the majority of components that would be without power. Taking exception to LCO 3.0.2 for compon.ents without adequate DC power, which would have Required Action Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , is acceptable because of:

a. The potential for decreased safety when requiring a change in plant conditions (i.e., requiring a shutdown) while not allowing stable operations to continue;

b. The potential for decreased safety when requiring entry into numerous applicable Conditions and Required Actions .for components without DC power, while not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected division;

c. The potential for an event in conjunction with a single failure of a redundant component.

SUSQUEHANNA - UNIT 2 TS I B 3.8-88 (continued)

Revision 1

Rev.5 Distribution Systems-Operating

BASES ACTIONS B.1 (continued)

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for DC buses is consistent with B 3.8.7 Regulatory Guide 1.93 (Ref. 3).

The second Completion Time for Required Action B.1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single continuous occurreni;e of failing to meet the LCO. If Condition C is entered while, for instance, an AC bus is inoperable and subsequently restored OPERABLE, the LCO may already have been not met for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . This situation could lead to a total duration of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months , since initial failure of the LCO, to restore the DC distribution system. At this time, an AC division could again become inoperable, and DC distribution could be restored OPERABLE. This could continue indefinitely.

Condition B is modified by a Note that states that Condition B is not applicable to the DG E DC electrical power subsystem. Condition F or G is applicable to an inoperable DG E DC electrical power subsystem.

This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This allowance results in establishing the "time zero" at the time the LCO was initially not met, instead of at the time Condition C was entered. The 16 hour1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Completion Time is an acceptable limitation on this potential of failing to meet the LCO indefinitely. The Completion Time exception is not .

applicable to Condition E and F because Condition E and F are only applicable to DG E DC electrical power subsystem.

With one Unit 1 AC electrical power distribution subsystem that support Unit 2 inoperable, the remaining Unit 1 AC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor

. and maintain it in a safe shutdown condition, assuming no single failure. However, the overall reliability is reduced because a single failure in the remaining AC electrical power distribution subsystem could result in the minimum required:

ESF functions not being supported. The Completion

SUSQUEHANNA- UNIT 2 TS I B 3.8-89 (continued)

Revision 1

Rev.5 Distribution Systems-Operating

BASES ACTIONS C.1 (continued)

Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is consistent with the Completion Times associated B 3.8.7 with LCOs for the Unit 2 and common equipment potentially affected by loss of a Unit 1 AC electrical power subsystem.

The Completion Time has been extended to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months in order to complete the modifications in Unit 1 associated with the Multiple Fire-Induced Spurious Operations issue. This is a temporary extension of the Completion Time.

Upon completion of the MSO modifications on all four Unit 1 4.16 kV buses, this temporary extension is no longer applicable and will expire on May 31, 2012.

With two required Unit 1 AC buses, load centers, motor control centers, or distribution panels inoperable for the performance of Unit 1 SR 3.8.1.19 but not resulting in a loss of safety function, the remaining AC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the

remaining power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the required AC buses, load centers, motor control centers, and distribution panels must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

E.1and E.2 If the inoperable distribution subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

If Diesel Generator E is not aligned to the Class 1 E distribution system, the only supported safety function is for the ESW system. Therefore, under this condition, if Diesel Generator E DC power distribution subsystem is not OPERABLE, to ensure the OPERABILITY of the ESW system, actions are taken to either restore the power distribution subsystem to OPERABLE status or shutdown Diesel Generator E and

SUSQUEHANNA- UNIT 2 TS/ B 3.8-90 (continued)

Revision 2

Rev. 5 Distribution Systems-Operating

BASES ACTIONS F.1 (continued) close the associated ESW valves. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with B 3.8.7 the allowed time for other inoperable DC power distribution subsystems and provides sufficient time to evaluate the condition and take the corrective actions.

If the Diesel Generator E is aligned to the class 1E distribution system, the loss of Diesel Generator E DC power distribution subsystem will result in the loss of a on-site Class 1E power source. Therefore, under this condition, if Diesel Generator E DC power distribution subsystem is not OPERABLE actions are taken to either restore the power distribution subsystem to OPERABLE status or declare Diesel Generator E inoperable and take Actions of LCO 3.8.1. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with the allowed time for other DC sources and provides sufficient time to evaluate the condition and tal_<e the necessary corrective actions .

Condition H corresponds to a level of degradation in the electrical distribution system that causes a required safety function to be lost.

When more than one AC or DC electrical power distribution subsystem is lost, and this results in the loss of a required function, the plant is in a condition outside the accident analysis. Therefore, no additional time is justified for continued operation. LCO 3.0.3 must be entered immediately to commence a controlled shutdown. Entry into Condition G is not required if the loss of safety function is the result of entry into Condition A in combination with the loss of safety functions governed by LCOs other than LCO 3.8.7. In this case, enter LCO 3.8.7, Condition A, and the Condition for loss of function in the LCO that governs the safety function that is lost.

SUSQUEHANNA- UNIT 2 TS I B 3.8-91 (continued)

Revision 1

Rev. 5 Distribution Systems-Operating

BASES ACTIONS B 3.8.7 (continued)

With one or more Unit 1 DC electrical power subsystems inoperable, the remaining DC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. However, The overall reliability is reduced because a single failure in the remaining DC electrical power distribution subsystem could result in the minimum required ESF functions not being supported. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is consistent with the Completion Times associated with a loss of one or more DC distribution subsystems and will allow sufficient time to restore power.

Completion of Required Action 1.1 causes Unit 1 loads to be powered from a Unit 2 DC electrical power subsystem.

Although the corresponding Unit 2 DC electrical power subsystem is evaluated for this condition, this condition is outside the design commitment to maintain DC power separation between units. To minimize the time this condition exists, Required Action 1.2 direct power to be restored from the corresponding Unit 1 DC electrical power subsystem, which restores power to the common loads, or requires that the Unit 1 and common loads be declared inoperable. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months provides sufficient time to restore power and acknowledges the fact that the condition, although not consistent with all design requirements, maintains all required safety systems available.

If Unit 1 and common loads required to support Unit 2 cannot be transferred to corresponding Unit 2 DC electrical power subsystem when Unit 1 DC sources are inoperable; or, cannot be transferred back to a Unit 1 DC source when the Unit 1 DC source becomes OPERABLE, the associated loads may be incapable of performing their intended function and must be declared inoperable immediately.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.8-92 Revision 1

Rev.5 Distribution Systems-Operating

BASES (continued)

SURVEILLANCE SR 3.8.7.1 B 3.8.7 REQUIREMENTS This Surveillance verifies that the AC and DC, electrical power distribution systems are functioning properly, with the correct circuit breaker alignment. The correct breaker alignment ensures the appropriate independence of the electrical buses are maintained, and the appropriate voltage or indicated power is available to each required bus. This includes a verification that Unit 1 and common 125 VDC loads are aligned to a Unit 1 DC power distribution subsystem. The verification of voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Chapter 6.

2. FSAR, Chapter 15.

3. Regulatory Guide 1.93, December 1974.

4. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.8-93 Revision 2

_J

Rev. 1 Distribution Systems-Shutdown

B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.8 Distribution Systems-Shutdown B 3.8.8 BASES BACKGROUND A description of the AC and DC electrical power distribution system is provided in the Bases for LCO 3.8.7, "Distribution Systems-Operating."

APPLICABLE The initial conditions of Design Basis Accident and transient analyses SAFETY ANALYSES in the FSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume

Engineered Safety Feature (ESF) systems are OPERABLE. The AC and DC electrical power distribution systems and the DG E DC electrical power distribution subsystem are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.

The OPERABILITY of the AC and DC electrical power distribution system is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum AC and DC electrical power sources and associated power distribution subsystems during MODES 4 and 5, and during movement of irradiated fuel assemblies in the secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate power is provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident.

LCO 3.8.8 is normally satisfied by maintaining the OPERABILITY of all Division I or all Division II DC distribution subsystems listed in Table 3.8.7-1 and the

SUSQUEHANNA - UNIT 2 TS/ B 3.8-94 (continued)

Revision O

Rev. 1 Distribution Systems-Shutdown

BASES APPLICABLE diesel generator E distribution subsystem. However, any combination B 3.8.8 SAFETY ANALYSES of DC distribution subsystems that maintain OPERABILITY of (continued) equipment required by Technical Specifications may be used to satisfy this LCO.

The AC and DC electrical power distribution systems satisfy Criterion 3 of the NRC Policy Statement (Ref. 3).

LCO Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific plant condition. Implicit in those requirements is the required OPERABILITY of necessary support required features. This LCO explicitly requires energization of the portions of the electrical distribution system necessary to support OPERABILITY of Technical Specifications required systems, equipment, and components-both specifically addressed by their own LCO, and implicitly required by the definition of OPERABILITY.

Maintaining these portions of the distribution system energized ensures the availability of sufficient power to operate the plant in a safe manner to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents and inadvertent reactor vessel draindown). The AC and DC electrical distribution subsystem is only considered Inoperable when the subsystem is not energized to its proper voltage.

APPLICABILITY The AC and DC electrical power distribution subsystems required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core in case of an inadvertent draindown of the reactor vessel;

b. Systems needed to mitigate a fuel handling accident are available;

SUSQUEHANNA - UNIT 2 TS I B 3.8-95 (continued)

Revision O

Rev.1 Distribution Systems-Shutdown

BASES APPLICABILITY c.

B 3.8.8 Systems necessary to mitigate the effects of events that can lead (continued) to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The AC, DC and DG E electrical power distribution subsystem requirements for MODES 1, 2, and 3 are covered in LCO 3.8. 7.

ACTIONS The ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. This is acceptable because LCO 3.0.3 would not specify any additional Actions in MODE 4 or 5 moving irradiated Fuel assemblies.

The Unit 2 AC and DC subsystems remaining OPERABLE with one or more Unit 2 AC and DC power sources inoperable may be capable of supporting sufficient required feat1,Jres to allow continuation of CORI; ALTERATIONS, fuel movement, and operations with a potential for draining the reactor vessel. Therefore, the option is provided to declare required features with associated power sources inoperable which ensures that appropriate restrictions are implemented in accordance with the affected system LCOs' ACTIONS.

Condition A is modified by a Note that states that Condition A is not applicable to the DG E*DC electrical power subsystem. Conditions B and C are applicable to an inoperable DG E DC electrical power subsystem.

A.2.1. ~.2.2, A.2.3, A.2.4. and A.2.5 In many instances the option above may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made, (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies in the secondary containment, and any activities that could result in inadvertent draining of the reactor vessel).

SUSQUEHANNA - UNIT 2 TS I B 3.8-96 (continued)

Revision O

Rev. 1 Distribution Systems-Shutdown

BASES ACTIONS A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5 (continued)

B 3.8.8 Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the plant safety systems.

Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the RHR-SDC ACTIONS would not be entered. Therefore, Required Action,A.2.5 is provided to direct declaring RHR-SDC inoperable and not in operation, which results in taking all appropriate RHR-SDC ACTIONS.

Required Action A.2 is modified by a Note. The Note ensures that appropriate remedial actions are taken, if necessary, if a required ECCS subsystem is rendered inoperable by the lnoperability of the electrical distribution subsystem. Pursuant to LCO 3.0.6, these actions are not required even when the associated LCO is not met. Therefore, the Note is added to require the proper actions be taken.

A.3.1, A.3.2, A.3.3.1 and A.3.3.2 The option to transfer required common loads to an OPERABLE Unit 2 electrical power subsystem ensures power will be restored to required loads. To ensure any loads which are not transferred to the Unit 2 power distribution subsystem are compensated for, Required Action A.3.2, requires the required features to be declared inoperable.

Although the corresponding Unit 2 electrical power subsystem is evaluated for this condition, this violates a design commitment to maintain power separation between units. To minimize the time this condition exists, Required Action A.3.3 directs that power supply be restored to the corresponding Unit 1 electrical power subsystem, which restores power to the common loads, or requires that the Unit 1 and common loads are declared inoperable. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months provides sufficient time to restore power and acknowledges

SUSQUEHANNA - UNIT 2 TS I B 3.8-97 (continued)

Revision O

Rev. 1 Distribution Systems-Shutdown

BASES ACTIONS A.3.1, A.3.2, A.3.3.1 and A.3.3.2 (continued)

B 3.8.8 the fact that the condition, although not consistent with design requirements, maintains all required safety systems available.

A.1, A.2.1, A.2.2, A.2.3, A.2.4, A.2.5, A.3.1, A.3.2 A.3.3.1, and A.3.3.2 The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the plant safety systems may be without power.

If Diesel Generator E is not aligned to the class 1 E distribution system, the only supported safety function is the ESW system. Therefore, if Diesel Generator E DC power distribution subsystem is not OPERABLE, actions are taken to either restore the battery to OPERABLE status or shutdown Diesel Generator E and close the associated ESW valves to ensure the OPERABILITY of the ESW system. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with the allowed time for other inoperable DC sources and provides sufficient time to evaluate the condition of the battery and take the corrective actions.

If Diesel Generator E is aligned to the class 1E distribution system, the loss of Diesel Generator E DC power distribution subsystem will result in the loss of a on-site Class 1E subsystem source. Therefore, if Diesel Generator E DC power subsystem is not OPERABLE actions are taken to either restore the battery to OPERABLE status or declare Diesel Generator E inoperable and take Actions of LCO 3.8.2. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with the allowed time for other DC sources and provides sufficient time to evaluate the condition of the battery and take the necessary corrective actions.

SUSQUEHANNA - UNIT 2 TS I B 3.8-98 (continued)

Revision O

Rev. 1 Distribution Systems-Shutdown

BASES (continued)

SURVEILLANCE SR 3.8.8.1 B 3.8.8 REQUIREMENTS This Surveillance verifies that the AC and DC electrical power distribution subsystems are functioning properly, with the buses energized. The verification of proper voltage or indicated power availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Chapter 6.

2. FSAR, Chapter 15.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.8-99 Revision 1

Rev. 1 Refueling Equipment Interlocks

B3.9 B3.9.1 REFUELING OPERATIONS Refueling Equipment Interlocks 83.9.1 BASES BACKGROUND Refueling equipment interlocks restrict the operation of the refueling equipment or the withdrawal of control rods to reinforce unit procedures that prevent the reactor from achieving criticality during refueling. The refueling interlock circuitry senses the conditions of the refueling equipment and the control rods. Depending on the sensed conditions, interlocks are actuated to prevent the operation of the refueling equipment or the withdrawal of control rods.

GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods, when fully inserted, serve as the system capable of maintaining the reactor subcritical in cold conditions during all fuel movement activities and accidents.

Two separate inputs are provided for refuel platform position. The Rod Position Indication System (RPIS) provides the "all control rods inserted" input to the Reactor Manual Control System (RMCS). Additionally, inputs are provided for the loading of the refueling platform frame mounted hoist, the loading of the refueling platform monorail mounted hoist, and the loading of the refueling platform fuel grapple. With the reactor mode switch in the shutdown or refueling position, the indicated conditions are combined in logic circuits to determine if all restrictions on refueling equipment operations and control rod insertion are satisfied.

The SSES Refueling Equipment Interlocks input names (generic and plant specific) and functional descriptions for each are as follows:

a. All-rods in (Rod Block No. 1 and No. 2)

This interlock prevents withdrawal of a control rod with any grapple/hoist loaded and the refueling platform (bridge) over the Unit 2 Reactor Vessel.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.9-1 Revision 1

Rev. 1 Refueling Equipment Interlocks

BASES 83.9.1

b. Refuel Platform Position (Unit 2 Bridge Reverse No. 1 or Unit 1 Bridge Forward No. 1)

This interlock prevents refueling platform (bridge) movement towards the Unit 2 Reactor Vessel with indication of a control rod withdrawn and any grapple/hoist loaded. The refueling platform (bridge) has two mechanical switches that open before the platform (bridge) or any of its grapple/ hoists are physically located over the reactor vessel. Only one of these switches is required for the interlock to be considered OPERABLE.

c. Refueling Platform Fuel Grapple, Fuel Loaded (Fuel Hoist Interlock)

The fuel grapple (fuel hoist) will not raise or lower when the refueling platform (bridge) is over the reactor vessel and the fuel grapple (fuel hoist) is loaded and a control rod is indicated as withdrawn.

d. Refuel Platform Frame Mounted hoist, Fuel Loaded (Frame Hoist Interlock)

The frame mounted hoist (frame hoist) will not raise or lower when the refueling platform (bridge) is over the reactor vessel and the frame mounted hoist (frame hoist) is loaded and a control rod is indicated as withdrawn.

e. Refueling Platform monorail mounted hoist, fuel loaded (Mono Hoist Interlock)

The Mono Hoist will not raise or lower when the refueling bridge (platform) is over the reactor vessel and the Mono Hoist is loaded and a control rod is indicated as withdrawn.

All refueling hoists have switches that open when the hoists are loaded with fuel.

The refueling interlocks use these indications to prevent operation of the refueling equipment with fuel loaded over the core whenever any control rod is withdrawn, or to prevent control rod withdrawal whenever fuel loaded refueling equipment is over the core (Ref. 2).

(continued)

SUSQUEHANNA- UNIT 2 TS I B 3.9-2 Revision 1

Rev. 1 Refueling Equipment Interlocks

BASES 83.9.1 The hoist switches open at a load lighter than the weight of a single fuel assembly in water.

APPLICABLE The refueling interlocks are explicitly assumed in the FSAR analyses for the SAFETY control rod removal error and fuel loading during refueling (Ref. 3). The ANALYSES reference 3 analysis evaluates the consequences of control rod withdrawal during refueling and also fuel movement with a control rod removed. A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment.

Criticality and, therefore, subsequent prompt reactivity excursions are prevented during the insertion of fuel, provided all control rods are fully inserted during the fuel insertion. The refueling interlocks accomplish this by preventing loading of fuel into the core with any control rod withdrawn or by preventing withdrawal of a rod from the core during fuel loading.

The refueling platform limit switches activate at a point outside of the reactor core such that the platform will not carry a loaded fuel bundle over the core when a control rod is withdrawn.

Refueling equipment interlocks satisfy Criterion 3 of the NRC Policy Statement. (Ref. 4)

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.9-2a Revision 1

Rev. 1 Refueling Equipment Interlocks

BASES (continued)

. 83.9.1 LCO ; To prevent criticality during refueling, the refueling interlocks ensure that fuel assemblies are not loaded with any control rod withdrawn.

To prevent these conditions from developing, the all-rods-in, one of the Wito refueling platform position, the refueling platform fuel grapple fuel loaded, the refueling platform trolley frame mounted hoist fuel loaded, and the refueling platform monorail mounted hoist fuel loaded inputs are required to be OPERABLE. These inputs are combined in logic circuits, which provide refueling equipment or control rod blocks to prevent operations that could result in criticality during refueling operations.

APPLICABILITY In MODE 5, a prompt reactivity excursion could cause fuel damage and subsequent release of radioactive material to the environment The refueling equipment interlocks protect against prompt reactivity excursions during MODE 5. The interlocks are required to be OPERABLE during in-vessel fuel movement with refueling equipment associated with the interlocks.

In MODES 1, 2, 3, and 4, the reactor pressure vessel head is on, and CORE ALTERATIONS are not possible. Therefore, the refueling interlocks are not required to be OPERABLE in these MODES.

ACTIONS With one or more of the required refueling equipment interlocks inoperable (does not include the one-rod-out interlock addressed in LCO 3.9.2), the unit must be placed in a condition in which the LCO does not apply. In-vessel fuel movement with the affected refueling equipment must be immediately suspended. This action ensures that operations are not performed with equipment that would potentially not be blocked from unacceptable operations (e.g., loading fuel into a cell with a control rod withdrawn).

Suspension of in-vessel fuel movement shall not preclude inserting control rods or remove fuel from the core to reduce the total reactivity.

SUSQUEHANNA - UNIT 2 TS I B 3.9-3 (continued)

Revision 1

Rev. 1 Refueling Equipment Interlocks

BASES (continued) 83.9.1 SURVEILLANCE SR 3.9.1.1 REQUIREMENTS Petformance of a CHANNEL FUNCTIONAL TEST demonstrates each required refueling equipment interlock will function properly when a simulated or actual signal indicative of a required condition is injected into the logic.

Acceptable testing methods include: providing simulated signals for the refueling equipment inputs to the reactor mode switch (i.e., main/auxiliary hoists loaded and platform position); or, performing actual main/auxiliary hoist lifting operations with test weights in conjunction with platform movements over the reactor cavity. The CHANNEL FUNCTIONAL TEST may be petformed by any series of sequential, overlapping, or total channel steps so that the entire channel is tested.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

. REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. FSAR, Section 7.7.1 .

3. FSAR, Section 15.4.1.1.

4. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.9-4 Revision 2

Rev. 2 Refuel Position One-Rod-Out Interlock

B 3.9 B 3.9.2 REFUELING OPERATIONS Refuel Position One-Rod-Out Interlock B 3.9.2 BASES BACKGROUND The refuel position one-rod-out interlock restricts the movement of control rods to reinforce unit procedures that prevent the reactor from becoming critical during refueling operations. During refueling operations, no more than one control rod is permitted to be withdrawn from a core cell containing one or more fuel assemblies. When all four fuel assemblies are removed from a cell, the control rod may be withdrawn with no restrictions. Any number of control rods may be withdrawn and removed from the reactor vessel if their cells contain no fuel.

GDC 26of10 CFR 50, Appendix A, requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods serve as the system capable of maintaining the reactor subcritical in cold conditions .

The refuel position one-rod-out interlock prevents the selection of a second control rod for movement when any other control rod is not fully inserted (Ref. 2). It uses the all-rods-in signal (from the control rod full-in position indicators discussed in LCO 3.9.4, "Control Rod Position Indication") and a rod selection signal (from the Reactor Manual Control System).

This Specification ensures that the refuel position one-rod-out interlock meets the assumptions used in the safety analysis of Reference 3.

APPLICABLE The refueling position one-rod-out interlock is explicitly assumed in the SAFETY FSAR analysis for the control rod withdrawal error during refueling ANALYSES (Ref. 3). This analysis evaluates the consequences of control rod withdrawal during refueling. A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment.

The refuel position one-rod-out interlock and adequate SDM (LCO 3.1.1, "StiUTDOWN MARGIN (SDM))" prevent criticality by preventing withdrawal of more than one control rod. With (continued)

SUSQUEHANNA - UNIT 2 TS I B 3.9-5 Revision 1

Rev.2 Refuel Position One-Rod-Out Interlock

BASES B 3.9.2 APPLICABLE one control rod withdrawn, the core will remain subcritical, thereby SAFETY preventing any prompt critical excursion.

ANALYSES (continued) The refuel position one-rod-out interlock satisfies Criterion 3 of the NRC Policy Statement. (Ref. 4)

LCO To prevent criticality during MODE 5, the refuel position one-rod-out interlock ensures no more than one control rod may be withdrawn. The refuel position one-rod-out interlock is required to be OPERABLE and the reactor mode switch must be locked in the refuel position to support the OPERABILITY of this interlock.

APPLICABILITY In MODE 5, with the reactor mode switch in the refuel position, the OPERABLE refuel position one-rod-out interlock provides protection against prompt reactivity excur~ions.

In MODES 1, 2, 3, and 4, the refuel position one-rod-out interlock is not required to be OPERABLE and is bypassed. In MODES 1 and 2, the Reactor Protection System (LCO 3.3.1.1) and the control rods (LCO 3.1.3) provide mitigation of potential reactivity excursions. In MODES 3 and 4, with the reactor mode switch in the shutdown position, a control rod block (LCO 3.3.2.1) ensures all control rods are inserted (except as permitted by LCO 3.10.3 and LCO 3.10.4), thereby preventing criticality during shutdown conditions.

ACTIONS A.1 and A.2 With the refueling position one-rod-out interlock inoperable, the refueling interlocks may not be capable of preventing more than one control rod from being withdrawn. This condition may lead to criticality.

Control rod withdrawal must be immediately suspended, and action must be immediately initiated to fully insert all insertable control rods in core cells containing one or more

SUSQUEHANNA - UNIT 2 TS I B 3.9-6 (continued)

Revision 0

Rev. 2 Refuel Position One-Rod-Out Interlock

BASES B 3.9.2 ACTIONS A.1 and A.2 (continued) fuel assemblies. Action must continue until all such control rods are fully inserted. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and, therefore, do not have to be inserted.

SURVEILLANCE REQUIREMENTS SR 3 *9 *2 *1 Proper functioning of the refueling position one-rod-out interlock requires the reactor mode switch to be in Refuel. During control rod withdrawal in MOqE 5, improper positioning of the reactor mode switch could, in some instances, allow improper bypassing of required interlocks. Therefore, this Surveillance imposes an additional level of assurance that the refueling position one-rod-out interlock will be OPERABLE when required. By "locking" the reactor mode switch in the proper position (i.e., removing the reactor mode switch key from the console while the reactor mode switch is positioned in refuel), an additional administrative control is in place to preclude operator errors from resulting in unanalyzed operation .

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.9.2.2 Performance of a CHANNEL FUNCTIONAL TEST demonstrates the associated refuel position one-rod-out interlock will function properly when a simulated or actual signal indicative of a required condition is injected into the logic. The CHANNEL FUNCTIONAL TEST may be performed by any series of sequential, overlapping, or total channel steps so that the entire channel is tested. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. To perform the required testing, the applicable condition must be entered (i.e., a control rod must

SUSQUEHANNA - UNIT 2 TS I B 3.9-7 (continued)

Revision 1

Rev. 2 Refuel Position One-Rod-Out Interlock

BASES B 3.9.2 SURVEILLANCE SR 3.9.2.2 (continued)

REQUIREMENTS be withdrawn from its full-in position). Therefore, SR 3.9.2.2 has been modified by a Note that states the CHANNEL FUNCTIONAL TEST is not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after any control rod is withdrawn.

The intent of this allowance is that SR 3.9.2.2 be performed in conjunction with the withdrawal of the first control rod.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. FSAR, Section 7.7.1.

3. FSAR, Section 15.4.1.1.

4. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA- UNIT 2 TS I 8.3.9-8 Revision 0

Rev. 1 Control Rod Position

B3.9 B3.9.3 REFUELING OPERATIONS Control Rod Position B3.9.3 BASES BACKGROUND Control rods provide the capability to maintain the reactor subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the Control Rod Drive System. During refueling, movement of control rods is limited by the refueling interlocks (LCO 3.9.1 and LCO 3.9.2) or the control rod block with the reactor mode switch in the shutdown position (LCO 3.3.2.1).

GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods serve as the system capable of maintaining the reactor subcritical in cold conditions.

The refueling interlocks allow a single control rod to be withdrawn at any time unless fuel is being loaded into the core. To preclude loading fuel assemblies into the core with a control rod withdrawn, all control rods must be fully inserted. This prevents the reactor from achieving criticality during refueling operations.

APPLICABLE Prevention and mitigation of prompt reactivity excursions during refueling are SAFETY provided by the refueling interlocks (LCO 3.9.1 and LCO 3.9.2), the ANALYSES SOM (LCO 3.1.1 ), the intermediate range monitor neutron flux scram (LCO 3.3.1.1), the average power range monitor neutron flux scram (LCO 3.3.1.1), and the control rod block instrumentation (LCO 3.3.2.1).

The safety analysis for the control rod withdrawal error during refueling in the FSAR (Ref. 2) assumes the functioning Qf the refueling interlocks and adequate SOM. The analysis for the fuel loading during refueling (Ref. 2) assumes the control rod for the cell being loaded is fully inserted. Thus, prior to fuel reload, all control rods must be fully inserted to minimize the probability of an inadvertent criticality.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.9-9 Revision 0

Rev. 1 Control Rod Position

BASES B 3.9.3 APPLICABLE Control rod position satisfies Criterion 3 of the NRC Policy Statement SAFETY ANALYSES (Ref. 3).

(continued)

LCO All control rods must be fully inserted during applicable refueling conditions to minimize the probability of an inadvertent criticality during refueling.

APPLICABILITY During MODE 5, loading fuel into core cells with control rods withdrawn may result in inadvertent criticality. Therefore, the control rods must be inserted before loading fuel into a core cell. All control rods must be inserted before loading fuel to ensure that a fuel loading error does not result in loading fuel into a core cell with the control rod withdrawn.

In MODES 1, 2, 3, and 4, the reactor pressure vessel head is on, and no fuel loading activities are possible. Therefore, this Specification is not applicable in these MODES.

ACTIONS With all control rods not fully inserted during the applicable conditions, an inadvertent criticality could occur that is not analyzed in the FSAR. All fuel loading operations must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.9.3.1 REQUIREMENTS During refueling, to ensure that the reactor remains subcritical, all control rods must be fully inserted prior to and during fuel loading. Periodic checks of the control rod position ensure this condition is maintained.

(continued)

SUSQUEHANNA - UNIT 2 TS I B 3.9-10 Revision O

__ ___J

Rev. 1 Control Rod Position

BASES B3.9.3 SU RVEILLP,NCE SR 3.9.3.1 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50, Appendix A, GDC26.

2. FSAR, Section 15.4.1.1.

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS/83.9-11 Revision 1

Rev.1 Control Rod OPERABILITY-Refueling B 3.9.5 B 3.9 REFUELING OPERATIONS B 3.9.5 Control Rod OPERABILITY-Refueling BASES BACKGROUND Control rods are components of the Control Rod Drive (CRD) System, the primary reactivity control system for the reactor. In conjunction with the Reactor Protection System, the CRD System provides the means for the reliable control of reactivity changes during refueling operation. In addition, the control rods provide the capability to maintain the reactor subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the CRD System.

GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The CRD System is the system capable of maintaining the reactor subcritical in cold conditions.

APPLICABLE SAFETY ANALYSES Prevention and mitigation of prompt reactivity excursions during refueling are provided by refueling interlocks (LCO 3.9.1 and LCO 3.9.2), the SOM (LCO 3.1.1 ), the intermediate range monitor neutron flux scram (LCO 3.3.1.1 ), and the control rod block instrumentation (LCO 3.3.2.1 ).

The safety analyses for the control rod withdrawal error during refueling (Ref. 2) assumes the functioning of the refueling interlock and adequate SOM. The analysis for fuel loading during refueling (Ref. 2) assumes that the control rod for the cell being loaded is fully inserted. A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment.

Control rod scram provides protection should a prompt reactivity excursion occur.

Control rod OPERABILITY during refueling satisfies Criterion 3 of the NRC Policy Statement (Ref. 3) .

SUSQUEHANNA - UNIT 2 TS I B 3.9-16 (continued)

Revision 0

Rev. 1 Control Rod OPERABILITY-Refueling B 3.9.5 BASES (continued)

LCO Each withdrawn control rod must be OPERABLE. The withdrawn control rod is considered OPERABLE if the scram accumulator pressure is

~ 940 psig and the control rod is capable of being automatically inserted upon receipt of a scram signal. Inserted control rods have already completed their reactivity control function, and therefore are not required to be OPERABLE.

APPLICABILITY During MODE 5, withdrawn control rods must be OPERABLE to ensure that in a scram the control rods will insert and provide the required negative reactivity to maintain the reactor subcritical.

For MODES 1 and 2, control rod requirements are found in LCO 3.1.2, "Reactivity Anomalies," LCO 3.1.3, "Control Rod OPERABILITY,"

LCO 3.1.4, "Control Rod Scram Times," and LCO 3.1.5, "Control Rod Scram Accumulators." During MODES 3 and 4, control rods are not able to be withdrawn (except as permitted by LCO 3.10.3 and LCO 3.10.4) since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod OPERABILITY during these conditions.

ACTIONS With one or more withdrawn control rods inoperable, action must be immediately initiated to fully insert the inoperable control rod(s). Inserting the control rod(s) ensures the shutdown and scram capabilities are not adversely affected. Actions must continue until the inoperable control rod(s) is fully inserted.

SURVEILLANCE REQUIREMENTS SR 3.9.5.1 and SR 3.9.5.2 5;

During MODE the OPERABILITY of control rods is primarily required to ensure a withdrawn control rod will automatically insert if a signal requiring a reactor shutdown occurs. Because no explicit analysis exists for automatic shutdown during refueling, the shutdown function is satisfied if the withdrawn control rod is capable of

SUSQUEHANNA - UNIT 2 TS I B 3.9-17 (continued)

Revision O

Rev. 1 Control Rod OPERABILITY-Refueling

BASES B 3.9.5 SURVEILLANCE REQUIREMENTS SR 3.9.5.1 and SR 3.9.5.2 (continued) automatic insertion and the associated CRD scram accumulator pressure is;;:: 940 psig.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.9.5.1 is modified by a Note that allows 7 days after withdrawal of the control rod to perform the Surveillance. This acknowledges that the control rod must first be withdrawn before performance of the Surveillance, and therefore avoids potential conflicts with SR 3.0.3 and SR 3.0.4.

REFERENCES 1. 10 CFR SO, Appendix A, GDC 26.

2. FSAR, Section 15.4.1.1 .

3. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.9-18 Revision 1

Rev.2 RPV Water Level

B3.9 B3.9.6 REFUELING OPERATIONS Reactor Pressure Vessel (RPV) Water Level 83.9.6 BASES BACKGROUND The movement of fuel assemblies or handling of control rods within the RPV requires a minimum water level of 22 ft above the top of the RPV flange.

During refueling, this maintains a sufficient water level in the reactor vessel cavity and spent fuel pool. Sufficient water is necessary to retain iodine fission product activity in the water in the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite doses from the accident to :::; 25% of 10 CFR 50.67 limits, as provided by the guidance of Reference 1.

APPLICABLE During movement of fuel assemblies or handling of control rods, the water SAFETY level in the RPV is an initial condition design parameter in the analysis of a ANALYSES fuel handling accident in containment postulated by Regulatory Guide 1.183 (Ref. 1). A decontamination factor of 138 is used in the accident analysis for

- iodine. This relates to the assumption that 99.3%. of the total iodine released from the pellet to cladding gap of all the dropped fuel assembly rods is retained by the water. The fuel pellet to cladding gap is assumed to contain 8% of the total fuel rod 1-131 inventory and 5% of the total fuel rod 1-132, 1-133, 1-134, and 1-135 inventory (Ref. 1).

Analysis of the fuel handling accident inside containment is described in Reference 2. With an assumed minimum water level of 21 ft and a minimum decay time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months prior to fuel handling, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water and that offsite doses are maintained within allowable limits (Ref. 2).

While the worst case assumptions include the dropping of the irradiated fuel assembly being handled onto the reactor core, the possibility exists of the dropped assembly striking.the RPV flange and releasing fission products. Therefore, the minimum depth for water coverage to ensure

SUSQUEHANNA - UNIT 2 TS I B 3.9-19 (continued)

Revision 1

Rev.2 RPV Water Level

BASES B 3.9.6 APPLICABLE acceptable radiological consequences is specified from the RPV flange.

SAFETY Since the worst case event results in failed fuel assemblies seated in the core, ANALYSES as well as the dropped assembly, dropping an assembly on the RPV flange

{continued) will result in reduced releases of fission gases.

RPV water level satisfies Criterion 2 of the NRC Policy Statement (Ref. 5).

LCO A minimum water level of 22 ft above the top of the RPV flange is required to ensure that the radiological consequences of a postulated fuel handling accident are within acceptable limits, as provided by the guidance of Reference 1.

APPLICABILITY LCO 3.9.6 is applicable when moving fuel assemblies or handling control rods (i.e., movement with other than the normal control rod drive) within the RPV.

The LCO minimizes the possibility of a fuel handling accident in containment that is beyond the assumptions of the safety analysis. Requirements for fuel handling accidents in the spent fuel storage pool are covered by LCO 3.7.7, "Spent Fuel Storage Pool Water Level."

ACTIONS A.1 If the water level is < 22 ft above the top of the RPV flange, all operations involving movement of fuel assemblies and handling control rods within the RPV shall be suspended immediately to ensure that a fuel handling accident

~nnot occur. The suspension of fuel movement and handling control rods shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.9.6.1 REQUIREMENTS Verification of a minimum water level of 22 ft above the top of the RPV flange ensures that the design basis for the

SUSQUEHANNA- UNIT 2 TS I B 3.9-20 (continued)

Revision 1

Rev.2 RPV Water Level B 3.9.6 BASES SURVEILLANCER postulated fuel handling accident analysis during refueling operations is met.

EQUIREMENTS Water at the required level limits the consequences of damaged fuel rods, (continued) whicli are postulated to result from a fuel handling accident in containment (Ref. 2).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Regulatory Guide 1.183, July 2000.

2. FSAR, Section 15.7.4.

3. Deleted.

4. 10 CFR 50.67.

5. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.9-21 Revision 2

Rev. 1 RHR-High Water Level

B3.9 B 3.9.7 REFUELING OPERATIONS Residual Heat Removal (RHR)-High Water Level B 3.9.7 BASES BACKGROUND The purpose of the RHR System in MODE 5 is to remove decay heat and sensible heat from the reactor coolant, as* required by GDC 34. Each of the two shutdown cooling loops of the RHR System can provide the -

required decay heat removal. Each loop consists of two motor driven pumps, a heat exchanger, and associated piping and valves. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after it has been cooled by circulation through the respective heat exchangers, to the reactor via the low pressure coolant injection path. The RHR heat exchangers transfer heat to the RHR Service Water System. The RHR shutdown cooling mode is manually controlled.

In addition to the RHR subsystems, the volume of water above the reactor pressure vessel (RPV) flange provides a heat sink for decay heat removal.

APPLICABLE SAFETY ANALYSES With the unit in MODE 5, with RPV water level ~ 22 feet above the RPV Flange, the RHR System is not required to mitigate any events or accidents evaluated in the safety analyses. The RHR System is required for removing decay heat to maintain the temperature of the-reactor coolant.

Although the RHR System shutdown cooling requirements do not meet a specific criterion of the NRC Policy Statement (Ref. 1), it was identified in

the NRC Policy Statement as an important contributor to risk reduction.

Therefore, the RHR System is retained as a Specification.

LCO Only one RHR shutdown cooling subsystem is required to be OPERABLE and in operation in MODE 5 with irradiated fuel in the RPV and the water level ;;:: 22 ft above the RPV flange. Only one subsystem is required because the volume of water above the RPV flange provides backup decay heat removal capability .

SUSQUEHANNA - UNIT 2 TS/ B 3.9-22 (continued)

Revision O

Rev. 1 RHR-High Water Level

BASES B 3.9.7 LCO An OPERABLE RHR shutdown cooling subsystem consists of an RHR (continued) pump with an associated RHRSW pump, a heat exchanger, valves, piping, instruments, and controls to ensure the corresponding flow paths are OPERABLE. In MODE 5, the RHR cross tie valves are not required to

be closed; thus, the valve may be opened to allow pumps in one loop to discharge through the opposite loop's injection flow path to make a complete subsystem.

Additionally, each RHR shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. Operation (either continuous or intermittent) of one subsystem can maintain and reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. A Note is provided to allow a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months exception to shut down the operating subsystem every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

APPLICABILITY One RHR shutdown cooling subsystem must be OPERABLE and in operation in MODE 5, with irradiated fuel in the reactor pressure vessel and with the water level ;;:: 22 feet above the top of the RPV flange, to provide decay heat removal. RHR System requirements in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS);

Section 3.5, Emergency Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling (RCIC) System; and Section 3.6, Containment Systems.

RHR Shutdown Cooling System requirements in MODE 5 with irradiated fuel in the reactor pressure vessel and with the water level < 22 ft above the RPV flange are given in LCO 3.9.8.

ACTIONS A.1 With no RHR shutdown cooling subsystem OPERABLE, an alternate method of decay heat removal must be verified available within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . In this condition, the volume of water above the RPV flange provides adequate capability to remove decay heat from the reactor core.

However, the overall reliability is reduced because loss of water level

SUSQUEHANNA - UNIT 2 TS/ B 3.9-23 (continued)

Revision O

Rev.1 RHR-High Water Level

BASES B 3.9.7 ACTIONS A.1 (continued) could result in reduced decay heat removal capability. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on decay heat removal function and the probability of a loss of the available decay heat removal capabilities.

Furthermore, verification of the functional availability of these alternate method(s) must be reconfirmed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. This will ensure continued heat removal capability.

Alternate decay heat removal methods are available to the operators for review and preplanning in the unit's Operating Procedures. For example, this may include the use of the Reactor Water Cleanup System, operating with the regenerative heat exchanger bypassed. The method used to remove the decay heat should be the most prudent choice based on unit conditions.

B.1. B.2. B.3. and B.4 If no RHR shutdown cooling subsystem is OPERABLE and an alternate method of decay heat removal is not available in accordance with Required Action A.1, actions shall be taken immediately to suspend operations involving an increase in reactor decay heat load by suspending loading of irradiated fuel assemblies into the RPV.

Additional actions are required to minimize any potential fission product release to the environment. This includes ensuring secondary containment is OPERABLE; one standby gas treatment subsystem is OPERABLE; and secondary containment isolation capability (i.e., one secondary containment isolation valve and associated instrumentation are OPERABLE or other

acceptable administrative controls to assure isolation capability) in each secondary containment penetration not isolated and required to be isolated to mitigate radioactive releases. This may be performed as an administrative check, by examining logs or other information to determine whether the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, a surveillance may need to

SUSQUEHANNA - UNIT 2 TS I B 3.9-24 (continued)

Revision O

Rev.1 RHR-High Water Level

BASES B 3.9.7 ACTIONS B.1. B.2. B.3. and B.4 (continued) be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE.

C.1 and C.2 If no RHR Shutdown Cooling System is in operation, an alternate method of coolant circulation is required to be established within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This alternate method may use forced or natural circulation. The Completion Time is modified such that the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable separately for each occurrence involving a loss of coolant circulation.

During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR Shutdown Cooling System), the reactor coolant temperature must be periqdically monitored to ensure proper functioning of the alternate method. The once per hour Completion Time is deemed appropriate.

SURVEILLANCE REQUIREMENTS SR 3 *9 *7 *1 This Surveillance demonstrates that the RHR subsystem is in operation and circulating reactor coolant.

The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCE 1. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA - UNIT 2 TS I B 3.9-25 Revision 1

Rev. 1 RHR-Low Water Level

B 3.9 B 3.9.8 REFUELING OPERATIONS Residual Heat Removal (RHR)-Low Water Level B 3.9.8 BASES BACKGROUND The purpose of the RHR System in MODE 5 is to remove decay heat and sensible heat from the reactor coolant, as required by GDC 34. Each of the two shutdown cooling loops of the RHR System can provide the required decay heat removal. Each loop consists of two motor driven pumps, a heat exchanger, and associated piping and valves. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after it has been cooled by circulation through the respective heat exchangers, to the reactor via the low pressure coolant injection path. The RHR heat exchangers transfer heat to the RHR Service Water System. The RHR shutdown cooling mode is manually controlled.

APPLICABLE With the unit in MODE 5, the RHR System *is not required to mitigate any SAFETY events or accidents evaluated in the safety analyses. The RHR System is ANALYSES required for removing decay heat to maintain the temperature of the reactor coolant.

Although the RH R System shutdown cooling requirements do not meet a specific criterion of the NRC Policy Statement (Ref. 1), it was identified in the NRC Policy Statement as an important contributor to risk reduction.

Therefore, the RHR System is retained as a Specification.

LCO In MODE 5 with irradiated fuel in the reactor pressure vessel (RPV) and the water level < 22 ft above the reactor pressure vessel (RPV) flange, two RHR shutdown cooling subsystems must be OPERABLE.

An OPERABLE RHR shutdown cooling subsystem consists of an RHR pump with an associated RHRSW pump, a heat exchanger, valves, piping, instruments, and controls to ensure the corresponding flow paths are OPERABLE. To meet the LCO, both pumps in one loop or one pump in each of the two loops (continued)

SUSQUEHANNA- UNIT 2 TS I B 3.9-26 Revision 0

. Rev.1 RHR-Low Water Level

BASES B 3.9.8 LCO must be OPERABLE. Since the piping and heat exchangers are passive (continued) components and assumed not to fail, they are allowed to be common to both subsystems. For each pump required to be OPERABLE on the primary (RHR) side, an associated RHRSW pump must be OPERABLE

on the secondary side to transport decay heat to the UHS. Therefore, if two RHR pumps (and one heat exchanger) in the same loop are being used to comprise two shutdown cooling subsystems, the two RHRSW pumps (one from Unit 1 and one from Unit 2) which are capable of servicing the subject heat exchanger must be OPERABLE.

In MODE 5, the RHR crosstie valves are not required to be closed; thus, the valves may be opened to allow pumps in one loop to discharge through the opposite loop's injection flow path to make a complete subsystem.

Additionally, each RHR shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. Operation (either continuous or intermittent) of one subsystem can maintain and reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. A Note is provided to allow a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months exception to shut down the operating subsystem every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

APPLICABILITY Two RHR shutdown cooling subsystems are required to be OPERABLE, and one must be in operation in MODE 5, with irradiated fuel in the RPV and with the water level < 22 ft above the top of the RPV flange, to provide decay heat removal. RHR System requirements in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS);

Section 3.5, Emergency Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling (RCIC) System; and Section 3.6, Containment Systems.

RHR Shutdown Cooling System requirements in MODE 5 with irradiated fuel in the RPV and with the water level ~ 22 ft above the RPV flange are given in LCO 3.9.7, "Residual Heat Removal (RHR)-High Water Level."

SUSQUEHANNA - UNIT 2 TS/ B 3.9-27 (continued)

Revision O

Rev. 1 RHR-Low Water Level

BASES (continued)

B 3.9.8 ACTIONS A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.

With one of the two required RHR shutdown cooling subsystems inoperable, the remaining subsystem is capable of providing the required decay heat removal. However, the overall reliability is reduced. Therefore an alternate method of decay heat removal must be verified available.

With both required RHR shutdown cooling subsystems inoperable, an alternate method of decay heaf removal must be verified available in addition to that verified available for the initial RHR shutdown cooling subsystem inoperability. This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities.

Furthermore, verification of the functional availability of this alternate method(s) must be reconfirmed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. This will ensure continued heat removal capability.

Alternate decay heat removal methods are available to the operators for review and preplanning in the unit's Operating Procedures. For example, this may include the use of the Reactor Water Cleanup System, operating with the regenerative heat exchanger bypassed. The method used to remove decay heat should be the most prudent choice based on unit conditions .

SUSQUEHANNA - UNIT 2 TS/ B 3.9-28 (continued)

Revision O

Rev. 1 RHR-Low Water Level

BASES B 3.9.8 ACTIONS 8.1, B.2, and B.3 (continued)

With the required decay heat removal subsystem(s) inoperable and the required alternate method(s) of decay heat removal not available in accordance with Required Action A.1, additional actions are required to minimize any potential fission product release to the environment. This includes ensuring secondary containment is OPERABLE; one standby

gas treatment subsystem is OPERABLE; and secondary containment isolation capability (i.e., one secondary containment isolation valve and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability) in each secondary containment penetration not isolated and required to be isolated to mitigate radioactive releases. This may be performed as an administrative check, by examining logs or other information to determine whether the components are out of service for maintenance or other reasons. lt is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the surveillance may need to be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE.

C.1 and C.2 If no RHR subsystem is in operation, an alternate method of coolant circulation is required to be established within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This alternate method may use forced or natural circulation. The Completion Time is modified such that the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable separately for each occurrence involving a loss of coolant circulation.

During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR Shutdown Cooling System), the reactor coolant temperature must be periodically monitored to ensure proper functioning of the alternate method. The once per hour Completion Time is deemed appropriate .

SUSQUEHANNA - UNIT 2 TS I B 3.9-29 (continued)

Revision O

Rev. 1 RHR-Low Water Level

BASES (continued)

B 3.9.8 SURVEILLANCE REQUIREMENTS SR 3 *9*8* 1 This Surveillance demonstrates that one RHR shutdown cooling subsystem is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCE 1. Final Policy Statement on Technical Specifications Improvements, July 22, 1993 (58 FR 39132) .

SUSQUEHANNA- UNIT 2 TS I B 3.9-30 Revision 1

Rev.1 Reactor Mode Switch Interlock Testing

B 3.10 B 3.10.2 SPECIAL OPERATIONS Reactor Mode Switch Interlock Testing B 3.10.2 BASES BACKGROUND The purpose of this Special Operations LCO is to permit operation of the reactor mode switch from one position to another to confirm certain aspects of associated interlocks during periodic tests and calibrations in MODES 3, 4, and 5.

The reactor mode switch is a conveniently located multiposition, keylock switch provided to select the necessary scram functions for various plant conditions (Ref. 1). The reactor mode switch selects the appropriate trip relays for scram functions and provides appropriate bypasses. The mode switch positions and related scram interlock functions are summarized as follows:

a. Shutdown-Initiates a reactor scram; bypasses main steam line isolation scram;

b. Refuel-Selects Neutron Monitoring System (NMS) scram function for low neutron flux level operation (but does not disable the average power range monitor scram); bypasses main steam line isolation scram;

c. Startup/Hot Standby-Selects NMS scram function for low neutron flux level operation (intermediate range monitors and average power range monitors); bypasses main steam line isolation scram; and

d. Run-Selects NMS scram function for power range operation.

The reactor mode switch also provides interlocks for such functions as control rod blocks, scram discharge volume trip bypass, refueling interlocks, and main steam isolation valve isolations.

APPLICABLE The acceptance criterion for reactor mode switch interlock SAFETY ANALYSES testing is to prevent fuel failure by precluding reactivity excursions or core criticality. The interlock functions of the shutdown and refuel positions normally maintained for the reactor mode switch in MODES 3, 4, and 5 are provided to

SUSQUEHANNA- UNIT 2 TS I B 3.10-6 (continued)

Revision O

Rev.1 Reactor Mode Switch Interlock Testing

BASES APPLICABLE B 3.10.2 preclude reactivity excursions that could potentially result in fuel failure.

SAFETY ANALYSES Interlock testing that requires moving the reactor mode switch to other (continued) positions (run, startup/hot standby, or refuel) while in MODES 3, 4, or 5, requires administratively maintaining all control rods inserted and no other CORE ALTERATIONS in progress. With all control rods inserted in core cells containing one or more fuel assemblies, and no CORE ALTERATIONS in progress, there are no credible mechanisms for unacceptable reactivity excursions during the planned interlock testing.

For postulated accidents, such as control rod removal error during refueling or loading of fuel with a control rod withdrawn, the accident analysis demonstrates that fuel failure will not occur (Ref. 2). The withdrawal of a single control rod will not result in criticality when adequate SOM is maintained. The analysis for fuel loading during refueling (Ref. 2) assumes that the control rod for the cell being loaded is fully inserted. However, if adequate SOM is maintained, withdrawal of this control rod will not result in criticality.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Policy Statement

apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. MODES 3, 4, and 5 operations not specified in Table 1.1-1 can be performed in accordance with other Special Operations LCOs (i.e., LCO 3.10.1, "lnservice Leak and Hydrostatic Testing Operation," LCO 3.10.3, "Single Control Rod Withdrawal-Hot Shutdown," LCO 3.10.4, "Single Control Rod Withdrawal-Cold Shutdown," and LCO 3.10.8 "SOM Test-Refueling") without meeting this LCO or its ACTIONS. If any testing is performed that involves the reactor mode switch interlocks and requires repositioning beyond that specified in Table 1.1-1 for the current MODE of operation, the testing can be performed, provided all interlock functions potentially defeated are

SUSQUEHANNA- UNIT 2 TS I B 3.10-7 (continued)

Revision 0

Rev.1 Reactor Mode Switch Interlock Testing B 3.10.2 BASES LCO administratively controlled. In MODES 3, 4, and 5 with the reactor (continued) mode switch in shutdown as specified in Table 1.1-1, all control rods are fully inserted and a control rod block is initiated. Therefore, all control rods in core cells that contain one or more fuel assemblies must be verified fully inserted while in MODES 3, 4, and 5 with the reactor mode switch in other than the shutdown position. The additional LCO requirement to preclude CORE ALTERATIONS is appropriate for MODE 5 operations, as discussed below, and is inherently met in MODES 3 and 4 by the definition of CORE ALTERATIONS, which cannot be performed with the vessel head in place.

In MODE 5, with the reactor mode switch in the refuel position, only one control rod can be withdrawn under the refuel position one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock"). The refueling equipment interlocks (LCO 3.9.1, "Refueling Equipment Interlocks") appropriately control other CORE ALTERATIONS. Due to the increased potential for error in controlling these multiple interlocks, and the limited duration of tests involving the reactor mode switch position, conservative controls are required, consistent with MODES 3 and 4. The additional controls of administratively not permitting other CORE ALTERATIONS will adequately ensure that the reactor does not become critical during these tests.

APPLICABILITY Any required periodic interlock testing involving the reactor mode switch, while in MODES 1 and 2, can be performed without the need for Special Operations exceptions. Mode switch manipulations in these MODES would likely result in unit trips. In MODES 3, 4, and 5, this Special Operations LCO is only permitted to be used to allow reactor mode switch interlock testing that cannot conveniently be performed without this allowance. Such interlock testing may consist of required Surveillances, or may be the result of maintenance, repair, or troubleshooting activities. In MODES 3, 4, and 5, the interlock functions provided by the reactor mode switch in shutdown (i.e., all control rods inserted and incapable of withdrawal) and refueling (i.e., refueling interlocks to prevent inadvertent criticality during CORE ALTERATIONS) positions can be administratively controlled adequately during the performance of certain tests .

SUSQUEHANNA - UNIT 2 TS I B 3.10-8 (continued)

Revision 0

Rev. 1 Reactor Mode Switch Interlock Testing

BASES (continued)

ACTIONS A.1, A.2, A.3.1 and A.3.2 B 3.10.2 These Required Actions are provided to restore compliance with the Technical Specifications overridden by this Special Operations LCO.

Restoring compliance will also result in exiting the Applicability of this Special Operations LCO.

All CORE ALTERA TIONS, except control rod insertion, if in progress, are immediately suspended in accordance with Required Action A.1 and all insertable control rods in core cells that contain one or more fuel assemblies are fully inserted within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , in accordance with Required Action A.2. This will preclude potential mechanisms that could lead to criticality. Suspension of CORE ALTERA TIONS shall not preclude the completion of movement of a component to a safe condition. Placing the reactor mode switch in the shutdown position will ensure that all inserted control rods remain inserted and result in operating in accordance with Table 1.1-1. Alternatively, if in MODE 5, the reactor mode switch may be placed in the refuel position, which will also result in operating in accordance with Table 1.1-1. A Note is added to Required Action A.3.2 to indicate that this Required Action is not

applicable in MODES 3 and 4, since only the shutdown position is allowed in these MODES. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for Required Action A.2, Required Action A.3.1, and Required Action A.3.2 provides sufficient time to normally insert the control rods and place the reactor mode switch in the required position, based on operating experience, and is acceptable given that all operations that could increase core reactivity have been suspended.

SURVEILLANCE SR 3.10.2.1 and SR 3.10.2.2 REQUIREMENTS Meeting the requirements of this Special Operations LCO maintains operation consistent with or conservative to operating with the reactor mode switch in the shutdown position (or the refuel position for MODE 5). The functions of the reactor mode switch interlocks that are not in effect, due to the testing in progress, are adequately compensated for by the Special Operations LCO requirements. The administrative controls are to be periodically verified to ensure that the operational requirements continue to be met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program .

SUSQUEHANNA - UNIT 2 TS I B 3.10-9 (continued)

Revision 1

Rev.1 Reactor Mode Switch Interlock Testing B 3.10.2 BASES REFERENCES 1. FSAR, Chapter 7.

2. FSAR, Section 15.4.1.1

SUSQUEHANNA - UNIT 2 TS I B 3.10-10 Revision 0

Rev. 1 Single Control Rod Withdrawal-Hot Shutdown

B 3.10 B. 3.10.3 SPECIAL OPERATIONS Single Control Rod Withdrawal-Hot Shutdown B 3.10.3 BASES BACKGROUND The purpose of this MODE 3 Special Operations LCO is to permit the withdrawal of a single control rod for testing while in hot shutdown, by imposing certain restrictions. In MODE 3, the reactor mode switch is in the shutdown position, and all control rods are inserted and blocked from withdrawal. Many systems and functions are not required in these conditions, due to the other installed interlocks that are actuated when the reactor mode switch is in the shutdown position. However, circumstances may arise while in MODE 3 that present the need to withdraw a single control rod for various tests (e.g., friction tests, scram timing, and coupling integrity checks). These single control rod withdrawals are normally accomplished by selecting the refuel position for the reactor mode switch. This Special Operations LCO provides the appropriate additional controls to allow a single control rod withdrawal in MODE3.

APPLICABLE SAFETY ANALYSES With the reactor mode switch in the refuel position, the analyses for control rod withdrawal during refueling are applicable and, provided the assumptions of these analyses are satisfied in MODE 3, these analyses will bound the consequences of an accident. Explicit safety analyses in the FSAR (Ref. 1) demonstrate that the functioning of the refueling interlocks and adequate SOM will preclude unacceptable reactivity excursions.

Refueling interlocks restrict the movement of control rods to reinforce operational procedures that prevent the reactor from becoming critical.

These interlocks prevent the withdrawal of more than one control rod.

Under these conditions, since only one control rod can be withdrawn, the core will always be shut down even with the highest worth control rod withdrawn if adequate SOM exists.

The control rod scram function provides backup protection to normal refueling procedures and the refueling interlocks, which prevent inadvertent criticalities during refueling .

SUSQUEHANNA- UNIT 2 TS I B 3.10-11 (continued)

Revision 0

Rev. 1 Single Control Rod Withdrawal-Hot Shutdown

BASES APPLICABLE Alternate backup protection can be obtained by ensuring that a five by B 3.10.3 SAFETY ANALYSES five array of control rods, centered on the withdrawn control rod, are (continued) inserted and incapable of withdrawal.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Policy Statement apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 3 with the reactor mode switch in the refuel position can be performed in accordance with other Special Operations LCOs (i.e., LCO 3.10.2, "Reactor Mode Switch Interlock Testing," without meeting this Special Operations LCO or its ACTIONS.

However, if a single control rod withdrawal is desired in MODE 3, controls consistent with those required during refueling must be implemented and this Special Operations LCO applied. "Withdrawal" in

this application includes the actual withdrawal of the control rod as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod. The refueling interlocks of LCO 3.9.2, "Refuel Position One-Rod-Out Interlock," required by this Special Operations LCO, will ensure that only one control rod can be withdrawn.

To back up the refueling interlocks (LCO 3.9.2), the ability to scram the withdrawn control rod in the event of an inadvertent criticality is provided by this Special Operations LCO's requirements in Item d.1.

Alternately, provided a sufficient number of control rods in the vicinity of the withdrawn control rod are known to be inserted and incapable of withdrawal (Item d.2), the possibility of criticality on withdrawal of this control rod is sufficiently precluded, so as not to require the scram capability of the withdrawn control rod. Also, once this alternate (Item d.2) is completed, the SOM requirement to account for both the withdrawn-untrippable control rod and the highest worth control rod may be changed to allow the

SUSQUEHANNA-UNIT 2 TS I B 3.10-12 (continued)

Revision O

Rev.1 Single Control Rod Withdrawal-Hot Shutdown

BASES LCO withdrawn-untrippab!e control rod to be the single highest B 3.10.3 (continued) worth control rod.

APPLICABILITY Control rod withdrawals are adequately controlled in MODES 1, 2, and 5 by existing LCOs. In MODES 3 and 4, control rod withdrawal is only allowed if performed in accordance with this Special Operations LCO or Special Operations LCO 3.10.4, and if limited to one control rod. This allowance is only provided with the reactor mode switch in the refuel position. For these conditions, the one-rod-out interlock (LCO 3.9.2), control rod position indication (LCO 3.9.4 "Control Rod Position *Indication"), full insertion requirements for all other control rods and scram functions (LCO 3.3.1.1, "Reactor Protection System (RPS)

Instrumentation," and LCO 3.9.5, "Control Rod OPERABILITY-Refueling"), or the added administrative controls in Item d.2 of this Special Operations LCO, minimize potential reactivity excursions.

ACTIONS A Note has been provided to modify the ACTIONS related to a single control rod withdrawal while in MODE 3. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for each requirement of the LCO not met provide appropriate compensatory measures for separate requirements that are not met. As such, a Note has been provided that allows separate Condition entry for each requirement of the LCO.

If one or more of the requirements specified in this Special Operations LCO are not met, the ACTIONS applicable to the stated requirements of the affected LCOs are immediately entered as directed by Required Action A.1. Required Action A.1 has been modified by a Note that clarifies the

SUSQUEHANNA- UNIT 2 TS/ 8 3.10-13 (continued)

Revision O

Rev.1 Single Control Rod Withdrawal-Hot Shutdown

BASES ACTIONS A.1 (continued)

B 3.10.3 intent of any other LCO's Required Action, to insert all control rods.

This Required Action includes exiting this Special Operations Applicability by returning the reactor mode switch to the shutdown position. A second Note has been added, which clarifies that this Required Action is only applicable if the requirements not met are for an affected LCO.

A.2.1 and A.2.2 Required Actions A.2.1 and A.2.2 are alternate Required Actions that can be taken instead of Required Action A.1 to restore compliance with the normal MODE 3 requirements, thereby exiting this Special Operations LCO's Applicability. Actions must be initiated immediately to insert all insertable control rods. Actions must continue until all such control rods are fully inserted. Placing the reactor mode switch in the shutdown position will ensure all inserted rods remain inserted and restore operation in accordance with Table 1.1-1. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to place the reactor mode switch in the

SURVEILLANCE REQUIREMENTS shutdown position provides sufficient time to normally insert the control rods.

SR 3.10.3.1, SR 3.10.3.2, and SR 3.10.3.3 The other LCOs made applicable in this.Special Operations LCO are required to have their Surveillances met to establish that this Special Operations LCO is being met. If the local array of control rods is inserted and disarmed while the scram function for the withdrawn rod is not available, periodic verification in accordance with SR 3.10.3.2 is required to preclude the possibility of criticality. SR 3.10.3.2 has been modified by a Note, which clarifies that this SR is not required to be met if SR 3.10.3.1 is satisfied for LCO 3.10.3.d.1 requirements, since SR 3.10.3.2 demonstrates that the alternative LCO 3.10.3.d.2 requirements are satisfied. Also, SR 3.10.3.3 verifies that all control rods other than the control rod being withdrawn are fully inserted. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SUSQUEHANNA- UNIT 2 TS I B 3.10-14 (continued)

Revision 1

Rev.1 Single Control Rod Withdrawal-Hot Shutdown

BASES B 3.10.3 REFERENCE 1. FSAR, Section 15.4.1.1 .

SUSQUEHANNA - UNIT 2 TS I B 3.10-15 Revision 1

Rev. 1 Single Control Rod Withdrawal-Cold Shutdown

B 3.10

B 3.10.4 SPECIAL OPERATIONS Single Control Rod Withdrawal-Cold Shutdown B 3.10.4 BASES BACKGROUND The purpose of this MODE 4 Special Operations LCO is to permit the withdrawal of a single control rod for testing or maintenance, while in cold shutdown, by imposing certain restrictions. In MODE 4, the reactor mode switch is in the shutdown position, and all control rods are inserted and blocked from withdrawal. Many systems and functions are not required in these conditions, due to the installed interlocks associated with the reactor mode switch in the shutdown position.

Circumstances may arise while in MODE 4, however, that present the need to withdraw a single control rod for various tests (e.g., friction tests, scram time testing, and coupling integrity checks). Certain situations may also require the removal of the associated control rod drive (CRD). These single control rod withdrawals and possible subsequent removals are normally accomplished by selecting the refuel position for the reactor mode switch .

APPLICABLE SAFETY ANALYSES With the reactor mode switch in the refuel position, the analyses for control rod withdrawal during refueling are applicable and, provided the assumptions of these analyses are satisfied in MODE 4, these analyses will bound the consequences of an accident. Explicit safety analyses in the FSAR (Ref. 1) demonstrate that the functioning of the refueling intertocks and adequate SDM will preclude unacceptable reactivity excursions.

Refueling interlocks restrict the movement of control rods to reinforce operational procedures that prevent the reactor from becoming critical.

These interlocks prevent the withdrawal of more than one control rod.

Under these conditions, since only one control rod can be withdrawn, the core will always be shut down even with the highest worth control rod withdrawn if adequate SDM exists.

The control rod scram function provides backup protection in the event normal refueling procedures and the refueling interlocks fail to prevent inadvertent criticalities during refueling. Alternate backup protection can be obtained by

SUSQUEHANNA-UNIT 2 TS I B 3.10-16 (continued)

Revision O

Rev.1 Single Control Rod Withdrawal-Cold Shutdown B 3.10.4 BASES APPLICABLE ensuring that a five by five array of control rods, centered on the SAFETY ANALYSES withdrawn control rod, are inserted and incapable of withdrawal (i.e.,

(continued) electrically or hydraulically disarmed). This alternate backup protection is required when removing a CRD because this removal renders the withdrawn control rod incapable of being scrammed.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Policy Statement apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 4 with the reactor mode switch in the refuel position can be performed in accordance with other LCOs (i.e., Special Operations LCO 3.10.2, "Reactor Mode Switch Interlock Testing") without meeting this Special Operaticms LCO or its ACTIONS.

If a single control rod withdrawal is desired in MODE 4, controls

consistent with those required during refueling must be implemented and this Special Operations LCO applied. "Withdrawal" in this application includes the actual withdrawal of the control rod as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod.

The refueling interlocks of LCO 3.9.2, "Refuel Position One-Rod-Out Interlock," required by this Special Operations LCO will ensure that only one control rod can be withdrawn. The requirements of LCO 3.9.4, "Control Rod Position Indication" can continue to be met even when the control rod position indication probe is disconnected to allow decoupling, provided the withdrawn control rod does not erroneously indicate "full-in." However, in the event the control rod does indicate "full-in" (either due to component malfunction or intentional jumpering to cause a full-in" indication), a control rod withdrawal block is required to be inserted to ensure that no additional control rods can be withdrawn and that compliance with this Special Operations LCO is maintained .

SUSQUEHANNA- UNIT 2 TS I B 3.10-17 (continued)

Revision 0

Rev. 1 Single Control Rod Withdrawal-Cold Shutdown B 3.10.4 BASES LCO To back up the refueling interlocks (LCO 3.9.2) or the control rod (continued) withdrawal block, the ability to scram the withdrawn control rod in the event of an inadvertent criticality is provided by the Special Operations LCO requirements in Item c.1. Alternatively, when the scram function is not OPERABLE, or when the CRD is to be removed, a sufficient number of rods in the vicinity of the withdrawn control rod are required to be inserted and made incapable of withdrawal (Item c.2). This precludes the possibility of criticality upon withdrawal of this control rod.

Also, once this alternate (Item c.2) is completed, the SOM requirement to account for both the withdrawn-untrippable control rod and the highest worth control rod may be changed to allow the withdrawn-untrippable control rod to be the single highest worth control rod.

APPLICABILITY Control rod withdrawals are adequately controlled in MODES 1, 2, and 5 by existing LCOs. In MODES 3 and 4, control rod withdrawal is only allowed if performed in accordance with Special Operations LCO 3.10.3, or this Special Operations LCO, and if limited to one control rod. This allowance is only provided with the reactor mode

switch in the refuel position .

During these conditions, the full insertion requirements for all other control rods, the one-rod-out interlock (LCO 3.9.2), control rod position indication (LCO 3.9.4), and scram functions (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," and LCO 3.9.5, "Control Rod OPERABILITY-Refueling"), or the added administrative controls in Item b.2 and Item c.2 or this Special Operations LCO, provide mitigation of potential reactivity excursions.

ACTIONS A note has been provided to modify the ACTIONS related to a single control rod withdrawal while in MODE 3. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial

SUSQUEHANNA- UNIT 2 TS I B 3.10-18 (continued)

Revision 0

Rev.1 Single Control Rod Withdrawal-Cold Shutdown B 3.10.4 BASES ACTIONS entry into the Condition. However, the Required Actions for each (continued) requirement of the LCO not met provide appropriate compensatory measures for separate requirements that are not met. As such, a Note has been provided that allows separate Condition entry for each requirement of the LCO.

A.1, A.2.1 and A.2.2 If one or more of the requirements of this Special Operations LCO are not met with the affected control rod insertable, these Required Actions restore operation consistent with normal MODE 4 conditions (i.e., all rods inserted) or with the exceptions allowed in this Special Operations LCO. Required Action A.1 has been modified by a Note that clarifies that the intent of any other LCO's Required Action to insert all control rods. This Required Action Includes exiting this Special Operations Applicability by returning the reactor mode switch to the shutdown position. A second Note has been added to Required Action A.1 to clarify that this Required Action is only applicable if the requirements not met are for an affected LCO.

Required Actions A.2.1 and A.2.2 are specified, based on the assumption that the control rod is being withdrawn. If the control rod is still insertable, actions must be immediately initiated to fully insert all insertable control rods and within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months place the reactor mode switch in the shutdown position. Actions must continue until all such control rods are fully inserted. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for placing the reactor mode switch in the shutdown position provides sufficient time to normally insert the control rods.

B.1. B.2.1. and B.2.2 If one or more of the requirements of this Special Operations LCO are not met with the affected control rod not insertable, withdrawal of the control rod and removal of the associated CRD must be immediately suspended. If the CRD has been removed, such that the control rod is not insertable, the Required Actions require the most expeditious action be taken to either initiate action to

SUSQUEHANNA- UNIT 2 TS I B 3.10-19 (continued)

Revision 0

Rev. 1 Single Control Rod Withdrawal-Cold Shutdown B 3.10.4 BASES ACTIONS B.1, B.2.1. and B.2.2 (continued) restore the CRD and insert its control rod, or initiate action to restore compliance with this Special Operations LCO. The Required Actions do not prevent the completion of the movement of the component to a safe conservative position.

SURVEILLANCE SR 3.10.4.1, SR 3.10.4.2, SR 3.10.4.3, and SR 3.10.4.4 REQUIREMENTS The other LCOs made applicable by this Special Operations LCO are required to have their associated surveillances met to establish that this Special Operations LCO is being met. If the local array of control rods is inserted and disarmed while the scram function for the withdrawn rod is not available, periodic verification is required to ensure that the possibility of criticality remains precluded. Verification that all the other control rods are fully inserted is required to meet the SOM requirements. Verification that a control rod withdrawal block has been inserted ensures that no other control rods can be inadvertently withdrawn under conditions when position indication instrumentation is

inoperable for the affected control rod. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.10.4.2 and SR 3.10.4.4 have been modified by Notes, which clarify that these SRs are not required to be met if the alternative requirements demonstrated by SR 3.10.4.1 are satisfied.

REFERENCE 1. FSAR, Section 15.4.1.1.

SUSQUEHANNA - UNIT 2 TS I B 3.10-20 . Revision 1

Rev.1 Single CRD Removal-Refueling B 3.10.5 B 3.10 SPECIAL OPERATIONS B 3.10.5 Single Control Rod Drive (CRD) Removal-Refueling BASES BACKGROUND The purpose of this MODE 5 Special Operations LCO is to permit the removal of a single CRD during refueling operations by imposing certain administrative controls. Refueling interlocks restrict the movement of control rods and the operation of the refueling equipment to reinforce operational procedures that prevent the reactor from becoming critical during refueling operations. During refueling operations, no more than one control rod is permitted to be withdrawn from a core cell containing one or more fuel assemblies. The refueling interlocks use the "full in" position indicators to determine the position of all control rods. If the "full in" position signal is not present for every control rod, then the all rods in permissive for the refueling equipment interlocks is not present and fuel loading is prevented. Also, the refuel

position one-rod-out interlock will not allow the withdrawal of a second control rod.

The control rod scram function provides backup protection in the event

normal refueling procedures, and the refueling interlocks described above fail to preverit inadvertent criticalities during refueling. The requirement for this function to be OPERABLE precludes the possibility of removing the CRD once a control rod is withdrawn from a core cell containing one or more fuel assemblies. This Special Operations LCO provides controls sufficient to ensure the possibility of an inadvertent criticality is precluded, while allowing a single CRD to be removed from a core cell containing one or more fuel assemblies. The removal of the CRD involves disconnecting the position indication probe. The requirements of LCO 3.9.4, "Control Rod Position Indication" can continue to be met even when the control rod position indication probe is disconnected to allow de-coupling, provided the withdrawn control rod does not erroneously indicate "full-in." However, in the event the control rod does indicate "full-in" (either due to component malfunction or intentional jumpering to cause a full-in" indication), this Special Operation has provision for this event. The CRD removal also requires isolation of the CRD from the CRD Hydraulic System, thereby causing inoperability of the control rod (LCO 3.9.5, "Control Rod OPERABILITY-Refueling") .

SUSQUEHANNA - UNIT 2 TS I B 3.10-21 (continued)

Revision 0

Rev. 1 Single CRD Removal-Refueling B 3.10.5 BASES (continued)

APPLICABLE With the reactor mode switch in the refuel position, the analyses for SAFETY ANALYSES control rod withdrawal during refueling are applicable and, provided the assumptions of these analyses are satisfied, these analyses will bound the consequences of accidents. Explicit safety analyses in the FSAR (Ref. 1) demonstrate that proper operation of the refueling interlocks and adequate SOM will preclude unacceptable reactivity excursions.

Refueling interlocks restrict the movement of control rods and the operation of the refueling equipment to reinforce operational procedures that prevent the reactor from becoming critical. These interlocks prevent the withdrawal of more than one control rod. Under these conditions, since only one control rod can be withdrawn, the core will always be shut down even with the highest worth control rod withdrawn if adequate SOM exists.

The control rod scram function provides backup protection to nonnal refueling procedures and the refueling interlocks, which prevent inadvertent criticalities during refueling. Since the scram function is suspended, alternate backup protection required by this Special Operations LCO is obtained by ensuring that a five by five array of control rods, centered on the withdrawn control rod, are inserted and are incapable of being withdrawn and all other control rods are fully inserted. The requirements of LCO 3.9.4, "Control Rod Position Indication" (arid therefore, LCO 3.9.1 and LCO 3.9.2) can continue to be met even when the control rod position indication probe is disconnected to allow de-coupling, provided the withdrawn control rod does not erroneously indicate "full*.:in" (either due to component malfunction or intentional jumpering to cause a "full-in" indication), by requiring all other control rods to be inserted and a control rod withdrawal block initiated, the function of the inoperable one-rod-out interlock (LCO 3.9.2) is adequately maintained. This Special Operations LCO requirement to suspend all CORE ALTERATIONS adequately compensates for the inoperable all rods in pennissive for the refueling equipment interlocks (LCO 3.9.1) .

SUSQUEHANNA- UNIT 2 TS I B 3.10-22 (continued)

Revision O

Rev. 1 Single CRD Removal-Refueling

BASES APPLICABLE As described in* LCO 3.0.7, compliance with Special Operations LCOs B 3.10.5

.SAFETY ANALYSES is optional, and therefore, no criteria of the NRC Policy Statement (continued) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs.A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO . As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 5 with either the following LCOs, LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation" or LCO 3.3.8.2 "Reactor Protection System (RPS) Electrical Power Monitoring," not met, can be performed in accordance with the Required Actions of these LCOs without meeting this Special Operations LCO or its ACTIONS. However, if a single CRD withdrawal and removal from a core cell containing one or more fuel assemblies is desired in MODE 5, controls consistent with those required by LCO 3.3.1.1 and LCO 3.3.8.2 must be implemented, and this Special Operations LCO applied.

'Withdrawal" in this application includes the actual withdrawal of the control rod as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod.

Ensuring that the five by five array of control rods, centered on the withdrawn control rod, are inserted and incapable of withdrawal (i.e.,

electrically or hydraulically disarmed) adequately satisfies the backup protection that LCO 3.3.1.1 and LCO 3.9.2 would have otherwise provided. Also, once this requirement is completed, the SOM requirement to account for both the withdrawn-untrippable control rod and the highest worth control rod may be changed to allow the withdrawn-untrippable control rod to be the single highest worth control rod.

The requirements of LCO 3.9.4, "Control Rod Position Indication" (

and therefore, LCO 3.9.1 and LCO 3.9.2) can continue to be met when the control rod position indication probe is disconnected to allow de-coupling, provided the withdrawn control rod does not erroneously indicate full-in". However, in the event the control rod

SUSQUEHANNA - UNIT 2 TS I B 3.10-23 (continued)

Revision 0

Rev. 1 Single CRD Removal-Refueling B 3.10.5 BASES LCO does indicate "full-in" (either due to component malfunction or (continued) intentional jumpering to cause a "full-in" _indication), by requiring all other control rods to be inserted and a control rod withdrawal block initiated, the function of the inoperable one-rod-out interlock (LCO 3.9.2) is adequately maintained. This Special Operations LCO requirement to suspend all CORE ALTERATIONS adequately compensates for the inoperable all rods in permissive for the refueling equipment interlocks (LCO 3.9.1).

APPLICABILITY Operation in MODE 5 is controlled by existing LCOs. The allowance to comply with this Special Operations LCO in lieu of the ACTIONS of LCO 3.3.1.1, LCO 3.3.8.2, LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 is appropriately controlled with the additional administrative controls required by this Special Operations LCO, which reduce the potential for reactivity excursions.

ACTIONS A.1, A.2.1. and A.2.2

If one or more of the requirements of this Special Operations LCO are not met, the immediate implementation of these Required Actions restores operation consistent with the normal requirements for failure to meet LCO 3.3.1.1, LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 (i.e., all control rods inserted) or with the allowances of this Special Operations LCO. The Completion Times for Required Action A.1, Required Action A.2.1, and Required Action A.2.2 are intended to require that these Required Actions be implemented in a very short time and carried through in an expeditious manner to either initiate action to restore the CRD and insert its control rod, or initiate action to restore compliance with this Special Operations LCO. Actions must continue until either Required Action A.2.1 or Required Action A.2.2 is satisfied.

The Required Actions do not prevent the completion of the movement of the component to a safe conservative position.

SUSQUEHANNA- UNIT 2 TS I B 3.10-24 (continued)

Revision 0

Rev.1 Single CRD Removal-Refueling B 3.10.5 BASES (continued)

SURVEILLANCE SR 3.10.5.1. SR 3.10.5.2. SR 3.10.5.3, SR 3.10.5.4.

REQUIREMENTS and SR 3.10.5.5 Verification that all the control rods, other than the control rod withdrawn for the removal of the associated CRD, are fully inserted is required to ensure the SOM is within limits. Verification that the local five by five array of control rods, other than the control rod withdrawn for removal of the associated CRD, is inserted and disarmed, while the scram function for the withdrawn rod is not available, is required to ensure that the possibility of criticality remains precluded. The Surveillance for LCO 3.1.1, which is made applicable by this Special Operations LCO, is required in order to establish that this Special Operations LCO is being met. Verification that a control rod withdrawal block has been inserted and that no other CORE ALTERA TIONS are being made is required to ensure the assumptions of the safety analysis are satisfied under conditions when position indication instrumentation is inoperable for the withdrawn control rod.

Periodic verification of the administrative controls established by this

, Special Operations LCO is prudent to preclude the possibility of an inadvertent criticality. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCE 1. FSAR, Section 15.4.1.1 .

SUSQUEHANNA- UNIT 2 TS I B 3.10-25 Revision 1

Rev.1 Multiple Control Rod Withdrawal-Refueling B 3.10.6 B 3.10 SPECIAL OPERATIONS B 3.10.6 Multiple Control Rod Withdrawal-Refueling BASES BACKGROUND The purpose of this MODE 5 Special Operations LCO is to permit multiple control rod withdrawal during refueling by imposing certain administrative controls.

Refueling interlocks restrict the movement of control rods and the operation of the refueling equipment to reinforce operational procedures that prevent the reactor from becoming critical during refueling operations. During refueling operations, no more than one control rod is permitted to be withdrawn from a core cell containing one or more fuel assemblies. When all four fuel assemblies are removed from a cell, the control rod may be withdrawn with no restrictions. Any number of control rods may be withdrawn and removed from the reactor vessel if their cells contain no fuel.

The refueling interlocks use the "full in" position indicators to determine the position of all control rods. If the "full in" position signal is not

present for every control rod, then the all rods in permissive for the refueling equipment interlocks is not present and fuel loading is prevented. Also, the refuel position one-rod-out interlock will not allow the withdrawal of a second control rod.

To allow more than one control rod to be withdrawn during refueling, these interlocks must be defeated. This Special Operations LCO establishes the necessary administrative controls to allow bypassing the "full in" position indicators.

APPLICABLE Explicit safety analyses in the FSAR (Ref. 1) demonstrate that the SAFETY ANALYSES functioning of the refueling interlocks and adequate SOM will prevent unacceptable reactivity excursions during refueling. To allow multiple control rod withdrawals, control rod removals, associated control rod drive (CRD) removal, or any combination of these, the "full in" position indication is allowed to be bypassed for each withdrawn control rod if all fuel has been removed from the

SUSQUEHANNA - UNIT 2 TS I B 3.10-26 (continued)

Revision 0

Rev. 1 Multiple Control Rod Withdrawal-Refueling

BASES APPLICABLE B 3.10.6 cell. With no fuel assemblies in the core cell, the associated control rod SAFETY ANALYSES has no reactivity control function and is not required to remain inserted.

(continued) Prior to reloading fuel into the cell, however, the associated control rod must be inserted to ensure that an inadvertent criticality does not occur, as evaluated in the Reference 1 analysis.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Policy Statement apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 5 with either LCO 3.9.3, "Control Rod Position," LCO 3.9.4, "Control Rod Position Indication," or LCO 3.9.5, "Control Rod OPERABILITY-Refueling," not met, can be performed in accordance with the Required Actions of these LCOs without meeting this Special Operations LCO or its ACTIONS. If

multiple control rod withdrawal or removal, or CRD removal is desired, all four fuel assemblies are required to be removed from the associated cells. Prior to entering this LCO, any fuel remaining in a cell whose CRD was previously removed under the provisions of another LCO must be removed. "Withdrawal" in this application includes the actual withdrawal of the control rod as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod.

When fuel is loaded into the core with multiple control rods withdrawn, special reload sequences are used to ensure that reactivity additions are minimized. Otherwise, all control rods must be fully inserted before loading fuel.

LCO 3.9.2 must be met during the application of this Special Operations LCO. The One-Rod-Out interlock must remain OPERABLE for all control rods which are NOT withdrawn in accordance with 3.10.6 to prevent inadvertent criticality due to a Control Rod Withdrawal error. Those Control Rods which are withdrawn per this LCO have no fuel in the surrounding

SUSQUEHANNA - UNIT 2 TS I B 3.10-27 (continued)

Revision 0

Rev. 1 Multiple Control Rod Withdrawal-Refueling

BASES LCO cell, so it is permissible to bypass their inputs to the one-rod-out B 3.10.6 (continued) interlock and withdraw them, without affecting OPERABILITY of the one-rod-out interlock.

APPLICABILITY Operation in MODE 5 is controlled by existing LCOs. The exceptions from other LCO requirements (e.g., the ACTIONS of LCO 3.9.3, LCO 3.9.4, or LCO 3.9.5) allowed by this Special Operations LCO are appropriately controlled by requiring all fuel to be removed from cells whose "full in" indicators are allowed to be bypassed.

ACTIONS A.1, A.2, A.3.1. and A.3.2 If one or more of the requirements of this Special Operations LCO are not met, the immediate implementation of these Required Actions restores operation consistent with the normal requirements for refueling (i.e., all control rods inserted in core cells containing one or more fuel assemblies) or with the exceptions granted by this Special Operations LCO. The Completion Times for Required Action A.1, Required Action

A.2, Required Action A.3.1, and Required Action A.3.2 are intended to require that these Required Actions be implemented in a very short time and carried through in an expeditious manner to either initiate action to restore the affected CRDs and insert their control rods, or initiate action to restore compliance with this Special Operations LCO. The Required Actions do not prevent the completion of the movement of the component to a safe conservative position.

SURVEILLANCE SR 3.10.6.1, SR 3.10.6.2. and SR 3.10.6.3 REQUIREMENTS Periodic verification of the administrative controls established by this Special Operations LCO is prudent to preclude the possibility of an inadvertent criticality. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SUSQUEHANNA - UNIT2 TS I B 3.10-28 (continued)

Revision 1

Rev.1 Multiple Control Rod Withdrawal-Refueling

BASES (continued)

REFERENCE 1. FSAR, Section 15.4.1.1.

B 3.10.6

SUSQUEHANNA - UNIT 2 TS I B 3.10-29 (continued)

Revision 0

Rev.3 SOM Test-Refueling

B 3.10 B 3.10.8 SPECIAL OPERATIONS SHUTDOWN MARGIN (SOM) Test-Refueling B 3.10.8 BASES BACKGROUND The purpose of this MODE 5 Special Operations LCO is to permit SOM testing to be performed for those plant configurations in which the reactor pressure vessel (RPV) head is either not in place or the head bolts are not fully tensioned.

LCO 3.1.1, "SHUTDOWN MARGIN (SOM)," requires that adequate SOM be demonstrated following fuel movements or control rod replacement within the RPV. The demonstration must be performed prior to or within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after *criticality is reached. This SOM test may be performed prior to or during the first startup following the refueling.

Performing the SOM test prior to startup requires the test to be performed while in MODE 5, with the vessel head bolts less than fully tensioned (and possibly with the vessel head removed). While in MODE 5, the reactor mode switch is required to be in the shutdown or refuel position, where the applicable control rod blocks ensure that the reactor will not become critical. The SOM test requires the reactor mode switch to be in the startup/hot standby position, since more than

one control rod will be withdrawn for the purpose of demonstrating adequate SOM. This Special Operations LCO provides the appropriate additional controls to allow withdrawing more than one control rod from a core cell containing one or more fuel assemblies when the reactor vessel head bolts are less than fully tensioned.

APPLICABLE Prevention and mitigation of unacceptable reactivity excursions during SAFETY ANALYSES control rod withdrawal, with the reactor mode switch in the startup/hot standby position while in MODE 5, is provided by the intermediate range monitor (IRM) neutron flux scram (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), and control rod block instrumentation (LCO 3.3.2.1, "Control Rod Block Instrumentation").

The limiting reactivity excursion during startup conditions while in MODE 5 is the control rod drop accident (CRDA) .

SUSQUEHANNA - UNIT 2 TS I B 3.10-34 (continued)

Revision O

Rev. 3 SOM Test-Refueling

BASES APPLICABLE CRDA analyses assume that the reactor operator follows prescribed B 3.10.8 SAFETY ANALYSES withdrawal sequences. For SOM tests performed within these defined (continued) sequences, the analyses of Reference 1 is applicable. However, for some sequences developed for the SOM testing, the control rod patterns assumed in the safety analyses of Reference 1 may not be met. Therefore, special CRDA analyses, performed in accordance with an NRC approved methodology, are required to demonstrate the SOM test sequence will not result in unacceptable consequences should a CRDA occur during the testing. For the purpose of this test, the protection provided by the normally required MODE 5 applicable LCOs, in addition to the requirements of this LCO, will maintain normal test operations as well as postulated accidents within the bounds of the appropriate safety analyses (Ref. 1). In addition to the added requirements for the RWM, APRM, and control rod coupling, the notch out mode is specified for control rod withdrawals that are not in conformance with the BPWS. Requiring the notch out mode limits withdrawal steps to a single notch, which limits inserted reactivity, and allows adequate monitoring of changes in neutron flux, which may occur during the test.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Policy Statement apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. SOM tests may be performed while in MODE 2, in accordance with Table 1.1-1, without meeting this Special Operations LCO or its ACTIONS. For SOM tests performed while in MODE 5, additional requirements must be met to ensure that adequate protection against potential reactivity excursions is available. To provide additional scram protection, beyond the normally required IRMs, the APRMs are also required to be OPERABLE (LCO 3.3.1.1, Functions 2.a, 2.d and 2.e) as though the reactor were in MODE 2. Because multiple control rods will be withdrawn and the reactor will potentially become critical, RPS MODE 2 requirements for Functions 2.a, 2.d and 2.e of Table 3.3.1.1-1

SUSQUEHANNA - UNIT 2 TS I B 3.10-35 (continued)

Revision 1

Rev.3 SOM Test-Refueling B 3.10.8 BASES LCO must be enforced and the approved control rod withdrawal sequence (continued) must be enforced by the RWM (LCO 3.3.2.1, Function 2, MODE 2), or must be verified by a second licensed operator or other qualified member of the technical staff. The SOM may be demonstrated during an in sequence control rod withdrawal, in which the hi_ghest worth control rod is analytically determined, or during loCCl.I criticals, where the highest worth control rod is determined by analysis.or testing.

Local critical tests require the withdrawal of control rods in a sequence that is not in conformance with the BPWS. This testing would therefore require bypassing or reprogramming of the rod worth minimizer to allow the withdrawal of rods not in conformance with BPWS, and therefore additional requirements must be met (see LCO 3.10.7, "Control Rod Testing- Operating").

Control rod withdrawals that do not conform to the banked position withdrawal sequence specified in LCO 3.1.6, "Rod Pattern Control,"

(i.e., out of sequence control rod withdrawals) must be made in the individual notched withdrawal mode to minimize the potential reactivity insertion associated with each movement.

Coupling integrity of withdrawn control rods is required to minimize the probability of a CRDA and ensure proper functioning of the withdrawn control rods, if they are required to scram. Because the reactor vessel head may be removed during these tests, no other CORE ALTERATIONS may be in progress. Furthermore, since the control rod scram function with the RCS at atmospheric pressure relies solely on the CRD accumulator, it is essential that the CRD charging water header remain pressurized. This Special Operations LCO then allows changing the Table 1.1-1 reactor mode switch position requirements to include the startup/hot standby position, such that the SOM tests may be performed while in MODE 5.

APPLICABILITY These SOM test Special Operations requirements are only applicable if the SOM tests performed in accordance with LCO 3.1.1, "SOM" are to be performed while in MODE 5 with the reactor vessel head removed or the head bolts not fully tensioned.

Additional requirements during these tests to

SUSQUEHANNA- UNIT 2 TS I B 3.10-36 (continued)

Revision O

Rev. 3 SOM Test-Refueling

BASES APPLICABILITY enforce control rod withdrawal sequences and restrict other CORE B 3.10.8 (continued) ALTERATIONS provide protection against potential reactivity excursions. Operations in all other MODES are unaffected by this LCO.

ACTIONS With one or more control rods discovered uncoupled during this Special Operation, a controlled insertion of each uncoupled control rod is required; either to attempt recoupling, or to preclude a control rod drop.

This controlled insertion is preferred since, if the control rod fails to follow the drive as it is withdrawn (i.e., is "stuck" in an inserted position),

placing the reactor mode switch in the shutdown position per Required Action B.1 could cause substantial secondary damage. If recoupling is not accomplished, operation may continue, provided the control rods are fully inserted within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months and disarmed (electrically or hydraulically) within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Inserting a control rod ensures the shutdown and scram capabilities are not adversely affected. The control rod is disarmed to prevent inadvertent withdrawal during subsequent operations. The control rods can be hydraulically disarmed

by closing the drive water and exhaust water isolation valves .

Electrically the control rods can be disarmed by disconnecting power from all four directional control valv$ solenoids. Required Action A.1 is modified by a Note that allows the RWM to be bypassed if required to allow insertion of the inoperable control rods and continued operation.

LCO 3.3.2.1, "Control Rod Block Instrumentation," Actions provide additional requirements when the RWM is bypassed to ensure compliance with the CRDA analysis.

The allowed Completion Tinies are reasonable, considering the small number of allowed inoperable control rods, and provide time to insert and disarm the control rods in an orderly manner and without challenging plant systems.

Condition A is modified by a Note allowing separate Condition entry for each uncoupled control rod. This is acceptable since the Required Actions for this Condition provide appropriate compensatory actions for each uncoupled control rod. Complying with the Required Actions may allow for continued operation. Subsequent uncoupled control rods

SUSQUEHANNA- UNIT 2 TS I B 3.10-37 (continued)

Revision 0

Rev. 3 SOM Test-Refueling B 3.10.8 BASES ACTIONS A.1 (continued) are governed by subsequent entry into the Condition and application of the Required Actions.

With one or more of the requirements of this LCO not met for reasons other than an uncoupled control rod, the testing should be immediately stopped by placing the reactor mode switch in the shutdown or refuel position. This results in a condition that is consistent with the requirements for MODE 5 where the provisions of this Special Operations LCO are no longer required.

SURVEILLANCE SR 3.10.8.1 REQUIREMENTS Performance of the applicable SRs for LCO 3.3.1.1, Functions 2.a and 2.d will ensure that the reactor is operated within the bounds of the safety analysis .

SR 3.10.8.1, SR 3.10.8.2, and SR 3.10.8.3 LCO 3.3.1.1, Functions 2.a, 2.d and 2.e, made applicable in this Special Operations LCO, are required to have applicable Surveillances met to establish that this Special Operations LCO is being met. However, the control rod withdrawal sequences during the SOM tests may be enforced by the RWM (LCO 3.3.2.1, Function 2, MODE 2 requirements) or by a s.econd licensed operator or other qualified member of the technical staff. As noted, either the applicable SRs for the RWM (LCO 3.3.2.1) must be satisfied according to the applicable Frequencies (SR 3.10.8.2), or the proper movement of control rods must be verified (SR 3.10.8.3). This latter verification (i.e., SR 3.10.8.3) must be performed during control rod movement to prevent deviations from the specified sequence. These surveillances provide adequate assurance that the specified test sequence is being followed .

SUSQUEHANNA- UNIT 2 TS I B 3.10-38 (continued)

Revision 1

Rev. 3 SOM Test-Refueling B 3.10.8 BASES SURVEILLANCE SR 3.10.8.4 REQUIREMENTS (continued) Periodic verification of the administrative controls established by this LCO will ensure that the reactor is operated within the bounds of the safety analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.10.8.5 Coupling verification is performed to ensure the control rod is connected to the control rod drive mechanism and will perform its intended function when necessary. The verification is required to be performed any time a control rod is withdrawn to the "full out" notch position, or prior to declaring the control rod OPERABLE after work on the control rod or CRD System that could affect coupling. This Frequency is acceptable, considering the low probability that a control rod will become uncoupled when it is not being moved as well as operating experience related to uncoupling events.

SR 3.10.8.6

CRD charging water header pressure verification is performed to ensure the motive force is available to scram the control rods in the event of a scram signal. A minimum accumulator pressure is specified, below which the capability of the accumulator to perform its intended function becomes degraded and the accumulator is considered inoperable. The minimum accumulator pressure of 940 psig is well below the expected pressure of 1100 psig. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCE 1. XN-NF-80-19(P)(A) Volume 1 and Supplements 1and2, "Exxon Nuclear Methodology for Boiling Water Reactors," Exxon Nuclear Company, March 1983.

SUSQUEHANNA- UNIT 2 TS I B 3.10-39 Revision 3

"-....,

ML16334A265: Difference between revisions

Latest revision as of 22:53, 4 February 2020

Text

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title:

Title: