BSEP 16-0067, Technical Specification Bases, Rev 88

Technical Specification Bases, Rev 88

ML16224A284
Person / Time
Site:	Brunswick
Issue date:	08/03/2016
From:	Pope A Duke Energy Progress
To:	Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML16224A234	List: BSEP 16-0067, Technical Specification Bases, Rev 88 ML16224A243 ML16224A283
References
BSEP 16-0067
Download: ML16224A284 (660)

Text

[[:#Wiki_filter:Technical Specification Bases Brunswick Steam Electric Plant, Unit No. 2 Renewed Facility Operating License DPR-62 Revision 88

LIST OF EFFECTIVE PAGES - BASES Page No. Revision No. Page No. Revision No. Title Page 88 B 3.1.1-5 30 B 3.1.1-6 30 List of Effective Pages - Book 1 B 3.1.2-1 30 B 3.1.2-2 30 LOEP-1 88 B 3.1.2-3 30 LOEP-2 86 B 3.1.2-4 30 LOEP-3 79 B 3.1.2-5 30 LOEP-4 78 B 3.1.3-1 30 B 3.1.3-2 62 i 62 B 3.1.3-3 30 ii 30 B 3.1.3-4 60 B 3.1.3-5 30 B 2.1.1-1 30 B 3.1.3-6 30 B 2.1.1-2 73 B 3.1.3-7 60 B 2.1.1-3 73 B 3.1.3-8 60 B 2.1.1-4 79 B 3.1.3-9 60 B 2.1.2-1 30 B 3.1.4-1 30 B 2.1.2-2 30 B 3.1.4-2 62 B 2.1.2-3 30 B 3.1.4-3 60 B 3.1.4-4 30 B 3.0-1 48 B 3.1.4-5 40 B 3.0-2 30 B 3.1.4-6 30 B 3.0-3 30 B 3.1.4-7 30 B 3.0-4 30 B 3.1.5-1 62 B 3.0-5 39 B 3.1.5-2 30 B 3.0-6 39 B 3.1.5-3 30 B 3.0-7 39 B 3.1.5-4 30 B 3.0-8 39 B 3.1.5-5 30 B 3.0-9 39 B 3.1.6-1 62 B 3.0-10 48 B 3.1.6-2 62 B 3.0-11 48 B 3.1.6-3 62 B 3.0-12 48 B 3.1.6-4 62 B 3.0-13 48 B 3.1.6-5 62 B 3.0-14 48 B 3.1.7-1 30 B 3.0-15 48 B 3.1.7-2 30 B 3.0-16 48 B 3.1.7-3 30 B 3.0-17 48 B 3.1.7-4 30 B 3.0-18 48 B 3.1.7-5 30 B 3.1.7-6 30 B 3.1.1-1 30 B 3.1.8-1 30 B 3.1.1-2 30 B 3.1.8-2 34 B 3.1.1-3 30 B 3.1.8-3 34 B 3.1.1-4 30 B 3.1.8-4 30 B 3.1.8-5 30 (continued) Brunswick Unit 2 LOEP-1 Revision 88

LIST OF EFFECTIVE PAGES - BASES (continued) Page No. Revision No. Page No. Revision No. B 3.2.1-1 79 B 3.3.1.1-34 30 B 3.2.1-2 79 B 3.3.1.1-35 30 B 3.2.1-3 79 B 3.3.1.1-36 69 B 3.2.2-1 62 B 3.3.1.1-37 30 B 3.2.2-2 62 B 3.3.1.1-38 30 B 3.2.2-3 62 B 3.3.1.1-39 30 B 3.2.2-4 79 B 3.3.1.1-40 30 B 3.2.3-1 79 B 3.3.1.1-41 33 B 3.2.3-2 79 B 3.3.1.1-42 33 B 3.2.3-3 62 B 3.3.1.1-43 69 B 3.3.1.2-1 30 B 3.3.1.1-1 30 B 3.3.1.2-2 57 B 3.3.1.1-2 80 B 3.3.1.2-3 30 B 3.3.1.1-3 30 B 3.3.1.2-4 30 B 3.3.1.1-4 30 B 3.3.1.2-5 30 B 3.3.1.1-5 30 B 3.3.1.2-6 30 B 3.3.1.1-6 30 B 3.3.1.2-7 30 B 3.3.1.1-7 30 B 3.3.1.2-8 30 B 3.3.1.1-8 30 B 3.3.1.2-9 30 B 3.3.1.1-9 30 B 3.3.2.1-1 30 B 3.3.1.1-10 30 B 3.3.2.1-2 62 B 3.3.1.1-11 30 B 3.3.2.1-3 62 B 3.3.1.1-12 30 B 3.3.2.1-4 62 B 3.3.1.1-13 30 B 3.3.2.1-5 62 B 3.3.1.1-14 30 B 3.3.2.1-6 62 B 3.3.1.1-15 62 B 3.3.2.1-7 30 B 3.3.1.1-16 30 B 3.3.2.1-8 30 B 3.3.1.1-17 30 B 3.3.2.1-9 30 B 3.3.1.1-18 30 B 3.3.2.1-10 30 B 3.3.1.1-19 30 B 3.3.2.1-11 30 B 3.3.1.1-20 30 B 3.3.2.1-12 30 B 3.3.1.1-21 86 B 3.3.2.1-13 30 B 3.3.1.1-22 86 B 3.3.2.1-14 30 B 3.3.1.1-23 30 B 3.3.2.1-15 62 B 3.3.1.1-24 30 B 3.3.2.2-1 30 B 3.3.1.1-25 30 B 3.3.2.2-2 62 B 3.3.1.1-26 30 B 3.3.2.2-3 62 B 3.3.1.1-27 30 B 3.3.2.2-4 30 B 3.3.1.1-28 37 B 3.3.2.2-5 62 B 3.3.1.1-29 37 B 3.3.2.2-6 30 B 3.3.1.1-30 30 B 3.3.2.2-7 30 B 3.3.1.1-31 30 B 3.3.3.1-1 30 B 3.3.1.1-32 30 B 3.3.3.1-2 30 B 3.3.1.1-33 69 B 3.3.3.1-3 30 (continued) Brunswick Unit 2 LOEP-2 Revision 86

LIST OF EFFECTIVE PAGES - BASES (continued) Page No. Revision No. Page No. Revision No. B 3.3.3.1-4 30 B 3.3.5.1-17 62 B 3.3.3.1-5 30 B 3.3.5.1-18 62 B 3.3.3.1-6 51 B 3.3.5.1-19 62 B 3.3.3.1-7 39 B 3.3.5.1-20 30 B 3.3.3.1-8 38 B 3.3.5.1-21 30 B 3.3.3.1-9 38 B 3.3.5.1-22 30 B 3.3.3.1-10 38 B 3.3.5.1-23 30 B 3.3.3.2-1 39 B 3.3.5.1-24 30 B 3.3.3.2-2 39 B 3.3.5.1-25 30 B 3.3.3.2-3 39 B 3.3.5.1-26 30 B 3.3.3.2-4 39 B 3.3.5.1-27 30 B 3.3.3.2-5 39 B 3.3.5.1-28 30 B 3.3.4.1-1 30 B 3.3.5.1-29 30 B 3.3.4.1-2 30 B 3.3.5.1-30 30 B 3.3.4.1-3 30 B 3.3.5.1-31 62 B 3.3.4.1-4 30 B 3.3.5.2-1 30 B 3.3.4.1-5 30 B 3.3.5.2-2 30 B 3.3.4.1-6 30 B 3.3.5.2-3 30 B 3.3.4.1-7 30 B 3.3.5.2-4 30 B 3.3.4.1-8 30 B 3.3.5.2-5 30 B 3.3.4.1-9 30 B 3.3.5.2-6 30 B 3.3.5.1-1 30 B 3.3.5.2-7 30 B 3.3.5.1-2 30 B 3.3.5.2-8 30 B 3.3.5.1-3 30 B 3.3.5.2-9 30 B 3.3.5.1-4 33 B 3.3.5.2-10 30 B 3.3.5.1-5 30 B 3.3.5.2-11 42 B 3.3.5.1-6 30 B 3.3.6.1-1 30 B 3.3.5.1-7 30 B 3.3.6.1-2 30 B 3.3.5.1-8 62 B 3.3.6.1-3 66 B 3.3.5.1-9 79 B 3.3.6.1-4 66 B 3.3.5.1-10 62 B 3.3.6.1-5 70 B 3.3.5.1-11 30 B 3.3.6.1-6 70 B 3.3.5.1-12 62 B 3.3.6.1-7 30 B 3.3.5.1-13 33 B 3.3.6.1-8 31 B 3.3.5.1-14 33 B 3.3.6.1-9 30 B 3.3.5.1-15 33 B 3.3.6.1-10 30 B 3.3.5.1-16 33 B 3.3.6.1-11 30 B 3.3.6.1-12 30 B 3.3.6.1-13 30 B 3.3.6.1-14 30 (continued) Brunswick Unit 2 LOEP-3 Revision 79

LIST OF EFFECTIVE PAGES - BASES (continued) Page No. Revision No. Page No. Revision No. B 3.3.6.1-15 30 B 3.3.7.2-7 30 B 3.3.6.1-16 30 B 3.3.8.1-1 78 B 3.3.6.1-17 66 B 3.3.8.1-2 78 B 3.3.6.1-18 30 B 3.3.8.1-3 78 B 3.3.6.1-19 30 B 3.3.8.1-4 78 B 3.3.6.1-20 30 B 3.3.8.1-5 78 B 3.3.6.1-21 30 B 3.3.8.1-6 78 B 3.3.6.1-22 70 B 3.3.8.2-1 30 B 3.3.6.1-23 70 B 3.3.8.2-2 30 B 3.3.6.1-24 70 B 3.3.8.2-3 30 B 3.3.6.1-25 70 B 3.3.8.2-4 30 B 3.3.6.1-26 70 B 3.3.8.2-5 30 B 3.3.6.1-27 70 B 3.3.8.2-6 30 B 3.3.6.1-28 70 B 3.3.8.2-7 30 B 3.3.6.1-29 70 B 3.3.6.1-30 70 B 3.3.6.1-31 70 B 3.3.6.1-32 70 B 3.3.6.2-1 76 B 3.3.6.2-2 30 B 3.3.6.2-3 30 B 3.3.6.2-4 30 B 3.3.6.2-5 30 B 3.3.6.2-6 30 B 3.3.6.2-7 76 B 3.3.6.2-8 76 B 3.3.6.2-9 76 B 3.3.6.2-10 76 B 3.3.7.1-1 43 B 3.3.7.1-2 43 B 3.3.7.1-3 43 B 3.3.7.1-4 43 B 3.3.7.1-5 30 B 3.3.7.1-6 30 B 3.3.7.1-7 33 B 3.3.7.2-1 30 B 3.3.7.2-2 30 B 3.3.7.2-3 30 B 3.3.7.2-4 30 B 3.3.7.2-5 30 B 3.3.7.2-6 30 Brunswick Unit 2 LOEP-4 Revision 78

LIST OF EFFECTIVE PAGES - BASES Page No. Revision No. Page No. Revision No. Title Page N/A B 3.4.7-4 39 B 3.4.7-5 39 List of Effective Pages - Book 2 B 3.4.8-1 30 B 3.4.8-2 30 LOEP-1 88 B 3.4.8-3 30 LOEP-2 77 B 3.4.8-4 30 LOEP-3 88 B 3.4.8-5 30 LOEP-4 82 B 3.4.9-1 30 LOEP-5 65 B 3.4.9-2 35 B 3.4.9-3 35 i 30 B 3.4.9-4 30 ii 30 B 3.4.9-5 35 B 3.4.9-6 35 B 3.4.1-1 30 B 3.4.9-7 30 B 3.4.1-2 79 B 3.4.9-8 87 B 3.4.1-3 79 B 3.4.9-9 35 B 3.4.1-4 62 B 3.4.10-1 62 B 3.4.1-5 79 B 3.4.10-2 30 B 3.4.2-1 30 B 3.4.2-2 30 B 3.5.1-1 30 B 3.4.2-3 30 B 3.5.1-2 30 B 3.4.2-4 30 B 3.5.1-3 30 B 3.4.3-1 72 B 3.5.1-4 62 B 3.4.3-2 30 B 3.5.1-5 62 B 3.4.3-3 30 B 3.5.1-6 39 B 3.4.3-4 56 B 3.5.1-7 30 B 3.4.4-1 30 B 3.5.1-8 62 B 3.4.4-2 30 B 3.5.1-9 30 B 3.4.4-3 30 B 3.5.1-10 30 B 3.4.4-4 30 B 3.5.1-11 30 B 3.4.4-5 30 B 3.5.1-12 30 B 3.4.5-1 75 B 3.5.1-13 56 B 3.4.5-2 75 B 3.5.1-14 42 B 3.4.5-3 75 B 3.5.1-15 42 B 3.4.5-4 75 B 3.5.1-16 30 B 3.4.5-5 75 B 3.5.1-17 62 B 3.4.6-1 39 B 3.5.2-1 30 B 3.4.6-2 39 B 3.5.2-2 30 B 3.4.6-3 39 B 3.5.2-3 30 B 3.4.7-1 30 B 3.5.2-4 30 B 3.4.7-2 30 B 3.5.2-5 30 B 3.4.7-3 39 B 3.5.2-6 30 B 3.5.3-1 30 B 3.5.3-2 39 (continued) Brunswick Unit 2 LOEP-1 Revision 88

LIST OF EFFECTIVE PAGES - BASES (continued) Page No. Revision No. Page No. Revision No. B 3.5.3-3 30 B 3.6.1.5-7 30 B 3.5.3-4 30 B 3.6.1.5-8 33 B 3.5.3-5 30 B 3.6.1.5-9 30 B 3.5.3-6 30 B 3.6.1.6-1 30 B 3.5.3-7 30 B 3.6.1.6-2 30 B 3.6.1.6-3 30 B 3.6.1.1-1 30 B 3.6.1.6-4 30 B 3.6.1.1-2 30 B 3.6.1.6-5 63 B 3.6.1.1-3 30 B 3.6.1.1-4 55 B 3.6.2.1-1 30 B 3.6.1.1-5 55 B 3.6.2.1-2 30 B 3.6.1.1-6 55 B 3.6.2.1-3 30 B 3.6.1.2-1 30 B 3.6.2.1-4 30 B 3.6.1.2-2 30 B 3.6.2.1-5 30 B 3.6.1.2-3 30 B 3.6.2.2-1 30 B 3.6.1.2-4 30 B 3.6.2.2-2 30 B 3.6.1.2-5 30 B 3.6.2.2-3 30 B 3.6.1.2-6 30 B 3.6.2.3-1 30 B 3.6.1.2-7 44 B 3.6.2.3-2 39 B 3.6.1.2-8 44 B 3.6.2.3-3 39 B 3.6.1.3-1 30 B 3.6.2.3-4 56 B 3.6.1.3-2 77 B 3.6.3.1-1 64 B 3.6.1.3-3 77 B 3.6.3.1-2 64 B 3.6.1.3-4 30 B 3.6.3.2-1 64 B 3.6.1.3-5 30 B 3.6.4.1-1 30 B 3.6.1.3-6 30 B 3.6.4.1-2 52 B 3.6.1.3-7 30 B 3.6.4.1-3 30 B 3.6.1.3-8 30 B 3.6.4.1-4 30 B 3.6.1.3-9 30 B 3.6.4.1-5 30 B 3.6.1.3-10 30 B 3.6.4.2-1 30 B 3.6.1.3-11 30 B 3.6.4.2-2 30 B 3.6.1.3-12 44 B 3.6.4.2-3 30 B 3.6.1.3-13 44 B 3.6.4.2-4 30 B 3.6.1.3-14 71 B 3.6.4.2-5 30 B 3.6.1.4-1 30 B 3.6.4.2-6 30 B 3.6.1.4-2 30 B 3.6.4.3-1 30 B 3.6.1.4-3 30 B 3.6.4.3-2 30 B 3.6.1.5-1 30 B 3.6.4.3-3 30 B 3.6.1.5-2 30 B 3.6.1.5-3 30 B 3.6.1.5-4 30 B 3.6.1.5-5 30 B 3.6.1.5-6 30 (continued) Brunswick Unit 2 LOEP-2 Revision 77

LIST OF EFFECTIVE PAGES - BASES (continued) Page No. Revision No. Page No. Revision No. B 3.6.4.3-4 30 B 3.7.7-1 30 B 3.6.4.3-5 30 B 3.7.7-2 30 B 3.6.4.3-6 30 B 3.7.7-3 30 B 3.7.1-1 30 B 3.8.1-1 30 B 3.7.1-2 30 B 3.8.1-2 78 B 3.7.1-3 39 B 3.8.1-3 83 B 3.7.1-4 39 B 3.8.1-4 83 B 3.7.1-5 39 B 3.8.1-5 81 B 3.7.2-1 30 B 3.8.1-6 68 B 3.7.2-2 58 B 3.8.1-7 81 B 3.7.2-3 58 B 3.8.1-8 30 B 3.7.2-4 30 B 3.8.1-9 30 B 3.7.2-5 30 B 3.8.1-10 30 B 3.7.2-6 30 B 3.8.1-11 83 B 3.7.2-7 30 B 3.8.1-12 83 B 3.7.2-8 30 B 3.8.1-13 83 B 3.7.2-9 30 B 3.8.1-14 83 B 3.7.2-10 30 B 3.8.1-15 83 B 3.7.2-11 30 B 3.8.1-16 30 B 3.7.2-12 30 B 3.8.1-17 30 B 3.7.2-13 30 B 3.8.1-18 30 B 3.7.2-14 58 B 3.8.1-19 30 B 3.7.3-1 61 B 3.8.1-20 88 B 3.7.3-2 61 B 3.8.1-21 30 B 3.7.3-3 61 B 3.8.1-22 30 B 3.7.3-4 61 B 3.8.1-23 30 B 3.7.3-5 61 B 3.8.1-24 30 B 3.7.3-6 61 B 3.8.1-25 30 B 3.7.3-7 61 B 3.8.1-26 30 B 3.7.3-8 61 B 3.8.1-27 30 B 3.7.4-1 30 B 3.8.1-28 46 B 3.7.4-2 30 B 3.8.1-29 46 B 3.7.4-3 30 B 3.8.1-30 30 B 3.7.4-4 30 B 3.8.1-31 30 B 3.7.4-5 30 B 3.8.1-32 30 B 3.7.5-1 30 B 3.8.1-33 33 B 3.7.5-2 30 B 3.8.1-34 30 B 3.7.5-3 30 B 3.8.2-1 30 B 3.7.6-1 62 B 3.8.2-2 30 B 3.7.6-2 62 B 3.8.2-3 84 B 3.7.6-3 62 B 3.8.2-4 84 B 3.7.6-4 85 B 3.8.2-5 30 (continued) Brunswick Unit 2 LOEP-3 Revision 88

LIST OF EFFECTIVE PAGES - BASES (continued) Page No. Revision No. Page No. Revision No. B 3.8.2-6 30 B 3.8.7-9 30 B 3.8.2-7 30 B 3.8.7-10 30 B 3.8.3-1 30 B 3.8.7-11 30 B 3.8.3-2 30 B 3.8.7-12 30 B 3.8.3-3 30 B 3.8.7-13 30 B 3.8.3-4 30 B 3.8.7-14 30 B 3.8.3-5 49 B 3.8.7-15 30 B 3.8.3-6 74 B 3.8.8-1 30 B 3.8.3-7 74 B 3.8.8-2 30 B 3.8.4-1 82 B 3.8.8-3 30 B 3.8.4-2 30 B 3.8.8-4 30 B 3.8.4-3 30 B 3.8.8-5 30 B 3.8.4-4 30 B 3.8.4-5 30 B 3.9.1-1 30 B 3.8.4-6 30 B 3.9.1-2 30 B 3.8.4-7 30 B 3.9.1-3 30 B 3.8.4-8 30 B 3.9.1-4 30 B 3.8.4-9 30 B 3.9.2-1 30 B 3.8.4-10 30 B 3.9.2-2 30 B 3.8.4-11 30 B 3.9.2-3 30 B 3.8.5-1 30 B 3.9.2-4 30 B 3.8.5-2 30 B 3.9.3-1 30 B 3.8.5-3 30 B 3.9.3-2 30 B 3.8.5-4 30 B 3.9.3-3 30 B 3.8.5-5 30 B 3.9.4-1 30 B 3.8.6-1 30 B 3.9.4-2 30 B 3.8.6-2 30 B 3.9.4-3 30 B 3.8.6-3 30 B 3.9.4-4 30 B 3.8.6-4 30 B 3.9.5-1 30 B 3.8.6-5 30 B 3.9.5-2 30 B 3.8.6-6 30 B 3.9.5-3 30 B 3.8.6-7 30 B 3.9.6-1 30 B 3.8.7-1 30 B 3.9.6-2 30 B 3.8.7-2 30 B 3.9.6-3 30 B 3.8.7-3 30 B 3.9.7-1 30 B 3.8.7-4 30 B 3.9.7-2 30 B 3.8.7-5 30 B 3.9.7-3 30 B 3.8.7-6 30 B 3.9.7-4 30 B 3.8.7-7 30 B 3.9.8-1 30 B 3.8.7-8 30 B 3.9.8-2 30 B 3.9.8-3 30 B 3.9.8-4 30 (continued) Brunswick Unit 2 LOEP-4 Revision 82

LIST OF EFFECTIVE AGES - BASES (continued) Page No. Revision No. B 3.10.1-1 59 B 3.10.1-2 59 B 3.10.1-3 59 B 3.10.1-4 59 B 3.10.1-5 59 B 3.10.2-1 30 B 3.10.2-2 30 B 3.10.2-3 30 B 3.10.2-4 30 B 3.10.2-5 30 B 3.10.3-1 30 B 3.10.3-2 30 B 3.10.3-3 30 B 3.10.3-4 30 B 3.10.3-5 30 B 3.10.4-1 30 B 3.10.4-2 30 B 3.10.4-3 30 B 3.10.4-4 30 B 3.10.4-5 30 B 3.10.5-1 30 B 3.10.5-2 30 B 3.10.5-3 30 B 3.10.5-4 30 B 3.10.5-5 30 B 3.10.6-1 30 B 3.10.6-2 30 B 3.10.6-3 30 B 3.10.7-1 30 B 3.10.7-2 65 B 3.10.7-3 30 B 3.10.7-4 30 B 3.10.8-1 30 B 3.10.8-2 30 B 3.10.8-3 30 B 3.10.8-4 30 B 3.10.8-5 30 B 3.10.8-6 30 Brunswick Unit 2 LOEP-5 Revision 65

TABLE OF CONTENTS B 2.0 SAFETY LIMITS (SLs) ................................................................................ B 2.1.1-1 B 2.1.1 Reactor Core SLs .................................................................................. B 2.1.1-1 B 2.1.2 Reactor Coolant System (RCS) Pressure SL ........................................ B 2.1.2-1 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY ........... B 3.0-1 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY .......................... B 3.0-12 B 3.1 REACTIVITY CONTROL SYSTEMS ........................................................... B 3.1.1-1 B 3.1.1 SHUTDOWN MARGIN (SDM) ............................................................... B 3.1.1-1 B 3.1.2 Reactivity Anomalies ............................................................................. B 3.1.2-1 B 3.1.3 Control Rod OPERABILITY ................................................................... B 3.1.3-1 B 3.1.4 Control Rod Scram Times ..................................................................... B 3.1.4-1 B 3.1.5 Control Rod Scram Accumulators ......................................................... B 3.1.5-1 B 3.1.6 Rod Pattern Control ............................................................................... B 3.1.6-1 B 3.1.7 Standby Liquid Control (SLC) System ................................................... B 3.1.7-1 B 3.1.8 Scram Discharge Volume (SDV) Vent and Drain Valves ...................... B 3.1.8-1 B 3.2 POWER DISTRIBUTION LIMITS ................................................................ B 3.2.1-1 B 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR) ............................................................................. B 3.2.1-1 B 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR) ..................................... B 3.2.2-1 B 3.2.3 LINEAR HEAT GENERATION RATE (LHGR) ...................................... B 3.2.3-1 B 3.3 INSTRUMENTATION .................................................................................. B 3.3.1.1-1 B 3.3.1.1 Reactor Protection System (RPS) Instrumentation ............................... B 3.3.1.1-1 B 3.3.1.2 Source Range Monitor (SRM) Instrumentation ..................................... B 3.3.1.2-1 B 3.3.1.3 Period Based Detection System (PBDS) ............................................... B 3.3.1.3-1 B 3.3.2.1 Control Rod Block Instrumentation ........................................................ B 3.3.2.1-1 B 3.3.2.2 Feedwater and Main Turbine High Water Level Trip Instrumentation ................................................................................B 3.3.2.2-1 B 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation .................................. B 3.3.3.1-1 B 3.3.3.2 Remote Shutdown Monitoring Instrumentation ..................................... B 3.3.3.2-1 B 3.3.4.1 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation .......................................................... B 3.3.4.1-1 B 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation .................. B 3.3.5.1-1 B 3.3.5.2 Reactor Core Isolation Cooling (RCIC) System Instrumentation ........... B 3.3.5.2-1 B 3.3.6.1 Primary Containment Isolation Instrumentation ..................................... B 3.3.6.1-1 B 3.3.6.2 Secondary Containment Isolation Instrumentation ................................ B 3.3.6.2-1 B 3.3.7.1 Control Room Emergency Ventilation (CREV) System Instrumentation ................................................................................B 3.3.7.1-1 (continued) Brunswick Unit 2 i Revision No. 62

TABLE OF CONTENTS B 3.3 INSTRUMENTATION (continued) B 3.3.7.2 Condenser Vacuum Pump Isolation Instrumentation..............................B 3.3.7.2-1 B 3.3.8.1 Loss of Power (LOP) Instrumentation .....................................................B 3.3.8.1-1 B 3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring .................B 3.3.8.2-1 Brunswick Unit 2 ii Revision No. 30

TABLE OF CONTENTS B 3.4 REACTOR COOLANT SYSTEM (RCS)........................................................B 3.2.3-1 B 3.4.1 Recirculation Loops Operating ................................................................B 3.4.1-1 B 3.4.2 Jet Pumps ................................................................................................B 3.4.2-1 B 3.4.3 Safety/Relief Valves (SRVs) ....................................................................B 3.4.3-1 B 3.4.4 RCS Operational LEAKAGE....................................................................B 3.4.4-1 B 3.4.5 RCS Leakage Detection Instrumentation ................................................B 3.4.5-1 B 3.4.6 RCS Specific Activity................................................................................B 3.4.6-1 B 3.4.7 Residual Heat Removal (RHR) Shutdown Cooling SystemHot Shutdown .....................................................................B 3.4.7-1 B 3.4.8 Residual Heat Removal (RHR) Shutdown Cooling SystemCold Shutdown ...................................................................B 3.4.8-1 B 3.4.9 RCS Pressure and Temperature (P/T) Limits .........................................B 3.4.9-1 B 3.4.10 Reactor Steam Dome Pressure...............................................................B 3.4.10-1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM ..........................................B 3.4.10-1 B 3.5.1 ECCSOperating....................................................................................B 3.5.1-1 B 3.5.2 ECCSShutdown ...................................................................................B 3.5.2-1 B 3.5.3 RCIC System............................................................................................B 3.5.3-1 B 3.6 CONTAINMENT SYSTEMS ..........................................................................B 3.3.8.2-1 B 3.6.1.1 Primary Containment ...............................................................................B 3.6.1.1-1 B 3.6.1.2 Primary Containment Air Lock .................................................................B 3.6.1.2-1 B 3.6.1.3 Primary Containment Isolation Valves (PCIVs) .......................................B 3.6.1.3-1 B 3.6.1.4 Drywell Air Temperature ..........................................................................B 3.6.1.4-1 B 3.6.1.5 Reactor Building-to-Suppression Chamber Vacuum Breakers...............B 3.6.1.5-1 B 3.6.1.6 Suppression Chamber-to-Drywell Vacuum Breakers..............................B 3.6.1.6-1 B 3.6.2.1 Suppression Pool Average Temperature ................................................B 3.6.2.1-1 B 3.6.2.2 Suppression Pool Water Level ................................................................B 3.6.2.2-1 B 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling.....................B 3.6.2.3-1 B 3.6.3.1 Primary Containment Oxygen Concentration ..........................................B 3.6.3.1-1 B 3.6.3.2 Containment Atmosphere Dilution (CAD) System...................................B 3.6.3.2-1 B 3.6.4.1 Secondary Containment ..........................................................................B 3.6.4.1-1 B 3.6.4.2 Secondary Containment Isolation Dampers (SCIDs) ..............................B 3.6.4.2-1 B 3.6.4.3 Standby Gas Treatment (SGT) System...................................................B 3.6.4.3-1 B 3.7 PLANT SYSTEMS .........................................................................................B 3.5.3-1 B 3.7.1 Residual Heat Removal Service Water (RHRSW) System.....................B 3.7.1-1 B 3.7.2 Service Water (SW) System and Ultimate Heat Sink (UHS) ..................B 3.7.2-1 B 3.7.3 Control Room Emergency Ventilation (CREV) System ...........................B 3.7.3-1 (continued) Brunswick Unit 2 i Revision No. 30

TABLE OF CONTENTS B 3.7 PLANT SYSTEMS (continued) B 3.7.4 Control Room Air Conditioning (AC) System...........................................B 3.7.4-1 B 3.7.5 Main Condenser Offgas ...........................................................................B 3.7.5-1 B 3.7.6 Main Turbine Bypass System ..................................................................B 3.7.6-1 B 3.7.7 Spent Fuel Storage Pool Water Level .....................................................B 3.7.7-1 B 3.8 ELECTRICAL POWER SYSTEMS................................................................B 3.8.1-1 B 3.8.1 AC SourcesOperating ..........................................................................B 3.8.1-1 B 3.8.2 AC SourcesShutdown ..........................................................................B 3.8.2-1 B 3.8.3 Diesel Fuel Oil..........................................................................................B 3.8.3-1 B 3.8.4 DC SourcesOperating ..........................................................................B 3.8.4-1 B 3.8.5 DC SourcesShutdown ..........................................................................B 3.8.5-1 B 3.8.6 Battery Cell Parameters ...........................................................................B 3.8.6-1 B 3.8.7 Distribution SystemsOperating.............................................................B 3.8.7-1 B 3.8.8 Distribution SystemsShutdown ............................................................B 3.8.8-1 B 3.9 REFUELING OPERATIONS..........................................................................B 3.9.1-1 B 3.9.1 Refueling Equipment Interlocks ...............................................................B 3.9.1-1 B 3.9.2 Refuel Position One-Rod-Out Interlock ...................................................B 3.9.2-1 B 3.9.3 Control Rod Position ................................................................................B 3.9.3-1 B 3.9.4 Control Rod Position Indication ...............................................................B 3.9.4-1 B 3.9.5 Control Rod OPERABILITYRefueling ..................................................B 3.9.5-1 B 3.9.6 Reactor Pressure Vessel (RPV) Water Level..........................................B 3.9.6-1 B 3.9.7 Residual Heat Removal (RHR)High Water Level ................................B 3.9.7-1 B 3.9.8 Residual Heat Removal (RHR)Low Water Level.................................B 3.9.8-1 B 3.10 SPECIAL OPERATIONS ...............................................................................B 3.10.1-1 B 3.10.1 Inservice Leak and Hydrostatic Testing Operation..................................B 3.10.1-1 B 3.10.2 Reactor Mode Switch Interlock Testing ...................................................B 3.10.2-1 B 3.10.3 Single Control Rod WithdrawalHot Shutdown .....................................B 3.10.3-1 B 3.10.4 Single Control Rod WithdrawalCold Shutdown ...................................B 3.10.4-1 B 3.10.5 Single Control Rod Drive (CRD) RemovalRefueling............................B 3.10.5-1 B 3.10.6 Multiple Control Rod WithdrawalRefueling ..........................................B 3.10.6-1 B 3.10.7 Control Rod TestingOperating .............................................................B 3.10.7-1 B 3.10.8 SHUTDOWN MARGIN (SDM) TestRefueling .....................................B 3.10.8-1 Brunswick Unit 2 ii Revision No. 30

Reactor Core SLs B 2.1.1 B 2.0 SAFETY LIMITS (SLS) B 2.1.1 Reactor Core SLs BASES BACKGROUND SLs ensure that specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs). The fuel cladding integrity SL is set such that no fuel damage is calculated to occur if the limit is not violated. Because fuel damage is not directly observable, a stepback approach is used to establish an SL, such that the MCPR is not less than the limit specified in Specification 2.1.1.2. MCPR greater than the specified limit represents a conservative margin relative to the conditions required to maintain fuel cladding integrity. The fuel cladding is one of the physical barriers that separate the radioactive materials from the environs. The integrity of this cladding barrier is related to its relative freedom from perforations or cracking. Although some corrosion or use related cracking may occur during the life of the cladding, fission product migration from this source is incrementally cumulative and continuously measurable. Fuel cladding perforations, however, can result from thermal stresses, which occur from reactor operation significantly above design conditions. While fission product migration from cladding perforation is just as measurable as that from use related cracking, the thermally caused cladding perforations signal a threshold beyond which still greater thermal stresses may cause gross, rather than incremental, cladding deterioration. Therefore, the fuel cladding SL is defined with a margin to the conditions that would produce onset of transition boiling (i.e., MCPR = 1.00). These conditions represent a significant departure from the condition intended by design for planned operation. The MCPR fuel cladding integrity SL ensures that during normal operation and during AOOs, at least 99.9% of the fuel rods in the core do not experience transition boiling. (continued) Brunswick Unit 2 B 2.1.1-1 Revision No. 30

Reactor Core SLs B 2.1.1 BASES BACKGROUND Operation above the boundary of the nucleate boiling regime could (continued) result in excessive cladding temperature because of the onset of transition boiling and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant. The reactor vessel water level SL ensures that adequate core cooling capability is maintained during all MODES of reactor operation. Establishment of Emergency Core Cooling System initiation setpoints higher than this safety limit provides margin to ensure the safety limit will not be reached or exceeded such that fuel damage would occur. APPLICABLE The fuel cladding must not sustain damage as a result of normal SAFETY ANALYSES operation and AOOs. The reactor core SLs are established to preclude violation of the fuel design criterion that an MCPR limit is to be established, such that at least 99.9% of the fuel rods in the core would not be expected to experience the onset of transition boiling. The Reactor Protection System setpoints (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), in combination with the other LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System water level, pressure, and THERMAL POWER level that would result in reaching the MCPR limit. 2.1.1.1 Fuel Cladding Integrity The critical power correlations are valid for critical power calculations at pressures > 600 psia and bundle mass fluxes > 0.09E+6 lbm/hr-ft2 (References 1 and 4). For operation at low pressures or low flows, another basis is used, as follows: Since the pressure drop in the bypass region is essentially all elevation head, the core pressure drop at low power and flows will always be > 4.5 psi. Analyses show that with a bundle flow of 28 x 103 lb/hr, bundle pressure drop is nearly independent of bundle power and has a value of 3.5 psi. Thus, the bundle flow with a 4.5 psi driving head will be > 28 x 103 lb/hr. Full scale ATLAS test data taken at pressures from 14.7 psia (0 psig) to 800 psia (785 psig) indicate that the fuel assembly critical power at this flow is approximately 3.35 MWt. With the design peaking factors, this corresponds to a THERMAL POWER > 46 % RTP. Thus, a THERMAL POWER limit of 23% RTP for reactor pressure

                         < 785 psig is conservative.

(continued) Brunswick Unit 2 B 2.1.1-2 Revision No. 73

Reactor Core SLs B 2.1.1 BASES APPLICABLE 2.1.1.2 MCPR SAFETY ANALYSES (continued) The fuel cladding integrity SL is set such that no fuel damage is calculated to occur if the limit is not violated. Since the parameters that result in fuel damage are not directly observable during reactor operation, the thermal and hydraulic conditions that result in the onset of transition boiling have been used to mark the beginning of the region in which fuel damage could occur. Although it is recognized that the onset of transition boiling would not result in damage to BWR fuel rods, the critical power at which boiling transition is calculated to occur has been adopted as a convenient limit. However, the uncertainties in monitoring the core operating state and in the procedures used to calculate the critical power result in an uncertainty in the value of the critical power. Therefore, the fuel cladding integrity SL is defined as the critical power ratio in the limiting fuel assembly for which more than 99.9% of the fuel rods in the core are expected to avoid boiling transition, considering the power distribution within the core and all uncertainties. The MCPR SL is determined using a statistical model that combines all the uncertainties in operating parameters and the procedures used to calculate critical power. The probability of the occurrence of boiling transition is determined using the approved AREVA critical power correlations. One specific uncertainty included in the SL is the uncertainty inherent in the critical power correlation. References 1, 2, 3, and 4 describe the uncertainties and methodology used to determine the MCPR SL. 2.1.1.3 Reactor Vessel Water Level During MODES 1 and 2 the reactor vessel water level is required to be above the top of the active irradiated fuel to provide core cooling capability. In conjunction with LCOs, the limiting safety system settings, defined in LCO 3.3.1.1 as the Allowable Values, establish the threshold for protective system action to prevent exceeding acceptable limits, including this reactor vessel water level SL, during Design Basis Accidents. With fuel in the reactor vessel during periods when the reactor is shut down, consideration must be given to water level requirements due to the effect of decay heat. If the water level should drop below the top of the active irradiated fuel during this period, the ability to remove decay heat is reduced. This reduction in cooling capability could lead to elevated cladding temperatures and clad perforation in the event that the water level becomes < 2/3 of the core height. The reactor vessel water level SL has been established at the top of the active irradiated fuel to provide a point that can be monitored and to also provide adequate margin for effective action. (continued) Brunswick Unit 2 B 2.1.1-3 Revision No. 73

Reactor Core SLs B 2.1.1 BASES SAFETY LIMITS The reactor core SLs are established to protect the integrity of the fuel clad barrier to prevent the release of radioactive materials to the environs. SL 2.1.1.1 and SL 2.1.1.2 ensure that the core operates within the fuel design criteria. SL 2.1.1.3 ensures that the reactor vessel water level is greater than the top of the active irradiated fuel in order to prevent elevated clad temperatures and resultant clad perforations. APPLICABILITY SLs 2.1.1.1, 2.1.1.2, and 2.1.1.3 are applicable in all MODES. SAFETY LIMIT Exceeding an SL may cause fuel damage and create a potential VIOLATIONS for radioactive releases in excess of 10 CFR 50.67, "Accident Source Term," limits (Ref. 5). Therefore, it is required to insert all insertable control rods and restore compliance with the SLs within 2 hours. The 2 hour Completion Time ensures that the operators take prompt remedial action and also ensures that the probability of an accident occurring during this period is minimal. REFERENCES 1. EMF-2209(P)(A), "SPCB Critical Power Correlation," (as identified in the COLR).

2. EMF-2245(P)(A), "Application of Siemens Power Corporation's Critical Power Correlations to Co-Resident Fuel," (as identified in the COLR).

3. ANP-10307PA, "AREVA MCPR Safety Limit Methodology for Boiling Water Reactors," (as identified in the COLR).

4. ANP-10298PA, "ACE/ATRIUM 10XM Critical Power Correlation,"

(as identified in the COLR).

5. 10 CFR 50.67.

Brunswick Unit 2 B 2.1.1-4 Revision No. 79

RCS Pressure SL B 2.1.2 B 2.0 SAFETY LIMITS (SLs) B 2.1.2 Reactor Coolant System (RCS) Pressure SL BASES BACKGROUND The SL on reactor steam dome pressure protects the RCS against overpressurization. In the event of fuel cladding failure, fission products are released into the reactor coolant. The RCS then serves as the primary barrier in preventing the release of fission products into the atmosphere. Establishing an upper limit on reactor steam dome pressure ensures continued RCS integrity. According to the UFSAR (Ref. 1), the reactor coolant pressure boundary (RCPB) shall be designed with sufficient margin to ensure that the design conditions are not exceeded during normal operation and anticipated operational occurrences (AOOs). During normal operation and AOOs, RCS pressure is limited from exceeding the design pressure by more than 10%, in accordance with Section III of the ASME Code (Ref. 2). Hydrostatic testing with fuel in the core may be done under LCO 3.10.1, "Inservice Leak and Hydrostatic Testing Operation." RCS components shall be pressure tested in accordance with the requirements of ASME Code, Section XI (Ref. 3). Overpressurization of the RCS could result in a breach of the RCPB, reducing the number of protective barriers designed to prevent radioactive releases from exceeding the limits specified in 10 CFR 50.67,

                   " Accident Source Term" (Ref. 4). If this occurred in conjunction with a fuel cladding failure, fission products could enter the containment atmosphere.

APPLICABLE The RCS safety/relief valves and the Reactor Protection System Reactor SAFETY ANALYSES Vessel Steam Dome PressureHigh Function have settings established to ensure that the RCS pressure SL will not be exceeded. The RCS pressure SL has been selected such that it is at a pressure below which it can be shown that the integrity of the system is not endangered. The reactor pressure vessel is designed to Section III of the ASME, Boiler and Pressure Vessel Code, 1965 Edition, including Addenda through the summer of 1967 (Ref. 5), which permits a maximum pressure (continued) Brunswick Unit 2 B 2.1.2-1 Revision No. 30

RCS Pressure SL B 2.1.2 BASES APPLICABLE transient of 110% (1375 psig) of the design pressure of 1250 psig. The SAFETY ANALYSES SL of 1325 psig, as measured in the reactor steam dome, is equivalent (continued) to 1375 psig at the lowest elevation of the RCS. The RCS is designed to the USAS Nuclear Power Piping Code, Section B31.1, 1967 Edition, including Addenda (Ref. 6), for the reactor recirculation piping, which permits a maximum pressure transient of 120% of design pressures of 1150 psig for suction piping and 1325 psig for discharge piping. The RCS pressure SL is selected to be the lowest transient overpressure allowed by the applicable codes. SAFETY LIMITS The maximum transient pressure allowable in the RCS pressure vessel under the ASME Code, Section III, is 110% of design pressure. The maximum transient pressure allowable in the RCS piping, valves, and fittings is 120% of design pressures of 1150 psig for suction piping and 1325 psig for discharge piping. The most limiting of these allowances is the 110% of the RCS pressure vessel design pressure; therefore, the SL on maximum allowable RCS pressure is established at 1325 psig as measured at the reactor steam dome. APPLICABILITY SL 2.1.2 applies in all MODES. SAFETY LIMIT Exceeding the RCS pressure SL may cause RCS failure and create VIOLATIONS a potential for radioactive releases in excess of 10 CFR 50.67, "Accident Source Term," limits (Ref. 4). Therefore, it is required to insert all insertable control rods and restore compliance with the SL within 2 hours. The 2 hour Completion Time ensures that the operators take prompt remedial action and also assures that the probability of an accident occurring during this period is minimal. REFERENCES 1. UFSAR Section 3.1.2.2.6.

2. ASME, Boiler and Pressure Vessel Code, Section III, Article N-910, 1965 Edition.

3. ASME, Boiler and Pressure Vessel Code, Section XI, Article IW-5000.

4. 10 CFR 50.67.

(continued) Brunswick Unit 2 B 2.1.2-2 Revision No. 30

RCS Pressure SL B 2.1.2 BASES REFERENCES 5. ASME, Boiler and Pressure Vessel Code, Section III, (continued) 1965 Edition, Addenda summer of 1967.

6. ASME, USAS, Nuclear Power Piping Code, Section B31.1, 1967 Edition, including Addenda.

Brunswick Unit 2 B 2.1.2-3 Revision No. 30

LCO Applicability B 3.0 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCOs LCO 3.0.1 through LCO 3.0.8 establish the general requirements applicable to all Specifications in Sections 3.1 through 3.10 and apply at all times, unless otherwise stated. LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met (i.e., when the unit is in the MODES or other specified conditions of the Applicability statement of each Specification). LCO 3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered. The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that:

a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification; and

b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.

There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which the LCO must be met. This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status or to restore variables to within specified limits. If this type of Required Action is not completed within the specified Completion Time, a shutdown may be required to place the unit in a MODE or condition in which the Specification is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.) The second type of Required Action specifies the remedial measures that permit continued operation of the (continued) Brunswick Unit 2 B 3.0-1 Revision No. 48

LCO Applicability B 3.0 BASES LCO 3.0.2 unit that is not further restricted by the Completion Time. (continued) In this case, compliance with the Required Actions provides an acceptable level of safety for continued operation. Completing the Required Actions is not required when an LCO is met or is no longer applicable, unless otherwise stated in the individual Specifications. The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Condition no longer exists. The individual LCO's ACTIONS specify the Required Actions where this is the case. An example of this is in LCO 3.4.9, "RCS Pressure and Temperature (P/T) Limits." The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. The reasons for intentionally relying on the ACTIONS include, but are not limited to, performance of Surveillances, preventive maintenance, corrective maintenance, or investigation of operational problems. Entering ACTIONS for these reasons must be done in a manner that does not compromise safety. Intentional entry into ACTIONS should not be made for operational convenience. Additionally, if intentional entry into ACTIONS would result in redundant equipment being inoperable, alternatives should be used instead. Doing so limits the time both subsystems/divisions of a safety function are inoperable and limits the time conditions exist which may result in LCO 3.0.3 being entered. Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of the Required Actions are applicable when this time limit expires, if the equipment remains removed from service or bypassed. When a change in MODE or other specified condition is required to comply with Required Actions, the unit may enter a MODE or other specified condition in which another Specification becomes applicable. In this case, the Completion Times of the associated Required Actions would apply from the point in time that the new Specification becomes applicable and the ACTIONS Condition(s) are entered. (continued) Brunswick Unit 2 B 3.0-2 Revision No. 30

LCO Applicability B 3.0 BASES (continued) LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implemented when an LCO is not met and:

a. An associated Required Action and Completion Time is not met and no other Condition applies; or

b. The condition of the unit is not specifically addressed by the associated ACTIONS. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the unit. Sometimes, possible combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately.

This Specification delineates the time limits for placing the unit in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LCO and its ACTIONS. It is not intended to be used as an operational convenience that permits routine voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable. Upon entering LCO 3.0.3, 1 hour is allowed to prepare for an orderly shutdown before initiating a change in unit operation. This includes time to permit the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the unit, assuming that only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the Reactor Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3, Completion Times. (continued) Brunswick Unit 2 B 3.0-3 Revision No. 30

LCO Applicability B 3.0 BASES LCO 3.0.3 A unit shutdown required in accordance with LCO 3.0.3 may be (continued) terminated and LCO 3.0.3 exited if any of the following occurs:

a. The LCO is now met.

b. A Condition exists for which the Required Actions have now been performed.

c. ACTIONS exist that do not have expired Completion Times.

These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited. The time limits of Specification 3.0.3 allow 37 hours for the unit to be in MODE 4 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE applies. If a lower MODE is reached in less time than allowed, however, the total allowable time to reach MODE 4, or other applicable MODE, is not reduced. For example, if MODE 2 is reached in 2 hours, then the time allowed for reaching MODE 3 is the next 11 hours, because the total time for reaching MODE 3 is not reduced from the allowable limit of 13 hours. Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed. In MODES 1, 2, and 3, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 4 and 5 because the unit is already in the most restrictive Condition required by LCO 3.0.3. The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, or 3) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken. Exceptions to LCO 3.0.3 are provided in instances where requiring a unit shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the unit. An example of this is in LCO 3.7.7, "Spent Fuel Storage Pool Water Level." (continued) Brunswick Unit 2 B 3.0-4 Revision No. 30

LCO Applicability B 3.0 BASES LCO 3.0.3 LCO 3.7.7 has an Applicability of "During movement of irradiated fuel (continued) assemblies in the spent fuel storage pool." Therefore, this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.7 are not met while in MODE 1, 2, or 3, there is no safety benefit to be gained by placing the unit in a shutdown condition. The Required Action of LCO 3.7.7 of "Suspend movement of irradiated fuel assemblies in the spent fuel storage pool" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3. These exceptions are addressed in the individual Specifications. LCO 3.0.4 LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It allows placing the unit in a MODE or other specified condition stated in that Applicability (e.g., the Applicability desired to be entered) when unit conditions are such that the requirements of the LCO would not be met, in accordance with LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c. LCO 3.0.4.a allows entry into a MODE or other specified condition in the Applicability with the LCO not met when the associated ACTIONS to be entered permit continued operation in the MODE or other specified condition in the Applicability for an unlimited period of time. Compliance with Required Actions that permit continued operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the MODE change. Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made in accordance with the provisions of the Required Actions. LCO 3.0.4.b allows entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management actions, if appropriate. The risk assessment may use quantitative, qualitative, or blended approaches, and the risk assessment will be conducted using the plant program, procedures, and criteria in place to implement 10 CFR 50.65(a)(4), which requires that risk impacts of maintenance activities to be assessed and managed. The risk assessment, for the purposes of LCO 3.0.4.b, must take into account all inoperable Technical Specification equipment regardless of whether the equipment is included in the normal 10 CFR 50.65(a)(4) risk assessment scope. The (continued) Brunswick Unit 2 B 3.0-5 Revision No. 39

LCO Applicability B 3.0 BASES LCO 3.0.4 risk assessments will be conducted using the procedures and guidance (continued) endorsed by Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." Regulatory Guide 1.182 endorses the guidance in Section 11 of NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. These include actions to plan and conduct other activities in a manner that controls overall risk, increased risk awareness by shift and management personnel, actions to reduce the duration of the condition, actions to minimize the magnitude of risk increases (establishment of backup success paths or compensatory measures), and determination that the proposed MODE change is acceptable. Consideration should also be given to the probability of completing restoration such that the requirements of the LCO would be met prior to the expiration of ACTIONS Completion Times that would require exiting the Applicability. LCO 3.0.4.b may be used with single, or multiple systems and components unavailable. NUMARC 93-01 provides guidance relative to consideration of simultaneous unavailability of multiple systems and components. The results of the risk assessment shall be considered in determining the acceptability of entering the MODE or other specified condition in the Applicability, and any corresponding risk management actions. The LCO 3.0.4.b risk assessments do not have to be documented. The Technical Specifications allow continued operation with equipment unavailable in MODE 1 for the duration of the Completion Time. Since this is allowable, and since in general the risk impact in that particular MODE bounds the risk of transitioning into and through the applicable MODES or other specified conditions in the Applicability of the LCO, the use of the LCO 3.0.4.b allowance should be generally acceptable, as long as the risk is assessed and managed as stated above. However, there is a small subset of systems and components that have been determined to be more important to risk and use of the LCO 3.0.4.b allowance is prohibited. The LCOs governing these system and components contain Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not applicable. LCO 3.0.4.c allows entry into a MODE or other specified condition in the Applicability with the LCO not met based on a Note in the Specification which states LCO 3.0.4.c is applicable. These specific allowances permit entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time and a risk assessment has not (continued) Brunswick Unit 2 B 3.0-6 Revision No. 39

LCO Applicability B 3.0 BASES LCO 3.0.4 been performed. This allowance may apply to all the ACTIONS or to a (continued) specific Required Action of a Specification. The risk assessments performed to justify the use of LCO 3.0.4.b usually only consider systems and components. For this reason, LCO 3.0.4.c is typically applied to Specifications which describe values and parameters (e.g., RCS Specific Activity), and may be applied to other Specifications based on NRC plant-specific approval. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability. The provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, and MODE 3 to MODE 4. Upon entry into a MODE or other specified condition in the Applicability with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the applicable Conditions and Required Actions until the Condition is resolved, until the LCO is met, or until the unit is not within the Applicability of the Technical Specification. Surveillances do not have to be performed on the associated inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or SR 3.0.4 for any Surveillances that have not been performed on inoperable equipment. However, SRs must be met to ensure OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO. LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of SRs to demonstrate:

a. The OPERABILITY of the equipment being returned to service; or

b. The OPERABILITY of other equipment.

(continued) Brunswick Unit 2 B 3.0-7 Revision No. 39

LCO Applicability B 3.0 BASES LCO 3.0.5 The administrative controls ensure the time the equipment is returned to (continued) service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the allowed SRs. This Specification does not provide time to perform any other preventive or corrective maintenance. An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the SRs. An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of an SR on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of an SR on another channel in the same trip system. LCO 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that have an LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system's LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the plant is maintained in a safe condition are specified in the support system's LCO's Required Actions. These Required Actions may include entering the supported system's Conditions and Required Actions or may specify other Required Actions. When a support system is inoperable and there is an LCO specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability. (continued) Brunswick Unit 2 B 3.0-8 Revision No. 39

LCO Applicability B 3.0 BASES LCO 3.0.6 However, it is not necessary to enter into the supported systems' (continued) Conditions and Required Actions unless directed to do so by the support system's Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCOs' Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the plant is maintained in a safe condition in the support system's Required Actions. However, there are instances where a support system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system. This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2. Specification 5.5.11, "Safety Function Determination Program (SFDP)," ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6. Cross division checks to identify a loss of safety function for those support systems that support safety systems are required. The cross division check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained. If this evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered. (continued) Brunswick Unit 2 B 3.0-9 Revision No. 39

LCO Applicability B 3.0 BASES (continued) LCO 3.0.7 There are certain special tests and operations required to be performed at various times over the life of the unit. These special tests and operations are necessary to demonstrate select unit performance characteristics, to perform special maintenance activities, or to perform special evolutions. Special Operations LCOs in Section 3.10 allow specified TS requirements to be changed to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS. Unless otherwise specified, all the other TS requirements remain unchanged. This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect. The Applicability of a Special Operations LCO represents a condition not necessarily in compliance with the normal requirements of the TS. Compliance with Special Operations LCOs is optional. A special operation may be performed either under the provisions of the appropriate Special Operations LCO or under the other applicable TS requirements. If it is desired to perform the special operation under the provisions of the Special Operations LCO, the requirements of the Special Operations LCO shall be followed. When a Special Operations LCO requires another LCO to be met, only the requirements of the LCO statement are required to be met regardless of that LCO's Applicability (i.e., should the requirements of this other LCO not be met, the ACTIONS of the Special Operations LCO apply, not the ACTIONS of the other LCO). However, there are instances where the Special Operations LCO's ACTIONS may direct the other LCOs' ACTIONS be met. The Surveillances of the other LCO are not required to be met, unless specified in the Special Operations LCO. If conditions exist such that the Applicability of any other LCO is met, all the other LCO's requirements (ACTIONS and SRs) are required to be met concurrent with the requirements of the Special Operations LCO. LCO 3.0.8 LCO 3.0.8 establishes conditions under which systems are considered to remain capable of performing their intended safety function when associated snubbers are not capable of providing their associated support function(s). This LCO states that the supported system is not considered to be inoperable solely due to one or more snubbers not capable of performing their associated support function(s). This is appropriate because a limited length of time is allowed for maintenance, testing, or repair of one or more snubbers not capable of performing their associated support function(s) and appropriate compensatory measures are specified in the snubber requirements, which are located outside of the Technical Specifications (TS) under licensee control. The snubber requirements do not meet the criteria in 10 CFR 50.36(c)(2)(ii), and, as such, are appropriate for control by the licensee. (continued) Brunswick Unit 2 B 3.0-10 Revision No. 48

LCO Applicability B 3.0 BASES (continued) LCO 3.0.8 If the allowed time expires and the snubber(s) are unable to perform their (continued) associated support function(s), the affected supported system's LCO(s) must be declared not met and the Conditions and Required Actions entered in accordance with LCO 3.0.2. LCO 3.0.8.a applies when one or more snubbers are not capable of providing their associated support function(s) to a single train or subsystem of a multiple train or subsystem supported system or to a single train or subsystem supported system. LCO 3.0.8.a allows 72 hours to restore the snubber(s) before declaring the supported system inoperable. The 72 hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function and due to the availability of the redundant train of the supported system. LCO 3.0.8.b applies when one or more snubbers are not capable of providing their associated support function(s) to more than one train or subsystem of a multiple train or subsystem supported system. LCO 3.0.8.b allows 12 hours to restore the snubber(s) before declaring the supported system inoperable. The 12 hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function. LCO 3.0.8 requires that risk be assessed and managed. Industry and NRC guidance on the implementation of 10 CFR 50.65(a)(4) (the Maintenance Rule) does not address seismic risk. However, use of LCO 3.0.8 should be considered with respect to other plant maintenance activities, and integrated into the existing Maintenance Rule process to the extent possible so that maintenance on any unaffected train or subsystem is properly controlled, and emergent issues are properly addressed. The risk assessment need not be quantified, but may be a qualitative awareness of the vulnerability of systems and components when one or more snubbers are not able to perform their associated support function. Brunswick Unit 2 B 3.0-11 Revision No. 48

SR Applicability B 3.0 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASES SRs SR 3.0.1 through SR 3.0.4 establish the general requirements applicable to all Specifications in Sections 3.1 through 3.10 and apply at all times, unless otherwise stated. SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO. Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when:

a. The systems or components are known to be inoperable, although still meeting the SRs; or

b. The requirements of the Surveillance(s) are known to be not met between required Surveillance performances.

Surveillances do not have to be performed when the unit is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a Special Operations LCO are only applicable when the Special Operations LCO is used as an allowable exception to the requirements of a Specification. Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given SR. In this case, the unplanned event may be credited as fulfilling the performance of the SR. This allowance includes those SRs whose performance is normally precluded in a given MODE or other specified condition. (continued) Brunswick Unit 2 B 3.0-12 Revision No. 48

SR Applicability B 3.0 BASES SR 3.0.1 Surveillances, including Surveillances invoked by Required Actions, (continued) do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with SR 3.0.2, prior to returning equipment to OPERABLE status. Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed. Some examples of this process are:

a. Control Rod Drive maintenance during refueling that requires scram testing at > 800 psi. However, if other appropriate testing is satisfactorily completed and the scram time testing of SR 3.1.4.3 is satisfied, the control rod can be considered OPERABLE. This allows startup to proceed to reach 800 psi to perform other necessary testing.

b. High pressure coolant injection (HPCI) maintenance during shutdown that requires system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with HPCI considered OPERABLE. This allows operation to reach the specified pressure to complete the necessary post maintenance testing.

SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a "once per..." interval. (continued) Brunswick Unit 2 B 3.0-13 Revision No. 48

SR Applicability B 3.0 BASES SR 3.0.2 SR 3.0.2 permits a 25% extension of the interval specified in the (continued) Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities). The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply. These exceptions are stated in the individual Specifications. An example of where SR 3.0.2 does not apply is a Surveillance with a Frequency of "in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions." The requirements of regulations take precedence over the TS. The TS cannot in and of themselves extend a test interval specified in the regulations. As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a "once per..." basis. The 25% extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25% extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner. The provisions of SR 3.0.2 are not intended to be used repeatedly merely as an operational convenience to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified. (continued) Brunswick Unit 2 B 3.0-14 Revision No. 48

SR Applicability B 3.0 BASES (continued) SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified Frequency. A delay period of up to 24 hours or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met. This delay period provides adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with Required Actions or other remedial measures that might preclude completion of the Surveillance. The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements. When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered not to have been performed when specified, SR 3.0.3 allows the full delay period of up to the specified Frequency to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity. SR 3.0.3 also provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions. Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used as an operational convenience to extend (continued) Brunswick Unit 2 B 3.0-15 Revision No. 48

SR Applicability B 3.0 BASES SR 3.0.3 Surveillance intervals. While up to 24 hours or the limit of the specified (continued) Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time require to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65 (a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants. This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillance will be placed in the Corrective Action Program. If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the (specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance. Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1. (continued) Brunswick Unit 2 B 3.0-16 Revision No. 48

SR Applicability B 3.0 BASES (continued) SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability. This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability. A provision is included to allow entry into a MODE or other specified condition in the Applicability when an LCO is not met due to Surveillance not being met in accordance with LCO 3.0.4. However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change. When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed per SR 3.0.1, which states that Surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions of the Applicability. However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes. SR 3.0.4 does not restrict changing MODES or other specified conditions of the Applicability when a Surveillance has not been performed within the specified Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3. The provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, and MODE 3 to MODE 4. (continued) Brunswick Unit 2 B 3.0-17 Revision No. 48

SR Applicability B 3.0 BASES SR 3.0.4 The precise requirements for performance of SRs are specified such that (contined) exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCO's Applicability would have its Frequency specified such that it is not "due" until the specific conditions needed are met. Alternately, the Surveillance may be stated in the form of a Note as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency. Brunswick Unit 2 B 3.0-18 Revision No. 48

SDM B 3.1.1 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM) BASES BACKGROUND SDM requirements are specified to ensure:

a. The reactor can be made subcritical from all operating conditions and transients and Design Basis Events;

b. The reactivity transients associated with postulated accident conditions are controllable within acceptable limits; and

c. The reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.

These requirements are satisfied by the control rods, as described in the UFSAR (Ref. 1), which can compensate for the reactivity effects of the fuel and water temperature changes experienced during all operating conditions. APPLICABLE Having sufficient SDM assures that the reactor will become and remain SAFETY ANALYSES subcritical after all analyzed accidents and transients. For example, SDM is assumed as an initial condition for the control rod removal error during refueling (Ref. 2) and fuel assembly insertion error during refueling (Ref. 3) accidents. The analysis of these reactivity insertion events assumes the refueling interlocks are OPERABLE when the reactor is in the refueling mode of operation. These interlocks prevent the withdrawal of more than one control rod from the core during refueling. (Special consideration and requirements for multiple control rod withdrawal during refueling are covered in Special Operations LCO 3.10.6, "Multiple Control Rod WithdrawalRefueling.") The analysis assumes this condition is acceptable since the core will be shut down with the highest worth control rod withdrawn, if adequate SDM has been demonstrated. SDM satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). (continued) Brunswick Unit 2 B 3.1.1-1 Revision No. 30

SDM B 3.1.1 BASES (continued) LCO The specified SDM limits account for the uncertainty in the demonstration of SDM by testing. Separate SDM limits are provided for testing where the highest worth control rod is determined analytically or by measurement. This is due to the reduced uncertainty in the SDM test when the highest worth control rod is determined by measurement. When SDM is demonstrated by calculations not associated with a test (e.g., to confirm SDM during the fuel loading sequence), additional margin is included to account for uncertainties in the calculation. To ensure adequate SDM, a design margin is included to account for uncertainties in the design calculations (Ref. 5). APPLICABILITY In MODES 1 and 2, SDM must be provided to assure shutdown capability. In MODES 3 and 4, SDM is required to ensure the reactor will be held subcritical with margin for a single withdrawn control rod. SDM is required in MODE 5 to prevent an open vessel inadvertent criticality during the withdrawal of a single control rod from a core cell containing one or more fuel assemblies or a fuel assembly insertion error (Refs. 2 and 3). ACTIONS A.1 With SDM not within the limits of the LCO in MODE 1 or 2, SDM must be restored within 6 hours. Failure to meet the specified SDM may be caused by a control rod that cannot be inserted. The allowed Completion Time of 6 hours is acceptable, considering that the reactor can still be shut down, assuming no failures of additional control rods to insert, and the low probability of an event occurring during this interval. B.1 If the SDM cannot be restored within 6 hours, the plant must be brought to MODE 3 in 12 hours, to prevent the potential for further reductions in available SDM (e.g., additional stuck control rods). The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. (continued) Brunswick Unit 2 B 3.1.1-2 Revision No. 30

SDM B 3.1.1 BASES ACTIONS C.1 (continued) With SDM not within limits in MODE 3, the operator must immediately initiate action to fully insert all insertable control rods. Action must continue until all insertable control rods are fully inserted. This action results in the least reactive condition for the core. D.1, D.2, D.3, and D.4 With SDM not within limits in MODE 4, the operator must immediately initiate action to fully insert all insertable control rods. Action must continue until all insertable control rods are fully inserted. This action results in the least reactive condition for the core. Action must also be initiated within 1 hour to provide means for control of potential radioactive releases. This includes ensuring secondary containment is OPERABLE; at least one Standby Gas Treatment (SGT) subsystem is OPERABLE; and secondary containment isolation capability is available in each associated secondary containment penetration flow path not isolated that is assumed to be isolated to mitigate radioactivity releases. Secondary containment isolation capability is considered available when at least one secondary containment isolation damper and associated instrumentation are OPERABLE, or other acceptable administrative controls are established to assure isolation capability. These administrative controls consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated. Required Actions D.2, D.3, and D.4 may be performed as an administrative check, by examining logs or other information, to determine if the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, SRs may need to be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE. (continued) Brunswick Unit 2 B 3.1.1-3 Revision No. 30

SDM B 3.1.1 BASES ACTIONS E.1, E.2, E.3, E.4, and E.5 (continued) With SDM not within limits in MODE 5, the operator must immediately suspend CORE ALTERATIONS that could reduce SDM (e.g., insertion of fuel in the core or the withdrawal of control rods). Suspension of these activities shall not preclude completion of movement of a component to a safe condition. Inserting control rods or removing fuel from the core will reduce the total reactivity and are therefore excluded from the suspended actions. Action must also be immediately initiated to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies have been fully inserted. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and therefore do not have to be inserted. Action must also be initiated within 1 hour to provide means for control of potential radioactive releases. This includes ensuring secondary containment is OPERABLE; at least one SGT subsystem is OPERABLE; and secondary containment isolation capability is available in each associated secondary containment penetration flow path not isolated that is assumed to be isolated to mitigate radioactivity releases. Secondary containment isolation capability is considered available when at least one secondary containment isolation damper and associated instrumentation are OPERABLE, or other acceptable administrative controls are established to assure isolation capability. The administrative controls consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated. Required Actions E.3, E.4, and E.5 may be performed as an administrative check, by examining logs or other information, to determine if the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances as needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, SRs may need to (continued) Brunswick Unit 2 B 3.1.1-4 Revision No. 30

SDM B 3.1.1 BASES ACTIONS E.1, E.2, E.3, E.4, and E.5 (continued) be performed to restore the component to OPERABLE status. Action must continue until all required components are OPERABLE. SURVEILLANCE SR 3.1.1.1 REQUIREMENTS Adequate SDM must be verified to ensure that the reactor can be made subcritical from any initial operating condition. This can be accomplished by a test, an evaluation, or a combination of the two. Adequate SDM is demonstrated by testing before or during the first startup after fuel movement, or control rod replacement. Control rod replacement refers to the decoupling and removal of a control rod from a core location, and subsequent replacement with a new control rod or a control rod from another core location. Since core reactivity will vary during the cycle as a function of fuel depletion and poison burnup, the beginning of cycle (BOC) test must also account for changes in core reactivity during the cycle. Therefore, to obtain the SDM, the initial measured value must be increased by an adder, "R", which is the difference between the calculated value of maximum core reactivity during the operating cycle and the calculated BOC core reactivity. If the value of R is negative (that is, BOC is the most reactive point in the cycle), no correction to the BOC measured value is required (Ref. 6). For the SDM demonstrations that rely solely on calculation of the highest worth control rod, additional margin (0.10% k/k) must be added to the SDM limit of 0.28% k/k to account for uncertainties in the calculation. The SDM may be demonstrated during an in-sequence control rod withdrawal, in which the highest worth control rod is analytically determined, or during local critical testing, where the highest worth control rod is determined by this testing. Local critical tests require the withdrawal of out of sequence control rods. This testing therefore requires bypassing of the rod worth minimizer to allow the out of sequence withdrawal and additional requirements must be met (see LCO 3.10.7, "Control Rod TestingOperating"). (continued) Brunswick Unit 2 B 3.1.1-5 Revision No. 30

SDM B 3.1.1 BASES SURVEILLANCE SR 3.1.1.1 (continued) REQUIREMENTS The Frequency of 4 hours after reaching criticality is allowed to provide a reasonable amount of time to perform the required calculations and have appropriate verification. During MODES 3 and 4, analytical calculation of SDM may be used to assure the requirements of SR 3.1.1.1 are met. During MODE 5, adequate SDM is required to ensure that the reactor does not reach criticality during control rod withdrawals. An evaluation of each in-vessel fuel movement during fuel loading (including shuffling fuel within the core) is required to ensure adequate SDM is maintained during refueling. This evaluation ensures that the intermediate loading patterns are bounded by the safety analyses for the final core loading pattern. For example, bounding analyses that demonstrate adequate SDM for the most reactive configurations during the refueling may be performed to demonstrate acceptability of the entire fuel movement sequence. These bounding analyses include additional margins to the associated uncertainties. Spiral offload/reload sequences inherently satisfy the SR, provided the fuel assemblies are reloaded in the same configuration analyzed for the new cycle. Removing fuel from the core will result in an increase in SDM. REFERENCES 1. UFSAR, Section 3.1.2.3.

2. UFSAR, Section 15.4.5.1.

3. UFSAR, Section 15.4.5.2.

4. 10 CFR 50.36(c)(2)(ii).

5. UFSAR, Section 4.3.2.4.

6. UFSAR, Section 14.2.9.2.

Brunswick Unit 2 B 3.1.1-6 Revision No. 30

Reactivity Anomalies B 3.1.2 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.2 Reactivity Anomalies BASES BACKGROUND In accordance with the UFSAR (Ref. 1), reactivity shall be controllable such that subcriticality is maintained under cold conditions and acceptable fuel design limits are not exceeded during normal operation and anticipated operational occurrences. Therefore, this Specification uses a difference of the predicted versus measured core reactivity during power operation to determine if a significant reactivity anomaly exists. The periodic confirmation of core reactivity is necessary to ensure that the Design Basis Accident (DBA) and transient safety analyses remain valid. A large reactivity anomaly could be the result of unanticipated changes in fuel reactivity or control rod worth or operation at conditions not consistent with those assumed in the predictions of core reactivity, and could potentially result in a loss of SDM or violation of acceptable fuel design limits. Comparing predicted versus measured core reactivity validates the nuclear methods used in the safety analysis and supports the SDM demonstrations (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") in assuring the reactor can be brought safely to cold, subcritical conditions. When the reactor core is critical or in normal power operation, a reactivity balance exists and the net reactivity is zero. A comparison of predicted and measured reactivity is convenient under such a balance, since parameters are being maintained relatively stable under steady state power conditions. The positive reactivity inherent in the core design is balanced by the negative reactivity of the control components, thermal feedback, neutron leakage, and materials in the core that absorb neutrons, such as burnable absorbers, producing zero net reactivity. In order to achieve the required fuel cycle energy output, the uranium enrichment in the new fuel loading and the fuel loaded in the previous cycles provide excess positive reactivity beyond that required to sustain steady state operation at the beginning of cycle (BOC). When the reactor is critical at RTP and operating at normal moderator temperature, the excess positive reactivity is compensated by burnable absorbers (e.g., (continued) Brunswick Unit 2 B 3.1.2-1 Revision No. 30

Reactivity Anomalies B 3.1.2 BASES BACKGROUND gadolinia), control rods, and whatever neutron poisons (mainly xenon and (continued) samarium) are present in the fuel. The predicted core reactivity, as represented by k effective (keff), is calculated by a 3D core simulator code as a function of cycle exposure. This calculation is performed for projected operating states and conditions throughout the cycle. The monitored keff is calculated by the same 3D core simulator code for actual plant conditions and is then compared to the predicted value of keff for the cycle exposure. APPLICABLE Accurate prediction of core reactivity is either an explicit or implicit SAFETY ANALYSES assumption in the accident analysis evaluations (Ref. 2). In particular, SDM and reactivity transients, such as control rod withdrawal accidents or rod drop accidents, are very sensitive to accurate prediction of core reactivity. These accident analysis evaluations rely on computer codes that have been qualified against available test data, operating plant data, and analytical benchmarks. Monitoring reactivity to determine if a significant anomaly exists provides additional assurance that the nuclear methods provide an accurate representation of the core reactivity. The comparison between the measured and predicted initial core reactivity provides a normalization for the calculational models used to predict core reactivity. If the measured and predicted keff for identical core conditions at BOC do not reasonably agree, then the assumptions used in the reload cycle design analysis or the calculation models used to predict core keff may not be accurate. If reasonable agreement between measured and predicted core reactivity exists at BOC, then the prediction may be normalized to the measured value. Thereafter, any significant deviations in the measured core keff from the predicted core keff that develop during fuel depletion may be an indication that the assumptions of the DBA and transient analyses are no longer valid, or that an unexpected change in core conditions has occurred. Reactivity Anomalies satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). (continued) Brunswick Unit 2 B 3.1.2-2 Revision No. 30

Reactivity Anomalies B 3.1.2 BASES (continued) LCO The reactivity anomaly limit is established to ensure plant operation is maintained within the assumptions of the safety analyses. Large differences between monitored and predicted core reactivity may indicate that the assumptions of the DBA and transient analyses are no longer valid, or that the uncertainties in the nuclear design methodology are larger than expected. A limit on the difference between the monitored and the predicted core keff of +/- 1% k/k has been established based on engineering judgment. A > 1% deviation in reactivity from that predicted is larger than expected for normal operation and should therefore be evaluated. APPLICABILITY In MODE 1, most of the control rods are withdrawn and steady state operation is typically achieved. Under these conditions, the comparison between predicted and monitored core reactivity provides an effective measure of the reactivity anomaly. In MODE 2, control rods are typically being withdrawn during a startup. In MODES 3 and 4, all control rods are fully inserted and therefore the reactor is in the least reactive state, where monitoring core reactivity is not necessary. In MODE 5, fuel loading results in a continually changing core reactivity. SDM requirements (LCO 3.1.1) ensure that fuel movements are performed within the bounds of the safety analysis, and an SDM demonstration is required during the first startup following operations that could have altered core reactivity (e.g., fuel movement or control rod replacement). The SDM test, required by LCO 3.1.1, provides a direct comparison of the predicted and monitored core reactivity at cold conditions; therefore, reactivity anomaly is not required during these conditions. ACTIONS A.1 Should an anomaly develop between measured and predicted core reactivity, the core reactivity difference must be restored to within the limit within 72 hours to ensure continued operation is within the core design assumptions. Restoration of the core reactivity difference to within the limit may be performed by an evaluation of the core design and safety analysis to determine the reason for the anomaly. This evaluation normally reviews the core conditions to determine their consistency with (continued) Brunswick Unit 2 B 3.1.2-3 Revision No. 30

Reactivity Anomalies B 3.1.2 BASES ACTIONS A.1 (continued) input to design calculations. Measured core and process parameters are also normally evaluated to determine that they are within the bounds of the safety analysis. The safety analysis calculational models may also be reviewed to verify that they are adequate for representation of the core conditions. The required Completion Time of 72 hours is based on the low probability of a DBA occurring during this period, and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis. B.1 If Required Action A.1 and the associated Completion Time are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.1.2.1 REQUIREMENTS Verifying the reactivity difference between the monitored and predicted core keff is within the limits of the LCO provides added assurance that plant operation is maintained within the assumptions of the DBA and transient analyses. A 3D core simulator code calculates the core keff for the reactor conditions obtained from plant instrumentation. A comparison of this monitored core keff to the predicted core keff at the same cycle exposure is used to calculate the reactivity difference. The comparison of monitored and predicted core reactivity is required when the core reactivity has potentially changed by a significant amount. This may occur following a refueling in which new fuel assemblies are loaded, fuel assemblies are shuffled within the core, or control rods are replaced or shuffled. Control rod replacement refers to the decoupling and removal of a control rod from a core location, and subsequent replacement with a (continued) Brunswick Unit 2 B 3.1.2-4 Revision No. 30

Reactivity Anomalies B 3.1.2 BASES SURVEILLANCE SR 3.1.2.1 (continued) REQUIREMENTS new control rod or a control rod from another core location. The 24 hour interval after reaching equilibrium conditions following a startup is based on the need for equilibrium xenon concentrations in the core, such that an accurate comparison between the monitored and predicted core keff can be made. For the purposes of this SR, the reactor is assumed to be at equilibrium conditions when steady state operations (no control rod movement or core flow changes) at 75% RTP have been obtained. Also, core reactivity changes during the operating cycle. Therefore, the 1100 MWD/T Frequency was developed, considering the relatively slow change in core reactivity with exposure and operating experience related to variations in core reactivity. The comparison of monitored and predicted core reactivity requires the core to be operating at power levels which minimize the uncertainties and measurement errors, in order to obtain meaningful results. Therefore, the comparison at this Frequency is only done when in MODE 1. The core weight, tons (T) in MWD/T, reflects metric tons. REFERENCES 1. UFSAR, Section 3.1.2.3.

2. UFSAR, Chapter 15.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.1.2-5 Revision No. 30

Control Rod OPERABILITY B 3.1.3 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.3 Control Rod OPERABILITY BASES BACKGROUND Control rods are components of the control rod drive (CRD) System, which is the primary reactivity control system for the reactor. In conjunction with the Reactor Protection System, the CRD System provides the means for the reliable control of reactivity changes to ensure under conditions of normal operation, including anticipated operational occurrences, that specified acceptable fuel design limits are not exceeded. In addition, the control rods provide the capability to hold the reactor core subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the CRD System. The CRD System is designed to satisfy the requirements of UFSAR Sections 3.1.2.3.7.2, 3.1.2.3.8.2, 3.1.2.3.9.2, and 3.1.2.3.10.2 (Ref. 1). The CRD System consists of 137 control rod drive mechanisms (CRDMs) and a hydraulic control unit for each drive mechanism. The CRDM is a double-acting, mechanically latched, hydraulic piston, which uses condensate water as the operating fluid. Accumulators provide additional energy for scram. An index tube and piston, coupled to the control rod, are locked at fixed increments by a collet mechanism. The collet fingers engage notches in the index tube to prevent accidental withdrawal of the control rod, but without restricting insertion. This Specification, along with LCO 3.1.4, "Control Rod Scram Times," and LCO 3.1.5, "Control Rod Scram Accumulators," ensure that the performance of the control rods in the event of a Design Basis Accident (DBA) or transient meets the assumptions used in the safety analyses of References 2, 3, and 4. APPLICABLE The analytical methods and assumptions used in the evaluations SAFETY ANALYSES involving control rods are presented in References 2, 3, and 4. The control rods provide the primary means for rapid reactivity control (reactor scram), for maintaining the reactor subcritical and for limiting the potential effects of reactivity insertion events caused by malfunctions in the CRD System. (continued) Brunswick Unit 2 B 3.1.3-1 Revision No. 30

Control Rod OPERABILITY B 3.1.3 BASES APPLICABLE The capability to insert the control rods provides assurance that the SAFETY ANALYSES assumptions for scram reactivity in the DBA and transient analyses (continued) are not violated. Since the SDM ensures the reactor will be subcritical with the highest worth control rod withdrawn (assumed single failure), the additional failure of a second control rod to insert, if required, could invalidate the demonstrated SDM and potentially limit the ability of the CRD System to hold the reactor subcritical. If the control rod is stuck at an inserted position and becomes decoupled from the CRD, a control rod drop accident (CRDA) can possibly occur. Therefore, the requirement that all control rods be OPERABLE ensures the CRD System can perform its intended function. The control rods also protect the fuel from damage which could result in release of radioactivity. The limits protected are the MCPR Safety Limit (SL) (see Bases for SL 2.1.1, "Reactor Core SLs," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), the 1% cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), and the fuel damage limit (see Bases for LCO 3.1.6, "Rod Pattern Control") during reactivity insertion events. The negative reactivity insertion (scram) provided by the CRD System provides the analytical basis for determination of plant thermal limits and provides protection against fuel damage limits during a CRDA. The Bases for LCO 3.1.4, LCO 3.1.5, and LCO 3.1.6 discuss in more detail how the SLs are protected by the CRD System. Control rod OPERABILITY satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 5). LCO The OPERABILITY of an individual control rod is based on a combination of factors, primarily, the scram insertion times, the control rod coupling integrity, and the ability to determine the control rod position. Accumulator OPERABILITY is addressed by LCO 3.1.5. The associated scram accumulator status for a control rod only affects the scram insertion times; therefore, an inoperable accumulator does not immediately require declaring a control rod inoperable. Although not all control rods are required to be OPERABLE to satisfy the intended (continued) Brunswick Unit 2 B 3.1.3-2 Revision No. 62

Control Rod OPERABILITY B 3.1.3 BASES LCO reactivity control requirements, strict control over the number and (continued) distribution of inoperable control rods is required to satisfy the assumptions of the DBA and transient analyses. APPLICABILITY In MODES 1 and 2, the control rods are assumed to function during a DBA or transient and are therefore required to be OPERABLE in these MODES. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod OPERABILITY during these conditions. Control rod requirements in MODE 5 are located in LCO 3.9.5, "Control Rod OPERABILITY Refueling." ACTIONS The ACTIONS Table is modified by a Note indicating that a separate Condition entry is allowed for each control rod. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable control rod. Complying with the Required Actions may allow for continued operation, and subsequent inoperable control rods are governed by subsequent Condition entry and application of associated Required Actions. A.1, A.2, A.3, and A.4 A control rod is considered stuck if it will not insert by either CRD drive water or scram pressure. With a fully inserted control rod stuck, no actions are required as long as the control rod remains fully inserted. The Required Actions are modified by a Note, which allows the stuck control rod to be bypassed in the rod worth minimizer (RWM) or the RWM to be bypassed, if required, to allow continued operation. LCO 3.3.2.1, "Control Rod Block Instrumentation," provides additional requirements when the stuck control rod is bypassed in the RWM or when the RWM is bypassed to ensure compliance with the banked position withdrawal sequence (BPWS) analysis (Ref. 6). With one withdrawn control rod stuck, the local scram reactivity rate assumptions may not be met if the stuck control rod separation criteria are not met. Therefore, a verification that the separation criteria are met must be performed immediately (Required Action A.1). The separation criteria are not met if a) the stuck control rod occupies a location adjacent to two "slow" control rods, b) the stuck (continued) Brunswick Unit 2 B 3.1.3-3 Revision No. 30

Control Rod OPERABILITY B 3.1.3 BASES ACTIONS A.1, A.2, A.3, and A.4 (continued) control rod occupies a location adjacent to one "slow" control rod and the one "slow" control rod occupies a location adjacent to another "slow" control rod, or c) the stuck control rod occupies a location adjacent to one "slow" control rod when there is another pair of "slow" control rods adjacent to one another located anywhere in the core. The description of "slow" control rods is provided in LCO 3.1.4. In addition, the associated control rod drive must be disarmed in 2 hours (Required Action A.2). The allowed Completion Time of 2 hours is acceptable, considering the reactor can still be shut down, and provides a reasonable time to perform the Required Action in an orderly manner. The control rod must be isolated from both scram pressure and normal insert and withdraw pressure. Isolating the control rod from scram pressure and normal insert and withdraw pressure prevents damage to the CRDM. The control rod should be isolated from scram pressure and normal insert and withdraw pressure while maintaining cooling water to the CRD. Monitoring of the insertion capability of each withdrawn control rod must also be performed within 24 hours from discovery of Condition A concurrent with THERMAL POWER greater than the low power setpoint (LPSP) of the RWM (Required Action A.3). SR 3.1.3.2 performs periodic tests of the control rod insertion capability of withdrawn control rods. Testing each withdrawn control rod ensures that a generic problem does not exist. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." The Required Action A.3 Completion Time only begins from discovery of Condition A concurrent with THERMAL POWER greater than the LPSP of the RWM since the notch insertions may not be compatible with the requirements of rod pattern control (LCO 3.1.6) and the RWM (LCO 3.3.2.1). The allowed Completion Time of 24 hours provides a reasonable time to test the control rods, considering the potential for a need to reduce power to perform the tests. (continued) Brunswick Unit 2 B 3.1.3-4 Revision No. 60

Control Rod OPERABILITY B 3.1.3 BASES ACTIONS A.1, A.2, A.3, and A.4 (continued) To allow continued operation with a withdrawn control rod stuck, an evaluation of adequate SDM is also required within 72 hours (Required Action A.4). Should a DBA or transient require a shutdown, to preserve the single failure criterion, an additional control rod would have to be assumed to fail to insert when required. Therefore, the original SDM demonstration may not be valid. The SDM must therefore be evaluated (by analysis) with the stuck control rod at its stuck position and the highest worth OPERABLE control rod assumed to be fully withdrawn. The allowed Completion Time of 72 hours to verify SDM is adequate, considering that with a single control rod stuck in a withdrawn position, the remaining OPERABLE control rods are capable of providing the required scram and shutdown reactivity. Failure to reach MODE 4 is only likely if an additional control rod adjacent to the stuck control rod also fails to insert during a required scram. Even with the postulated additional single failure of an adjacent control rod to insert, sufficient reactivity control remains to reach and maintain MODE 3 conditions. B.1 With two or more withdrawn control rods stuck, the plant must be brought to MODE 3 within 12 hours. The occurrence of more than one control rod stuck at a withdrawn position increases the probability that the reactor cannot be shut down if required. Insertion of all insertable control rods eliminates the possibility of an additional failure of a control rod to insert. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. C.1 and C.2 With one or more control rods inoperable for reasons other than being stuck in the withdrawn position, operation may continue, provided the control rods are fully inserted within 3 hours and disarmed (electrically or hydraulically) within 4 hours. Inserting a control rod ensures the (continued) Brunswick Unit 2 B 3.1.3-5 Revision No. 30

Control Rod OPERABILITY B 3.1.3 BASES ACTIONS C.1 and C.2 (continued) shutdown and scram capabilities are not adversely affected and allows coupling attempts to be initiated for an uncoupled control rod when greater than the low power setpoint of the RWM. The control rod is disarmed to prevent inadvertent withdrawal during subsequent operations. The control rods can be hydraulically disarmed by closing the drive water and exhaust water isolation valves. The control rods can be electrically disarmed by disconnecting power from all four directional control valve solenoids. Required Action C.1 is modified by a Note, which allows the inoperable control rods to be bypassed in the RWM or the RWM to be bypassed, if required, to allow insertion of the inoperable control rods and continued operation. LCO 3.3.2.1 provides additional requirements when one or more control rods are bypassed in the RWM or when the RWM is bypassed to ensure compliance with the BPWS analysis (Ref. 6). The allowed Completion Times are reasonable, considering the small number of allowed inoperable control rods, and provide time to insert and disarm the control rods in an orderly manner and without challenging plant systems. D.1 and D.2 Out of sequence control rods may increase the potential reactivity worth of a dropped control rod during a CRDA. At 8.75% RTP, the generic BPWS analysis (Ref. 6) requires inserted control rods not in compliance with BPWS to be separated by at least two OPERABLE control rods in all directions, including the diagonal. Therefore, if two or more inoperable control rods are not in compliance with BPWS and not separated by at least two OPERABLE control rods, action must be taken to restore compliance with BPWS or restore the control rods to OPERABLE status. Condition D is modified by a Note indicating that the Condition is not applicable when THERMAL POWER is > 8.75% RTP, since the BPWS is not required to be followed under these conditions, as described in the Bases for LCO 3.1.6. The allowed Completion Time of 4 hours is acceptable, considering the low probability of a CRDA occurring. (continued) Brunswick Unit 2 B 3.1.3-6 Revision No. 30

Control Rod OPERABILITY B 3.1.3 BASES ACTIONS E.1 (continued) If any Required Action and associated Completion Time of Condition A, C, or D are not met, or there are nine or more inoperable control rods, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours. This ensures all insertable control rods are inserted and places the reactor in a condition that does not require the active function (i.e., scram) of the control rods. The number of control rods permitted to be inoperable when operating above 8.75% RTP (e.g., no CRDA considerations) could be more than the value specified, but the occurrence of a large number of inoperable control rods could be indicative of a generic problem, and investigation and resolution of the potential problem should be undertaken. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.1.3.1 REQUIREMENTS The position of each control rod must be determined to ensure adequate information on control rod position is available to the operator for determining control rod OPERABILITY and controlling rod patterns. Control rod position may be determined by the use of OPERABLE reed switch position indicators (including "full-in" or "full-out" indication), by moving control rods to a position with an OPERABLE reed switch indicator, or by the use of other appropriate methods. The 24 hour Frequency of this SR is based on operating experience related to expected changes in control rod position and the availability of control rod position indications in the control room. SR 3.1.3.2 Control rod insertion capability is demonstrated by inserting each partially or fully withdrawn control rod at least one notch and observing that the control rod moves. The control rod may then be returned to its original position. This ensures the control rod is not stuck and is free to insert on a scram signal. As noted, SR 3.1.3.2 is not required to be performed until 31 days after the control rod is withdrawn and THERMAL POWER is greater than the LPSP of the RWM. This Note acknowledges that the (continued) Brunswick Unit 2 B 3.1.3-7 Revision No. 60

Control Rod OPERABILITY B 3.1.3 BASES SURVEILLANCE SR 3.1.3.2 (continued) REQUIREMENTS control rod must first be withdrawn and THERMAL POWER must be increased to above the LPSP of the RWM before performance of the Surveillance. Thus the Note avoids potential conflicts with SR 3.0.3 and SR 3.0.4. The Surveillance is not required to be performed when THERMAL POWER is less than or equal to the LPSP of the RWM, since the notch insertions may not be compatible with the requirements of the BPWS (LCO 3.1.6) and the RWM (LCO 3.3.2.1). While performance of the SR is exempted during this condition, the SR must still be met. The 31 day Frequency takes into account operating experience related to changes in CRD performance. At any time, if a control rod is immovable, a determination of that control rod's trippability (OPERABILITY) must be made and appropriate action taken. SR 3.1.3.3 Verifying that the scram time for each control rod to notch position 06 is 7 seconds provides reasonable assurance that the control rod will insert when required during a DBA or transient, thereby completing its shutdown function. This SR is performed in conjunction with the control rod scram time testing of SR 3.1.4.1, SR 3.1.4.2, SR 3.1.4.3, and SR 3.1.4.4. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," and the functional testing of SDV vent and drain valves in LCO 3.1.8, "Scram Discharge Volume (SDV) Vent and Drain Valves," overlap this Surveillance to provide complete testing of the assumed safety function. The associated Frequencies are acceptable, considering the more frequent testing performed to demonstrate other aspects of control rod OPERABILITY and operating experience, which shows scram times do not significantly change over an operating cycle. (continued) Brunswick Unit 2 B 3.1.3-8 Revision No. 60

Control Rod OPERABILITY B 3.1.3 BASES SURVEILLANCE SR 3.1.3.4 REQUIREMENTS (continued) Coupling verification is performed to ensure the control rod is connected to the CRDM and will perform its intended function when necessary. The Surveillance requires verifying a control rod does not go to the withdrawn overtravel position. The overtravel position feature provides a positive check on the coupling integrity since only an uncoupled CRD can reach the overtravel position. The verification is required to be performed any time a control rod is withdrawn to the "full out" position (notch position 48) or prior to declaring the control rod OPERABLE after work on the control rod or CRD System that could affect coupling. This includes performing the SR when control rods are inserted one notch and then returned to the "full out" position during the performance of SR 3.1.3.2. This Frequency is acceptable, considering the low probability that a control rod will become uncoupled when it is not being moved and operating experience related to uncoupling events. REFERENCES 1. UFSAR, Sections 3.1.2.3.7.2, 3.1.2.3.8.2, 3.1.2.3.9.2, and 3.1.2.3.10.2.

2. UFSAR, Section 4.2.1.1.8.

3. UFSAR, Section 15.4.

4. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, September 1995.

5. 10 CFR 50.36(c)(2)(ii).

6. NEDO-21231, Banked Position Withdrawal Sequence, Section 7.2, January 1977.

Brunswick Unit 2 B 3.1.3-9 Revision No. 60

Control Rod Scram Times B 3.1.4 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.4 Control Rod Scram Times BASES BACKGROUND The scram function of the Control Rod Drive (CRD) System controls reactivity changes during abnormal operational transients to ensure that specified acceptable fuel design limits are not exceeded (Ref. 1). The control rods are scrammed by positive means using hydraulic pressure exerted on the CRD piston. When a scram signal is initiated, control air is vented from the scram valves, allowing them to open by spring action and CRD System pressure. Opening the exhaust valve reduces the pressure above the main drive piston to atmospheric pressure, and opening the inlet valve applies the accumulator or reactor pressure to the bottom of the piston. Since the notches in the index tube are tapered on the lower edge, the collet fingers are forced open by cam action, allowing the index tube to move upward without restriction because of the high differential pressure across the piston. As the drive moves upward and the accumulator pressure reduces below the reactor pressure, a ball check valve opens, letting the reactor pressure complete the scram action. If the reactor pressure is low, such as during startup, the accumulator will fully insert the control rod in the required time without assistance from reactor pressure. APPLICABLE The analytical methods and assumptions used in evaluating the control SAFETY ANALYSES rod scram function are presented in References 2, 3, and 4. The Design Basis Accident (DBA) and transient analyses assume that all of the control rods scram at a specified insertion rate. The resulting negative scram reactivity forms the basis for the determination of plant thermal limits (e.g., the MCPR). Other distributions of scram times (e.g., several control rods scramming slower than the average time with several control rods scramming faster than the average time) can also provide sufficient negative scram reactivity. Surveillance of each individual control rod's scram time ensures the scram reactivity assumed in the DBA and transient analyses can be met. (continued) Brunswick Unit 2 B 3.1.4-1 Revision No. 30

Control Rod Scram Times B 3.1.4 BASES APPLICABLE The scram function of the CRD System protects the MCPR Safety Limit SAFETY ANALYSES (SL) (see Bases for SL 2.1.1, "Reactor Core SLs," and LCO 3.2.2, (continued) "MINIMUM CRITICAL POWER RATIO (MCPR)") and the 1% cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)" and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), which ensure that no fuel damage will occur if these limits are not exceeded. Above 800 psig, the scram function is designed to insert negative reactivity at a rate fast enough to prevent the actual MCPR from becoming less than the MCPR SL, during the analyzed limiting power transient. Below 800 psig, the scram function is assumed to perform during the control rod drop accident (Ref. 5) and, therefore, also provides protection against violating fuel damage limits during reactivity insertion accidents (see Bases for LCO 3.1.6, "Rod Pattern Control"). For the reactor vessel overpressure protection analysis, the scram function, along with the safety/relief valves, ensure that the peak vessel pressure is maintained within the applicable ASME Code limits. Control rod scram times satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 6). LCO The scram times specified in Table 3.1.4-1 (in the accompanying LCO) are required to ensure that the scram reactivity assumed in the DBA and transient analysis is met (Ref. 5). To account for single failures and "slow" scramming control rods, the scram times specified in Table 3.1.4-1 are faster than those assumed in the design basis analysis. The scram times have a margin that allows up to approximately 7% of the control rods (e.g., 137 x 7% 10) to have scram times exceeding the specified limits (i.e., "slow" control rods) assuming a single stuck control rod (as allowed by LCO 3.1.3, "Control Rod OPERABILITY") and an additional control rod failing to scram per the single failure criterion. The scram times are specified as a function of reactor steam dome pressure to account for the pressure dependence of the scram times. The scram times are specified relative to measurements based on reed switch positions, which provide the control rod position indication. The reed switch closes ("pickup") when the index tube passes a specific location and then opens ("dropout") as the index tube travels upward. Verification of the specified scram times in (continued) Brunswick Unit 2 B 3.1.4-2 Revision No. 62

Control Rod Scram Times B 3.1.4 BASES LCO Table 3.1.4-1 is accomplished through measurement of the "dropout" (continued) times. To ensure that local scram reactivity rates are maintained within acceptable limits, no more than two of the allowed "slow" control rods may occupy adjacent locations. Table 3.1.4-1 is modified by two Notes which state that control rods with scram times not within the limits of the Table are considered "slow" and that control rods with scram times > 7 seconds are considered inoperable per SR 3.1.3.3. This LCO applies only to OPERABLE control rods since inoperable control rods will be inserted and disarmed (LCO 3.1.3). Slow scramming control rods may be conservatively declared inoperable and not accounted for as "slow" control rods. APPLICABILITY In MODES 1 and 2, a scram is assumed to function during transients and accidents analyzed for these plant conditions. These events are assumed to occur during startup and power operation; therefore, the scram function of the control rods is required during these MODES. In MODES 3 and 4, the control rods are not able to be withdrawn since the reactor mode switch is in the shutdown position and a control rod block is applied. This provides adequate requirements for control rod scram capability during these conditions. Scram requirements in MODE 5 are contained in LCO 3.9.5, "Control Rod OPERABILITYRefueling." ACTIONS A.1 When the requirements of this LCO are not met, the rate of negative reactivity insertion during a scram may not be within the assumptions of the safety analyses. Therefore, the plant must be brought to a MODE in which the LCO does not apply. To achieve this condition, the plant must be brought to MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. (continued) Brunswick Unit 2 B 3.1.4-3 Revision No. 60

Control Rod Scram Times B 3.1.4 BASES (continued) SURVEILLANCE The four SRs of this LCO are modified by a Note stating that during a REQUIREMENTS single control rod scram time surveillance, the CRD pumps shall be isolated from the associated scram accumulator. With the CRD pump isolated, (i.e., charging valve closed) the influence of the CRD pump head does not affect the single control rod scram times. During a full core scram, the CRD pump head would be seen by all control rods and would have a negligible effect on the scram insertion times. SR 3.1.4.1 The scram reactivity used in DBA and transient analyses is based on an assumed control rod scram time. Measurement of the scram times with reactor steam dome pressure 800 psig demonstrates acceptable scram times for the transients analyzed in Reference 4. Maximum scram insertion times occur at a reactor steam dome pressure of approximately 800 psig because of the competing effects of reactor steam dome pressure and stored accumulator energy. Therefore, demonstration of adequate scram times at reactor steam dome pressure 800 psig ensures that the measured scram times will be within the specified limits at higher pressures. This test is performed for each control rod from its fully withdrawn position. Limits are specified as a function of reactor pressure to account for the sensitivity of the scram insertion times with pressure and to allow a range of pressures over which scram time testing can be performed. To ensure that scram time testing is performed within a reasonable time following a shutdown 120 days, all control rods are required to be tested before exceeding 40% RTP following the shutdown. The specified Frequencies are acceptable considering the additional surveillances performed for control rod OPERABILITY, the frequent verification of adequate accumulator pressure, and the required testing of control rods affected by fuel movement within the associated core cell and by work on control rods or the CRD System. (continued) Brunswick Unit 2 B 3.1.4-4 Revision No. 30

Control Rod Scram Times B 3.1.4 BASES SURVEILLANCE SR 3.1.4.2 REQUIREMENTS (continued) Additional testing of a sample of control rods is required to verify the continued performance of the scram function during the cycle. A representative sample contains at least 10% of the control rods. The sample remains representative if no more than 7.5% of the control rods in the sample tested are determined to be "slow." With more than 7.5% of the sample declared to be "slow" per the criteria in Table 3.1.4-1, additional control rods are tested until this 7.5% criterion (i.e., 7.5% of the entire sample size) is satisfied, or until the total number of "slow" control rods (throughout the core, from all surveillances) exceeds the LCO limit. For planned testing, the control rods selected for the sample should be different for each test. This test is performed for each control rod in the sample from its fully withdrawn position. Data from inadvertent scrams should be used whenever possible to avoid unnecessary testing at power, even if the control rods with data may have been previously tested in a sample. The 200 day Frequency is based on operating experience that has shown control rod scram times do not significantly change over an operating cycle. This Frequency is also reasonable based on the additional Surveillances done on the CRDs at more frequent intervals in accordance with LCO 3.1.3 and LCO 3.1.5, "Control Rod Scram Accumulators." SR 3.1.4.3 When work that could affect the scram insertion time is performed on a control rod or the CRD System, testing must be done to demonstrate that each affected control rod retains adequate scram performance over the range of applicable reactor pressures from zero to the maximum permissible pressure. The scram testing must be performed once before declaring the control rod OPERABLE. The required scram time testing must demonstrate the affected control rod is still within acceptable limits. This test is performed for each affected control rod from its fully withdrawn position. In lieu of actually initiating a scram for each affected control rod, testing that adequately demonstrates the scram times are within acceptable limits is allowed to satisfy this SR. The test may include any series of sequential, overlapping, or total steps so the entire scram (continued) Brunswick Unit 2 B 3.1.4-5 Revision No. 40

Control Rod Scram Times B 3.1.4 BASES SURVEILLANCE SR 3.1.4.3 (continued) REQUIREMENTS time sequence is verified. The limits for reactor pressures < 800 psig are established based on a high probability of meeting the acceptance criteria at reactor pressures 800 psig. Limits for 800 psig are found in Table 3.1.4-1 and do not apply for testing performed at < 800 psig. If testing demonstrates the affected control rod does not meet these limits, but is within the 7-second limit of Note 2 to Table 3.1.4-1, the control rod can be considered OPERABLE and "slow." Specific examples of work that could affect the scram times are (but are not limited to) the following: removal of any CRD for maintenance or modification; replacement of a control rod; and maintenance or modification of a scram solenoid pilot valve, scram valve, accumulator, isolation valve or check valve in the piping required for scram. The Frequency of once prior to declaring the affected control rod OPERABLE is acceptable because of the capability to test the control rod over a range of operating conditions and the more frequent surveillances on other aspects of control rod OPERABILITY. SR 3.1.4.4 When work that could affect the scram insertion time is performed on a control rod or CRD System, or when fuel movement within the reactor pressure vessel occurs, testing must be performed to demonstrate each affected control rod is still within the scram time limits of Table 3.1.4-1 with the reactor steam dome pressure 800 psig. Where work has been performed at high reactor pressure, the requirements of SR 3.1.4.3 and SR 3.1.4.4 can be satisfied with one test. For a control rod affected by work performed while shut down, however, a zero pressure and high pressure test may be required. This testing ensures that, prior to withdrawing the control rod for continued operation, the control rod scram performance is acceptable for operating reactor pressure conditions. This test is performed for each affected control rod from its fully withdrawn position. Alternatively, a control rod scram test during hydrostatic pressure testing could also satisfy both criteria. When fuel movement within the reactor pressure vessel occurs, only those control rods (continued) Brunswick Unit 2 B 3.1.4-6 Revision No. 30

Control Rod Scram Times B 3.1.4 BASES SURVEILLANCE SR 3.1.4.4 (continued) REQUIREMENTS associated with the control cells affected by the fuel movement are required to be scram time tested. During a routine refueling outage, it is expected that all control rods will be affected. The Frequency of prior to exceeding 40% RTP is acceptable because of the capability to test the control rod over a range of operating conditions and the more frequent surveillances on other aspects of control rod OPERABILITY. REFERENCES 1. USFAR, Section 3.1.2.2.1.

2. UFSAR, Section 4.2.1.1.8.

3. UFSAR, Section 4.3.2.

4. UFSAR, Chapter 15.

5. Letter from R.F. Janecek (BWROG) to R.W. Starostecki (NRC),

BWR Owners Group Revised Reactivity Control System Technical Specifications, BWROG-8754, September 17, 1987.

6. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.1.4-7 Revision No. 30

Control Rod Scram Accumulators B 3.1.5 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.5 Control Rod Scram Accumulators BASES BACKGROUND The control rod scram accumulators are part of the Control Rod Drive (CRD) System and are provided to ensure that the control rods scram under varying reactor conditions. The control rod scram accumulators store sufficient energy to fully insert a control rod independent of any other source of energy. The accumulator is a hydraulic cylinder with a free floating piston. The piston separates the water used to scram the control rods from the nitrogen, which provides the required energy. The scram accumulators are necessary to scram the control rods within the required insertion times of LCO 3.1.4, "Control Rod Scram Times." APPLICABLE The analytical methods and assumptions used in evaluating the control SAFETY ANALYSES rod scram function are presented in References 1, 2, and 3. The Design Basis Accident (DBA) and transient analyses assume that all of the control rods scram at a specified insertion rate. OPERABILITY of each individual control rod scram accumulator, along with LCO 3.1.3, "Control Rod OPERABILITY," and LCO 3.1.4, ensures that the scram reactivity assumed in the DBA and transient analyses can be met. The existence of an inoperable accumulator may invalidate prior scram time measurements for the associated control rod. The scram function of the CRD System, and therefore the OPERABILITY of the accumulators, protects the MCPR Safety Limit (see Bases for SL 2.1.1, "Reactor Core SLs," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and 1% cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)" and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), which ensure that no fuel damage will occur if these limits are not exceeded (see Bases for LCO 3.1.4). In addition, the scram function at low reactor vessel pressure (i.e., startup conditions) provides protection against violating fuel design limits during reactivity insertion accidents (see Bases for LCO 3.1.6, "Rod Pattern Control"). Control rod scram accumulators satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). (continued) Brunswick Unit 2 B 3.1.5-1 Revision No. 62

Control Rod Scram Accumulators B 3.1.5 BASES (continued) LCO The OPERABILITY of the control rod scram accumulators is required to ensure that adequate scram insertion capability exists when needed over the entire range of reactor pressures. The OPERABILITY of the scram accumulators is based on maintaining adequate accumulator pressure. APPLICABILITY In MODES 1 and 2, the scram function is required for mitigation of DBAs and transients, and therefore the scram accumulators must be OPERABLE to support the scram function. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in the shutdown position and a control rod block is applied. This provides adequate requirements for control rod scram accumulator OPERABILITY during these conditions. Requirements for scram accumulators in MODE 5 are contained in LCO 3.9.5, "Control Rod OPERABILITY Refueling." ACTIONS The ACTIONS Table is modified by a Note indicating that a separate Condition entry is allowed for each control rod scram accumulator. This is acceptable since the Required Actions for each Condition provide appropriate compensatory actions for each affected accumulator. Complying with the Required Actions may allow for continued operation and subsequent affected accumulators governed by subsequent Condition entry and application of associated Required Actions. A.1 and A.2 With one control rod scram accumulator inoperable and the reactor steam dome pressure 950 psig, the control rod may be declared "slow," since the control rod will still scram at the reactor operating pressure but may not satisfy the required scram times in Table 3.1.4-1 (see LCO 3.1.4). Required Action A.1 is modified by a Note indicating that declaring the control rod "slow" only applies if the associated control scram time was within the limits of Table 3.1.4-1 during the last scram time test. Otherwise, the control rod is already considered "slow" and further degradation of scram performance with an inoperable accumulator may result in excessive scram times. In this event, the associated control rod is declared inoperable (Required Action A.2) and LCO 3.1.3 is entered. (continued) Brunswick Unit 2 B 3.1.5-2 Revision No. 30

Control Rod Scram Accumulators B 3.1.5 BASES ACTIONS A.1 and A.2 (continued) This results in requiring the affected control rod to be fully inserted and disarmed, thereby satisfying its intended function in accordance with ACTIONS of LCO 3.1.3. The allowed Completion Time of 8 hours is reasonable, based on the large number of control rods available to provide the scram function and the ability of the affected control rod to scram with only reactor pressure at high reactor pressures. B.1, B.2.1, and B.2.2 With two or more control rod scram accumulators inoperable and reactor steam dome pressure 950 psig, adequate pressure must be supplied to the charging water header. With inadequate charging water pressure, all of the accumulators may be inoperable, resulting in a potentially severe degradation of the scram performance. Therefore, within 20 minutes from discovery of charging water header pressure < 940 psig concurrent with Condition B, adequate charging water header pressure must be restored. The allowed Completion Time of 20 minutes is a reasonable period to place a CRD pump into service and restore the charging water header pressure. This Completion Time is based on the ability of the reactor pressure alone to fully insert all control rods. The control rod may be declared "slow," since the control rod will still scram using only reactor pressure, but the control rod may not satisfy the scram times in Table 3.1.4-1. Required Action B.2.1 is modified by a Note indicating that declaring the control rod "slow" only applies if the associated control rod scram time is within the limits of Table 3.1.4-1 during the last scram time test. Otherwise, the control rod is already considered "slow" and further degradation of scram performance with an inoperable accumulator may result in excessive scram times. In this event, the associated control rod is declared inoperable (Required Action B.2.2) and LCO 3.1.3 is entered. This results in requiring the affected control rod to be fully inserted and disarmed, thereby satisfying its intended function in accordance with ACTIONS of LCO 3.1.3. (continued) Brunswick Unit 2 B 3.1.5-3 Revision No. 30

Control Rod Scram Accumulators B 3.1.5 BASES ACTIONS B.1, B.2.1, and B.2.2 (continued) The allowed Completion Time of 1 hour is reasonable, based on the ability of only reactor pressure to scram the control rods and the low probability of a DBA or transient occurring while the affected accumulators are inoperable. C.1 and C.2 With one or more control rod scram accumulators inoperable and the reactor steam dome pressure < 950 psig, the pressure supplied to the charging water header must be adequate to ensure that the remaining accumulators remain charged. With the reactor steam dome pressure

                < 950 psig, the function of the accumulators in providing the scram force becomes much more important since the scram function could become severely degraded during a depressurization event or at low reactor pressures. Therefore, immediately upon discovery of charging water header pressure < 940 psig concurrent with Condition C, all control rods associated with inoperable accumulators must be verified to be fully inserted. Withdrawn control rods with inoperable accumulators may fail to scram under these low pressure conditions. The associated control rods must also be declared inoperable within 1 hour. The allowed Completion Time of 1 hour is reasonable for Required Action C.2, considering the low probability of a DBA or transient occurring during the time that the accumulator is inoperable.

D.1 The reactor must be immediately scrammed if either Required Action and associated Completion Time associated with loss of the CRD charging pump (Required Actions B.1 and C.1) cannot be met. This ensures that all insertable control rods are inserted and that the reactor is in a condition that does not require the active function (i.e., scram) of the control rods. This Required Action is modified by a Note stating that the action is not applicable if all control rods associated with the inoperable scram accumulators are fully inserted, since the function of the control rods has been performed. (continued) Brunswick Unit 2 B 3.1.5-4 Revision No. 30

Control Rod Scram Accumulators B 3.1.5 BASES (continued) SURVEILLANCE SR 3.1.5.1 REQUIREMENTS SR 3.1.5.1 requires that the control rod scram accumulator pressure be checked every 7 days to ensure adequate accumulator pressure exists to provide sufficient scram force. The primary indicator of accumulator OPERABILITY is the accumulator pressure. A minimum accumulator pressure is specified, below which the capability of the accumulator to perform its intended function becomes degraded and the accumulator is considered inoperable. The minimum accumulator pressure of 940 psig is well below the expected pressure of approximately 1100 psig. Declaring the accumulator inoperable when the minimum pressure is not maintained ensures that appropriate action is taken if significant degradation in scram capability occurs. This Surveillance may be performed by verification of absence of the common scram accumulator low pressure alarm. The 7 day Frequency has been shown to be acceptable through operating experience and takes into account alarms and indication available in the control room. REFERENCES 1. UFSAR, Section 4.2.1.1.8.

2. UFSAR, Section 4.3.2.

3. UFSAR, Chapter 15.

4. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.1.5-5 Revision No. 30

Rod Pattern Control B 3.1.6 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.6 Rod Pattern Control BASES BACKGROUND Control rod patterns during startup conditions are controlled by the operator and the rod worth minimizer (RWM) (LCO 3.3.2.1, "Control Rod Block Instrumentation"), so that only specified control rod sequences and relative positions are allowed over the operating range of all control rods inserted to 8.75% RTP. The sequences limit the potential amount of reactivity addition that could occur in the event of a Control Rod Drop Accident (CRDA). This Specification assures that the control rod patterns are consistent with the assumptions of the CRDA analyses of References 1, 2 and 3. APPLICABLE The analytical methods and assumptions used in evaluating the CRDA SAFETY ANALYSES are summarized in References 2 and 3. CRDA analyses assume that the reactor operator follows prescribed withdrawal sequences. These sequences define the potential initial conditions for the CRDA analysis. The RWM (LCO 3.3.2.1) provides backup to operator control of the withdrawal sequences to ensure that the initial conditions of the CRDA analysis are not violated. Prevention or mitigation of positive reactivity insertion events is necessary to limit the energy deposition in the fuel, thereby preventing significant fuel damage which could result in the undue release of radioactivity. Since the failure consequences for UO2 have shown that sudden fuel pin rupture requires a fuel energy deposition of approximately 425 cal/gm (Ref. 6), the fuel damage limit of 280 cal/gm provides a margin of safety from significant core damage which would result in release of radioactivity (Ref. 7). Generic evaluations (Refs. 4 and 8) of a design basis CRDA (i.e., a CRDA resulting in a peak fuel energy deposition of 280 cal/gm) have shown that if the peak fuel enthalpy remains below 280 cal/gm, then the maximum reactor pressure will be less than the required ASME Code limits (Ref. 9) and the calculated offsite doses will be well within the required limits (Ref. 10). (continued) Brunswick Unit 2 B 3.1.6-1 Revision No. 62

Rod Pattern Control B 3.1.6 BASES APPLICABLE Control rod patterns analyzed with AREVA methods (Refs. 2 and 3) follow SAFETY ANALYSES the banked position withdrawal sequence (BPWS). The BPWS is (continued) applicable from the condition of all control rods fully inserted to 8.75% RTP (Ref. 5). For the BPWS, the control rods are required to be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions (e.g., between notches 08 and 12). The banked positions are established to minimize the maximum incremental control rod worth without being overly restrictive during normal plant operation. Generic analysis of the BPWS with GNF methods has demonstrated that the 280 cal/gm fuel damage limit will not be violated during a CRDA while following the BPWS during a plant startup or shutdown. The generic BPWS analysis (Ref. 11) also evaluates the effect of fully inserted, inoperable control rods not in compliance with the sequence, to allow a limited number (i.e., eight) and a required distribution of fully inserted, inoperable control rods. Cycle-specific analysis with AREVA methods (Refs. 2 and 3) demonstrates that postulated CRDA events do not exceed the acceptance criteria for CRDA events. Rod pattern control satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 12). LCO Compliance with the prescribed control rod sequences minimizes the potential consequences of a CRDA by limiting the initial conditions to those consistent with the BPWS. This LCO only applies to OPERABLE control rods. For inoperable control rods required to be inserted, separate requirements are specified in LCO 3.1.3, "Control Rod OPERABILITY," consistent with the allowances for inoperable control rods in the BPWS. APPLICABILITY In MODES 1 and 2, when THERMAL POWER is 8.75% RTP, the CRDA is a Design Basis Accident and, therefore, compliance with the assumptions of the safety analysis is required. When THERMAL POWER is > 8.75% RTP, there is no credible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA (Ref. 5). In MODES 3, 4, and 5, since the reactor is shut down and interlocks allow only a single control rod to be withdrawn from a core cell containing fuel assemblies in MODE 5, adequate SDM ensures that the consequences of a CRDA are acceptable. This is due to the fact that the reactor will remain subcritical with a single control rod withdrawn. (continued) Brunswick Unit 2 B 3.1.6-2 Revision No. 62

Rod Pattern Control B 3.1.6 BASES (continued) ACTIONS A.1 and A.2 With one or more OPERABLE control rods not in compliance with the prescribed control rod sequence, actions may be taken to either correct the control rod pattern or declare the associated control rods inoperable within 8 hours. Noncompliance with the prescribed sequence may be the result of "double notching;" drifting as a result of a control rod drive cooling water transient or leaking scram valves; or a power reduction to 8.75% RTP before establishing the correct control rod pattern. The number of OPERABLE control rods not in compliance with the prescribed sequence is limited to eight, to prevent the operator from attempting to correct a control rod pattern that significantly deviates from the prescribed sequence. When the control rod pattern is not in compliance with the prescribed sequence, all control rod movement should be stopped except for moves needed to correct the rod pattern, or scram if warranted. Required Action A.1 is modified by a Note which allows an individual control rod to be bypassed in the RWM or the entire RWM to be bypassed to allow the affected control rods to be returned to their correct position. LCO 3.3.2.1 requires verification of control rod movement by a second licensed operator or other qualified member of the technical staff. This ensures that the control rods will be moved to the correct BPWS position. A control rod not in compliance with the prescribed sequence is not considered inoperable except as required by Required Action A.2. OPERABILITY of control rods is determined by compliance with LCO 3.1.3, "Control Rod OPERABILITY," LCO 3.1.4, "Control Rod Scram Times," and LCO 3.1.5, "Control Rod Scram Accumulators." The allowed Completion Time of 8 hours is reasonable, considering the restrictions on the number of allowed out of sequence control rods and the low probability of a CRDA occurring during the time the control rods are out of sequence. B.1 and B.2 If nine or more OPERABLE control rods are out of sequence, the control rod pattern significantly deviates from the prescribed sequence. Control rod withdrawal should be suspended immediately to prevent the potential for further deviation from the prescribed sequence. Control rod insertion to correct the position of control rods withdrawn beyond their allowed position is allowed since, in general, insertion of control rods has less impact on control rod worth than withdrawals have. Required Action B.1 is modified by a Note which allows an individual control rod to be bypassed in the RWM or the entire RWM to be bypassed to allow the affected control rods to be returned to their correct position. LCO 3.3.2.1 requires verification of control rod movement by a second licensed operator or other qualified member of the technical staff. (continued) Brunswick Unit 2 B 3.1.6-3 Revision No. 62

Rod Pattern Control B 3.1.6 BASES ACTIONS B.1 and B.2 (continued) When nine or more OPERABLE control rods are not in compliance with BPWS, the reactor must be manually scrammed within 1 hour. This ensures the reactor is shut down and, as such, does not meet the applicability requirements of this LCO. The allowed Completion Time of 1 hour is reasonable to allow insertion of control rods to restore compliance, and is appropriate relative to the low probability of a CRDA occurring with the control rods out of sequence. SURVEILLANCE SR 3.1.6.1 REQUIREMENTS The control rod pattern is verified to be in compliance with the BPWS at a 24 hour Frequency to ensure the assumptions of the CRDA analyses are met. The 24 hour Frequency was developed considering that the primary check on compliance with the BPWS is performed by the RWM (LCO 3.3.2.1), which provides control rod blocks to enforce the required sequence and is required to be OPERABLE when operating at 8.75% RTP. REFERENCES 1. UFSAR, Section 15.4.

2. XM-NF-80-19(P)(A), Volume 1, "Exxon Nuclear Methodology for Boiling Water Reactors - Neutronic Methods for Design and Analysis," (as identified in the COLR).

3. EMF-2158(P)(A), "Siemens Power Corporation Methodology for Boiling Water Reactors: Evaluation and Validation of CASMO/MICROBURN-B2," (as identified in the COLR).

4. NEDE-24011-P-A-11-US, General Electric Standard Application for Reactor Fuel, Supplement for United States, Section 2.2.3.1, November 1995.

5. NRC Safety Evaluation Report, Acceptance for Referencing of Licensing Topical Report NEDE-24011-P-A, General Electric Standard Application for Reactor Fuel, Revision 8, Amendment 17; December 27, 1987.

6. UFSAR, Section 4.3.2.5.

7. NUREG-0800, Section 15.4.9, Revision 2, July 1981.

8. NEDO-21778-A, Transient Pressure Rises Affected Fracture Toughness Requirements for Boiling Water Reactors, December 1978.

(continued) Brunswick Unit 2 B 3.1.6-4 Revision No. 62

Rod Pattern Control B 3.1.6 BASES REFERENCES 9. ASME, Boiler and Pressure Vessel Code. (continued)

10. 10 CFR 50.67.

11. NEDO-21231, Banked Position Withdrawal Sequence, January 1977.

12. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.1.6-5 Revision No. 62

SLC System B 3.1.7 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.7 Standby Liquid Control (SLC) System BASES BACKGROUND The SLC System is designed to provide the capability of bringing the reactor, at any time in a fuel cycle, from full power and minimum control rod inventory (which is at the peak of the xenon transient) to a subcritical condition with the reactor in the most reactive, xenon free state without taking credit for control rod movement. The SLC System satisfies the requirements of 10 CFR 50.62 (Ref. 1) on anticipated transient without scram. The SLC System is also used to maintain suppression pool pH level above 7 following a loss of coolant accident (LOCA) involving significant fission product releases. Maintaining suppression pool pH levels greater than 7 following an accident ensures that iodine will be retained in the suppression pool water (Reference 2). The SLC System consists of a boron solution storage tank, two positive displacement pumps, two explosive valves that are provided in parallel for redundancy, and associated piping and valves used to transfer borated water from the storage tank to the reactor pressure vessel (RPV). The borated solution is discharged near the bottom of the core shroud, where it then mixes with the cooling water rising through the core. A smaller tank containing demineralized water is provided for testing purposes. APPLICABLE The SLC System is manually initiated from the main control room, as SAFETY ANALYSES directed by the emergency operating procedures, if the operator believes the reactor cannot be shut down, or kept shut down, with the control rods. The SLC System is used in the event that enough control rods cannot be inserted to accomplish shutdown and cooldown in the normal manner. The SLC System injects borated water into the reactor core to add negative reactivity to compensate for all of the various reactivity effects that could occur during plant operations. To meet this objective, it is necessary for SLC to inject a quantity of boron which produces a concentration of 720 ppm equivalent of natural boron in the reactor coolant at 70°F with normal reactor vessel water level. To allow for (continued) Brunswick Unit 2 B 3.1.7-1 Revision No. 30

SLC System B 3.1.7 BASES APPLICABLE potential leakage and imperfect mixing in the reactor system, an SAFETY ANALYSES additional amount of boron equal to 25% of the amount cited above is (continued) added (Ref. 3). The volume versus concentration limits in Figure 3.1.7-1 and the temperature versus concentration limits in Figure 3.1.7-2 are calculated such that the required concentration is achieved accounting for dilution in the RPV with normal water level and including the water volume in the residual heat removal shutdown cooling piping and in the recirculation loop piping. This quantity of borated solution is the amount that is above the pump suction level in the boron solution storage tank. No credit is taken for the portion of the tank volume that cannot be injected. Following a LOCA MSLB accident, or CRD accident, offsite doses from the accident will remain within 10 CFR 50.57 limits (Reference 4) provided sufficient iodine activity is retained in the suppression pool. Credit for iodine deposition in the suppression pool is allowed (Reference 2) as long as suppression pool pH is maintained greater than 7. BSEP Alternative Source Term analyses credit the use of the SLC System for maintaining the pH of the suppression pool greater than 7. The SLC System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii) (Ref. 5) because operating experience and probabilistic risk assessments have shown the SLC System to be important to public health and safety. Thus, it is retained in the Technical Specifications. LCO The OPERABILITY of the SLC System provides backup capability for reactivity control independent of normal reactivity control provisions provided by the control rods. The OPERABILITY of the SLC System is based on the conditions (concentration and temperature) of the borated solution in the storage tank and the availability of a flow path to the RPV, including the OPERABILITY of the pumps and valves. Two SLC subsystems are required to be OPERABLE; each contains an OPERABLE pump, an explosive valve, and associated piping, valves, and instruments and controls to ensure an OPERABLE flow path. In addition, the boron solution concentration should be within the limits of Figure 3.1.7-1 and the boron solution temperature should be within the limits of Figure 3.1.7-2. (continued) Brunswick Unit 2 B 3.1.7-2 Revision No. 30

SLC System B 3.1.7 BASES (continued) APPLICABILITY In MODES 1 and 2, shutdown capability is required. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in the shutdown position and a control rod block is applied. This provides adequate controls to ensure that the reactor remains subcritical. In MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Determination of adequate SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") ensures that the reactor will not become critical with the analytically determined strongest control rod withdrawn. Therefore, the SLC System is not required to be OPERABLE when only a single control rod can be withdrawn. ACTIONS A.1 If one SLC subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE subsystem is adequate to perform the original licensing basis shutdown function. However, the overall capability is reduced since the remaining OPERABLE subsystem cannot meet the requirements of Reference 1. The 7 day Completion Time is based on the availability of an OPERABLE subsystem capable of performing the original licensing basis SLC System function and the low probability of a Design Basis Accident (DBA) or severe transient occurring concurrent with the failure of the control rods to shut down the plant. B.1 If both SLC subsystems are inoperable, at least one subsystem must be restored to OPERABLE status within 8 hours. Both SLC subsystems are considered inoperable if the boron solution concentration or temperature is outside the limits of the associated figures. The allowed Completion Time of 8 hours is considered acceptable given the low probability of a DBA or transient occurring concurrent with the failure of the control rods to shut down the reactor. (continued) Brunswick Unit 2 B 3.1.7-3 Revision No. 30

SLC System B 3.1.7 BASES ACTIONS C.1 (continued) If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.1.7.1, SR 3.1.7.2, and SR 3.1.7.3 REQUIREMENTS SR 3.1.7.1 through SR 3.1.7.3 are 24 hour Surveillances verifying certain characteristics of the SLC System (e.g., the volume and temperature of the borated solution in the storage tank), thereby ensuring SLC System OPERABILITY without disturbing normal plant operation. These Surveillances ensure that the proper borated solution volume and temperature, including the temperature of the pump suction and discharge piping up to the SLC injection valves, are maintained. Maintaining a minimum specified borated solution temperature is important in ensuring that the boron remains in solution and does not precipitate out in the storage tank or in the pump suction piping. The temperature versus concentration curve of Figure 3.1.7-2 ensures that a 5°F margin will be maintained above the saturation temperature. The 24 hour Frequency is based on operating experience and has shown there are relatively slow variations in the measured parameters of volume and temperature. SR 3.1.7.4 SR 3.1.7.4 verifies the continuity of the explosive charges in the SLC injection valves to ensure that proper operation will occur if required. Other administrative controls, such as those that limit the shelf life of the explosive charges, must be followed. The 31 day Frequency is based on operating experience and has demonstrated the reliability of the explosive charge continuity. (continued) Brunswick Unit 2 B 3.1.7-4 Revision No. 30

SLC System B 3.1.7 BASES SURVEILLANCE SR 3.1.7.5 REQUIREMENTS This Surveillance requires an examination of the sodium pentaborate solution by using chemical analysis to ensure that the proper concentration of boron (measured in weight % sodium pentaborate) exists in the storage tank. SR 3.1.7.5 must be performed anytime boron or water is added to the storage tank solution to determine that the boron solution concentration is within the specified limits. SR 3.1.7.5 must also be performed anytime the temperature is restored to within the limits of Figure 3.1.7-2, to ensure that no significant boron precipitation occurred during the time period temperature was outside the limits of the Figure. The 31 day Frequency of this Surveillance is appropriate because of the relatively slow variation of boron concentration between Surveillances. SR 3.1.7.6 Demonstrating that each SLC System pump develops a flow rate 41.2 gpm at a discharge pressure 1190 psig ensures that pump performance has not degraded during the fuel cycle. This minimum pump flow rate requirement ensures that, when combined with the sodium pentaborate solution concentration requirements, the rate of negative reactivity insertion from the SLC System will adequately compensate for the positive reactivity effects encountered during power reduction, cooldown of the moderator, and xenon decay. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm component OPERABILITY and detect incipient failures by indicating abnormal performance. The Frequency of this Surveillance is in accordance with the Inservice Testing Program. SR 3.1.7.7 This Surveillance ensures that there is a functioning flow path from the boron solution storage tank to the RPV, including the firing of an explosive valve. The replacement charge for the explosive valve shall be from the same manufactured batch as the one fired or from another batch (continued) Brunswick Unit 2 B 3.1.7-5 Revision No. 30

SLC System B 3.1.7 BASES (continued) SURVEILLANCE SR 3.1.7.8 REQUIREMENTS (continued) that has been certified by having one of that batch successfully fired. The pump and explosive valve tested should be alternated such that both complete flow paths are tested every 48 months at alternating 24 month intervals. The Surveillance may be performed in separate steps to prevent injecting boron into the RPV. An acceptable method for verifying flow from the pump to the RPV is to pump demineralized water from a test tank through one SLC subsystem and into the RPV. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated these components will usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. SR 3.1.7.8 Enriched sodium pentaborate solution is made by mixing granular, enriched sodium pentaborate with water. Isotopic tests on the granular sodium pentaborate to verify the actual B-10 enrichment must be performed prior to addition to the SLC tank in order to ensure that the proper B-10 atom percentage is being used. REFERENCES 1. 10 CFR 50.62.

2. NUREG-1465, Accident Source Terms for Light-Water Nuclear Power Plants, Final Report," February 1, 1995.

3. UFSAR, Section 9.3.4.

4. 10 CFR 50.67.

5. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.1.7-6 Revision No. 30

SDV Vent and Drain Valves B 3.1.8 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.8 Scram Discharge Volume (SDV) Vent and Drain Valves BASES BACKGROUND The SDV vent and drain valves are normally open and discharge any accumulated water in the SDV to ensure that sufficient volume is available at all times to allow a complete scram. During a scram, the SDV vent and drain valves close to contain reactor water. The SDV is a volume of header piping that connects to each hydraulic control unit (HCU) and drains into an instrument volume. There are two SDVs (headers) and two instrument volumes, each receiving approximately one half of the control rod drive (CRD) discharges. The two instrument volumes are connected to a common drain line with two valves in series. The two headers are connected to a common vent line with two valves in series. The header piping is sized to receive and contain all the water discharged by the CRDs during a scram. APPLICABLE The Design Basis Accident and transient analyses assume the control SAFETY ANALYSES rods are capable of scramming. The acceptance criteria for the SDV vent and drain valves are that they operate automatically to:

a. Close during scram to limit the amount of reactor coolant discharged so that adequate core cooling is maintained and offsite doses remain within the limits of 10 CFR 50.67 (Ref. 1); and

b. Open on scram reset to maintain the SDV vent and drain path open so that there is sufficient volume to accept the reactor coolant discharged during a scram.

Isolation of the SDV can also be accomplished by manual closure of the SDV valves. Additionally, the discharge of reactor coolant to the SDV can be terminated by scram reset or closure of the HCU manual isolation valves. For a bounding leakage case, the offsite doses are well within the limits of 10 CFR 50.67 (Ref. 1), and adequate core cooling is maintained (Ref. 2). The SDV vent and drain valves allow continuous drainage of the SDV during normal plant operation to ensure that the SDV has sufficient (continued) Brunswick Unit 2 B 3.1.8-1 Revision No. 30

SDV Vent and Drain Valves B 3.1.8 BASES APPLICABLE capacity to contain the reactor coolant discharge during a full core scram. SAFETY ANALYSES To automatically ensure this capacity, a reactor scram (LCO 3.3.1.1, (continued) "Reactor Protection System (RPS) Instrumentation") is initiated if the SDV water level in the instrument volume exceeds a specified setpoint. The setpoint is chosen so that all control rods are inserted before the SDV has insufficient volume to accept a full scram. SDV vent and drain valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). LCO The OPERABILITY of all SDV vent and drain valves ensures that the SDV vent and drain valves will close during a scram to contain reactor water discharged to the SDV piping. Since the vent and drain lines are provided with two valves in series, the single failure of one valve in the open position will not impair the isolation function of the system. Additionally, the valves are required to open on scram reset to ensure that a path is available for the SDV piping to drain freely at other times. APPLICABILITY In MODES 1 and 2, scram may be required; therefore, the SDV vent and drain valves must be OPERABLE. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in the shutdown position and a control rod block is applied. This provides adequate controls to ensure that control rods cannot be withdrawn. Also, during MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Therefore, the SDV vent and drain valves are not required to be OPERABLE in these MODES since the reactor is subcritical and no more than one rod may be withdrawn and subject to scram. ACTIONS The ACTIONS Table is modified by Notes indicating that a separate Condition entry is allowed for each SDV vent and drain line. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SDV line. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SDV lines are governed by subsequent Condition entry and application of associated Required Actions. When a line is isolated, the potential for an inadvertent scram due to high SDV level is increased. During these periods, the line may be unisolated under administrative control. This allows any accumulated water in the line to be drained, to preclude a reactor scram on SDV high level. This is acceptable since the administrative controls ensure the valve can be closed quickly, by a dedicated operator, if a scram occurs with the valve open. (continued) Brunswick Unit 2 B 3.1.8-2 Revision No. 34

SDV Vent and Drain Valves B 3.1.8 BASES ACTIONS A.1 (continued) When one SDV vent or drain valve is inoperable in one or more lines, the associated line must be isolated to contain the reactor coolant during a scram. The 7 day Completion Time is reasonable, given the redundant capability afforded by the remaining valves in the affected lines and the low probability of a scram occurring while the valve(s) are inoperable and the line is not isolated. The SDV is still isolable since the redundant valve in the affected line is OPERABLE. During these periods, the single failure criterion may not be preserved, and a higher risk exists to allow reactor water out of the primary system during a scram. B.1 If both valves in a line are inoperable, the line must be isolated to contain the reactor coolant during a scram. The 8 hour Completion Time to isolate the line is based on the low probability of a scram occurring while the line is not isolated and unlikelihood of significant CRD seal and scram exhaust valve leakage. C.1 If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. (continued) Brunswick Unit 2 B 3.1.8-3 Revision No. 34

SDV Vent and Drain Valves B 3.1.8 BASES (continued) SURVEILLANCE SR 3.1.8.1 REQUIREMENTS During normal operation, the SDV vent and drain valves should be in the open position (except when performing SR 3.1.8.2, at which time the valves may be closed intermittently under administrative control) to allow for drainage of the SDV piping. Verifying that each valve is in the open position ensures that the SDV vent and drain valves will perform their intended functions during normal operation. This SR does not require any testing or valve manipulation; rather, it involves verification that the valves are in the correct position. The 31 day Frequency is based on engineering judgment and is consistent with the procedural controls governing valve operation, which ensure correct valve positions. SR 3.1.8.2 During a scram, the SDV vent and drain valves should close to contain the reactor water discharged to the SDV piping. Cycling each valve through its complete range of motion (closed and open) ensures that the valve will function properly during a scram. The 31 day Frequency is based on operating experience and takes into account the level of redundancy in the system design. SR 3.1.8.3 SR 3.1.8.3 is an integrated test of the SDV vent and drain valves to verify total system performance. After receipt of a simulated or actual scram signal, the closure of the SDV vent and drain valves is verified. The closure time of 30 seconds after receipt of a scram signal is based on the bounding leakage case evaluated in the accident analysis (Ref. 2). Similarly, after receipt of a simulated or actual scram reset signal, the opening of the SDV vent and drain valves is verified. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.1.1 and the scram time testing of control rods in LCO 3.1.3, "Control RodOPERABILITY," overlap this Surveillance to provide complete testing of the assumed safety function. The 24 month Frequency is based on the need to perform this (continued) Brunswick Unit 2 B 3.1.8-4 Revision No. 30

SDV Vent and Drain Valves B 3.1.8 BASES SURVEILLANCE SR 3.1.8.3 (continued) REQUIREMENTS Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated these components will usually pass the Surveillance when performed at the 24 month Frequency; therefore, the Frequency was concluded to be acceptable from a reliability standpoint. REFERENCES 1. 10 CFR 50.67.

2. NUREG-0803, Generic Safety Evaluation Report Regarding Integrity of BWR Scram System Piping, August 1981.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.1.8-5 Revision No. 30

APLHGR B 3.2.1 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR) BASES BACKGROUND The APLHGR is a measure of the average LHGR of all the fuel rods in a fuel assembly at any axial location. Limits on the APLHGR are specified to ensure that the peak cladding temperature (PCT) during the postulated design basis loss of coolant accident (LOCA) does not exceed the limits specified in 10 CFR 50.46. APPLICABLE The analytical methods and assumptions used in evaluating the fuel SAFETY ANALYSES design limits are presented in References 1, 2, and 6. The analytical methods and assumptions used in evaluating Design Basis Accidents (DBAs), anticipated operational transients, and normal operation that determine the APLHGR limits are presented in References 1, 2, 3, 4, 6, and 7. The analytical methods and assumptions used in evaluating the DBA that determine the APLHGR limit are presented in Reference 6. APLHGR limits are developed as a function of planar exposure. LOCA analyses are performed to ensure that the APLHGR limits are adequate to meet the PCT and maximum oxidation limits of 10 CFR 50.46. The analysis is performed using analysis models that are consistent with the requirements of 10 CFR 50, Appendix K. The analysis models and methodology are described in Reference 6. The AREVA fuel APLHGR limits are presented in the COLR. For single recirculation loop operation, a multiplier is applied to the two recirculation loop operation exposure dependent APLHGR limits. This multiplier is due to an earlier departure from nucleate boiling with one recirculation loop available, resulting in a more severe cladding heatup during a LOCA. The APLHGR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 5). LCO The APLHGR limits specified in the COLR are the result of the DBA analyses. For two recirculation loops operating, the limit is dependent on exposure. With only one recirculation loop in operation, in conformance with LCO 3.4.1, "Recirculation Loops Operating," the limit is determined by multiplying the exposure dependent APLHGR limit by a multiplier determined by a specific single recirculation loop analysis. Additional APLHGR operating limits adjustments may be provided in the COLR to support analyzed equipment out-of-service operation. (continued) Brunswick Unit 2 B 3.2.1-1 Revision No. 79

APLHGR B 3.2.1 BASES APPLICABILITY The APLHGR limits are derived from LOCA analyses that are assumed to occur at high power levels. Studies and operating experience have shown that as power is reduced, the margin to the required APLHGR limits increases. This trend continues down to the power range of 5% to 15% RTP when entry into MODE 2 occurs. When in MODE 2, the intermediate range monitor scram function provides prompt scram initiation during any significant transient, thereby effectively removing any APLHGR limit compliance concern in MODE 2. At THERMAL POWER levels 23% RTP, the reactor is operating with substantial margin to the APLHGR limits. For consistency with the 2.1.1.1 SL, this power level was selected for LCO applicability. ACTIONS A.1 If any APLHGR exceeds the required limits, an assumption regarding an initial condition of the DBA and transient analyses may not be met. Therefore, prompt action should be taken and continued to restore the APLHGR(s) to within the required limits such that the plant operates within analyzed conditions and within design limits of the fuel rods. The 4 hour Completion Time is sufficient to restore the APLHGR(s) to within its limits and is acceptable based on the low probability of a transient or DBA occurring simultaneously with the APLHGR out of specification. B.1 If the APLHGR cannot be restored to within its required limits within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 23% RTP within 4 hours. The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 23% RTP in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.2.1.1 REQUIREMENTS APLHGRs are required to be initially calculated within 12 hours after THERMAL POWER is 23% RTP and then every 24 hours thereafter. They are compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour Frequency is based on both engineering judgment and recognition of the slowness of changes in power distribution during normal operation. The 12 hour allowance after THERMAL POWER 23% RTP is achieved is acceptable given the large inherent margin to operating limits at low power levels. (continued) Brunswick Unit 2 B 3.2.1-2 Revision No. 79

APLHGR B 3.2.1 BASES REFERENCES 1. NEDO-24011-P-A "General Electric Standard Application for Reactor Fuel" (latest approved version).

2. UFSAR, Chapter 4.

3. UFSAR, Chapter 6.

4. UFSAR, Chapter 15.

5. 10 CFR 50.36(c)(2)(ii).

6. EMF-2361(P)(A), "EXEM BWR-2000 ECCS Evaluation Model,"

(as identified in the COLR).

7. EMF-2292(P)(A), "ATRIUM'-10: Appendix K Spray Heat Transfer Coefficients," (as identified in the COLR).

Brunswick Unit 2 B 3.2.1-3 Revision No. 79

MCPR B 3.2.2 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR) BASES BACKGROUND MCPR is a ratio of the fuel assembly power that would result in the onset of boiling transition to the actual fuel assembly power. The MCPR Safety Limit (SL) is set such that 99.9% of the fuel rods avoid boiling transition if the limit is not violated (refer to the Bases for SL 2.1.1.2). The operating limit MCPR is established to ensure that no fuel damage results during anticipated operational occurrences (AOOs). Although fuel damage does not necessarily occur if a fuel rod actually experienced boiling transition (Ref. 1), the critical power at which boiling transition is calculated to occur has been adopted as a fuel design criterion. The onset of transition boiling is a phenomenon that is readily detected during the testing of various fuel bundle designs. Based on these experimental data, correlations have been developed to predict critical bundle power (i.e., the bundle power level at the onset of transition boiling) for a given set of plant parameters (e.g., reactor vessel pressure, flow, and subcooling). Because plant operating conditions and bundle power levels are monitored and determined relatively easily, monitoring the MCPR is a convenient way of ensuring that fuel failures due to inadequate cooling do not occur. APPLICABLE The analytical methods and assumptions used in evaluating the AOOs to SAFETY ANALYSES establish the operating limit MCPR are presented in References 2, 3, 4, 5, 7, 8, 9, and 10. To ensure that 99.9% of the fuel rods avoid boiling transition during any transient that occurs with moderate frequency, limiting transients are analyzed to determine the largest reduction in critical power ratio (CPR). The types of transients evaluated are loss of flow, increase in pressure and power, positive reactivity insertion, and coolant temperature decrease. The limiting transient yields the largest change in CPR (CPR). When the largest CPR is added to the MCPR SL, the required operating limit MCPR (OLMCPR) is obtained. The MCPR operating limits derived from the transient analysis are dependent on the operating core flow and power state (MCPRf and MCPRp respectively) to ensure adherence to fuel design limits during the worst transient that occurs with moderate frequency as identified in the UFSAR Chapter 15 (Reference 5). Flow dependent MCPR limits are determined using steady state thermal hydraulic methods (Reference 7) to analyze slow flow runout transients. The MCPRf limits are dependent on the maximum core flow runout capability of the Recirculation System. (continued) Brunswick Unit 2 B 3.2.2-1 Revision No. 62

MCPR B 3.2.2 BASES APPLICABLE Power dependent MCPR limits (MCPRp) are determined on a cycle-SAFETY ANALYSES specific basis using the methodologies presented in References 8, 9, (continued) and 10. The MCPRp limits are established for a set of exposure intervals. Due to the sensitivity of the transient response to initial core flow levels at power levels below those at which turbine stop valve and/or turbine control valve fast closure and the associated scrams occur, high and low flow MCPRp operating limits may be provided for the following core power level ranges: 23 to 26% RTP and 26 to 50% RTP. The 26% RTP is the previously mentioned bypass power level and 50% RTP is the power level below which the power load unbalance unit (PLU) may not generate a turbine control valve fast closure on a generator loss of load event. The MCPR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 11). LCO The MCPR operating limits, as a function of core flow, core power, and cycle exposure, specified in the COLR are the result of the Design Basis Accident (DBA) and transient analysis. The operating limit MCPR is determined by the larger of the MCPRf and MCPRp limits. APPLICABILITY The MCPR operating limits are primarily derived from transient analyses that are assumed to occur at high power levels. Below 23% RTP, the reactor is operating at a minimum recirculation pump speed and the moderator void ratio is small. Surveillance of thermal limits below 23% RTP is unnecessary due to the large inherent margin that ensures that the MCPR SL is not exceeded even if a limiting transient occurs. Statistical analyses indicate that the nominal value of the initial MCPR expected at 23% RTP is > 3.5. Studies of the variation of limiting transient behavior have been performed over the range of power and flow conditions. These studies encompass the range of key actual plant parameter values important to typically limiting transients. The results of these studies demonstrate that a margin is expected between performance and the MCPR requirements, and that margins increase as power is reduced to 23% RTP. This trend is expected to continue to the 5% to 15% power range when entry into MODE 2 occurs. When in MODE 2, the intermediate range monitor provides rapid scram initiation for any significant power increase transient, which effectively eliminates any MCPR compliance concern. Therefore, at THERMAL POWER levels

                < 23% RTP, the reactor is operating with substantial margin to the MCPR limits and this LCO is not required.

(continued) Brunswick Unit 2 B 3.2.2-2 Revision No. 62

MCPR B 3.2.2 BASES ACTIONS A.1 If any MCPR is outside the required limits, an assumption regarding an initial condition of the design basis transient analyses may not be met. Therefore, prompt action should be taken to restore the MCPR(s) to within the required limits such that the plant remains operating within analyzed conditions. The 4 hour Completion Time is normally sufficient to restore the MCPR(s) to within its limits and is acceptable based on the low probability of a transient or DBA occurring simultaneously with the MCPR out of specification. B.1 If the MCPR cannot be restored to within its required limits within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 23% RTP within 4 hours. The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 23% RTP in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.2.2.1 REQUIREMENTS The MCPR is required to be initially calculated within 12 hours after THERMAL POWER is 23% RTP and then every 24 hours thereafter. It is compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour Frequency is based on both engineering judgment and recognition of the slowness of changes in power distribution during normal operation. The 12 hour allowance after THERMAL POWER 23% RTP is achieved is acceptable given the large inherent margin to operating limits at low power levels. SR 3.2.2.2 Because the transient analysis takes credit for conservatism in the scram speed performance, it must be demonstrated that the specific scram speed distribution is consistent with that used in the transient analysis. SR 3.2.2.2 determines the actual scram speed distribution and compares it with the assumed distribution. The MCPR operating limit is then determined based either on the applicable limit associated with scram times of LCO 3.1.4, Control Rod Scram Times, or the realistic (nominal) scram times. The scram time dependent MCPR limits are contained in the COLR. This determination must be performed within 72 hours after each set of control rod scram time tests required by SR 3.1.4.1, SR 3.1.4.2, and SR 3.1.4.4 because the effective scram speed distribution may change during the cycle. The 72 hour Completion Time is acceptable due to the relatively minor changes in the actual control rod scram speed distribution expected during the fuel cycle. (continued) Brunswick Unit 2 B 3.2.2-3 Revision No. 62

MCPR B 3.2.2 BASES REFERENCES 1. UFSAR Section 4.4.2.1.

2. ANP-10307PA, "AREVA MCPR Safety Limit Methodology for Boiling Water Reactors."

3. UFSAR, Chapter 4.

4. UFSAR, Chapter 6.

5. UFSAR, Chapter 15.

6. (Deleted.)

7. X N-NF-80-19(P)(A) Volume 3, "Exxon Nuclear Methodology for Boiling Water Reactors, THERMEX: Thermal Limits Methodology Summary Description," (as identified in the COLR).

8. EMF-2158(P)(A), "Siemens Power Corporation Methodology for Boiling Water Reactors: Evaluation and Validation of CASMO-4/MICROBURN-B2," (as identified in the COLR).

9. ANF-913(P)(A) Volume 1, "COTRANSA2: A Computer Program for Boiling Water Reactor Transient Analyses," (as identified in the COLR).

10. XN-NF-84-105(P)(A), "XCOBRA-T: A Computer Code for BWR Transient Thermal-Hydraulic Core Analysis," (as identified in the COLR).

11. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.2.2-4 Revision No. 79

LHGR B 3.2.3 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.3 LINEAR HEAT GENERATION RATE (LHGR) BASES BACKGROUND The LHGR is a measure of the heat generation rate of a fuel rod in a fuel assembly at any axial location. Limits on the LHGR are specified to ensure that fuel design limits are not exceeded anywhere in the core during normal operation, including anticipated operational occurrences (AOOs). Exceeding the LHGR limit could potentially result in fuel damage and subsequent release of radioactive materials. Fuel design limits are specified to ensure that fuel system damage, fuel rod failure or inability to cool the fuel does not occur during the anticipated operating conditions identified in References 1 and 2. APPLICABLE The analytical methods and assumptions used in evaluating the fuel SAFETY ANALYSES system design are presented in References 1 and 2. The fuel assembly is designed to ensure (in conjunction with the core nuclear and thermal hydraulic design, plant equipment, instrumentation, and protection system) that the fuel damage will not result in the release of radioactive materials in excess of the guidelines of 10 CFR, Parts 20, 50, and 50.67. The mechanisms that could cause fuel damage during normal operations and operational transients and that are considered in fuel evaluations are:

a. Rupture of the fuel rod cladding caused by strain from the relative expansion of the UO2 pellet; and

b. Severe overheating of the fuel rod cladding caused by inadequate cooling A value of 1% plastic strain of the fuel cladding has been defined as the limit below which fuel damage caused by overstraining of the fuel cladding is not expected to occur (Ref. 3).

Fuel design evaluations have been performed and demonstrate that the 1% fuel cladding plastic strain design limit is not exceeded during continuous operation with LHGRs up to the operating limit specified in the COLR. The analysis also includes allowances for short term transient operation above the operating limit to account for AOOs. (continued) Brunswick Unit 2 B 3.2.3-1 Revision No. 79

LHGR B 3.2.3 BASES APPLICABLE The LHGR limits are multiplied by the smaller of either the flow-SAFETY ANALYSES dependent LHGR factor (LHGRFACf) or the power-dependent LHGR (continued) factor (LHGRFACp) corresponding to the existing core flow and power state to ensure adherence to the fuel mechanical design bases during the limiting transient. Flow-dependent LHGR factors are determined using the three dimensional BWR simulator code (Reference 4) to analyze slow flow runout transients. The LHGRFACf is dependent on the maximum core flow runout capability of the Recirculation System. Based on analyses of limiting plant transients (other than the slow flow runout event) over a range of power and flow conditions, power-dependent LHGR factors are generated. Due to the sensitivity of the transient response to initial core flow levels at power levels below those at which turbine stop valve and/or turbine control valve fast closure and the associated scrams occur, high and low flow LHGRFACp multipliers may be provided for the following core power level ranges: 23 to 26% RTP and 26 to 50% RTP. The 26% RTP is the previously mentioned bypass power level and 50% RTP is the power level below which the power load unbalance unit (PLU) may not generate a turbine control valve fast closure on a generator loss of load event. The LHGR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Reference 5). LCO The LHGR is a basic assumption in the fuel design analysis. The fuel has been designed to operate at rated core power with sufficient design margin to the calculated LHGR which would cause a 1% fuel cladding plastic strain. The operating limit to accomplish this objective is specified in the COLR. Additional LHGR operating limits adjustments may be provided in the COLR to support analyzed equipment out-of-service operation. APPLICABILITY The LHGR limits are derived from fuel design analysis that is limiting at high power level conditions. At core thermal power levels < 23% RTP, the reactor is operating with margin to the LHGR limits and, therefore, the Specification is only required when the reactor is operating at 23% RTP. (continued) Brunswick Unit 2 B 3.2.3-2 Revision No. 79

LHGR B 3.2.3 BASES ACTIONS A.1 If any LHGR exceeds its required limit, an assumption regarding an initial condition of the fuel design analysis in not met. Therefore, prompt action should be taken to restore the LHGR(s) to within its required limits such that the plant is operating within analyzed conditions. The 4 hour Completion Time is normally sufficient to restore the LHGR(s) to within its limits and is acceptable based on the low probability of a transient or Design Basis Accident occurring simultaneously with the LHGR out of specification. B.1 If the LHGR cannot be restored within its required limits within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER is reduced to < 23% RTP within 4 hours. The allowed Completion Time is reasonable, based on operating experience, to reduce THERAL POWER to < 23% RTP in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.2.3.1 REQUIREMENTS The LHGRs are required to be initially calculated within 12 hours after THERMAL POWER is > 23% RTP and then every 24 hours thereafter. They are compared with the LHGR limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour Frequency is based on both engineering judgment and recognition of the slowness of changes in power distribution during normal operation. The 12 hour allowance after THERMAL POWER 23% RTP is acceptable given the large inherent margin to operating limits at low power levels. REFERENCES 1. UFSAR, Chapter 4.

2. UFSAR, Chapter 15.

3. NUREG-0800, Section 4.2.II A.2(g), Revision 2, July 1981.

4. EMF-2158(P)(A), "Siemens Power Corporation Methodology for Boiling Water Reactors: Evaluation and Validation of CASMO-4/MICROBURN-B2," (as identified in the COLR).

5. 10 CFR 50.36(c)(2)(ii)

Brunswick Unit 2 B 3.2.3-3 Revision No. 62

RPS Instrumentation B 3.3.1.1 B 3.3 INSTRUMENTATION B 3.3.1.1 Reactor Protection System (RPS) Instrumentation BASES BACKGROUND The RPS initiates a reactor scram when one or more monitored parameters exceed their specified limits, to preserve the integrity of the fuel cladding and the reactor coolant pressure boundary (RCPB) and minimize the energy that must be absorbed following a loss of coolant accident (LOCA). This can be accomplished either automatically or manually. The protection and monitoring functions of the RPS have been designed to ensure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters and equipment performance. The LSSS are defined in this Specification as the Allowable Values, which, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs) during Design Basis Accidents (DBAs). The RPS, as described in the UFSAR, Section 7.2 (Ref. 1), includes sensors, relays, bypass circuits, and switches that are necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide range of dependent and independent parameters. The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level, reactor vessel pressure, neutron flux, main steam line isolation valve position, turbine control valve (TCV) fast closure, sensed from control oil pressure, turbine stop valve (TSV) position, drywell pressure, and scram discharge volume (SDV) water level, as well as reactor mode switch in shutdown position and manual scram signals. There are at least four redundant sensor input signals from each of these parameters (with the exception of the reactor mode switch in shutdown position scram signal and the manual scram signal). Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an RPS trip signal to the trip logic. (continued) Brunswick Unit 2 B 3.3.1.1-1 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES BACKGROUND The RPS is comprised of two independent trip systems (A and B) with (continued) three logic channels in each trip system (logic channels A1, A2, and A3; B1, B2, and B3) as shown in Reference 1 figures. Logic channels A1, A2, B1, and B2 contain automatic logic for which the above monitored parameters each have at least one input to each of these logic channels. The outputs of the logic channels in a trip system are combined in a one-out-of-two logic so that either channel can trip the associated trip system. The tripping of both trip systems will produce a reactor scram. This logic arrangement is referred to as a one-out-of-two taken twice logic. In addition to the automatic logic channels, logic channels A3 and B3 (one logic channel per trip system) are manual scram channels. Both must be deenergized in order to initiate the manual trip function. Each trip system can be reset by use of a reset switch. If a full scram occurs (both trip systems trip), a relay prevents reset of the trip systems for 10 seconds after the full scram signal is received. This 10 second delay on reset ensures that the scram function will be completed. One scram pilot valve is located in the hydraulic control unit for each control rod drive (CRD). Each scram pilot valve is operated by two solenoids, with the solenoids normally energized. The scram pilot valve controls the air supply to the scram inlet and outlet valves for the associated CRD. When either scram pilot valve solenoid is energized, air pressure holds the scram valves closed and, therefore, both scram pilot valve solenoids must be de-energized to cause a control rod to scram. The scram valves control the supply and discharge paths for the CRD water during a scram. One of the scram pilot valve solenoids for each CRD is controlled by trip system A, and the other solenoid is controlled by trip system B. Any trip of trip system A in conjunction with any trip in trip system B results in de-energizing both solenoids, air bleeding off, scram valves opening, and control rod scram. The backup scram valves, which energize on a scram signal to depressurize the scram air header, are also controlled by the RPS. Additionally, the RPS System controls the SDV vent and drain valves such that when both trip systems trip, the SDV vent and drain valves close to isolate the SDV. (continued) Brunswick Unit 2 B 3.3.1.1-2 Revision No. 80

RPS Instrumentation B 3.3.1.1 BASES (continued) APPLICABLE The actions of the RPS are assumed in the safety analyses of SAFETY ANALYSES, References 2, 3, and 4. The RPS initiates a reactor scram when LCO, and monitored parameter values exceed the Allowable Values, specified APPLICABILITY by the setpoint methodology and listed in Table 3.3.1.1-1 to preserve the integrity of the fuel cladding, the RCPB, and the containment by minimizing the energy that must be absorbed following a LOCA. RPS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 5). Functions not specifically credited in the accident analysis are retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis. The OPERABILITY of the RPS is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.1.1-1. Each Function must have a required number of OPERABLE channels per RPS trip system, with their setpoints within the specified Allowable Value, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Each channel must also respond within its assumed response time, where applicable. Allowable Values are specified for each RPS Function specified in the Table, where applicable. Trip setpoints are specified in the setpoint calculations. The setpoints are selected to ensure that the actual trip settings do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setting is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These (continued) Brunswick Unit 2 B 3.3.1.1-3 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE calibration based errors are limited to instrument drift, errors associated SAFETY ANALYSES, with measurement and test equipment, and calibration tolerance of loop LCO, and components. The trip setpoints and Allowable Values determined in this APPLICABILITY manner provide adequate protection because instrument uncertainties, (continued) process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation. The OPERABILITY of scram pilot valves and associated solenoids, backup scram valves, and SDV valves, described in the Background section, are not addressed by this LCO. The individual Functions are required to be OPERABLE in the MODES or other specified conditions indicated in Table 3.3.1.1-1, which may require an RPS trip to mitigate the consequences of a design basis accident or transient. To ensure a reliable scram function, a combination of Functions are required in each MODE to provide primary and diverse initiation signals. The RPS is required to be OPERABLE in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies. Control rods withdrawn from a core cell containing no fuel assemblies do not affect the reactivity of the core and, therefore, are not required to have the capability to scram. Provided all other control rods remain inserted, the RPS function is not required. In this condition, the required SDM (LCO 3.1.1) and refuel position one-rod-out interlock (LCO 3.9.2) ensure that no event requiring RPS will occur. During normal operation in MODES 3 and 4, all control rods are fully inserted and the Reactor Mode Switch Shutdown Position control rod withdrawal block (LCO 3.3.2.1) does not allow any control rod to be withdrawn. Under these conditions, the RPS function is not required to be OPERABLE. The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis. (continued) Brunswick Unit 2 B 3.3.1.1-4 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE Intermediate Range Monitor (IRM) SAFETY ANALYSES, LCO, and 1.a. Intermediate Range Monitor Neutron FluxHigh APPLICABILITY (continued) The IRMs monitor neutron flux levels from the upper range of the source range monitor (SRM) to the lower range of the average power range monitors (APRMs). The IRMs are capable of generating trip signals that can be used to prevent fuel damage resulting from abnormal operating transients in the intermediate power range. In this power range, the most significant source of reactivity change is due to control rod withdrawal. The IRM provides diverse protection from the rod worth minimizer (RWM), which monitors and controls the movement of control rods at low power. The RWM prevents the withdrawal of an out of sequence control rod during startup that could result in an unacceptable neutron flux excursion. The IRM provides mitigation of the neutron flux excursion. To demonstrate the capability of the IRM System to mitigate control rod withdrawal events, a generic analysis has been performed (Ref. 6) to evaluate the consequences of control rod withdrawal events during startup that are mitigated only by the IRM. This analysis, which assumes that one IRM channel in each trip system is bypassed, demonstrates that the IRMs provide protection against local control rod withdrawal errors and results in peak fuel enthalpy below the 170 cal/gm fuel failure threshold criterion. The IRMs are also capable of limiting other reactivity excursions during startup, such as cold water injection events, although no credit is specifically assumed. The IRM System is divided into two groups of IRM channels, with four IRM channels inputting to each trip system. The analysis of Reference 6 assumes that one channel in each trip system is bypassed. Therefore, six channels with three channels in each trip system are required for IRM OPERABILITY to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. This trip is active in each of the 10 ranges of the IRM, which must be selected by the operator to maintain the neutron flux within the monitored level of an IRM range. The analysis of Reference 6 has adequate conservatism to permit the IRM Allowable Value of 120 divisions of a 125 division scale. (continued) Brunswick Unit 2 B 3.3.1.1-5 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 1.a. Intermediate Range Monitor Neutron FluxHigh (continued) SAFETY ANALYSES, LCO, and The Intermediate Range Monitor Neutron FluxHigh Function must be APPLICABILITY OPERABLE during MODE 2 when control rods may be withdrawn and the potential for criticality exists. In MODE 5, when a cell with fuel has its control rod withdrawn, the IRMs provide monitoring for and protection against unexpected reactivity excursions. In MODE 1, the APRM System, the RWM, and the Rod Block Monitor provide protection against control rod withdrawal error events and the IRMs are not required. The IRMs are automatically bypassed when the mode switch is in the run position. 1.b. Intermediate Range MonitorInop This trip signal provides assurance that a minimum number of IRMs are OPERABLE. Anytime an IRM mode switch is moved to any position other than "Operate," the detector voltage drops below a preset level, or when a module is not plugged in, an inoperative trip signal will be received by the RPS unless the IRM is bypassed. Since only one IRM in each trip system may be bypassed, only one IRM in each RPS trip system may be inoperable without resulting in an RPS trip signal. This Function was not specifically credited in the accident analysis but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis. Six channels of Intermediate Range MonitorInop with three channels in each trip system are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. Since this Function is not assumed in the safety analysis, there is no Allowable Value for this Function. This Function is required to be OPERABLE when the Intermediate Range Monitor Neutron FluxHigh Function is required. (continued) Brunswick Unit 2 B 3.3.1.1-6 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE Average Power Range Monitor (APRM) SAFETY ANALYSES, LCO, and The APRM channels provide the primary indication of neutron flux within APPLICABILITY the core and respond almost instantaneously to neutron flux increases. (continued) The APRM channels receive input signals from the local power range monitors (LPRMs) within the reactor core to provide an indication of the power distribution and local power changes. The APRM channels average these LPRM signals to provide a continuous indication of average reactor power from a few percent to greater than RTP. Each APRM channel also includes an Oscillation Power Range Monitor (OPRM) Upscale Function which monitors small groups of LPRM signals to detect thermal-hydraulic instabilities. The APRM System is divided into four APRM channels and four 2-Out-Of-4 Voter channels. Each APRM channel provides inputs to each of the four voter channels. The four voter channels are divided into two groups of two each with each group of two providing inputs to one RPS trip system. The system is designed to allow one APRM channel, but no voter channels, to be bypassed. A trip from any one unbypassed APRM will result in a "half-trip" in all four of the voter channels, but no trip inputs to either RPS trip system. APRM trip Functions 2.a, 2.b, 2.c, and 2.d are voted independently from OPRM Upscale Function 2.f. Therefore, any Function 2.a, 2.b, 2.c, or 2.d trip from any two unbypassed APRM channels will result in a full trip in each of the four voter channels, which in turn results in two trip inputs into each RPS trip system logic channel (A1, A2, B1, and B2), thus resulting in a full scram signal. Similarly, a Function 2.f trip from any two unbypassed APRM channels will result in a full trip from each of the four voter channels. Three of the four APRM channels and all four of the voter channels are required to be OPERABLE to ensure that no single failure will preclude a scram on a valid signal. In addition, to provide adequate coverage of the entire core consistent with the design bases for the APRM Functions 2.a, 2.b, and 2.c, at least 17 LPRM inputs with at least three LPRM inputs from each of the four axial levels at which the LPRMs are located, must be OPERABLE for each APRM channel. For the OPRM Upscale Function 2.f, each LPRM in an APRM channel is assigned to one, two or (continued) Brunswick Unit 2 B 3.3.1.1-7 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE Average Power Range Monitor (APRM) (continued) SAFETY ANALYSES, LCO, and four OPRM "cells," forming a total of 24 separate OPRM cells per APRM APPLICABILITY channel, each with either three or four detectors. LPRMs near the edge of the core are assigned to either one or two OPRM cells. A minimum of 18 OPRM cells in an APRM channel must have at least two OPERABLE LPRMs for the OPRM Upscale Function 2.f to be OPERABLE (Ref. 22). 2.a. Average Power Range Monitor Neutron FluxHigh (Setdown) For operation at low power (i.e., MODE 2), the Average Power Range Monitor Neutron FluxHigh (Setdown) Function is capable of generating a trip signal that prevents fuel damage resulting from abnormal operating transients in this power range. For most operation at low power levels, the Average Power Range Monitor Neutron FluxHigh (Setdown) Function will provide a secondary scram to the Intermediate Range Monitor Neutron FluxHigh Function because of the relative setpoints. With the IRMs at Range 9 or 10, it is possible that the Average Power Range Monitor Neutron FluxHigh (Setdown) Function will provide the primary trip signal for a core-wide increase in power. No specific safety analyses take direct credit for the Average Power Range Monitor Neutron FluxHigh (Setdown) Function. However, this Function is credited in calculations used to eliminate the need to perform the spatial analysis required for the Intermediate Range Monitor Neutron FluxHigh Function (Ref. 6). In addition, the Average Power Range Monitor Neutron FluxHigh (Setdown) Function indirectly ensures that before the reactor mode switch is placed in the run position, reactor power does not exceed 23% RTP (SL 2.1.1.1) when operating at low reactor pressure and low core flow. Therefore, it indirectly prevents fuel damage during significant reactivity increases with THERMAL POWER

                < 23% RTP.

The Allowable Value is based on preventing significant increases in power when THERMAL POWER is < 23% RTP. The Average Power Range Monitor Neutron FluxHigh (Setdown) Function must be OPERABLE during MODE 2 when control rods may be withdrawn since the potential for criticality exists. (continued) Brunswick Unit 2 B 3.3.1.1-8 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.a. Average Power Range Monitor Neutron FluxHigh (Setdown) SAFETY ANALYSES, (continued) LCO, and APPLICABILITY In MODE 1, the Average Power Range Monitor Simulated Thermal PowerHigh and Neutron FluxHigh Functions provide protection against reactivity transients and the RWM and Rod Block Monitor protect against control rod withdrawal error events. 2.b. Average Power Range Monitor Simulated Thermal PowerHigh The Average Power Range Monitor Simulated Thermal PowerHigh Function monitors neutron flux to approximate the THERMAL POWER being transferred to the reactor coolant. The APRM neutron flux is electronically filtered with a time constant, nominally 6 seconds, representative of the fuel heat transfer dynamics to generate a signal proportional to the THERMAL POWER in the reactor. The trip level is varied as a function of rated recirculation drive flow (W) in percent and is clamped at an upper limit that is always lower than the Average Power Range Monitor Neutron FluxHigh Function Allowable Value. The Average Power Range Monitor Simulated Thermal PowerHigh Function provides a general definition of the licensed core power/core flow operating domain. A note is included, applicable when the plant is in single recirculation loop operation per LCO 3.4.1, which requires reducing by W the flow value used in the Allowable Value equation. The value of W is defined in plant procedures. The value of W is established to adjust the SLO limit down in power approximately 8.5% RTP to reflect the difference between the analyzed limits for two-recirculation loop operation (TLO) and SLO. The adjustment maintains the SLO limits at approximately the same absolute thermal power level as was established prior to extended power uprate. The 8.5% RTP has been converted to an equivalent "W" value for convenience of representation and to reflect the way the adjustment is actually made in the APRM equipment. In addition to this adjustment, the actual W value entered into the equipment includes an allowance for additional flow measurement uncertainties that may occur in SLO. The (continued) Brunswick Unit 2 B 3.3.1.1-9 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.b. Average Power Range Monitor Simulated Thermal PowerHigh SAFETY ANALYSES, (continued) LCO, and APPLICABILITY allowable value equation for single loop operation is only valid for flows down to W = W, at which point the allowable value is equal to the TLO "offset" value, the minimum required. The Average Power Range Monitor Simulated Thermal PowerHigh Function is not associated with an LSSS. Operating limits established for the licensed operating domain are used to develop the Average Power Range Monitor Simulated Thermal PowerHigh Function Allowable Values, including the clamp value, to provide pre-emptive reactor scram and prevent gross violation of the licensed operating domain. Operation outside the licensed operating domain may result in anticipated operational occurrences and postulated accidents being initiated from conditions beyond those assumed in the safety analysis. Each APRM channel uses one total recirculation drive flow signal representative of total core flow. The total drive flow signal is generated by the flow processing logic, part of the APRM channel, by summing the flow calculated from two flow transmitter signal inputs, one from each of the two recirculation loops. The flow processing logic OPERABILITY is part of the APRM channel OPERABILITY requirements for this Function. The Average Power Range Monitor Simulated Thermal PowerHigh Function uses a trip level generated based on recirculation loop drive flow. Changes in the core flow to drive flow functional relationship may vary over the core flow operating range. These changes can result from gradual changes in the Recirculation System and core components over the reactor life time as well as specific maintenance performed on these components (e.g., jet pump cleaning). The proper representation of drive flow as a representation of core flow is ensured through drive flow alignment, accomplished by SR 3.3.1.1.18. The Average Power Range Monitor Simulated Thermal PowerHigh Function is required to be OPERABLE in MODE 1 when there is the possibility of generating excessive THERMAL POWER and potentially (continued) Brunswick Unit 2 B 3.3.1.1-10 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.b. Average Power Range Monitor Simulated Thermal PowerHigh SAFETY ANALYSES, (continued) LCO, and APPLICABILITY damaging fuel cladding. During MODES 2 and 5, other IRM and APRM Functions provide protection for fuel cladding integrity. 2.c. Average Power Range Monitor Neutron FluxHigh The Average Power Range Monitor Neutron FluxHigh Function is capable of generating a trip signal to prevent fuel damage or excessive RCS pressure. For the overpressurization protection analysis of References 4 and 7, the Average Power Range Monitor Neutron Flux High Function is assumed to terminate the main steam isolation valve (MSIV) closure event and, along with the safety/relief valves (SRVs), limits the peak reactor pressure vessel (RPV) pressure to less than the ASME Code limits. The control rod drop accident (CRDA) analysis (Ref. 2) takes credit for the Average Power Range Monitor Neutron FluxHigh Function to terminate the CRDA. The Allowable Value is based on the Analytical Limit assumed in the CRDA analysis. The Average Power Range Monitor Neutron FluxHigh Function is required to be OPERABLE in MODE 1 where the potential consequences of the analyzed transients could result in the SLs (e.g., MCPR and RCS pressure) being exceeded. Although the Average Power Range Monitor Neutron FluxHigh Function is assumed in the CRDA analysis, which is applicable in MODE 2, the Average Power Range Monitor Neutron Flux High (Setdown) Function conservatively bounds the assumed trip and, together with the assumed IRM trips, provides adequate protection. Therefore, the Average Power Range Monitor Neutron FluxHigh Function is not required in MODE 2. 2.d. Average Power Range MonitorInop Three of the four APRM channels are required to be OPERABLE for each of the APRM Functions. This Function (Inop) provides assurance that the minimum number of APRM channels are OPERABLE. (continued) Brunswick Unit 2 B 3.3.1.1-11 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.d. Average Power Range MonitorInop (continued) SAFETY ANALYSES, LCO, and For any APRM channel, any time its mode switch is not in the "Operate" APPLICABILITY position, an APRM module required to issue a trip is unplugged, or the automatic self-test system detects a critical fault with the APRM channel, an Inop trip is sent to all four voter channels. Inop trips from two or more unbypassed APRM channels result in a trip output from each of the four voter channels to its associated trip system. This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis. There is no Allowable Value for this Function. This Function is required to be OPERABLE in the MODES where the APRM Functions are required. 2.e. 2-Out-Of-4 Voter The 2-Out-Of-4 Voter Function provides the interface between the APRM Functions, including the OPRM Upscale Function, and the final RPS trip system logic. As such, it is required to be OPERABLE in the MODES where the APRM Functions are required and is necessary to support the safety analysis applicable to each of those Functions. Therefore, the 2-Out-Of-4 Voter Function needs to be OPERABLE in MODES 1 and 2. All four voter channels are required to be OPERABLE. Each voter channel includes self-diagnostic functions. If any voter channel detects a critical fault in its own processing, a trip is issued from that voter channel to the associated trip system. The Two-Out-Of-Four Logic Module includes both the 2-Out-Of-4 Voter hardware (the non-safety-related portion of the Two-Out-Of-Four Logic Module including annunciator output relays, status lights, etc.). The 2-Out-Of-4 Voter Function 2.e votes APRM Functions 2.a, 2.b, 2.c, and 2.d independently of Function 2.f. This voting is accomplished by the 2-Out-Of-4 Voter hardware in the Two-Out-Of-Four Logic Module. The voter also includes separate outputs to RPS for the two independently (continued) Brunswick Unit 2 B 3.3.1.1-12 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.e. 2-Out-Of-4 Voter (continued) SAFETY ANALYSES, LCO, and voted sets of Functions, each of which is redundant (four total outputs). APPLICABILITY The analysis in Reference 15 took credit for this redundancy in the justification of the 12-hour Completion Time for Condition A, so the voter Function 2.e must be declared inoperable if any of its functionality is inoperable. The voter Function 2.e does not need to be declared inoperable due to any failure affecting only the APRM Interface hardware portion of the Two-Out-Of-Four Logic Module. There is no Allowable Value for this Function. 2.f. Oscillation Power Range Monitor (OPRM) Upscale The OPRM Upscale Function provides compliance with GDC 10 and GDC 12, thereby providing protection from exceeding the fuel MCPR safety limit (SL) due to anticipated thermal-hydraulic power oscillations. References 17, 18 and 19 describe three algorithms for detecting thermal-hydraulic instability related neutron flux oscillations: the period based detection algorithm, the amplitude based algorithm, and the growth rate algorithm. All three are implemented in the OPRM Upscale Function, but the safety analysis takes credit only for the period based detection algorithm. The remaining algorithms provide defense in depth and additional protection against unanticipated oscillations. OPRM Upscale Function OPERABILITY for Technical Specification purposes is based only on the period based detection algorithm. The OPRM Upscale Function receives input signals from the local power range monitors (LPRMs) within the reactor core, which are combined into "cells" for evaluation by the OPRM algorithms. Each channel is capable of detecting thermal-hydraulic instabilities, by detecting the related neutron flux oscillations, and issuing a trip signal before the MCPR SL is exceeded. Three of the four channels are required to be OPERABLE. The OPRM Upscale trip is automatically enabled (bypass removed) when THERMAL POWER is 25% RTP, as indicated by the APRM Simulated Thermal Power, and reactor core flow is 60% of rated flow, as indicated by APRM measured recirculation drive flow. This is the operating region (continued) Brunswick Unit 2 B 3.3.1.1-13 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.f. Oscillation Power Range Monitor (OPRM) Upscale SAFETY ANALYSES, (continued) LCO, and APPLICABILITY where actual thermal-hydraulic instability and related neutron flux oscillations may occur. See Reference 21 for additional discussion of OPRM Upscale trip enable region limits. The 25% RTP lower boundary of the enabled region was established by scaling the 30% value in Reference 21 for uprated power to correspond to 30% of original plant RTP. This scaling is not required by Reference 21, but has been done for conservatism. These setpoints, which are sometimes referred to as the "auto-bypass" setpoints, establish the boundaries of the OPRM Upscale trip enabled region. The APRM Simulated Thermal Power auto-enable setpoint has 1% deadband while the drive flow setpoint has a 2% deadband. The deadband for these setpoints is established so that it increased the enabled region. The OPRM Upscale Function is required to be OPERABLE when the plant is at 20% RPT. The 20% RTP level is selected to provide margin in the unlikely event that a reactor power increase transient occurring while the plant is operating below 25% RTP causes a power increase to or beyond the 25% APRM Simulated Thermal Power OPRM Upscale trip auto-enable setpoint without operator action. This OPERABILITY requirement assures that the OPRM Upscale trip auto-enable function will be OPERABLE when required. An OPRM Upscale trip is issued from an APRM channel when the period based detection algorithm in that channel detects oscillatory changes in the neutron flux, indicated by the combined signals of the LPRM detectors in a cell, with period confirmations and relative cell amplitude exceeding specified setpoints. One or more cells in a channel exceeding the trip conditions will result in a channel trip. An OPRM Upscale trip is also issued from the channel if either the growth rate or amplitude based algorithms detect growing oscillatory changes in the neutron flux for one or more cells in that channel. (Note: To facilitate placing the OPRM Upscale Function 2.f in one APRM channel in a "tripped" state, if (continued) Brunswick Unit 2 B 3.3.1.1-14 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.f. Oscillation Power Range Monitor (OPRM) Upscale (continued) SAFETY ANALYSES, LCO, and necessary to satisfy a Required Action, the APRM equipment is APPLICABILITY conservatively designed to force an OPRM Upscale trip output from the APRM channel if an APRM Inop condition occurs, such as when the APRM chassis keylock switch is placed in the Inop position.) There are four "sets" of OPRM related setpoints or adjustment parameters: (a) OPRM trip auto-enable setpoints for STP (25%) and drive flow (60%); (b) period based detection algorithm (PBDA) confirmation count and amplitude setpoints; (c) period based detection algorithm tuning parameters; and (d) growth rate algorithm (GRA) and amplitude based algorithm (ABA) setpoints. The first set, the OPRM auto-enable region setpoints, as discussed in the SR 3.3.1.1.19 Bases, are treated as nominal setpoints with no additional margins added. The settings, 25% APRM Simulated Thermal Power and 60% drive flow, are defined (limit values) in and confirmed by SR 3.3.1.1.19. The second set, the OPRM PBDA trip setpoints, are established in accordance with methodologies defined in Reference 19, and are documented in the COLR. There are no allowable values for these setpoints. The third set, the OPRM PBDA "tuning" parameters, are established, adjusted, and controlled by plant procedures. The fourth set, the GRA and ABA setpoints, in accordance with References 15 and 16, are established as nominal values only, and controlled by plant procedures.

3. Reactor Vessel Steam Dome PressureHigh An increase in the RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion. This causes the neutron flux and THERMAL POWER transferred to the reactor coolant to increase, which could challenge the integrity of the fuel cladding and the RCPB. The Reactor Vessel Steam Dome Pressure High Function initiates a scram for transients that results in a pressure increase, counteracting the pressure increase by rapidly reducing core power. For the overpressurization protection analyses of References 4, (continued)

Brunswick Unit 2 B 3.3.1.1-15 Revision No. 62

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 3. Reactor Vessel Steam Dome PressureHigh (continued) SAFETY ANALYSES, LCO, and 7, and 8, reactor scram, along with the SRVs, limits the peak RPV APPLICABILITY pressure to less than the ASME Section III Code limits. High reactor pressure signals are initiated from four pressure transmitters that sense reactor pressure. The Reactor Vessel Steam Dome PressureHigh Allowable Value is chosen to provide a sufficient margin to the ASME Section III Code limits during the event. Four channels of Reactor Vessel Steam Dome PressureHigh Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. The Function is required to be OPERABLE in MODES 1 and 2 since the Reactor Coolant System (RCS) is pressurized and the potential for pressure increase exists.

4. Reactor Vessel Water LevelLow Level 1 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, a reactor scram is initiated at Low Level 1 to substantially reduce the heat generated in the fuel from fission. The Reactor Vessel Water LevelLow Level 1 Function is assumed in the analysis of the recirculation line break (Ref. 9). The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the Emergency Core Cooling Systems (ECCS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water LevelLow Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water LevelLow Level 1 Function, with two channels in each trip system arranged in a one-out-of-two logic, (continued) Brunswick Unit 2 B 3.3.1.1-16 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 4. Reactor Vessel Water LevelLow Level 1 (continued) SAFETY ANALYSES, LCO, and are required to be OPERABLE to ensure that no single instrument failure APPLICABILITY will preclude a scram from this Function on a valid signal. The Reactor Vessel Water LevelLow Level 1 Allowable Value is selected to ensure that during normal operation the steam dryer seal skirt and lowest steam separator skirt are not uncovered (this protects available recirculation pump net positive suction head (NPSH) from significant carryunder) and, for transients involving loss of all normal feedwater flow, initiation of the low pressure ECCS subsystems at Reactor Vessel WaterLow Level 3 will not be required. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. The Function is required in MODES 1 and 2 where considerable energy exists in the RCS resulting in the limiting transients and accidents. ECCS initiations at Reactor Vessel Water LevelLow Level 2 and Low Level 3 provide sufficient protection for level transients in all other MODES.

5. Main Steam Isolation ValveClosure MSIV closure results in loss of the main turbine and the condenser as a heat sink for the nuclear steam supply system and indicates a need to shut down the reactor to reduce heat generation. Therefore, a reactor scram is initiated on a Main Steam Isolation ValveClosure signal before the MSIVs are completely closed in anticipation of the complete loss of the normal heat sink and subsequent overpressurization transient.

However, for the overpressurization protection analyses of References 4, 7, and 8, the Average Power Range Monitor Fixed Neutron FluxHigh Function, along with the SRVs, limits the peak RPV pressure to less than the ASME Code limits. That is, the direct scram on position switches for MSIV closure events is not assumed in the overpressurization analysis. Additionally, MSIV closure is assumed in the transients analyzed in Reference 2. The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the ECCS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. (continued) Brunswick Unit 2 B 3.3.1.1-17 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 5. Main Steam Isolation ValveClosure (continued) SAFETY ANALYSES, LCO, and MSIV closure signals are initiated from position switches located on each APPLICABILITY of the eight MSIVs. Each MSIV has two position switches; one inputs to RPS trip system A while the other inputs to RPS trip system B. Thus, each RPS trip system receives an input from eight Main Steam Isolation ValveClosure channels, each consisting of one position switch. The logic for the Main Steam Isolation ValveClosure Function is arranged such that either the inboard or outboard valve on three or more of the main steam lines must close in order for a scram to occur. In addition, certain combinations of valves closed in two lines will result in a half-scram. The Main Steam Isolation ValveClosure Allowable Value is specified to ensure that a scram occurs prior to a significant reduction in steam flow, thereby reducing the severity of the subsequent pressure transient. Sixteen channels of the Main Steam Isolation ValveClosure Function, with eight channels in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude the scram from this Function on a valid signal. This Function is only required in MODE 1 since, with the MSIVs open and the heat generation rate high, a pressurization transient can occur if the MSIVs close. In MODE 2, the heat generation rate is low enough so that the other diverse RPS functions provide sufficient protection. APPLICABLE 6. Drywell PressureHigh SAFETY ANALYSES, LCO, and High pressure in the drywell could indicate a break in the RCPB. APPLICABILITY A reactor scram is initiated to minimize the possibility of fuel damage (continued) and to reduce the amount of energy being added to the coolant and the drywell. The Drywell PressureHigh Function is a secondary scram signal to Reactor Vessel Water LevelLow Level 1 for LOCA events inside the drywell. However, no credit is taken for a scram initiated from (continued) Brunswick Unit 2 B 3.3.1.1-18 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 6. Drywell PressureHigh (continued) SAFETY ANALYSES, LCO, and this Function for any of the DBAs analyzed in the UFSAR. This Function APPLICABILITY was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis. The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the ECCS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and indicative of a LOCA inside primary containment. Four channels of Drywell PressureHigh Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. The Function is required in MODES 1 and 2 where considerable energy exists in the RCS, resulting in the limiting transients and accidents.

7. Scram Discharge Volume Water LevelHigh The SDV receives the water displaced by the motion of the CRD pistons during a reactor scram. Should this volume fill to a point where there is insufficient volume to accept the displaced water, control rod insertion would be hindered. Therefore, a reactor scram is initiated while the remaining free volume is still sufficient to accommodate the water from a full core scram. The two types of Scram Discharge Volume Water LevelHigh Functions are an input to the RPS logic. No credit is taken for a scram initiated from these Functions for any of the design basis accidents or transients analyzed in the UFSAR. However, they are retained to ensure the RPS remains OPERABLE.

(continued) Brunswick Unit 2 B 3.3.1.1-19 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 7. Scram Discharge Volume Water LevelHigh SAFETY ANALYSES, LCO, and SDV water level is measured by two diverse methods. The APPLICABILITY level in each of the two SDVs is measured by two float type level switches and two thermal probes for a total of eight level signals. The outputs of these devices are arranged so that there is a signal from a level switch and a thermal probe to each RPS logic channel. The level measurement instrumentation satisfies the recommendations of Reference 10. The Allowable Value is chosen low enough to ensure that there is sufficient volume in the SDV to accommodate the water from a full scram. Four channels of the Scram Discharge Volume Water LevelHigh Function, with at least one channel utilizing a float type switch and one channel utilizing a thermal probe in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from these Functions on a valid signal. These Functions are required in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn. At all other times, this Function may be bypassed.

8. Turbine Stop ValveClosure Closure of the TSVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated at the start of TSV closure in anticipation of the transients that would result from the closure of these valves. The Turbine Stop ValveClosure Function is the primary scram signal for the turbine trip event analyzed in Reference 2. For this event, the reactor scram reduces the amount of energy required to be absorbed and ensures that the MCPR SL is not exceeded.

(continued) Brunswick Unit 2 B 3.3.1.1-20 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 8. Turbine Stop ValveClosure (continued) SAFETY ANALYSES, LCO, and Turbine Stop ValveClosure signals are initiated from position switches APPLICABILITY located on each of the four TSVs. Two independent position switches are associated with each stop valve. One of the two switches provides input to RPS trip system A; the other, to RPS trip system B. Thus, each RPS trip system receives an input from four Turbine Stop ValveClosure channels, each consisting of one position switch. The logic for the Turbine Stop ValveClosure Function is such that three or more TSVs must be closed to produce a scram. In addition, certain combinations of two valves closed will result in a half-scram. This Function must be enabled at THERMAL POWER 26% RTP. This is accomplished automatically by pressure switches sensing turbine first stage pressure; therefore, opening of the turbine bypass valves may affect this Function. The Turbine Stop ValveClosure Allowable Value is selected to be high enough to detect imminent TSV closure, thereby reducing the severity of the subsequent pressure transient. Eight channels of Turbine Stop ValveClosure Function, with four channels in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function if any three TSVs should close. This Function is required, consistent with analysis assumptions, whenever THERMAL POWER is 26% RTP. This Function is not required when THERMAL POWER is < 26% RTP since the Reactor Vessel Steam Dome PressureHigh and the Average Power Range Monitor Fixed Neutron FluxHigh Functions are adequate to maintain the necessary safety margins.

9. Turbine Control Valve Fast Closure, Control Oil PressureLow Fast closure of the TCVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated on TCV fast closure in anticipation of the transients that would result from the closure of these valves. The Turbine Control Valve Fast Closure, Control Oil Pressure Low Function is the primary scram signal for the generator load rejection event analyzed in Reference 2. For this event, the reactor scram reduces (continued)

Brunswick Unit 2 B 3.3.1.1-21 Revision No. 86

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 9. Turbine Control Valve Fast Closure, Control Oil PressureLow SAFETY ANALYSES, (continued) LCO, and APPLICABILITY the amount of energy required to be absorbed and ensures that the MCPR SL is not exceeded. Turbine Control Valve Fast Closure, Control Oil PressureLow signals are initiated by the electrohydraulic control (EHC) fluid pressure at each control valve. One pressure switch is associated with each control valve, and the signal from each switch is assigned to a separate RPS logic channel. This Function must be enabled at THERMAL POWER 26% RTP. This is accomplished automatically by pressure switches sensing turbine first stage pressure; therefore, opening of the turbine bypass valves may affect this Function. The Turbine Control Valve Fast Closure, Control Oil PressureLow Allowable Value is selected high enough to detect imminent TCV fast closure. Four channels of Turbine Control Valve Fast Closure, Control Oil PressureLow Function with two channels in each trip system arranged in a one-out-of-two logic are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. This Function is required, consistent with the analysis assumptions, whenever THERMAL POWER is 26% RTP. This Function is not required when THERMAL POWER is < 26% RTP, since the Reactor Vessel Steam Dome PressureHigh and the Average Power Range Monitor Fixed Neutron FluxHigh Functions are adequate to maintain the necessary safety margins.

10. Reactor Mode SwitchShutdown Position The Reactor Mode SwitchShutdown Position Function provides signals, via the manual scram logic channels, to two RPS logic channels, which are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

(continued) Brunswick Unit 2 B 3.3.1.1-22 Revision No. 86

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 10. Reactor Mode SwitchShutdown Position (continued) SAFETY ANALYSES, LCO, and The reactor mode switch is a single switch with two channels, each of APPLICABILITY which provides input into one of the manual RPS logic channels (A3 and B3). The reactor mode switch is capable of scramming the reactor if the mode switch is placed in the shutdown position. Additionally, placing the mode switch in the shutdown position results in an MSIV isolation if main steam line flow is > 40% of rated flow. There is no Allowable Value for this Function, since the channels are mechanically actuated based solely on reactor mode switch position. Two channels of Reactor Mode SwitchShutdown Position Function, with one channel in trip channel A3 and one channel in trip channel B3 are available and required to be OPERABLE. The Reactor Mode Switch Shutdown Position Function is required to be OPERABLE in MODES 1 and 2, and MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.

11. Manual Scram The Manual Scram push button channels provide signals to the manual scram logic channels (A3 and B3), which are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Function was not specifically credited in the accident analysis but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

There is one Manual Scram push button channel for each RPS trip system. In order to cause a scram it is necessary for each trip system to be actuated. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons. Two channels of Manual Scram with one channel in trip channel A3 and one channel in trip channel B3 are available and required to be OPERABLE in MODES 1 and 2, and in MODE 5 with any control rod (continued) Brunswick Unit 2 B 3.3.1.1-23 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 11. Manual Scram (continued) SAFETY ANALYSES, LCO, and withdrawn from a core cell containing one or more fuel assemblies, since APPLICABILITY these are the MODES and other specified conditions when control rods are withdrawn. ACTIONS A Note has been provided to modify the ACTIONS related to RPS instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RPS instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable RPS instrumentation channel. A.1 and A.2 Because of the diversity of sensors available to provide trip signals and the redundancy of the RPS design, an allowable out of service time of 12 hours has been shown to be acceptable (Ref. 11) to permit restoration of any inoperable channel to OPERABLE status. However, this out of service time is only acceptable provided the associated Function's inoperable channel is in one trip system and the Function still maintains RPS trip capability (refer to Required Actions B.1, B.2, and C.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel or the associated trip system must be placed in the tripped condition per Required Actions A.1 and A.2. Placing the inoperable channel in trip (or the associated trip system in trip) would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternatively, if it is not desired to place the channel (or trip system) in trip (e.g., as in the case where placing the inoperable channel in trip would result in a full scram), Condition D must be entered and its Required Action taken. (continued) Brunswick Unit 2 B 3.3.1.1-24 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES ACTIONS A.1 and A.2 (continued) As noted, Action A.2 is not applicable for APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f. Inoperability of one required APRM channel affects both trip systems. For that condition, Required Action A.1 must be satisfied, and is the only action (other than restoring OPERABILITY) that will restore capability to accommodate a single failure. Inoperability of more than one required APRM channel of the same trip function results in loss of trip capability and entry into Condition C, as well as entry into Condition A for each channel. ACTIONS B.1 and B.2 (continued) Condition B exists when, for any one or more Functions, at least one required channel is inoperable in each trip system. In this condition, provided at least one channel per trip system is OPERABLE, the RPS still maintains trip capability for that Function, but cannot accommodate a single failure in either trip system. Required Actions B.1 and B.2 limit the time the RPS scram logic, for any Function, would not accommodate single failure in both trip systems (e.g., one-out-of-one and one-out-of-one arrangement for a typical four channel Function). The reduced reliability of this logic arrangement was not evaluated in References 11, 15, or 16 for the 12 hour Completion Time. Within the 6 hour allowance, the associated Function will have all required channels OPERABLE or in trip (or any combination) in one trip system. This is accomplished by either placing all inoperable channels in trip or tripping the trip system. Completing one of these Required Actions restores RPS to a reliability level equivalent to that evaluated in References 11, 15, or 16, which justified a 12 hour allowable out of service time as presented in Condition A. The trip system in the more degraded state should be placed in trip or, alternatively, all the inoperable channels in that trip system should be placed in trip (e.g., a trip system with two inoperable channels could be in a more degraded state than a trip system with four inoperable channels if the two inoperable channels are in the same Function while the four inoperable channels are all in different Functions). (continued) Brunswick Unit 2 B 3.3.1.1-25 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES ACTIONS B.1 and B.2 (continued) The decision of which trip system is in the more degraded state should be based on prudent judgment and take into account current plant conditions (i.e., what MODE the plant is in). If this action would result in a scram, it is permissible to place the other trip system or its inoperable channels in trip. The 6 hour Completion Time is judged acceptable based on the remaining capability to trip, the diversity of the sensors available to provide the trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of a scram. Alternatively, if it is not desired to place the inoperable channels (or one trip system) in trip (e.g., as in the case where placing the inoperable channel or associated trip system in trip would result in a scram, Condition D must be entered and its Required Action taken. As noted, Condition B is not applicable for APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f. Inoperability of an APRM channel affects both trip systems and is not associated with a specific trip system as are the APRM 2-Out-Of-4 Voter and other non-APRM channels for which Condition B applies. For an inoperable APRM channel, Required Action A.1 must be satisfied, and is the only action (other than restoring OPERABILITY) that will restore capability to accommodate a single failure. Inoperability of a Function in more than one required APRM channel results in loss of trip capability for that Function and entry into Condition C, as well as entry into Condition A for each channel. Because Conditions A and C provide Required Actions that are appropriate for the inoperability of APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f, and because these functions are not associated with specific trip systems as are the APRM 2-Out-Of-4 Voter and other non-APRM channels, Condition B does not apply. (continued) Brunswick Unit 2 B 3.3.1.1-26 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES (continued) ACTIONS C.1 (continued) Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same trip system for the same Function result in the Function not maintaining RPS trip capability. A Function is considered to be maintaining RPS trip capability when sufficient channels are OPERABLE or in trip (or the associated trip system is in trip), such that both trip systems will generate a trip signal from the given Function on a valid signal. For the typical Function with one-out-of-two taken twice logic and the IRM and APRM Functions, this would require both trip systems to have one channel OPERABLE or in trip (or the associated trip system in trip). For Function 5 (Main Steam Isolation ValveClosure), this would require both trip systems to have each channel associated with the MSIVs in three main steam lines (not necessarily the same main steam lines for both trip systems) OPERABLE or in trip (or the associated trip system in trip). For Function 8 (Turbine Stop ValveClosure), this would require both trip systems to have three channels, each OPERABLE or in trip (or the associated trip system in trip). For Function 10 (Reactor Mode Switch Shutdown Position) and Function 11 (Manual Scram), this would require both trip systems to have one channel, each OPERABLE or in trip (or the associated trip system in trip). The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels. D.1 Required Action D.1 directs entry into the appropriate Condition referenced in Table 3.3.1.1-1. The applicable Condition specified in the Table is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time an inoperable channel has not met any Required Action of Condition A, B, or C and the associated Completion Time has expired, (continued) Brunswick Unit 2 B 3.3.1.1-27 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES ACTIONS D.1 (continued) Condition D will be entered for that channel and provides for transfer to the appropriate subsequent Condition. E.1, F.1, and G.1 If the channel(s) is not restored to OPERABLE status or placed in trip (or the associated trip system placed in trip) within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. The allowed Completion Times are reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems. In addition, the Completion Time of Required Action E.1 is consistent with the Completion Time provided in LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)." H.1 If the channel(s) is not restored to OPERABLE status or placed in trip (or the associated trip system placed in trip) within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are, therefore, not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted. I.1 Condition I exists when the OPRM Upscale Trip capability has been lost for all APRM channels due to unanticipated equipment design or instability detection algorithm problems, or when testing to confirm plant response/performance following algorithm modifications. References 15 and 16 justified use of alternate methods to detect and suppress oscillations under limited conditions. The alternate methods are procedurally established consistent with the guidelines identified in Reference 20. The alternate methods procedures require operating (continued) Brunswick Unit 2 B 3.3.1.1-28 Revision No. 37

RPS Instrumentation B 3.3.1.1 BASES ACTIONS I.1 (continued) outside a "restricted zone" in the power-flow map and manual operator action to scram the plant if certain predefined events occur. The 12-hour allowed Completion Time for Required Action I.1 is based on engineering judgment to allow orderly transition to the alternate methods while limiting the period of time during which no automatic or alternate detect and suppress trip capability is formally in place. Based on the small probability of an instability event occurring at all, the 12 hours is judged to be reasonable. This Required Action is intended to allow continued plant operation under limited conditions when an unanticipated equipment design or instability detection algorithm problem causes OPRM Upscale Function inoperability in all APRM channels. This Required Action is not intended and was not evaluated as a routine alternative to return failed or inoperable equipment to OPERABLE status. Correction of routine equipment failure or inoperability is expected to be accomplished within the completion times allowed for Required Actions for Condition A. The alternate method to detect and suppress oscillations implemented in accordance with I.1 is intended to be applied only as long as is necessary to implement and test corrective action to resolve the unanticipated equipment design or instability detection algorithm problem. SURVEILLANCE As noted at the beginning of the SRs, the SRs for each RPS REQUIREMENTS instrumentation Function are located in the SRs column of Table 3.3.1.1-1. The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains RPS trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 11, 15, and 16) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the RPS will trip when necessary. (continued) Brunswick Unit 2 B 3.3.1.1-29 Revision No. 37

RPS Instrumentation B 3.3.1.1 BASES SR 3.3.1.1.1 Not used. SR 3.3.1.1.2 Performance of the CHANNEL CHECK once every 12 hours for APRM channels and once every 24 hours for all other applicable channels ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The CHANNEL CHECK for APRM functions includes a step to confirm that the automatic self-test functions for the APRM and RBM chassis are still operating. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequencies are based upon operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO. (continued) Brunswick Unit 2 B 3.3.1.1-30 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES SR 3.3.1.1.3 To ensure that the APRMs are accurately indicating the true core average power, the APRMs are adjusted to conform to the reactor power calculated from a heat balance. The Frequency of once per 7 days is based on minor changes in LPRM sensitivity, which could affect the APRM reading between performances of SR 3.3.1.1.8. A restriction to satisfying this SR when < 23% RTP is provided that requires the SR to be met only at 23% RTP because it is difficult to accurately maintain APRM indication of core THERMAL POWER consistent with a heat balance when < 23% RTP. At low power levels, a high degree of accuracy is unnecessary because of the large, inherent margin to thermal limits (MCPR and APLHGR). At 23% RTP, the Surveillance is required to have been satisfactorily performed within the last 7 days, in accordance with SR 3.0.2. A Note is provided which allows an increase in THERMAL POWER above 23% if the 7 day Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours after reaching or exceeding 23% RTP. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR. SR 3.3.1.1.4 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. As noted, SR 3.3.1.1.4 is not required to be performed when entering MODE 2 from MODE 1, since testing of the MODE 2 required IRM and APRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This allows entry into MODE 2 if the 7 day Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours after entering MODE 2 from MODE 1. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR. A Frequency of 7 days provides an acceptable level of system average unavailability over the Frequency interval and is based on reliability analysis (Ref. 11). (continued) Brunswick Unit 2 B 3.3.1.1-31 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.5 REQUIREMENTS (continued) There are four pairs of RPS automatic scram contactors with each pair associated with an RPS scram test switch. Each pair of scram contactors is associated with an automatic scram logic channel (A1, A2, B1, and B2). The automatic scram contactors can be functionally tested without the necessity of using a scram function trip. Surveillance Frequency extensions for RPS Functions, described in Reference 11, are allowed provided the automatic scram contactors are functionally tested weekly. This functional test is accomplished by placing the associated RPS scram test switch in the trip position, which will deenergize a pair of RPS automatic scram contactors thereby tripping the associated RPS logic channel. The RPS scram test switches were not specifically credited in the accident analysis. However, because the Manual Scram Functions at BNP were not configured the same as the generic model in Reference 11, the RPS scram test switches were evaluated in Reference 12. Reference 12 concluded that the Frequency extensions for RPS Functions are not affected by the difference in RPS configuration since each automatic RPS channel has a test switch which is functionally the same as the manual scram switches in the generic model. As such, a functional test of each automatic scram contactor is required to be performed every 7 days. The Frequency of 7 days is based on the reliability analysis of Reference 12. SR 3.3.1.1.6 and SR 3.3.1.1.7 These Surveillances are established to ensure that no gaps in neutron flux indication exist from subcritical to power operation for monitoring core reactivity status. The overlap between SRMs and IRMs is required to be demonstrated to ensure that reactor power will not be increased into a neutron flux region without adequate indication. This is required prior to withdrawing SRMs from the fully inserted position since indication is being transitioned from the SRMs to the IRMs. The overlap between IRMs and APRMs is of concern when reducing power into the IRM range. On power increases, the system design will prevent further increases (by initiating a rod block) if adequate overlap is not maintained. Overlap between IRMs and APRMs exists when sufficient IRMs and APRMs concurrently have onscale readings such that (continued) Brunswick Unit 2 B 3.3.1.1-32 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES the transition between MODE 1 and MODE 2 can be made without either APRM downscale rod block, or IRM upscale rod block. Overlap between SRMs and IRMs similarly exists when, prior to withdrawing the SRMs from the fully inserted position, IRM readings have doubled before the SRMs have reached the high-high upscale trip. As noted, SR 3.3.1.1.7 is only required to be met during entry into MODE 2 from MODE 1. That is, after the overlap requirement has been met and indication has transitioned to the IRMs, maintaining overlap is not required (APRMs may be reading downscale once in MODE 2). If overlap for a group of channels is not demonstrated (e.g., IRM/APRM overlap), the reason for the failure of the Surveillance should be determined and the appropriate channel(s) declared inoperable. Only those appropriate channels that are required in the current MODE or condition should be declared inoperable. A Frequency of 7 days is reasonable based on engineering judgment and the reliability of the IRMs and APRMs. SR 3.3.1.1.8 LPRM gain settings are determined from the local flux profiles measured by the Traversing Incore Probe (TIP) System. This establishes the relative local flux profile for appropriate representative input to the APRM System. The calibration interval of 2000 effective full power hours (EFPH) is related to the current licensed core thermal power in that it should be adjusted in inverse proportion to increases in licensed rated core thermal power so that core average detector fluence accumulated during the calibration interval remains essentially unchanged. The 2000 EFPH Frequency is based on LPRM operating experience and that the LPRM detector uncertainty remains less than that used to determine power distribution uncertainty applied in the calculation of the Safety Limit Minimum Critical Power Ratio (SLMCPR), as shown in Reference 23. SR 3.3.1.1.9 and SR 3.3.1.1.12 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The 92 day Frequency of SR 3.3.1.1.9 is based on the reliability analysis of Reference 11. (continued) Brunswick Unit 2 B 3.3.1.1-33 Revision No. 69

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.9 and SR 3.3.1.1.12 (continued) REQUIREMENTS The 24 month Frequency of SR 3.3.1.1.12 is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the 24 month Frequency. SR 3.3.1.1.10 Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.1.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology. The Frequency of 92 days is based on the reliability analysis of Reference 11. SR 3.3.1.1.11 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. For the APRM Functions, this test supplements the automatic self-test functions that operate continuously in the APRM and voter channels. The scope of the APRM CHANNEL FUNCTIONAL TEST is that which is necessary to test the hardware. Software controlled functions are tested only incidentally. Automatic self-test functions check the EPROMs in which the software-controlled logic is defined. Changes in the EPROMs will be detected by the self-test function and alarmed via the APRM trouble alarm. SR 3.3.1.1.2 for the APRM functions includes a step to confirm that the automatic self-test function is still operating. (continued) Brunswick Unit 2 B 3.3.1.1-34 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.11 (continued) REQUIREMENTS The APRM CHANNEL FUNCTIONAL TEST covers the APRM channels (including recirculation flow processing - applicable to Function 2.b and the auto-enable portion of Function 2.f only), the 2-Out-Of-4 Voter channels, and the interface connections into the RPS trip systems from the voter channels. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The 184-day Frequency of SR 3.3.1.1.11 is based on the reliability analyses of References 15 and 16. (NOTE: The actual voting logic of the 2-Out-Of-4 Voter Function is tested as part of SR 3.3.1.1.15. The auto-enable setpoints for the OPRM Upscale trip are confirmed by SR 3.3.1.1.19.) A Note is provided for Function 2.a that requires this SR to be performed within 12 hours of entering MODE 2 from MODE 1. Testing of the MODE 2 APRM Function cannot be performed in MODE 1 without utilizing jumpers or lifted leads. This Note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR 3.0.2. A second Note is provided for Functions 2.b and 2.f that clarifies that the CHANNEL FUNCTIONAL TEST for Functions 2.b and 2.f includes testing of the recirculation flow processing electronics, excluding the flow transmitters. SR 3.3.1.1.13 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The CHANNEL CALIBRATION for Functions 5 and 8 should consist of a physical inspection and actuation of the associated position switches. Note 1 states that neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal. Changes in neutron detector sensitivity are compensated for by performing the 7 day (continued) Brunswick Unit 2 B 3.3.1.1-35 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.13 (continued) REQUIREMENTS calorimetric calibration (SR 3.3.1.1.3) and the 2000 EFPH LPRM calibration against the TIPs (SR 3.3.1.1.8). A second Note is provided that requires the APRM and IRM SRs to be performed within 12 hours of entering MODE 2 from MODE 1. Testing of the MODE 2 APRM and IRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This Note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR 3.0.2. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR. A third note is provided that requires that the recirculation flow (drive flow) transmitters, which supply the flow signal to the APRMs, be included in the SR for Functions 2.b and 2.f. The APRM Simulated Thermal Power High Function (Function 2.b) and the OPRM Upscale Function (Function 2.f) both require a valid drive flow signal. The APRM Simulated Thermal PowerHigh Function uses drive flow to automatically enable or bypass the OPRM Upscale trip output to RPS. A CHANNEL CALIBRATION of the APRM drive flow signal requires both calibrating the drive flow transmitters and the processing hardware in the APRM equipment. SR 3.3.1.1.18 establishes a valid drive flow/core flow relationship. Changes throughout the cycle in the drive flow/core flow relationship due to the changing thermal hydraulic operating conditions of the core are accounted for in the margins included in the bases or analyses used to establish the setpoints for the APRM Simulated Thermal PowerHigh Function and the OPRM Upscale Function. The Frequency of SR 3.3.1.1.13 is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. SR 3.3.1.1.14 (Not used.) (continued) Brunswick Unit 2 B 3.3.1.1-36 Revision No. 69

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.15 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic and simulated automatic operation for a specific channel. The functional testing of control rods (LCO 3.1.3), and SDV vent and drain valves (LCO 3.1.8), overlaps this Surveillance to provide complete testing of the assumed safety function. The LOGIC SYSTEM FUNCTIONAL TEST for APRM Function 2.e simulates APRM and OPRM trip conditions at the 2-Out-Of-4 Voter channel inputs to check all combinations of two tripped inputs to the 2-Out-Of-4 logic in the voter channels and APRM related redundant RPS relays. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the 24 month Frequency. SR 3.3.1.1.16 This SR ensures that scrams initiated from the Turbine Stop Valve Closure and Turbine Control Valve Fast Closure, Control Oil Pressure Low Functions will not be inadvertently bypassed when THERMAL POWER is 26% RTP. This is satisfied by calibration of the bypass channels. Adequate margins for the instrument setpoint methodologies are incorporated into the Allowable Value and the actual setpoint. Because main turbine bypass flow can affect this setpoint nonconservatively (THERMAL POWER is derived from turbine first stage pressure), the main turbine bypass valves must remain closed during an in-service calibration at THERMAL POWER 26% RTP to ensure that the calibration is valid. If any bypass channel setpoint is nonconservative (i.e., the Functions are bypassed at 26% RTP, either due to open main turbine bypass valve(s) or other reasons), then the affected Turbine Stop ValveClosure and Turbine Control Valve Fast Closure, Control Oil PressureLow Functions are considered inoperable. Alternatively, the bypass channel can be placed in the conservative condition (non-bypass). If placed in the (continued) Brunswick Unit 2 B 3.3.1.1-37 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.16 (continued) REQUIREMENTS non-bypass condition, this SR is met and the channel is considered OPERABLE. The Frequency of 24 months is based on engineering judgment and reliability of the components. SR 3.3.1.1.17 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. This test may be performed in one measurement or in overlapping segments, with verification that all components are tested. The RPS RESPONSE TIME acceptance criteria are included in Reference 13. RPS RESPONSE TIME for the APRM 2-Out-Of-4 Voter Function (2.e) includes the output relays of the voter and the associated RPS relays and contactors. (The digital portion of the APRM and 2-Out-Of-4 Voter channels are excluded from RPS RESPONSE TIME testing because self-testing and calibration checks the time base of the digital electronics. Confirmation of the time base is adequate to assure required response times are met. Neutron detectors are excluded from RPS RESPONSE TIME testing because the principles of detector operation virtually ensure an instantaneous response time.) Note 2 states the response time of the sensors for Functions 3 and 4 may be assumed in the RPS RESPONSE TIME test to be the design sensor response time. This is allowed since the sensor response time is a small part of the overall RPS RESPONSE TIME (Ref. 14). RPS RESPONSE TIME tests are conducted on a 24 month STAGGERED TEST BASIS. Note 3 requires STAGGERED TEST BASIS Frequency to be determined based on 4 channels per trip system, in lieu of the 8 channels specified in Table 3.3.1.1-1 for the MSIV Closure Function. This Frequency is based on the logic interrelationships of the various channels required to produce an RPS scram signal. (continued) Brunswick Unit 2 B 3.3.1.1-38 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.17 (continued) REQUIREMENTS Note 4 allows the STAGGERED TEST BASIS Frequency for Function 2.e to be determined based on 8 channels rather than the 4 actual 2-Out-Of-4 Voter channels. The redundant outputs from the 2-Out-Of-4 Voter channel (2 for APRM trips and 2 for OPRM trips) are considered part of the same channel, but the OPRM and APRM outputs are considered to be separate channels for application of SR 3.3.1.1.17, so n = 8. The note further requires that testing of OPRM and APRM outputs be alternated. The testing sequence shown in the table below is one sequence that satisfies these requirements. Function 2.e Testing Sequence for SR 3.3.1.1.17 24- Voter Channel Month Cycle A1 A2 B1 B2 OPRM APRM OPRM APRM OPRM APRM OPRM APRM 1st X nd 2 X rd 3 X 4th X 5th X 6th X 7th X th 8 X Each test of an OPRM or APRM output tests each of the redundant outputs from the 2-Out-Of-4 Voter channel for that Function, and each of the corresponding relays in the RPS. Consequently, each of the RPS relays is tested every fourth cycle. This testing frequency is twice the frequency justified by References 15 and 16. (continued) Brunswick Unit 2 B 3.3.1.1-39 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.17 (continued) REQUIREMENTS The 24 month Frequency is consistent with the BNP refueling cycle and is based upon plant operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences. SR 3.3.1.1.18 The APRM Simulated Thermal PowerHigh Function (Function 2.b) uses drive flow to vary the trip setpoint. The OPRM Upscale Function (Function 2.f) uses drive flow to automatically enable or bypass the OPRM Upscale trip output to RPS. Both of these Functions use drive flow as a representation of reactor core flow. SR 3.3.1.1.13 assures that the drive flow transmitters and processing electronics are calibrated. This SR adjusts the recirculation drive flow scaling factors in each APRM channel to provide the appropriate drive flow/core flow alignment. The Frequency of once within 7 days after reaching equilibrium conditions following a refueling outage is based on the expectation that any change in the core flow to drive flow functional relationship during power operation would be gradual and the maintenance on the Recirculation System and core components which may impact the relationship is expected to be performed during refueling outages. The 7 day time period after reaching equilibrium conditions is based on plant conditions required to perform the test, engineering judgment of the time required to collect and analyze the necessary flow data, and engineering judgment of the time required to enter and check the applicable scaling factors in each of the APRM channels. The 7-day time period after reaching equilibrium conditions is acceptable based on the relatively small alignment errors expected, and the margins already included in the APRM Simulated Thermal Power High and OPRM Upscale Function trip-enable setpoints. (continued) Brunswick Unit 2 B 3.3.1.1-40 Revision No. 30

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.19 (continued) REQUIREMENTS APRM Simulated Thermal Power and recirculation drive flow. Other surveillances ensure that the APRM Simulated Thermal Power and recirculation drive flow properly correlate with THERMAL POWER (SR 3.3.1.1.3) and core flow (SR 3.3.1.1.18), respectively. In any auto-enable setpoint is nonconservative (i.e, the OPRM Upscale trip is bypassed when APRM Simulated Thermal Power 25% and recirculation drive flow 60%), then the affected channel is considered inoperable for the OPRM Upscale Function. Alternatively, the OPRM Upscale trip auto-enable setpoint(s) may be adjusted to place the channel in a conservative condition (not bypassed). If the OPRM Upscale trip is placed in the not-bypassed condition, this SR is met and the channel is considered OPERABLE. The Frequency of 24 months is based on engineering judgment and reliability of the components. REFERENCES 1. UFSAR, Section 7.2.

2. UFSAR, Chapter 15.0.

3. UFSAR, Section 7.2.2.

4. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, September 1995.

5. 10 CFR 50.36(c)(2)(ii).

6. NEDO-23842, Continuous Control Rod Withdrawal in the Startup Range, April 18, 1978.

7. UFSAR, Section 5.2.2.

8. UFSAR, Appendix 5A.

9. UFSAR, Section 6.3.1.

(continued) Brunswick Unit 2 B 3.3.1.1-41 Revision No. 33

RPS Instrumentation B 3.3.1.1 BASES REFERENCES 10. P. Check (NRC) letter to G. Lainas (NRC), BWR Scram Discharge (continued) System Safety Evaluation, December 1, 1980.

11. NEDC-30851-P-A, Technical Specification Improvement Analyses for BWR Reactor Protection System, March 1988.

12. MDE-81-0485, Technical Specification Improvement Analysis for the Reactor Protection System for Brunswick Steam Electric Plant, Units 1 and 2, April 1985.

13. UFSAR, Table 7-4.

14. NEDO-32291-A, System Analyses for the Elimination of Selected Response Time Testing Requirements, October 1995.

15. NEDC-32410P-A, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option III Stability Trip Function, October 1995.

16. NEDC-32410P-A, Supplement 1, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM)

Retrofit Plus Option III Stability Trip Function, November 1997.

17. NEDO-31960-A, BWR Owners' Group Long-Term Stability Solutions Licensing Methodology, November 1995.

18. NEDO-31960-A, Supplement 1, BWR Owners' Group Long-Term Stability Solutions Licensing Methodology, November 1995.

19. NEDO-32465-A, BWR Owners' Group Long-Term Stability Detect and Suppress Solutions Licensing Basis Methodology and Reload Applications, August 1996.

20. Letter, L. A. England (BWROG) to M. J. Virgilio, BWR Owners' Group Guidelines for Stability Interim Corrective Action, June 6, 1994.

21. BWROG Letter 96113, K. P. Donovan (BWROG) to L. E. Phillips (NRC), Guidelines for Stability Option III "Enable Region" (TAC M92882), September 17, 1996.

(continued) Brunswick Unit 2 B 3.3.1.1-42 Revision No. 33

RPS Instrumentation B 3.3.1.1 BASES REFERENCES 22. General Electric Nuclear Energy Letter NSA 01-212, (continued) DRF C51-00251-00, A. Chung (GE) to S. Chakraborty (GE),

                    "Minimum Number of Operable OPRM Cells for Option III Stability at Brunswick 1 and 2," June 8, 2001.

23. Calculation 0B21-1305, Core Monitoring LPRM Uncertainty and Sensitivity Decay.

Brunswick Unit 2 B 3.3.1.1-43 Revision No. 69

SRM Instrumentation B 3.3.1.2 B 3.3 INSTRUMENTATION B 3.3.1.2 Source Range Monitor (SRM) Instrumentation BASES BACKGROUND The SRMs provide the operator with information relative to the neutron flux level at very low flux levels in the core. As such, the SRM indication is used by the operator to monitor the approach to criticality and determine when criticality is achieved. The SRMs are maintained fully inserted until the count rate is greater than a minimum allowed count rate (a control rod block is set at this condition). After SRM to intermediate range monitor (IRM) overlap is demonstrated (as required by SR 3.3.1.1.6) and the IRMs are on Range 3, the SRMs are normally fully withdrawn from the core. The SRM subsystem of the Neutron Monitoring System (NMS) consists of four channels. Each of the SRM channels can be bypassed, but only one at any given time, by the operation of a bypass switch. Each channel includes one detector that can be physically positioned in the core. Each detector assembly consists of a miniature fission chamber with associated cabling, signal conditioning equipment, and electronics associated with the various SRM functions. The signal conditioning equipment converts the current pulses from the fission chamber to analog DC currents that correspond to the count rate. Each channel also includes indication, alarm, and control rod blocks. However, this LCO specifies OPERABILITY requirements only for the monitoring and indication functions of the SRMs. During refueling, shutdown, and low power operations, the primary indication of neutron flux levels is provided by the SRMs or special movable detectors connected to the normal SRM circuits. The SRMs provide monitoring of reactivity changes during fuel or control rod movement and give the control room operator early indication of unexpected subcritical multiplication that could be indicative of an approach to criticality. (continued) Brunswick Unit 2 B 3.3.1.2-1 Revision No. 30

SRM Instrumentation B 3.3.1.2 BASES (continued) APPLICABLE Prevention and mitigation of prompt reactivity excursions during SAFETY ANALYSES refueling and low power operation is provided by LCO 3.9.1, "Refueling Equipment Interlocks"; LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"; LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"; IRM Neutron FluxHigh and Average Power Range Monitor (APRM) Neutron FluxHigh (Setdown) Functions; and LCO 3.3.2.1, "Control Rod Block Instrumentation." The SRMs have no safety function and are not assumed to function during any UFSAR design basis accident or transient analysis. However, the SRMs provide the only on scale monitoring of neutron flux levels during refueling, shutdown, and low power operation (Mode 2 prior to SRM/IRM overlap). Therefore, they are being retained in Technical Specifications. LCO During startup in MODE 2, three of the four SRM channels are required to be OPERABLE to monitor the reactor flux level prior to and during control rod withdrawal, subcritical multiplication and reactor criticality, and neutron flux level and reactor period until the flux level is sufficient to maintain the IRM on Range 3 or above. All but one of the channels are required in order to provide a representation of the overall core response during those periods when reactivity changes are occurring throughout the core. In MODES 3 and 4, with the reactor shut down, two SRM channels provide redundant monitoring of flux levels in the core. In MODE 5, two SRMs are required to be OPERABLE to provide redundant monitoring of reactivity changes occurring in the reactor core. Because of the local nature of reactivity changes during refueling, adequate coverage is provided by requiring one SRM to be OPERABLE in the quadrant of the reactor core where CORE ALTERATIONS are being performed, and the other SRM to be OPERABLE in an adjacent quadrant containing fuel. These requirements ensure that the reactivity of the core will be continuously monitored during CORE ALTERATIONS. Special movable detectors, according to footnote (b) of Table 3.3.1.2-1, may be used in MODE 5 in place of the normal SRM nuclear detectors. These special detectors must be connected to the normal SRM circuits in the NMS, such that the applicable neutron flux indication can be (continued) Brunswick Unit 2 B 3.3.1.2-2 Revision No. 57

SRM Instrumentation B 3.3.1.2 BASES LCO generated. These special detectors provide more flexibility in monitoring (continued) reactivity changes during fuel loading, since they can be positioned anywhere within the core during refueling. They must still meet the location requirements of SR 3.3.1.2.2 and all other required SRs for SRMs. For an SRM channel to be considered OPERABLE, it must be providing continuous neutron flux monitoring indication in the control room. APPLICABILITY The SRMs are required to be OPERABLE in MODE 2 prior to the IRMs being on scale on Range 3, and MODES 3, 4, and 5 to provide for neutron monitoring. In MODE 1, the APRMs provide adequate monitoring of reactivity changes in the core; therefore, the SRMs are not required. In MODE 2, with IRMs on Range 3 or above, the IRMs provide adequate monitoring and the SRMs are not required. ACTIONS A.1 and B.1 In MODE 2, with the IRMs on Range 2 or below, SRMs provide the means of monitoring core reactivity and criticality. With any number of the required SRMs inoperable, the ability to monitor neutron flux is degraded. Therefore, a limited time is allowed to restore the inoperable channels to OPERABLE status. Provided at least one SRM remains OPERABLE, Required Action A.1 allows 4 hours to restore the required SRMs to OPERABLE status. This time is reasonable because there is adequate capability remaining to monitor the core, there is limited risk of an event during this time, and there is sufficient time to take corrective actions to restore the required SRMs to OPERABLE status or to establish alternate IRM monitoring capability. During this time, control rod withdrawal and power increase is not precluded by this Required Action. Having the ability to monitor the core with at least one SRM, proceeding to IRM Range 3 or greater (with overlap required by SR 3.3.1.1.6), and thereby exiting the Applicability of this LCO, is acceptable for ensuring adequate core monitoring and allowing continued operation. (continued) Brunswick Unit 2 B 3.3.1.2-3 Revision No. 30

SRM Instrumentation B 3.3.1.2 BASES ACTIONS A.1 and B.1 (continued) With three required SRMs inoperable, Required Action B.1 allows no positive changes in reactivity (control rod withdrawal must be immediately suspended) due to inability to monitor the changes. Required Action A.1 still applies and allows 4 hours to restore monitoring capability prior to requiring control rod insertion. This allowance is based on the limited risk of an event during this time, provided that no control rod withdrawals are allowed, and the desire to concentrate efforts on repair, rather than to immediately shut down, with no SRMs OPERABLE. C.1 In MODE 2, if the required number of SRMs is not restored to OPERABLE status within the allowed Completion Time, the reactor shall be placed in MODE 3. With all control rods fully inserted, the core is in its least reactive state with the most margin to criticality. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. D.1 and D.2 With one or more required SRMs inoperable in MODE 3 or 4, the neutron flux monitoring capability is degraded or nonexistent. The requirement to fully insert all insertable control rods ensures that the reactor will be at its minimum reactivity level while no neutron monitoring capability is available. Placing the reactor mode switch in the shutdown position prevents subsequent control rod withdrawal by maintaining a control rod block. The allowed Completion Time of 1 hour is sufficient to accomplish the Required Action, and takes into account the low probability of an event requiring the SRM occurring during this interval. E.1 and E.2 With one or more required SRMs inoperable in MODE 5, the ability to detect local reactivity changes in the core during refueling is degraded. (continued) Brunswick Unit 2 B 3.3.1.2-4 Revision No. 30

SRM Instrumentation B 3.3.1.2 BASES ACTIONS E.1 and E.2 (continued) CORE ALTERATIONS must be immediately suspended and action must be immediately initiated to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Suspending CORE ALTERATIONS prevents the two most probable causes of reactivity changes, fuel loading and control rod withdrawal, from occurring. Inserting all insertable control rods ensures that the reactor will be at its minimum reactivity given that fuel is present in the core. Suspension of CORE ALTERATIONS shall not preclude completion of the movement of a component to a safe, conservative position. Action (once required to be initiated) to insert control rods must continue until all insertable rods in core cells containing one or more fuel assemblies are inserted. SURVEILLANCE As noted at the beginning of the SRs, the SRs for each SRM REQUIREMENTS Applicable MODE or other specified condition are found in the SRs column of Table 3.3.1.2-1. SR 3.3.1.2.1 and SR 3.3.1.2.3 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on another channel. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. (continued) Brunswick Unit 2 B 3.3.1.2-5 Revision No. 30

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.1 and SR 3.3.1.2.3 (continued) REQUIREMENTS The Frequency of once every 12 hours for SR 3.3.1.2.1 is based on operating experience that demonstrates channel failure is rare. While in MODES 3 and 4, reactivity changes are not expected; therefore, the 12 hour Frequency is relaxed to 24 hours for SR 3.3.1.2.3. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO. SR 3.3.1.2.2 To provide adequate coverage of potential reactivity changes in the core, one SRM is required to be OPERABLE in the quadrant where CORE ALTERATIONS are being performed, and the other OPERABLE SRM must be in an adjacent quadrant containing fuel. Note 1 states that the SR is required to be met only during CORE ALTERATIONS. It is not required to be met at other times in MODE 5 since core reactivity changes are not occurring. This Surveillance consists of a review of plant logs to ensure that SRMs required to be OPERABLE for given CORE ALTERATIONS are, in fact, OPERABLE. Note 2 clarifies that more than one of the three requirements can be met by the same OPERABLE SRM. The 12 hour Frequency is based upon operating experience and supplements operational controls over refueling activities that include steps to ensure that the SRMs required by the LCO are in the proper quadrant. SR 3.3.1.2.4 This Surveillance consists of a verification of the SRM instrument readout to ensure that the SRM reading is greater than a specified minimum count rate with the detector inserted to the normal operating level, which ensures that the detectors are indicating count rates indicative of neutron flux levels within the core. With few fuel assemblies loaded, the SRMs will not have a high enough count rate to satisfy the SR. Therefore, allowances are made for loading sufficient "source" material, in the form of irradiated fuel assemblies, to establish the minimum count rate. (continued) Brunswick Unit 2 B 3.3.1.2-6 Revision No. 30

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.4 (continued) REQUIREMENTS To accomplish this, the SR is modified by Note 1 that states that the count rate is not required to be met on an SRM that has less than or equal to four fuel assemblies adjacent to the SRM and no other fuel assemblies are in the associated core quadrant. With four or less fuel assemblies loaded around each SRM and no other fuel assemblies in the associated core quadrant, even with a control rod withdrawn, the configuration will not be critical. In addition, Note 2 states that this requirement does not have to be met during a core spiral offload. A core spiral offload encompasses offloading a cell on the edge of a continuous fueled region (the core cell can be offloaded in any sequence). If the core is being unloaded in this manner, the various core configurations encountered will not be critical. The Frequency is based upon channel redundancy and other information available in the control room, and ensures that the required channels are frequently monitored while core reactivity changes are occurring. When no reactivity changes are in progress, the Frequency is relaxed from 12 hours to 24 hours. SR 3.3.1.2.5 and SR 3.3.1.2.6 Performance of a CHANNEL FUNCTIONAL TEST demonstrates the associated channel will function properly. SR 3.3.1.2.5 is required in MODE 5, and the 7 day Frequency ensures that the channels are OPERABLE while core reactivity changes could be in progress. This Frequency is reasonable, based on operating experience and on other Surveillances (such as a CHANNEL CHECK), that ensure proper functioning between CHANNEL FUNCTIONAL TESTS. SR 3.3.1.2.6 is required to be met in MODE 2 with IRMs on Range 2 or below, and in MODES 3 and 4. Since core reactivity changes do not normally take place in MODES 3 and 4 and core reactivity changes are due only to control rod movement in MODE 2, the Frequency is extended from 7 days to 31 days. The 31 day Frequency is based on operating experience and on other Surveillances (such as CHANNEL CHECK) that ensure proper functioning between CHANNEL FUNCTIONAL TESTS. (continued) Brunswick Unit 2 B 3.3.1.2-7 Revision No. 30

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.5 and SR 3.3.1.2.6 (continued) REQUIREMENTS The Note to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability (THERMAL POWER decreased to IRM Range 2 or below). The SR must be performed within 12 hours after IRMs are on Range 2 or below. The allowance to enter the Applicability with the 31 day Frequency not met is reasonable, based on the limited time of 12 hours allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels. Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour Frequency is reasonable, based on the SRMs being otherwise verified to be OPERABLE (i.e., satisfactorily performing the CHANNEL CHECK) and the time required to perform the Surveillances. SR 3.3.1.2.7 Performance of a CHANNEL CALIBRATION at a Frequency of 24 months verifies the performance of the SRM detectors and associated circuitry. The Frequency considers the plant conditions required to perform the test, the ease of performing the test, and the likelihood of a change in the system or component status. The neutron detectors are excluded from the CHANNEL CALIBRATION (Note 1) because they cannot readily be adjusted. The detectors are fission chambers that are designed to have a relatively constant sensitivity over the range and with an accuracy specified for a fixed useful life. Note 2 to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability. The SR must be performed in MODE 2 within 12 hours of entering MODE 2 with IRMs on Range 2 or below. The allowance to enter the Applicability with the 24 month Frequency not met is reasonable, based on the limited time of 12 hours allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels. Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour Frequency is reasonable, based on the SRMs (continued) Brunswick Unit 2 B 3.3.1.2-8 Revision No. 30

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.7 (continued) REQUIREMENTS being otherwise verified to be OPERABLE (i.e., satisfactorily performing the CHANNEL CHECK) and the time required to perform the Surveillances. REFERENCES None. Brunswick Unit 2 B 3.3.1.2-9 Revision No. 30

Control Rod Block Instrumentation B 3.3.2.1 B 3.3 INSTRUMENTATION B 3.3.2.1 Control Rod Block Instrumentation BASES BACKGROUND Control rods provide the primary means for control of reactivity changes. Control rod block instrumentation includes channel sensors, logic circuitry, switches, and relays that are designed to ensure that specified fuel design limits are not exceeded for postulated transients and accidents. During high power operation, the rod block monitor (RBM) provides protection for control rod withdrawal error events. During low power operations, control rod blocks from the rod worth minimizer (RWM) enforce specific control rod sequences designed to mitigate the consequences of the control rod drop accident (CRDA). During shutdown conditions, control rod blocks from the Reactor Mode SwitchShutdown Position Function ensure that all control rods remain inserted to prevent inadvertent criticalities. The purpose of the RBM is to limit control rod withdrawal if localized neutron flux exceeds a predetermined setpoint during control rod manipulations. It is assumed to function to block further control rod withdrawal to preclude a MCPR Safety Limit (SL) violation. The RBM supplies a trip signal to the Reactor Manual Control System (RMCS) to appropriately inhibit control rod withdrawal during power operation above the low power range setpoint specified in the COLR. The RBM has two channels, either of which can initiate a control rod block when the channel output exceeds the control rod block setpoint. One RBM channel inputs into one RMCS rod block circuit and the other RBM channel inputs into the second RMCS rod block circuit. The RBM channel signal is generated by averaging a set of local power range monitor (LPRM) signals at various core heights surrounding the control rod being withdrawn. A simulated thermal power signal from one of the four redundant average power range monitor (APRM) channels supplies a reference signal for one of the RBM channels and a simulated thermal power signal from another of the APRM channels supplies the reference signal to the second RBM channel. This reference signal is used to determine which RBM range setpoint (low, intermediate, or high) is enabled. If the APRM Simulated Thermal Power is indicating less than the low power range setpoint, the RBM is automatically bypassed. The RBM is also automatically bypassed if a peripheral control rod is selected (Ref. 1). (continued) Brunswick Unit 2 B 3.3.2.1-1 Revision No. 30

Control Rod Block Instrumentation B 3.3.2.1 BASES BACKGROUND A rod block signal is also generated if an RBM downscale trip or an (continued) inoperable trip occurs, since this could indicate a problem with the RBM channel. The inoperable trip will occur if during the nulling (normalization) sequence, if the RBM channel fails to null or too few LPRM inputs are available, if a critical self-test fault has been detected, or the RBM instrument mode switch is moved to any position other than "Operate." The purpose of the RWM is to control rod patterns during startup and shutdown, such that only specified control rod sequences and relative positions are allowed over the operating range from all control rods inserted to 8.75% RTP. The sequences effectively limit the potential amount and rate of reactivity increase during a CRDA. Prescribed control rod sequences are stored in the RWM, which will initiate control rod withdrawal and insert blocks when the actual sequence deviates beyond allowances from the stored sequence. The RWM determines the actual sequence based position indication for each control rod. The RWM also uses steam flow signals to determine when the reactor power is above the preset power level at which the RWM is automatically bypassed. The RWM is a single channel system that provides input into the RMCS rod withdraw permissive circuit. With the reactor mode switch in the shutdown position, a control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained. This Function prevents inadvertent criticality as the result of a control rod withdrawal during MODE 3 or 4, or during MODE 5 when the reactor mode switch is required to be in the shutdown position. The reactor mode switch has two channels, each inputting into a separate RMCS rod block circuit. A rod block in either RMCS circuit will provide a control rod block to all control rods. APPLICABLE 1. Rod Block Monitor SAFETY ANALYSES, LCO, and The RBM is designed to prevent violation of the MCPR SL and the APPLICABILITY cladding 1% plastic strain fuel design limit that may result from a single control rod withdrawal error (RWE) event. The analytical methods and assumptions used in evaluating the RWE event are summarized in References 11 and 12. A statistical analysis of RWE events was performed to determine the RBM response for both channels for each event. From these responses, the fuel thermal performance as a function of RBM Allowable Value was determined. The Allowable Values are chosen as a function of power level. Based on the specified Allowable Values, operating limits are established. With AREVA methods (References 11 and 12), cycle specific analyses are performed to establish MCPR limits and RBM setpoints considering allowed combinations of out of service LPRM instruments feeding the RBM channels, and assuming one RBM channel out of service. (continued) Brunswick Unit 2 B 3.3.2.1-2 Revision No. 62

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE 1. Rod Block Monitor (continued) SAFETY ANALYSES, LCO, and The RBM Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). APPLICABILITY Two channels of the RBM are required to be OPERABLE, with their setpoints within the appropriate Allowable Value for the associated power range, to ensure that no single instrument failure can preclude a rod block from this Function. The actual setpoints are calibrated consistent with applicable setpoint methodology. Trip setpoints are specified in the setpoint calculations. The setpoints are selected to ensure that the trip settings do not exceed the Allowable Values between successive CHANNEL CALIBRATIONS. Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setting is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter the calculated RBM flux (RBM channel signal). When the RBM flux value exceeds the applicable setpoint, the RBM provides a trip output. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint value, by accounting for calibration based errors. These calibration based instrument errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of LPRM input processing in the average power range monitor (APRM) equipment. The RBM performs only digital calculations on digitized LPRM signals received from the APRM equipment. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation (continued) Brunswick Unit 2 B 3.3.2.1-3 Revision No. 62

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE 1. Rod Block Monitor (continued) SAFETY ANALYSES, LCO, and uncertainties, process effects, calibration tolerances, instrument drift, and APPLICABILITY environment errors are accounted for and appropriately applied for the instrumentation. The RBM is assumed to mitigate the consequences of an RWE event when operating 29% RTP. Analyses demonstrate that below this power level the consequences of an RWE event will not exceed the MCPR SL and, therefore, the RBM is not required to be OPERABLE. Cycle specific analyses with Reference 11 and 12 methods are performed to establish an initial MCPR value above which the occurrence of an RWE event will not result in exceeding the MCPR SL while operating < 90% RTP. Cycle specific analyses are also performed to demonstrate that with MCPR greater than or equal to a specified value, no RWE event will result in exceeding the MCPR SL when operating 90% RTP. The MCPR values for both < 90% RTP and 90% RTP are provided in the COLR. Under the conditions of RTP and MCPR specified in the COLR, the RBM is not required be OPERABLE. The RBM selects one of three different RBM flux trip setpoints to be applied based on the current value of THERMAL POWER. THERMAL POWER is indicated to each RBM channel by a simulated thermal power (STP) reference signal input from an associated reference APRM channel. The OPERABLE range is divided into three "power ranges," a "low power range," an "intermediate power range," and a "high power range." The RBM flux trip setpoint applied within each of these three power ranges is, respectively, the "low trip setpoint," the "intermediate trip setpoint," and the "high trip setpoint" (Allowable Values for which are defined in the COLR). To determine the current power range, each RBM channel compares its current STP input value to three power setpoints, the "low power setpoint" (29%), the "intermediate power setpoint" (current value defined in the COLR), and the "high power setpoint" (current value defined in the COLR), which define, respectively, the lower limit of the low power range, the lower limit of the intermediate power range, and the lower limit of the high power range. The trip setpoint applicable for each power range is more restrictive than the corresponding setpoint for the lower power range(s). When STP is below the low power setpoint, the RBM flux trip outputs are automatically bypassed but the low trip setpoint continues to be applied to indicate the RBM flux setpoint on the NUMAC RBM displays. (continued) Brunswick Unit 2 B 3.3.2.1-4 Revision No. 62

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE 1. Rod Block Monitor (continued) SAFETY ANALYSES, LCO, and The calculated (required) setpoints and applicable power ranges are APPLICABILITY bounding values. In the equipment implementation, it is necessary to apply a "deadband" to each setpoint. The deadband is applied to the RBM trip setpoint selection logic and the RBM trip automatic bypass logic such that the setpoint being applied is always equal to or more conservative than the required setpoint. Since the RBM flux trip setpoint applicable to the higher power ranges are more conservative than the corresponding trip setpoints for lower power ranges, the trip setpoint applicable to the higher power range (high power range or intermediate power range) continues to be applied when STP decreases below the lower limit of that range until STP is below the power range setpoint by a value exceeding the deadband. Similarly, when STP decreases below the low power setpoint, the automatic bypass of RBM flux trip outputs will not be applied until STP decreases below the trip setpoint by a value exceeding the deadband. The RBM channel uses THERMAL POWER, as represented by the STP input value from its reference APRM channel, to automatically enable RBM flux trip outputs (remove the automatic bypass) and to select the RBM flux trip setpoint to be applied. However, the RBM Upscale function is only required to be OPERABLE when the MCPR values are less than the values specified in the COLR. Therefore, even though the RBM Upscale Function is implemented in each RBM channel as a single trip function with a selected trip setpoint, it is characterized in Table 3.3.2.1-1 as three Functions, the Low Power RangeUpscale Function, the Intermediate Power RangeUpscale Function, and the High Power RangeUpscale Function, to facilitate correct definition of the OPERABILITY requirements for the functions. Each Function corresponds to one of the RBM power ranges. Due to the deadband effects on the determination of the current power range, the transition between these three Functions will occur at slightly different THERMAL POWER levels for increasing power versus decreasing power. Since the RBM flux trip setpoints applied for the higher power ranges are more conservative, the OPERABILITY requirement for the Low Power Range Upscale Function is satisfied if the Intermediate Power RangeUpscale Function or the High Power RangeUpscale Function is OPERABLE. Similarly, the OPERABILITY requirement for the Intermediate Power RangeUpscale Function is satisfied if the High Power RangeUpscale Function is OPERABLE. (continued) Brunswick Unit 2 B 3.3.2.1-5 Revision No. 62

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE 2. Rod Worth Minimizer SAFETY ANALYSES, LCO, and The RWM enforces the banked position withdrawal sequence (BPWS) to APPLICABILITY ensure that the initial conditions of the CRDA analysis are not violated. (continued) The analytical methods and assumptions used in evaluating the CRDA are summarized in References 11 and 12. The BPWS requires that control rods be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions. Requirements that the control rod sequence is in compliance with the BPWS are specified in LCO 3.1.6, "Rod Pattern Control." The RWM Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). The RWM is a microprocessor-based system with the principle task to reinforce procedural control to limit the reactivity worth of control rods under lower power conditions. Only one channel of the RWM is available and required to be OPERABLE. Special circumstances provided for in the Required Action of LCO 3.1.3, "Control Rod OPERABILITY," and LCO 3.1.6 may necessitate bypassing the RWM to allow continued operation with inoperable control rods, or to allow correction of a control rod pattern not in compliance with the BPWS. As required by these conditions, one or more control rods may be bypassed in the RWM or the RWM may be bypassed. However, the RWM must be considered inoperable and the Required Actions of this LCO followed since the RWM can no longer enforce compliance with the BPWS. Compliance with the BPWS, and therefore OPERABILITY of the RWM, is required in MODES 1 and 2 when THERMAL POWER is 8.75% RTP. When THERMAL POWER is > 8.75% RTP, there is no possible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA (Refs. 5 and 6). In MODES 3 and 4, all control rods are required to be inserted into the core; (continued) Brunswick Unit 2 B 3.3.2.1-6 Revision No. 62

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE 2. Rod Worth Minimizer (continued) SAFETY ANALYSES, LCO, and therefore, a CRDA cannot occur. In MODE 5, since only a APPLICABILITY single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will be subcritical.

3. Reactor Mode SwitchShutdown Position During MODES 3 and 4, and during MODE 5 when the reactor mode switch is required to be in the shutdown position, the core is assumed to be subcritical; therefore, no positive reactivity insertion events are analyzed. The Reactor Mode SwitchShutdown Position control rod withdrawal block ensures that the reactor remains subcritical by blocking control rod withdrawal, thereby preserving the assumptions of the safety analysis.

The Reactor Mode SwitchShutdown Position Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). Two channels are required to be OPERABLE to ensure that no single channel failure will preclude a rod block when required. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on reactor mode switch position. During shutdown conditions (MODE 3, 4, or 5), no positive reactivity insertion events are analyzed because assumptions are that control rod withdrawal blocks are provided to prevent criticality. Therefore, when the reactor mode switch is in the shutdown position, the control rod withdrawal block is required to be OPERABLE. During MODE 5 with the reactor mode switch in the refueling position, the refuel position one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock") provides the required control rod withdrawal blocks. (continued) Brunswick Unit 2 B 3.3.2.1-7 Revision No. 30

Control Rod Block Instrumentation B 3.3.2.1 BASES (continued) ACTIONS A.1 With one RBM channel inoperable, the remaining OPERABLE channel is adequate to perform the control rod block function; however, overall reliability is reduced because a single failure in the remaining OPERABLE channel can result in no control rod block capability for the RBM. For this reason, Required Action A.1 requires restoration of the inoperable channel to OPERABLE status. The Completion Time of 24 hours is based on the low probability of an event occurring coincident with a failure in the remaining OPERABLE channel. B.1 If Required Action A.1 is not met and the associated Completion Time has expired, an RBM channel must be placed in the tripped condition within 1 hour. If both RBM channels are inoperable, the RBM is not capable of performing its intended function; thus, one channel must also be placed in trip within 1 hour. This initiates a control rod withdrawal block, thereby ensuring that the RBM function is met. The 1 hour Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities and is acceptable because it minimizes risk while allowing time for restoration or tripping of inoperable channels. C.1, C.2.1.1, C.2.1.2, and C.2.2 With the RWM Function inoperable during a reactor startup, the operator is still capable of enforcing the prescribed control rod sequence. However, the overall reliability is reduced because a single operator error can result in violating the control rod sequence. Therefore, control rod movement must be immediately suspended except by scram. Alternatively, startup may continue if at least 12 control rods have already been withdrawn, or a reactor startup with the RWM inoperable, for reasons other than one or more control rods bypassed in the RWM, was not performed in the last 12 months. Required Actions C.2.1.1 and C.2.1.2 require verification of these conditions by review of plant (continued) Brunswick Unit 2 B 3.3.2.1-8 Revision No. 30

Control Rod Block Instrumentation B 3.3.2.1 BASES ACTIONS C.1, C.2.1.1, C.2.1.2, and C.2.2 (continued) logs and control room indications. Once Required Action C.2.1.1 or C.2.1.2 is satisfactorily completed, control rod withdrawal may proceed in accordance with the restrictions imposed by Required Action C.2.2. Required Action C.2.2 allows for the RWM Function to be performed manually and requires double verification of compliance with the prescribed rod sequence by a second licensed operator (Reactor Operator or Senior Reactor Operator) or other qualified member of the technical staff. One or more control rods may be bypassed in the RWM or the RWM may be bypassed under these conditions to allow continued operations. In addition, Required Actions of LCO 3.1.3 and LCO 3.1.6 may require bypassing one or more control rods in the RWM or bypassing the RWM, during which time the RWM must be considered inoperable with Condition C entered and its Required Actions taken. In the event one or more control rods are bypassed in the RWM (up to 8 control rods may be bypassed in accordance with the RWM design), Required Action C.2.1.2 does not restrict startup. D.1 With the RWM Function inoperable during a reactor shutdown, the operator is still capable of enforcing the prescribed control rod sequence. Required Action D.1 allows for the RWM Function to be performed manually and requires double verification of compliance with the prescribed rod sequence by a second licensed operator (Reactor Operator or Senior Reactor Operator) or other qualified member of the technical staff. One or more control rods may be bypassed in the RWM or the RWM may be bypassed under these conditions to allow the reactor shutdown to continue. E.1 and E.2 With one Reactor Mode SwitchShutdown Position control rod withdrawal block channel inoperable, the remaining OPERABLE channel is adequate to perform the control rod withdrawal block function. However, since the Required Actions are consistent with the normal (continued) Brunswick Unit 2 B 3.3.2.1-9 Revision No. 30

Control Rod Block Instrumentation B 3.3.2.1 BASES ACTIONS E.1 and E.2 (continued) action of an OPERABLE Reactor Mode SwitchShutdown Position Function (i.e., maintaining all control rods inserted), there is no distinction between having one or two channels inoperable. In both cases (one or both channels inoperable), suspending all control rod withdrawal and initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies will ensure that the core is subcritical with adequate SDM ensured by LCO 3.1.1. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are therefore not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted. SURVEILLANCE As noted at the beginning of the SRs, the SRs for each Control Rod Block REQUIREMENTS instrumentation Function are found in the SRs column of Table 3.3.2.1-1. The Surveillances are modified by a Note to indicate that when an RBM channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours provided the associated Function maintains control rod block capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 7, 9, and 10) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that a control rod block will be initiated when necessary. SR 3.3.2.1.1 A CHANNEL FUNCTIONAL TEST is performed for each RBM channel to ensure that the channel will perform the intended function. It includes the Reactor Manual Control System input. Any setpoint adjustment shall be (continued) Brunswick Unit 2 B 3.3.2.1-10 Revision No. 30

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.1 (continued) REQUIREMENTS consistent with the assumptions of the current plant specific setpoint methodology. The Frequency of 184 days is based on reliability analyses (Refs. 8, 9, and 10). SR 3.3.2.1.2 and SR 3.3.2.1.3 A CHANNEL FUNCTIONAL TEST is performed for the RWM to ensure that the system will perform the intended function. The CHANNEL FUNCTIONAL TEST for the RWM is performed by selecting a control rod not in compliance with the prescribed sequence and verifying proper annunciation of the selection error, and by attempting to withdraw a control rod not in compliance with the prescribed sequence and verifying a control rod block occurs. As noted in the SRs, SR 3.3.2.1.2 is not required to be performed until 1 hour after any control rod is withdrawn in MODE 2. As noted, SR 3.3.2.1.3 is not required to be performed until 1 hour after THERMAL POWER is 8.75% RTP in MODE 1. This allows entry into MODE 2 for SR 3.3.2.1.2, and entry into MODE 1 when THERMAL POWER is 8.75% RTP for SR 3.3.2.1.3, to perform the required Surveillance if the 92 day Frequency is not met per SR 3.0.2. The 1 hour allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the SRs. Operating experience has demonstrated these components will usually pass the Surveillances when performed at the 92 day Frequency. Therefore, the Frequency is acceptable from a reliability standpoint. SR 3.3.2.1.4 The RBM setpoints are automatically varied as a function of power. Three Allowable Values are specified in Table 3.3.2.1-1, one corresponding to each specific power range. The purpose of this SR is to assure that for each RBM power range, the RBM flux trip rod block outputs are enabled (not bypassed) and that the RBM flux trip setpoint being applied is equal to or more conservative than the specified (continued) Brunswick Unit 2 B 3.3.2.1-11 Revision No. 30

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.4 (continued) REQUIREMENTS Allowable Values in the COLR. If any power range setpoint is non-conservative, then the affected RBM channel is considered inoperable. The Low Power RangeUpscale Function is enabled when the RBM flux trip setpoint being applied is equal to or less than the Allowable Value for low trip setpoint defined in the COLR, and the RBM flux trip rod block outputs are enabled (not bypassed). The Intermediate Power Range Upscale Function is enabled when the RBM flux trip setpoint being applied is equal to or less than the Allowable Value for intermediate trip setpoint defined in the COLR, and the RBM flux trip rod block outputs are enabled (not bypassed). The High Power RangeUpscale Function is enabled when the RBM flux trip setpoint being applied is equal to or less than the Allowable Value for high trip setpoint defined in the COLR, and the RBM flux trip rod block outputs are enabled (not bypassed). The SR is performed by varying the APRM Simulated Thermal Power input in the RBM, and confirming that the criteria in the SR is met for both increasing and decreasing values of Simulated Thermal Power. SR 3.3.2.1.4.a is satisfied if, for an APRM Simulated Thermal Power level 29%, the RBM flux trip rod block outputs are not bypassed and the RBM flux trip setpoint being applied is less than or equal to the low trip setpoint Allowable Value defined in the COLR. (Note that the intermediate trip setpoint and the high trip setpoint Allowable Values are less than the low trip setpoint Allowable Value.) SR 3.3.2.1.4.b is satisfied if, for an APRM Simulated Thermal Power level the intermediate power level setpoint Allowable Value defined in the COLR, the RBM flux trip rod block outputs are not bypassed and the RBM flux trip setpoint being applied is less than or equal to the intermediate trip setpoint Allowable Value defined in the COLR. (Note that the high trip setpoint Allowable Value is less than the intermediate trip setpoint Allowable Value.) (continued) Brunswick Unit 2 B 3.3.2.1-12 Revision No. 30

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.4 (continued) REQUIREMENTS SR 3.3.2.1.4.c is satisfied if, for an APRM Simulated Thermal Power level the high power level setpoint Allowable Value defined in the COLR, the RBM flux trip rod block outputs are not bypassed and the RBM flux trip setpoint being applied is less than or equal to the high trip setpoint Allowable Value defined in the COLR. SR 3.3.2.1.5 The RWM is automatically bypassed when power is above a specified value. The power level is determined from steam flow signals. The automatic bypass setpoint must be verified periodically to be

                > 8.75% RTP. If the RWM low power setpoint is nonconservative, then the RWM is considered inoperable. Alternately, the low power setpoint channel can be placed in the conservative condition (nonbypass). If placed in the nonbypassed condition, the SR is met and the RWM is not considered inoperable. The Frequency is based on the trip setpoint methodology utilized for the low power setpoint channel.

SR 3.3.2.1.6 A CHANNEL FUNCTIONAL TEST is performed for the Reactor Mode SwitchShutdown Position Function to ensure that the channel will perform the intended function. The CHANNEL FUNCTIONAL TEST for the Reactor Mode SwitchShutdown Position Function is performed by attempting to withdraw any control rod with the reactor mode switch in the shutdown position and verifying a control rod block occurs. As noted in the SR, the Surveillance is not required to be performed until 1 hour after the reactor mode switch is in the shutdown position, since testing of this interlock with the reactor mode switch in any other position cannot be performed without using jumpers, lifted leads, or movable links. This allows entry into MODES 3 and 4 if the 24 month Frequency is not met per SR 3.0.2. The 1 hour allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the SRs. (continued) Brunswick Unit 2 B 3.3.2.1-13 Revision No. 30

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.6 (continued) REQUIREMENTS The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. SR 3.3.2.1.7 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The CHANNEL CALIBRATION may be performed electronically. As noted, neutron detectors are excluded from the CHANNEL CALIBRATION because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal. Neutron detectors are adequately tested in SR 3.3.1.1.3 and SR 3.3.1.1.8. The Frequency is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. SR 3.3.2.1.8 The RWM will only enforce the proper control rod sequence if the rod sequence is properly input into the RWM computer. This SR ensures that the proper sequence is loaded into the RWM so that it can perform its intended function. The Surveillance is performed once prior to declaring RWM OPERABLE following loading of sequence into RWM, since this is when rod sequence input errors are possible. (continued) Brunswick Unit 2 B 3.3.2.1-14 Revision No. 30

Control Rod Block Instrumentation B 3.3.2.1 BASES (continued) REFERENCES 1. UFSAR, Section 7.6.1.1.5.

2. NEDC-31654P, Maximum Extended Operating Domain Analysis For Brunswick Steam Electric Plant, February 1989.

3. 10 CFR 50.36(c)(2)(ii).

4. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Unit 1 and 2, September 1995.

5. UFSAR Section 15.4.

6. NRC SER, Acceptance for Referencing of Licensing Topical Report NEDE-24011-P-A; General Electric Standard Application for Reactor Fuel, Revision 8, Amendment 17, December 27, 1987.

7. GENE-770-06-1-A, Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications, December 1992.

8. NEDC-30851P-A, Supplement 1, Technical Specification Improvement Analysis for BWR Control Rod Block Instrumentation, October 1988.

9. NEDC-32410P-A, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option III Stability Trip Function, October 1995.

10. NEDC-32410P-A Supplement 1, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM)

Retrofit Plus Option III Stability Trip Function, November 1997.

11. XN-NF-80-19(P)(A) Volume 1, Exxon Nuclear Methodology for Boiling Water Reactors - Neutronic Methods for Design and Analysis, (as identified in the COLR).

12. EMF-2158(P)(A), Siemens Power Corporation Methodology for Boiling Water Reactors: Evaluation and Validation of CASMO-4/MICROBURN-B2, (as identified in the COLR).

Brunswick Unit 2 B 3.3.2.1-15 Revision No. 62

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 B 3.3 INSTRUMENTATION B 3.3.2.2 Feedwater and Main Turbine High Water Level Trip Instrumentation BASES BACKGROUND The feedwater and main turbine high water level trip instrumentation is designed to detect a potential failure of the Feedwater Level Control System that causes excessive feedwater flow. With excessive feedwater flow, the water level in the reactor vessel rises toward the high water level setting causing the trip of the two feedwater pump turbines and the main turbine. High water levels signals are provided by three narrow range sensors of the Digital Feedwater Control System. These three level sensors sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level in the reactor vessel (variable leg). The three level signals are input into a digital control computer. The digital control computer provides three output signals to the high water level trip channels. Each high water level trip channel consists of a relay whose contacts form the trip logic. The high water level trip logic is arranged as a two-out-of-three logic, that trips the two feedwater pump turbines and the main turbine. The digital control computer processes the reactor water level input signals and compares them to pre-established setpoints. When the setpoint is exceeded, the associated channel output relay actuates, which then outputs to the main turbine and feedwater pump trip initiation logic. A trip of the feedwater pump turbines limits further increase in reactor vessel water level by limiting further addition of feedwater to the reactor vessel. A trip of the main turbine and closure of the stop valves protects the turbine from damage due to water entering the turbine. APPLICABLE The feedwater and main turbine high water level trip instrumentation SAFETY ANALYSES is assumed to be capable of providing a turbine trip in the design basis transient analysis for a feedwater controller failure, maximum demand event (Ref. 1). (continued) Brunswick Unit 2 B 3.3.2.2-1 Revision No. 30

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES APPLICABLE The high water level trip indirectly initiates a reactor scram from the SAFETY ANALYSES main turbine trip (above 26% RTP) and trips the feedwater pumps, (continued) thereby terminating the event. The reactor scram mitigates the reduction in MCPR and increase in LHGR. Feedwater and main turbine high water level trip instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 2). LCO The LCO requires three channels of the reactor vessel high water level instrumentation to be OPERABLE to ensure that the feedwater pump turbines and main turbine trip on a valid high water level signal. Two of the three channels are needed to provide trip signals in order for the feedwater and main turbine trips to occur. Each channel must have its setpoint set within the specified Allowable Value of SR 3.3.2.2.2. The Allowable Value is set to ensure that the thermal limits are not exceeded during the event. The actual setpoint is calibrated to be consistent with the applicable setpoint methodology assumptions. Trip setpoints are specified in the setpoint calculations. The setpoints are selected to ensure that the trip settings do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setting is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for calibration based errors. These calibration based instrument errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because (continued) Brunswick Unit 2 B 3.3.2.2-2 Revision No. 62

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES LCO instrumentation uncertainties, process effects, calibration tolerances, (continued) instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation. APPLICABILITY The feedwater and main turbine high water level trip instrumentation is required to be OPERABLE at 23% RTP to ensure that the fuel cladding integrity Safety Limit and the cladding 1% plastic strain limit are not violated during the feedwater controller failure, maximum demand event. As discussed in the Bases for LCO 3.2.1, "Average Planar Linear Heat Generation Rate (APLHGR)," LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR), and LCO 3.2.3, "LINEAR HEAT GENERATION RATE," sufficient margin to these limits exists below 23% RTP; therefore, these requirements are only necessary when operating at or above this power level. ACTIONS A Note has been provided to modify the ACTIONS related to feedwater and main turbine high water level trip instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable feedwater and main turbine high water level trip instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable feedwater and main turbine high water level trip instrumentation channel. A.1 With one channel inoperable, the remaining two OPERABLE channels can provide the required trip signal. However, overall instrumentation reliability is reduced because a single failure in one of the remaining channels concurrent with feedwater controller failure, maximum demand (continued) Brunswick Unit 2 B 3.3.2.2-3 Revision No. 62

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES ACTIONS A.1 (continued) event, may result in the instrumentation not being able to perform its intended function. Therefore, continued operation is only allowed for a limited time with one channel inoperable. If the inoperable channel cannot be restored to OPERABLE status within the Completion Time, the channel must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in a feedwater or main turbine trip), Condition C must be entered and its Required Action taken. The Completion Time of 7 days is based on the low probability of the event occurring coincident with a single failure in a remaining OPERABLE channel. B.1 With two or more channels inoperable, the feedwater and main turbine high water level trip instrumentation cannot perform its design function (feedwater and main turbine high water level trip capability is not maintained). Therefore, continued operation is only permitted for a 4 hour period, during which feedwater and main turbine high water level trip capability must be restored. The trip capability is considered maintained when sufficient channels are OPERABLE or in trip such that the feedwater and main turbine high water level trip logic will generate a trip signal on a valid signal. This requires two channels to each be OPERABLE or in trip. If the required channels cannot be restored to OPERABLE status or placed in trip, Condition C must be entered and its Required Action taken. The 4 hour Completion Time is sufficient for the operator to take corrective action, and takes into account the likelihood of an event requiring actuation of feedwater and main turbine high water level trip instrumentation occurring during this period. It is also consistent with the (continued) Brunswick Unit 2 B 3.3.2.2-4 Revision No. 30

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES ACTIONS B.1 (continued) 4 hour Completion Time provided in LCO 3.2.2 and LCO 3.2.3 for Required Action A.1, since this instrument's purpose is to preclude MCPR and LHGR violations. C.1 With the required channels not restored to OPERABLE status or placed in trip, THERMAL POWER must be reduced to < 23% RTP within 4 hours. As discussed in the Applicability section of the Bases, operation below 23% RTP results in sufficient margin to the required limits, and the feedwater and main turbine high water level trip instrumentation is not required to protect fuel integrity during the feedwater controller failure, maximum demand event. The allowed Completion Time of 4 hours is based on operating experience to reduce THERMAL POWER to

                < 23% RTP from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE The Surveillances are modified by a Note to indicate that when a channel REQUIREMENTS is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours provided the associated Function maintains feedwater and main turbine high water level trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 3) assumption that 6 hours is the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the feedwater pump turbines and main turbine will trip when necessary. SR 3.3.2.2.1 Performance of the CHANNEL CHECK once every 24 hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a (continued) Brunswick Unit 2 B 3.3.2.2-5 Revision No. 62

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES SURVEILLANCE SR 3.3.2.2.1 (continued) REQUIREMENTS similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels, or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limits. The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel status during normal operational use of the displays associated with the channels required by the LCO. SR 3.3.2.2.2 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The Frequency is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. SR 3.3.2.2.3 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the feedwater and main turbine valves is (continued) Brunswick Unit 2 B 3.3.2.2-6 Revision No. 30

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES SURVEILLANCE SR 3.3.2.2.3 (continued) REQUIREMENTS included as part of this Surveillance and overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the assumed safety function. Therefore, if a valve is incapable of operating, the associated instrumentation would also be inoperable. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. REFERENCES 1. UFSAR, Section 15.1.2.

2. 10 CFR 50.36(c)(2)(ii).

3. GENE-770-06-1-A, Bases for Changes to Surveillance Test Intervals and Allowed Out-Of-Service Times for Selected Instrumentation Technical Specifications, December 1992.

Brunswick Unit 2 B 3.3.2.2-7 Revision No. 30

PAM Instrumentation B 3.3.3.1 B 3.3 INSTRUMENTATION B 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND The primary purpose of the PAM instrumentation is to display in the control room plant variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Events. The instruments that monitor these variables are designated as Type A, Category I, and non-Type A, Category I, in accordance with Regulatory Guide 1.97 (Ref. 1). The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected plant parameters to monitor and assess plant status and behavior following an accident. This capability is consistent with the recommendations of Reference 1. APPLICABLE The PAM instrumentation LCO ensures the OPERABILITY of SAFETY ANALYSES Regulatory Guide 1.97, Type A variables so that the control room operating staff can:

• Perform the diagnosis specified in the Emergency Operating Procedures (EOPs). These variables are restricted to preplanned actions for the primary success path of Design Basis Accidents (DBAs), (e.g., loss of coolant accident (LOCA)), and
• Take the specified, preplanned, manually controlled actions for which no automatic control is provided, which are required for safety systems to accomplish their safety function.

The PAM instrumentation LCO also ensures OPERABILITY of Category I, non-Type A, variables so that the control room operating staff can:

• Determine whether systems important to safety are performing their intended functions; (continued)

Brunswick Unit 2 B 3.3.3.1-1 Revision No. 30

PAM Instrumentation B 3.3.3.1 BASES APPLICABLE

• Determine the potential for causing a gross breach of SAFETY ANALYSES the barriers to radioactivity release; (continued)
• Determine whether a gross breach of a barrier has occurred; and
• Initiate action necessary to protect the public and for an estimate of the magnitude of any impending threat.

The plant specific Regulatory Guide 1.97 Analysis (Ref. 2) documents the process that identified Type A and Category I, non-Type A, variables. Accident monitoring instrumentation that satisfies the definition of Type A in Regulatory Guide 1.97 meets Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). Category I, non-Type A, instrumentation is retained in Technical Specifications (TS) because they are intended to assist operators in minimizing the consequences of accidents. Therefore, these Category I variables are important for reducing public risk. LCO LCO 3.3.3.1 requires two OPERABLE channels for all but one Function to ensure that no single failure prevents the operators from being presented with the information necessary to determine the status of the plant and to bring the plant to, and maintain it in, a safe condition following that accident. Furthermore, providing two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information. The exception to the two channel requirement is primary containment isolation valve (PCIV) position. In this case, the important information is the status of the primary containment penetrations. The LCO requires one position indicator for each active (e.g., automatic) PCIV. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve and prior knowledge of passive valve or via system boundary status. If a normally active PCIV is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for closed and deactivated valves is not required to be OPERABLE. (continued) Brunswick Unit 2 B 3.3.3.1-2 Revision No. 30

PAM Instrumentation B 3.3.3.1 BASES LCO The following list is a discussion of the specified instrument Functions (continued) listed in Table 3.3.3.1-1 in the accompanying LCO.

1. Reactor Vessel Pressure Reactor vessel pressure is a Type A and Category I variable provided to support monitoring of Reactor Coolant System (RCS) integrity and to verify operation of the Emergency Core Cooling Systems (ECCS). Two independent pressure transmitters with a range of 0 psig to 1500 psig monitor pressure and are indicated in the control room. Wide range instruments are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

2.a., 2.b., 2.c. Reactor Vessel Water Level Reactor vessel water level is a Type A and Category I variable provided to support monitoring of core cooling and to verify operation of the ECCS. Channels from three different ranges of water level provide the PAM Reactor Vessel Water Level Function. The water level channels measure from -150 inches to +550 inches. Water level is measured by independent differential pressure transmitters for each required channel. The output from these channels is recorded on independent recorders or read on indicators, which are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

3. Suppression Chamber Water Level Suppression chamber water level is a Type A and Category I variable provided to detect a breach in the reactor coolant pressure boundary (RCPB). This variable is also used to verify and provide long term surveillance of ECCS function. The wide range suppression pool water level measurement provides the operator with sufficient information to assess the status of both the RCPB and the water supply to the ECCS.

The wide range water level indicators are capable of monitoring the suppression pool water level from the bottom of the ECCS suction lines to (continued) Brunswick Unit 2 B 3.3.3.1-3 Revision No. 30

PAM Instrumentation B 3.3.3.1 BASES LCO 3. Suppression Chamber Water Level (continued) 5 feet above the normal pool water level. Two wide range suppression pool water level signals are transmitted from separate differential pressure transmitters for each channel. The output of one of these channels is recorded on a recorder in the control room. The output of the other channel is read on an indicator in the control room. These instruments are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

4. Suppression Chamber Water Temperature Suppression chamber water temperature is a Type A and Category I variable provided to detect a condition that could potentially lead to containment breach and to verify the effectiveness of ECCS actions taken to prevent containment breach. The suppression chamber water temperature instrumentation, which measures from 40°F to 240°F, allows operators to detect trends in suppression pool water temperature in sufficient time to take action to prevent steam quenching vibrations in the suppression pool. Suppression pool temperature is monitored by 24 (12 per division) temperature sensors spaced around the suppression pool. A pair of sensors (one per division) is located near each of the quenchers on the discharge lines of the 11 safety/relief valves. Each pair of sensors is located so as to sense the representative temperature of that sector of the suppression pool even with the associated safety/relief valve open. The outputs for the sensors are indicated on two microprocessors in the control room. The signals from the sensors are conditioned by the two microprocessors to provide an average water temperature. A minimum of 11 out of 12 sensors are required to provide this average per division. Average water temperature is recorded on two independent recorders in the control room. These recorders are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channels.

(continued) Brunswick Unit 2 B 3.3.3.1-4 Revision No. 30

PAM Instrumentation B 3.3.3.1 BASES LCO 5. Suppression Chamber Pressure (continued) Suppression chamber pressure is a Type A and Category I variable provided to detect a condition that could potentially lead to containment breach and to verify the effectiveness of ECCS actions taken to prevent containment breach. Suppression chamber pressure is indicated in the control room from two separate pressure transmitters. The range of indication is 0 psig to 75 psig. These instruments are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

6. Drywell Pressure Drywell pressure is a Type A and Category I variable provided to detect breach of the RCPB and to verify ECCS functions that operate to maintain RCS integrity. Two wide range drywell pressure signals are transmitted from separate pressure transmitters for each channel. The output of one of these channels is recorded on a recorder in a control room. The output of the other channel is read on an indicator in the control room. The pressure channels measure from -5 psig to 245 psig. These instruments are the primary indication used by the operator during an accident.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

7. Drywell Temperature Drywell temperature is a Type A and Category I variable provided to detect a breach of the RCPB and to verify the effectiveness of ECCS functions that operate to maintain RCS integrity. Twenty (20) temperature sensors (10 per division) are located in the drywell and suppression pool atmosphere. In order to provide adequate monitoring of the entire air space, a minimum of 1 sensor per monitoring location, 5 per division are required (Ref. B 3.6.1.4, SR 3.6.1.4.1 for monitoring locations). The sensors are divided into two divisions for redundancy. The signals from these sensors are conditioned by two divisionalized microprocessors.

Drywell temperature is recorded by two pairs of divisionalized recorders in the control room. The range of the recorders is from 40°F to 440°F. These recorders are the primary indication used (continued) Brunswick Unit 2 B 3.3.3.1-5 Revision No. 30

PAM Instrumentation B 3.3.3.1 BASES LCO 7. Drywell Temperature (continued) by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

8. Primary Containment Isolation Valve (PCIV) Position PCIV position, a Category I variable, is provided for verification of containment integrity. In the case of PCIV position, the important information is the isolation status of the containment penetration. The LCO requires one channel of valve position indication in the control room to be OPERABLE for each active PCIV in a containment penetration flow path, i.e., two total channels of PCIV position indication for a penetration flow path with two active valves. For containment penetrations with only one active PCIV having control room indication, Note (b) requires a single channel of valve position indication to be OPERABLE. This is sufficient to redundantly verify the isolation status of each isolable penetration via indicated status of the active valve, as applicable, and prior knowledge of passive valve or system boundary status. If a penetration flow path is isolated, position indication for the PCIV(s) in the associated penetration flow path is not needed to determine status. Therefore, the position indication for valves in an isolated penetration flow path is not required to be OPERABLE.

The PCIV position PAM instrumentation consists of position switches, associated wiring and control room indication for active PCIVs (check valves and manual valves are not required to have position indication). Therefore, the PAM Specification deals specifically with these instrument channels.

9. (Not Used)

10. Drywell Area Radiation Drywell area radiation is a Category I variable provided to monitor the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans. Post accident drywell area radiation levels are monitored by four instruments, each with a range of 1 R/hr to 107 R/hr.

The outputs of these channels are indicated and recorded in the control room. Therefore, the PAM Specification deals specifically with this portion of the instrument channel. Each instrument is considered a channel and at least one OPERABLE channel should be available to a recorder. This RG 1.97 recording function is not required to meet single failure criteria, so only one channel recorded satisfies this function. If the instrument indicator is not available, the recorder output satisfies the channel indication requirement. UFSAR Figure 12-7 shows the divisional nature of these instruments and, to support single failure criteria, one channel in each division shall be OPERABLE to meet minimum LCO requirements. Brunswick Unit 2 B 3.3.3.1-6 Revision No. 51

PAM Instrumentation B 3.3.3.1 BASES (continued) APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1 and 2. These variables are related to the diagnosis and preplanned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1 and 2. In MODES 3, 4, and 5, plant conditions are such that the likelihood of an event that would require PAM instrumentation is extremely low; therefore, PAM instrumentation is not required to be OPERABLE in these MODES. ACTIONS A Note has been provided to modify the ACTIONS related to PAM instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable PAM instrumentation channels provide appropriate compensatory measures for separate Functions. As such, a Note has been provided that allows separate Condition entry for each inoperable PAM Function. A.1 When one or more Functions have one required channel that is inoperable, the required inoperable channel must be restored to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channels, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval. (continued) Brunswick Unit 2 B 3.3.3.1-7 Revision No. 39

PAM Instrumentation B 3.3.3.1 BASES ACTIONS B.1 (continued) If a channel has not been restored to OPERABLE status in 30 days, this Required Action specifies initiation of action in accordance with Specification 5.6.6, which requires a written report to be submitted to the NRC. This report discusses the results of the root cause evaluation of the inoperability and identifies proposed restorative actions. This Required Action is appropriate in lieu of a shutdown requirement, since another OPERABLE channel is monitoring the Function, and given the likelihood of plant conditions that would require information provided by this instrumentation. C.1 When one or more Functions have two required channels that are inoperable (i.e., two channels inoperable in the same Function), one channel in the Function should be restored to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur. D.1 This Required Action directs entry into the appropriate Condition referenced in Table 3.3.3.1-1. The applicable Condition referenced in the Table is Function dependent. Each time an inoperable channel has not met the Required Action of Condition C and the associated Completion Time has expired, Condition D is entered for that channel and provides for transfer to the appropriate subsequent Condition. E.1 For the majority of Functions in Table 3.3.3.1-1, if any Required Action and associated Completion Time of Condition C is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. (continued) Brunswick Unit 2 B 3.3.3.1-8 Revision No. 38

PAM Instrumentation B 3.3.3.1 BASES ACTIONS F.1 (continued) Since alternate means of monitoring primary containment area radiation are available, the Required Action is not to shut down the plant, but rather to follow the directions of Specification 5.6.6. These alternate means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels. SURVEILLANCE As noted at the beginning of the SRs, the following SRs apply to each REQUIREMENTS PAM instrumentation Function in Table 3.3.3.1-1. SR 3.3.3.1.1 Performance of the CHANNEL CHECK once every 31 days ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel against a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The high radiation instrumentation should be compared to similar plant instruments located throughout the plant. Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. The Frequency of 31 days is based upon plant operating experience, with regard to channel OPERABILITY and drift, which demonstrates that failure of more than one channel of a given Function in any 31 day interval is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of those displays associated with the channels required by the LCO. (continued) Brunswick Unit 2 B 3.3.3.1-9 Revision No. 38

PAM Instrumentation B 3.3.3.1 BASES SURVEILLANCE SR 3.3.3.1.2 REQUIREMENTS (continued) Not Used. SR 3.3.3.1.3 This SR requires a CHANNEL CALIBRATION to be performed. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies the channel responds to measured parameter with the necessary range and accuracy. For Function 10, the CHANNEL CALIBRATION shall consist of an electronic calibration of the channel, not including the detector, for range decades above 10 R/hr and a one point calibration check of the detector below 10 R/hr with an installed or portable gamma source. The 24 month Frequency for CHANNEL CALIBRATION of PAM Instrumentation of Table 3.3.3.1-1 is based on operating experience and consistency with the BNP refueling cycles. REFERENCES 1. Regulatory Guide 1.97, Instrumentation for Light Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident, Revision 2, December 1980.

2. NRC Safety Evaluation Report, Conformance to Regulatory Guide 1.97, Rev. 2, Brunswick Steam Electric Plant, Units 1 and 2, May 14, 1985.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.3.3.1-10 Revision No. 38

Remote Shutdown Monitoring Instrumentation B 3.3.3.2 B 3.3 INSTRUMENTATION B 3.3.3.2 Remote Shutdown Monitoring Instrumentation BASES BACKGROUND The remote shutdown monitoring instrumentation provides the control room operator with sufficient instrumentation to support placing and maintaining the plant in a safe shutdown condition from a location other than the control room. This capability is necessary to protect against the possibility of the control room becoming inaccessible. A safe shutdown condition is defined as MODE 3. With the plant in MODE 3, the Reactor Core Isolation Cooling (RCIC) System, the safety/relief valves, and the Residual Heat Removal (RHR) System can be used to remove core decay heat and meet all safety requirements. The long term supply of water for the RCIC System and the ability to operate shutdown cooling from outside the control room allow extended operation in MODE 3. In the event that the control room becomes inaccessible, the operators can monitor the status of the reactor and primary containment and the operation of the RCIC and RHR Systems at the remote shutdown panel and place and maintain the plant in MODE 3. Controls and selector switches will have to be operated locally at the switchgear, motor control panels, or other local stations. The plant is in MODE 3 following a plant shutdown and can be maintained safely in MODE 3 for an extended period of time. The OPERABILITY of the remote shutdown monitoring instrumentation Functions ensures that there is sufficient information available on selected plant parameters to place and maintain the plant in MODE 3 should the control room become inaccessible. APPLICABLE The remote shutdown monitoring instrumentation is required to provide SAFETY ANALYSES equipment at appropriate locations outside the control room with a design capability to monitor the prompt shutdown of the reactor to MODE 3, including the necessary instrumentation to support maintaining the plant in a safe condition in MODE 3. The criteria governing the design and the specific system requirements of the remote shutdown monitoring instrumentation are located in the UFSAR (Ref. 1). The Remote Shutdown Monitoring Instrumentation is considered an important contributor to reducing the risk of accidents; as such, it meets Criterion 4 of 10 CFR 50.36(c)(2)(ii) (Ref. 2). (continued) Brunswick Unit 2 B 3.3.3.2-1 Revision No. 39

Remote Shutdown Monitoring Instrumentation B 3.3.3.2 BASES (continued) LCO The Remote Shutdown Monitoring Instrumentation LCO provides the requirements for the OPERABILITY of the monitoring instrumentation necessary to support placing and maintaining the plant in MODE 3 from a location other than the control room. The monitoring instrumentation required are listed in Table B 3.3.3.2-1. The monitoring instrumentation are those required for:

• Reactor pressure vessel (RPV) pressure control;
• Decay heat removal; and
• RPV inventory control.

The remote shutdown monitoring instrumentation is OPERABLE if all instrument channels needed to support the remote shutdown monitoring function are OPERABLE with readouts displayed external to the control room. The remote shutdown monitoring instruments covered by this LCO do not need to be energized to be considered OPERABLE. This LCO is intended to ensure that the instruments will be OPERABLE if plant conditions require that the remote shutdown monitoring instrumentation be placed in operation. APPLICABILITY The Remote Shutdown Monitoring Instrumentation LCO is applicable in MODES 1 and 2. This is required so that the plant can be placed and maintained in MODE 3 for an extended period of time from a location other than the control room. This LCO is not applicable in MODES 3, 4, and 5. In these MODES, the plant is already subcritical and in a condition of reduced Reactor Coolant System energy. Under these conditions, considerable time is available to restore necessary instrument Functions if control room instruments or control becomes unavailable. Consequently, the LCO does not require OPERABILITY in MODES 3, 4, and 5. (continued) Brunswick Unit 2 B 3.3.3.2-2 Revision No. 39

Remote Shutdown Monitoring Instrumentation B 3.3.3.2 BASES (continued) ACTIONS A Note has been provided to modify the ACTIONS related to Remote Shutdown Monitoring Instrumentation Functions. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable Remote Shutdown Monitoring Instrumentation Functions provide appropriate compensatory measures for separate Functions. As such, a Note has been provided that allows separate Condition entry for each inoperable Remote Shutdown Monitoring Instrumentation Function. A.1 Condition A addresses the situation where one or more required Functions of the remote shutdown monitoring instrumentation is inoperable. This includes any Function listed in Table B 3.3.3.2-1. The Required Action is to restore the Function (all required channels) to OPERABLE status within 30 days. The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room. B.1 If the Required Action and associated Completion Time of Condition A are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Time is reasonable, based on operating experience, to reach the required MODE from full power conditions in an orderly manner and without challenging plant systems. (continued) Brunswick Unit 2 B 3.3.3.2-3 Revision No. 39

Remote Shutdown Monitoring Instrumentation B 3.3.3.2 BASES (continued) SURVEILLANCE SR 3.3.3.2.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 31 days ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. As specified in the Surveillance, a CHANNEL CHECK is only required for those channels that are normally energized. For Function 2 of Table B 3.3.3.2-1, the CHANNEL CHECK requirement does not apply to the NO17 instrument loop since this instrument loop has no displayed indication. The CHANNEL CHECK requirement does apply to the remaining instruments of Function 2. The Frequency is based upon plant operating experience that demonstrates channel failure is rare. SR 3.3.3.2.2 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies the channel responds to measured parameter values with the necessary range and accuracy. The 24 month Frequency is based upon operating experience and consistency with the BNP refueling cycle. REFERENCES 1. UFSAR, Section 7.4.4.

2. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.3.3.2-4 Revision No. 39

Remote Shutdown Monitoring Instrumentation B 3.3.3.2 Table B 3.3.3.2-1 (page 1 of 1) Remote Shutdown Monitoring Instrumentation REQUIRED READOUT NUMBER OF FUNCTION LOCATION CHANNELS

1. Reactor Vessel Pressure (a) 1

2. Reactor Vessel Water Level (a) 1

3. Suppression Chamber Water Level (a) 1

4. Suppression Chamber Water Temperature (a) 1

5. Drywell Pressure (a) 1

6. Drywell Temperature (a) 1

7. Residual Heat Removal System Flow (a) 1 (a) Remote Shutdown Panel, Reactor Building 20 ft. Elevation Brunswick Unit 2 B 3.3.3.2-5 Revision No. 39

ATWS-RPT Instrumentation B 3.3.4.1 B 3.3 INSTRUMENTATION B 3.3.4.1 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation BASES BACKGROUND The ATWS-RPT System initiates an RPT, adding negative reactivity, following events in which a scram does not, but should occur, to lessen the effects of an ATWS event. Tripping the recirculation pumps adds negative reactivity from the increase in steam voiding in the core area as core flow decreases. When Reactor Vessel Water LevelLow Level 2 or Reactor Vessel PressureHigh setpoint is reached, the recirculation pump drive motor breakers trip. The ATWS-RPT System (Ref. 1) includes sensors, relays, and circuit breakers that are necessary to cause initiation of an RPT. The channels include electronic equipment (e.g., trip units) that compare measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an ATWS-RPT signal to the trip logic. The ATWS-RPT consists of two independent trip systems, with two channels of Reactor Vessel PressureHigh and two channels of Reactor Vessel Water LevelLow Level 2 in each trip system. Each ATWS-RPT trip system is a two-out-of-two logic for each Function. Thus, either two Reactor Water LevelLow Level 2 or two Reactor Vessel PressureHigh signals are needed to trip a trip system. The outputs of the channels in a trip system are combined in a logic so that either trip system will trip both recirculation pumps (by tripping the respective drive motor breakers). There is one drive motor breaker provided for each of the two recirculation pumps for a total of two breakers. The output of each trip system is provided to these recirculation pump breakers. APPLICABLE The ATWS-RPT is not assumed to mitigate any accident or transient in SAFETY ANALYSES, the safety analysis. The ATWS-RPT initiates an RPT to aid in preserving LCO, and the integrity of the fuel cladding following events in which a scram does APPLICABILITY not, but should, occur. Based on its contribution to the reduction of overall plant risk, however, the instrumentation meets Criterion 4 of 10 CFR 50.36(c)(2)(ii) (Ref. 2). (continued) Brunswick Unit 2 B 3.3.4.1-1 Revision No. 30

ATWS-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE The OPERABILITY of the ATWS-RPT is dependent on the OPERABILITY SAFETY ANALYSES, of the individual instrumentation channel Functions. Each Function LCO, and must have a required number of OPERABLE channels in each trip APPLICABILITY system, with their setpoints within the specified Allowable Value of (continued) SR 3.3.4.1.4. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Channel OPERABILITY also includes the associated recirculation pump drive motor breakers. Allowable Values are specified for each ATWS-RPT Function specified in the LCO. Trip setpoints are specified in the setpoint calculations. The setpoints are selected to ensure that the trip settings do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setting is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the design analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for calibration based errors. These calibration based instrument errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation. The individual Functions are required to be OPERABLE in MODE 1 to protect against common mode failures of the Reactor Protection System by providing a diverse trip to mitigate the consequences of a postulated ATWS event. The Reactor Vessel PressureHigh and Reactor Vessel Water LevelLow Level 2 Functions are required to be OPERABLE in (continued) Brunswick Unit 2 B 3.3.4.1-2 Revision No. 30

ATWS-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE MODE 1, since the reactor is producing significant power and the SAFETY ANALYSES, recirculation system could be at high flow. During this MODE, the LCO, and potential exists for pressure increases or low water level, assuming an APPLICABILITY ATWS event. In MODE 2, the reactor is at low power and the (continued) recirculation system is at low flow; thus, the potential is low for a pressure increase or low water level, assuming an ATWS event. Therefore, the ATWS-RPT is not necessary. In MODES 3 and 4, the reactor is shut down with all control rods inserted; thus, an ATWS event is not significant and the possibility of a significant pressure increase or low water level is negligible. In MODE 5, the one rod out interlock ensures that the reactor remains subcritical; thus, an ATWS event is not significant. In addition, the reactor pressure vessel (RPV) head is not fully tensioned and no pressure transient threat to the reactor coolant pressure boundary (RCPB) exists. The specific Applicable Safety Analyses and LCO discussions are listed below on a Function by Function basis.

a. Reactor Vessel Water LevelLow Level 2 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the ATWS-RPT System is initiated at Level 2 to aid in maintaining level above the top of the active fuel. The reduction of core flow reduces the neutron flux and THERMAL POWER and, therefore, the rate of coolant boiloff.

Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water LevelLow Level 2, with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure can preclude an ATWS-RPT from this Function on a valid signal. The Reactor Vessel Water LevelLow Level 2 Allowable Value is (continued) Brunswick Unit 2 B 3.3.4.1-3 Revision No. 30

ATWS-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE a. Reactor Vessel Water LevelLow Level 2 (continued) SAFETY ANALYSES, LCO, and chosen so that the system will not be initiated after a Level 1 APPLICABILITY scram with feedwater still available, and for convenience with the reactor core isolation cooling initiation. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point.

b. Reactor Vessel PressureHigh Excessively high RPV pressure may rupture the RCPB. An increase in the RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion. This increases neutron flux and THERMAL POWER, which could potentially result in fuel failure and overpressurization.

The Reactor Vessel PressureHigh Function initiates an RPT for transients that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power generation. For the overpressurization event, the RPT aids in the termination of the ATWS event and, along with the safety/relief valves, limits the peak RPV pressure to less than the ASME Section III Code Service Level C limits (1500 psig). The Reactor Vessel PressureHigh signals are initiated from four pressure transmitters that monitor reactor vessel pressure. Four channels of Reactor Vessel PressureHigh, with two channels in each trip system, are available and are required to be OPERABLE to ensure that no single instrument failure can preclude an ATWS-RPT from this Function on a valid signal. The Reactor Vessel PressureHigh Allowable Value is chosen to provide an adequate margin to the ASME Section III Code Service Level C allowable Reactor Coolant System pressure. ACTIONS A Note has been provided to modify the ACTIONS related to ATWS-RPT instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into (continued) Brunswick Unit 2 B 3.3.4.1-4 Revision No. 30

ATWS-RPT Instrumentation B 3.3.4.1 BASES ACTIONS the Condition. Section 1.3 also specifies that Required Actions of the (continued) Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable ATWS-RPT instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable ATWS-RPT instrumentation channel. A.1 and A.2 With one or more channels inoperable, but with ATWS-RPT capability for each Function maintained (refer to Required Actions B.1 and C.1 Bases), the ATWS-RPT System is capable of performing the intended function. However, the reliability and redundancy of the ATWS-RPT instrumentation is reduced, such that a single failure in the remaining trip system could result in the inability of the ATWS-RPT System to perform the intended function. Therefore, only a limited time is allowed to restore the inoperable channels to OPERABLE status. Because of the diversity of sensors available to provide trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of ATWS-RPT, 14 days is provided to restore the inoperable channel (Required Action A.1). Alternately, the inoperable channel may be placed in trip (Required Action A.2), since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. As noted, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable breaker, since this may not adequately compensate for the inoperable breaker (e.g., the breaker may be inoperable such that it will not open). If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel would result in an RPT), or if the inoperable channel is the result of an inoperable breaker, Condition D must be entered and its Required Actions taken. (continued) Brunswick Unit 2 B 3.3.4.1-5 Revision No. 30

ATWS-RPT Instrumentation B 3.3.4.1 BASES ACTIONS B.1 (continued) Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not maintaining ATWS-RPT trip capability. A Function is considered to be maintaining ATWS-RPT trip capability when sufficient channels are OPERABLE or in trip such that the ATWS-RPT System will generate a trip signal from the given Function on a valid signal, and both recirculation pumps can be tripped. This requires two channels of the Function in the same trip system to each be OPERABLE or in trip, and the recirculation pump drive motor breakers to be OPERABLE or in trip. The 72 hour Completion Time is sufficient for the operator to take corrective action (e.g., restoration or tripping of channels) and takes into account the likelihood of an event requiring actuation of the ATWS-RPT instrumentation during this period and that one Function is still maintaining ATWS-RPT trip capability. C.1 Required Action C.1 is intended to ensure that appropriate Actions are taken if multiple, inoperable, untripped channels within both Functions result in both Functions not maintaining ATWS-RPT trip capability. The description of a Function maintaining ATWS-RPT trip capability is discussed in the Bases for Required Action B.1 above. The 1 hour Completion Time is sufficient for the operator to take corrective action and takes into account the likelihood of an event requiring actuation of the ATWS-RPT instrumentation during this period. D.1 and D.2 With any Required Action and associated Completion Time not met, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours (Required Action D.2). Alternately, the associated recirculation pump(s) may be removed from service since this (continued) Brunswick Unit 2 B 3.3.4.1-6 Revision No. 30

ATWS-RPT Instrumentation B 3.3.4.1 BASES ACTIONS D.1 and D.2 (continued) performs the intended function of the instrumentation (Required Action D.1). The allowed Completion Time of 6 hours is reasonable, based on operating experience, both to reach MODE 2 from full power conditions and to remove a recirculation pump from service in an orderly manner and without challenging plant systems. SURVEILLANCE The Surveillances are modified by a Note to indicate that when a channel REQUIREMENTS is placed in an inoperable status solely for performance of required Surveillances, entry into the associated Conditions and Required Actions may be delayed for up to 6 hours provided the associated Function maintains ATWS-RPT trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 3) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the recirculation pumps will trip when necessary. SR 3.3.4.1.1 Performance of the CHANNEL CHECK once every 24 hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication (continued) Brunswick Unit 2 B 3.3.4.1-7 Revision No. 30

ATWS-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE SR 3.3.4.1.1 (continued) REQUIREMENTS and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based upon operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the required channels of this LCO. SR 3.3.4.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Frequency of 92 days is based on the reliability analysis of Reference 3. SR 3.3.4.1.3 Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in SR 3.3.4.1.4. If the trip setting is discovered to be less conservative than the setting accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant design analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology. The Frequency of 92 days is based on the reliability analysis of Reference 3. SR 3.3.4.1.4 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL (continued) Brunswick Unit 2 B 3.3.4.1-8 Revision No. 30

ATWS-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE SR 3.3.4.1.4 (continued) REQUIREMENTS CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The Frequency is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. SR 3.3.4.1.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers is included as part of this Surveillance and overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the design function. Therefore, if a breaker is incapable of operating, the associated instrument channel(s) would be inoperable. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated these components will usually pass the Surveillance when performed at the 24 month Frequency. REFERENCES 1. UFSAR Sections 5.4.1.2.4 and 7.6.1.3.1.

2. 10 CFR 50.36(c)(2)(ii).

3. GENE-770-06-1-A, Bases for Changes To Surveillance Test Intervals and Allowed Out-of-Service Times For Selected Instrumentation Technical Specifications, December 1992.

Brunswick Unit 2 B 3.3.4.1-9 Revision No. 30

ECCS Instrumentation B 3.3.5.1 B 3.3 INSTRUMENTATION B 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation BASES BACKGROUND The purpose of the ECCS instrumentation is to initiate appropriate responses from the systems to ensure that the fuel is adequately cooled in the event of a design basis accident or transient. For most anticipated operational occurrences and Design Basis Accidents (DBAs), a wide range of dependent and independent parameters are monitored. The ECCS instrumentation actuates core spray (CS), the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System, high pressure coolant injection (HPCI), Automatic Depressurization System (ADS), and the diesel generators (DGs). The equipment involved with each of these systems is described in the Bases for LCO 3.5.1, "ECCSOperating" or LCO 3.8.1, "AC Sources Operating." Core Spray System The CS System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level Low Level 3 or Drywell PressureHigh coincident with Reactor Steam Dome PressureLow. Each of these diverse variables is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic (i.e., two trip systems) for each Function. The CS System initiation signal is a sealed in signal and must be manually reset. The CS System can be reset if reactor water level and high drywell pressure have been restored. Upon receipt of an initiation signal, the CS pumps are started approximately 15 seconds after power is available to limit the loading of the AC power sources. (continued) Brunswick Unit 2 B 3.3.5.1-1 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Core Spray System (continued) The CS test line isolation valve, which is also a primary containment isolation valve (PCIV), is closed on a CS initiation signal to allow full system flow assumed in the accident analyses and maintain primary containment isolated in the event CS is not operating. The CS System also monitors the pressure in the reactor to ensure that, before the injection valves open, the reactor pressure has fallen to a value below the CS System's maximum design pressure. The variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic. Low Pressure Coolant Injection System The LPCI is an operating mode of the Residual Heat Removal (RHR) System, with two LPCI subsystems. The LPCI subsystems may be initiated by automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water LevelLow Level 3 or Drywell PressureHigh coincident with Reactor Steam Dome PressureLow. Each of these diverse variables is monitored by four redundant transmitters, which, in turn, are connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic (i.e., two trip systems) for each Function. Once an initiation signal is received by the LPCI control circuitry, the signal is sealed in until manually reset. Upon receipt of an initiation signal, the LPCI pumps are started approximately 10 seconds after power is available to limit the loading of the AC power sources. The RHR test line suppression pool cooling isolation valve, suppression pool spray isolation valves, and containment spray isolation valves (which are also PCIVs) are also closed on a LPCI initiation signal to allow the full system flow assumed in the accident analyses and maintain primary containment isolated in the event LPCI is not operating. (continued) Brunswick Unit 2 B 3.3.5.1-2 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Low Pressure Coolant Injection System (continued) The LPCI System monitors the pressure in the reactor to ensure that, before an injection valve opens, the reactor pressure has fallen to a value below the LPCI System's maximum design pressure. The variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic. Additionally, instruments are provided to close the recirculation loop pump discharge valves to ensure that LPCI flow does not bypass the core when it injects into the recirculation lines. The variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic. Low reactor water level in the shroud is detected by two additional instruments to automatically isolate other modes of RHR (e.g., suppression pool cooling) when LPCI is required. One instrument closes LPCI loop A valves and the other instrument closes LPCI loop B valves. Manual overrides for these isolations are provided. High Pressure Coolant Injection System The HPCI System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level Low Level 2 or Drywell PressureHigh. Each of these variables is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic for each Function. The HPCI test line isolation valve is closed upon receipt of a HPCI initiation signal to allow the full system flow assumed in the accident analysis. The HPCI System also monitors the water levels in the condensate storage tank (CST) and the suppression pool because these are the two sources of water for HPCI operation. Reactor grade water in the CST is the normal source. Upon receipt of a HPCI initiation signal, the CST (continued) Brunswick Unit 2 B 3.3.5.1-3 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND High Pressure Coolant Injection System (continued) suction valve is automatically signaled to open (it is normally in the open position) unless both suppression pool suction valves are open. For automatic swaps from CST suction to suppression pools suction, first the suppression pool suction valves automatically open, and then the CST suction valve automatically closes. The sequence is intended to ensure that a pump suction flow path is continuously maintained during the transfer. Two level switches are used to detect high water level in the suppression pool and two level switches are used to detect low CST level. Actuation of any one switch will cause the automatic swap from CST suction to suppression pools suction. The HPCI System provides makeup water to the reactor until the reactor vessel water level reaches the Reactor Vessel Water LevelHigh trip, at which time the HPCI turbine trips, which causes the turbine's stop valve and the injection valve to close. This variable is monitored by two transmitters, which are, in turn, connected to two trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a two-out-of-two logic to provide high reliability of the HPCI System. The HPCI System automatically restarts if a Reactor Vessel Water LevelLow Level 2 signal is subsequently received. Automatic Depressurization System The ADS may be initiated by either automatic or manual means. Automatic initiation occurs when signals indicating Reactor Vessel Water LevelLow Level 3; and confirmed Reactor Vessel Water LevelLow Level 1; and CS or RHR (LPCI Mode) Pump Discharge PressureHigh are all present and the ADS Timer has timed out. There are two transmitters for Reactor Vessel Water LevelLow Level 3 and one transmitter for confirmed Reactor Vessel Water LevelLow Level 1 in (continued) Brunswick Unit 2 B 3.3.5.1-4 Revision No. 33

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Automatic Depressurization System (continued) each of the two ADS trip systems. Each of these transmitters connects to a trip unit, which then drives a relay whose contacts form the initiation logic. Each ADS trip system includes a time delay between satisfying the initiation logic and the actuation of the ADS valves. The ADS Timer time delay setpoint chosen is long enough that the HPCI System has sufficient operating time to recover to a level above Reactor Vessel Water Level Low Level 3, yet not so long that the LPCI and CS Systems are unable to adequately cool the fuel if the HPCI System fails to maintain that level. An alarm in the control room is annunciated when either of the timers is timing. Resetting the ADS initiation signals resets the ADS Timers. The ADS also monitors the discharge pressures of the four LPCI pumps and the two CS pumps. Each ADS trip system includes two discharge pressure permissive switches from one CS pump and from each LPCI pump in a Division (i.e., Division II LPCI subsystems B and D input to ADS trip system A, and Division I LPCI subsystems A and C input to ADS trip system B). The signals are used as a permissive for ADS actuation, indicating that there is a source of core coolant available once the ADS has depressurized the vessel. One CS pump or two RHR pumps in a LPCI loop are sufficient to permit automatic depressurization. The ADS logic in each trip system is arranged in two strings. Each string has a contact from Reactor Vessel Water LevelLow Level 3. One of the two strings in each trip system also has a confirmed Reactor Vessel Water LevelLow Level 1 contact and an ADS Timer. All contacts in both logic strings must close, the ADS timer must time out, and a CS or LPCI pump discharge pressure signal must be present to initiate an ADS trip system. Either the A or B trip system will cause all the ADS relief valves to open. Once the ADS Timer has timed out and the ADS initiation signal is present, the trip system is sealed in until manually reset. Manual inhibit switches are provided in the control room for the ADS; however, their function is not required for ADS OPERABILITY (provided ADS is not inhibited when required to be OPERABLE). (continued) Brunswick Unit 2 B 3.3.5.1-5 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Diesel Generators (continued) The DGs may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level Low Level 3 or Drywell PressureHigh coincident with Reactor Steam Dome PressureLow. The DGs are also initiated upon loss of voltage signals. (Refer to the Bases for LCO 3.3.8.1, "Loss of Power (LOP) Instrumentation," for a discussion of these signals.) Each of these diverse variables is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the four trip units are connected to relays whose contacts are connected to a one-out-of-two taken twice logic to initiate all DGs. The DGs receive their initiation signals from the CS System initiation logic. The DGs can also be started manually from the control room and locally from the associated DG room. Upon receipt of a loss of coolant accident (LOCA) initiation signal, each DG is automatically started, is ready to load within 10 seconds, and will run in standby conditions (rated voltage and frequency, with the DG output breaker open). The DGs will only energize their respective 4.16 kV emergency buses if a loss of offsite power occurs. (Refer to Bases for LCO 3.3.8.1.) APPLICABLE The actions of the ECCS are explicitly assumed in the safety analyses SAFETY ANALYSES, of References 1, 2, and 3. The ECCS is initiated to preserve the integrity LCO, and of the fuel cladding by limiting the post LOCA peak cladding temperature APPLICABILITY to less than the 10 CFR 50.46 limits. ECCS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion. The OPERABILITY of the ECCS instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. (continued) Brunswick Unit 2 B 3.3.5.1-6 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE Allowable Values are specified for each ECCS Function specified, in the SAFETY ANALYSES table. Trip setpoints are specified in the setpoint calculations. The LCO, and setpoints are selected to ensure that the trip settings do not exceed the APPLICABILITY Allowable Value between CHANNEL CALIBRATIONS. Operation with a (continued) trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setting is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for calibration based errors. These calibration based errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation. In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions that may require ECCS (or DG) initiation to mitigate the consequences of a design basis transient or accident. Table 3.3.5.1-1 footnotes (a), (b), and (c) specifically indicate other conditions when certain ECCS Instrumentation Functions are required to be OPERABLE. To ensure reliable ECCS and DG function, a combination of Functions is required to provide primary and secondary initiation signals. The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis. (continued) Brunswick Unit 2 B 3.3.5.1-7 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE Core Spray and Low Pressure Coolant Injection Systems SAFETY ANALYSES, LCO, and 1.a, 2.a. Reactor Vessel Water LevelLow Level 3 APPLICABILITY (continued) Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. The low pressure ECCS and associated DGs are initiated at Reactor Vessel Water LevelLow Level 3 to ensure that core spray and flooding functions are available to prevent or minimize fuel damage. The Reactor Vessel Water LevelLow Level 3 is one of the Functions assumed to be OPERABLE and capable of initiating the ECCS and associated DGs during the transients analyzed in References 1 and 3. In addition, the Reactor Vessel Water LevelLow Level 3 Function is directly assumed in the analysis of the recirculation line break. The core cooling function of the ECCS, along with the scram action of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. Reactor Vessel Water LevelLow Level 3 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Water LevelLow Level 3 Allowable Value is chosen to allow time for the low pressure core flooding systems to activate and provide adequate cooling. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. Four channels of Reactor Vessel Water LevelLow Level 3 Function are only required to be OPERABLE when the ECCS or DG(s) are required to be OPERABLE to ensure that no single instrument failure can preclude ECCS and DG initiation. Refer to LCO 3.5.1 and LCO 3.5.2, "ECCS Shutdown," for Applicability Bases for the low pressure ECCS subsystems; and LCO 3.8.1 and LCO 3.8.2, "AC SourcesShutdown," for Applicability Bases for the DGs. 1.b, 2.b. Drywell PressureHigh High pressure in the drywell could indicate a break in the reactor coolant pressure boundary (RCPB). The low pressure ECCS and associated (continued) Brunswick Unit 2 B 3.3.5.1-8 Revision No. 62

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.b, 2.b. Drywell PressureHigh (continued) SAFETY ANALYSES, LCO, and DGs are initiated upon receipt of the Drywell PressureHigh Function APPLICABILITY coincident with Reactor Steam Dome PressureLow Function in order to minimize the possibility of fuel damage. The Drywell PressureHigh Function is not explicitly used in the AREVA analysis of the recirculation line break since it does not impact the limiting LOCA. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible to be indicative of a LOCA inside primary containment. The Drywell PressureHigh Function is required to be OPERABLE when the ECCS or DG is required to be OPERABLE in conjunction with times when the primary containment is required to be OPERABLE. Thus, four channels of the CS and LPCI Drywell PressureHigh Functions are required to be OPERABLE in MODES 1, 2, and 3 to ensure that no single instrument failure can preclude ECCS and DG initiation. In MODES 4 and 5, the Drywell PressureHigh Function is not required, since there is insufficient energy in the reactor to pressurize the primary containment to Drywell PressureHigh setpoint. Refer to LCO 3.5.1 for Applicability Bases for the low pressure ECCS subsystems and to LCO 3.8.1 for Applicability Bases for the DGs. 1.c, 2.c. Reactor Steam Dome PressureLow Low reactor steam dome pressure signals are used as permissives for the low pressure ECCS subsystems. This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design pressure. The low reactor steam dome pressure signals are also used in the Drywell PressureHigh logic circuits to distinguish high drywell pressure caused by a LOCA from that caused by loss of drywell cooling. The Reactor Steam Dome PressureLow is one of the Functions assumed to be OPERABLE and capable of permitting initiation of the ECCS and associated DGs during the transients analyzed in References 2 and 3. In addition, the Reactor Steam Dome (continued) Brunswick Unit 2 B 3.3.5.1-9 Revision No. 79

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.c, 2.c. Reactor Steam Dome PressureLow (continued) SAFETY ANALYSES, LCO, and PressureLow Function is directly assumed in the analysis of the APPLICABILITY recirculation line break. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The Reactor Steam Dome PressureLow signals are initiated from four pressure transmitters that sense the reactor dome pressure. The Allowable Value is low enough to prevent overpressuring the equipment in the low pressure ECCS, but high enough to ensure that the ECCS injection prevents the fuel peak cladding temperature from exceeding the limits of 10 CFR 50.46. Four channels of Reactor Steam Dome PressureLow Function are only required to be OPERABLE when the ECCS or DG(s) are required to be OPERABLE to ensure that no single instrument failure can preclude ECCS and DG initiation. Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the low pressure ECCS subsystems; and LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for the DGs. 1.d, 2.f. Core Spray and RHR Pump StartTime Delay Relays The purpose of these time delays is to stagger the start of the CS and RHR pumps that are in each of Divisions I and II, thus limiting the starting transients on the 4.16 kV emergency buses. These Functions are necessary when power is being supplied from either the normal power sources (offsite power) or the standby power sources (DGs). The Core Spray Pump StartTime Delay Relays and the RHR Pump StartTime Delay Relays are assumed to be OPERABLE in the accident and transient analyses requiring ECCS initiation. That is, the analyses assume that the pumps will initiate when required and excess loading will not cause failure of the power sources. There are eight RHR Pump StartTime Delay Relays, two channels in each of the RHR pump start logic circuits. There are six CS pump start timers arranged such that there are four separate channels of the Core Spray Pump Start TimeDelay Relay Function, two channels in each of the CS pump start logic circuits. Each channel consists of an individual (continued) Brunswick Unit 2 B 3.3.5.1-10 Revision No. 62

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.d, 2.f. Core Spray and RHR Pump StartTime Delay Relays SAFETY ANALYSES (continued) LCO, and APPLICABILITY 10 second timer and a 5 second timer. The 5 second timer is common to both channels associated with a CS pump start logic circuit. Each 10 second timer associated with a CS pump start logic channel is shared with an RHR pump start logic channel. While two time delay relay channels are dedicated to a single CS pump start logic, a single failure of a 5 second CS pump timer could result in the failure of the two low pressure ECCS pumps, powered from the same 4.16 kV emergency bus, to perform their intended function within the assumed ECCS RESPONSE TIME (e.g., as in the case where both ECCS pumps on one 4.16 kV emergency bus start simultaneously due to an inoperable time delay relay). This still leaves four of the six low pressure ECCS pumps OPERABLE. Additionally, a failure of both shared time delay relay channels in an RHR and CS pump start logic circuit would also leave four of the six low pressure ECCS pumps OPERABLE as described above. As a result, to satisfy the single failure criterion (i.e., loss of one instrument does not preclude ECCS initiation), only one channel per pump of the Core Spray and RHR Pump StartTime Delay Relay Functions are required to be OPERABLE when the associated ECCS subsystem is required to be OPERABLE. Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the ECCS subsystems. The Allowable Values for the Core Spray and RHR Pump StartTime Delay Relays are chosen to be long enough so that most of the starting transient of the previously started pump is complete before starting a subsequent pump on the same 4.16 kV emergency bus and short enough so that ECCS operation is not degraded. 2.d. Reactor Steam Dome PressureLow (Recirculation Pump Discharge Valve Permissive) Low reactor steam dome pressure signals are used as permissives for recirculation pump discharge valve closure and recirculation pump discharge bypass valve closure. This ensures that the LPCI subsystems inject into the proper RPV location assumed in the safety analysis. The Reactor Steam Dome PressureLow is one of the Functions assumed to (continued) Brunswick Unit 2 B 3.3.5.1-11 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 2.d. Reactor Steam Dome PressureLow (Recirculation Pump SAFETY ANALYSES Discharge Valve Permissive) (continued) LCO, and APPLICABILITY be OPERABLE and capable of closing the valve(s) during the transients analyzed in References 2 and 3. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The Reactor Steam Dome PressureLow Function is directly assumed in the analysis of the recirculation line break. The Reactor Steam Dome PressureLow signals are initiated from four pressure transmitters that sense the reactor dome pressure. The Allowable Value is chosen to ensure that the valves close prior to commencement of LPCI injection flow into the core, as assumed in the safety analysis. Four channels of the Reactor Steam Dome PressureLow Function are only required to be OPERABLE in MODES 1, 2, and 3 with the associated recirculation pump discharge valve open or the associated recirculation pump discharge bypass valve open. With the valve(s) closed, the function of instrumentation has been performed; thus, the Function is not required. In MODES 4 and 5, the loop injection location is not critical since LPCI injection through the recirculation loop in either direction will still ensure that LPCI flow reaches the core (i.e., there is no significant reactor steam dome back pressure). 2.e. Reactor Vessel Shroud Level The Reactor Vessel Shroud Level Function is provided as a permissive to allow the RHR System to be manually aligned from the LPCI mode to the suppression pool cooling/spray or drywell spray modes. The permissive ensures that water in the vessel is at least two thirds core height before the manual transfer is allowed. This ensures that LPCI is available to prevent or minimize fuel damage. This function may be overridden during accident conditions as allowed by plant procedures. The Reactor Vessel Shroud Level Function is implicitly assumed in the analysis of the recirculation line break since the analysis assumes that no LPCI (continued) Brunswick Unit 2 B 3.3.5.1-12 Revision No. 62

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 2.e. Reactor Vessel Shroud Level (continued) SAFETY ANALYSES, LCO, and flow diversion occurs when reactor water level is below the Reactor APPLICABILITY Vessel Shroud Level. Reactor Vessel Shroud Level signals are initiated from two level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Shroud Level Allowable Value is chosen to allow the low pressure core flooding systems to activate and provide adequate cooling before allowing a manual transfer. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. Two channels of the Reactor Vessel Shroud Level Function are only required to be OPERABLE in MODES 1, 2, and 3. In MODES 4 and 5, the specified initiation time of the LPCI subsystems is not assumed, and other administrative controls are adequate to control the valves that this Function isolates (since the systems that the valves are opened for are not required to be OPERABLE in MODES 4 and 5 and are normally not used). HPCI System 3.a. Reactor Vessel Water LevelLow Level 2 Low RPV water level indicates that the capability to cool the fuel may be threatened. The Reactor Vessel Water LevelLow Level 2 is one of the Functions assumed to be OPERABLE and capable of initiating HPCI during the transients analyzed in Reference 2. Reactor Vessel Water LevelLow Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. (continued) Brunswick Unit 2 B 3.3.5.1-13 Revision No. 33

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.a. Reactor Vessel Water LevelLow Level 2 (continued) SAFETY ANALYSES, LCO, and The Reactor Vessel Water LevelLow Level 2 Allowable Value is low APPLICABILITY enough to avoid a HPCI System start from normal reactor level transients (e.g., a reactor scram without the loss of feedwater flow) and is high enough to avoid ADS timer start and initiation of low pressure ECCS at Reactor Vessel Water LevelLow Level 3 during a small LOCA (up to 1 nominal) where HPCI provides the preferred source of makeup. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. Four channels of Reactor Vessel Water LevelLow Level 2 Function are required to be OPERABLE only when HPCI is required to be OPERABLE to ensure that no single instrument failure can preclude HPCI initiation. Refer to LCO 3.5.1 for HPCI Applicability Bases. 3.b. Drywell PressureHigh High pressure in the drywell could indicate a break in the RCPB. The HPCI System is initiated upon receipt of the Drywell PressureHigh Function in order to minimize the possibility of ADS actuation. The Drywell PressureHigh Function is not assumed in accident or transient analyses. It is retained since it is a potentially significant contributor to risk. High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible to be indicative of a LOCA inside primary containment. Four channels of the Drywell PressureHigh Function are required to be OPERABLE when HPCI is required to be OPERABLE to ensure that no single instrument failure can preclude HPCI initiation. Refer to LCO 3.5.1 for the Applicability Bases for the HPCI System. 3.c. Reactor Vessel Water LevelHigh High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Reactor Vessel Water LevelHigh signal is used to trip the HPCI turbine to prevent overflow into the main steam lines (MSLs) which precludes an unanalyzed event. (continued) Brunswick Unit 2 B 3.3.5.1-14 Revision No. 33

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.c. Reactor Vessel Water LevelHigh (continued) SAFETY ANALYSES, LCO, and Reactor Vessel Water LevelHigh signals for HPCI are initiated from APPLICABILITY two level transmitters from the narrow range water level measurement instrumentation. Both Reactor Vessel Water LevelHigh signals are required in order to close the HPCI turbine stop valve. This ensures that no single instrument failure can preclude HPCI initiation. The Reactor Vessel Water LevelHigh Allowable Value is high enough to avoid interfering with HPCI System operation during reactor water level recovery resulting from low reactor water level events and low enough to prevent flow from the HPCI System from overflowing into the MSLs. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. Two channels of Reactor Vessel Water LevelHigh Function are required to be OPERABLE only when HPCI is required to be OPERABLE. Refer to LCO 3.5.1 for HPCI Applicability Bases. 3.d Condensate Storage Tank LevelLow Low level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source. Normally the suction valves between HPCI and the CST are open and, upon receiving a HPCI initiation signal, water for HPCI injection would be taken from the CST. However, if the water level in the CST falls below a preselected level, first the suppression pool suction valves automatically open, and then the CST suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the HPCI pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valves must be open before the CST suction valve automatically closes. The Function is assumed to provide the protection described in References 2 and 6. The Condensate Storage Tank LevelLow signal is initiated from two level switches. The logic is arranged such that either level switch can cause the suppression pool suction valves to open and the CST suction valve to close. The Condensate Storage Tank LevelLow Function (continued) Brunswick Unit 2 B 3.3.5.1-15 Revision No. 33

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.d Condensate Storage Tank LevelLow (continued) SAFETY ANALYSES LCO, and Allowable Value is high enough to ensure adequate pump suction head APPLICABILITY while water is being taken from the CST. With HPCI flow manually reduced to no more than 2000 gpm as the CST is being depleted, the allowable value is also sufficient to prevent any air entrainment that could cause pump damage during the time it takes for the suction transfer to be completed. Two channels of the Condensate Storage Tank LevelLow Function are required to be OPERABLE only when HPCI is required to be OPERABLE to ensure that no single instrument failure can preclude HPCI swap to suppression pool source. Refer to LCO 3.5.1 for HPCI Applicability Bases. 3.e. Suppression Chamber Water LevelHigh Excessively high suppression pool water could impact operation of the HPCI and Reactor Core Isolation Cooling (RCIC) exhaust vacuum breakers resulting in an inoperable HPCI or RCIC System. Therefore, signals indicating high suppression pool water level are used to transfer the suction source of HPCI from the CST to the suppression pool to eliminate the possibility of HPCI continuing to provide additional water from a source outside containment. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valves must be open before the CST suction valve automatically closes. The Function is assumed to actuate for the small line break events (up to 1 nominal) where HPCI is the preferred event response system. The Suppression Chamber Water LevelHigh signal is initiated from two level switches. The logic is arranged such that either switch can cause the suppression pool suction valves to open and the CST suction valve to close. The Allowable Value for the Suppression Chamber Water Level High Function is chosen to ensure that HPCI will be aligned for suction from the suppression pool before the water level reaches the point at which the HPCI and RCIC exhaust vacuum breakers become inoperable. The Allowable Value is referenced from the suppression chamber water level zero. Suppression chamber water level zero is one inch below the torus centerline. (continued) Brunswick Unit 2 B 3.3.5.1-16 Revision No. 33

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.e. Suppression Chamber Water LevelHigh (continued) SAFETY ANALYSES LCO, and Two channels of Suppression Chamber Water LevelHigh Function APPLICABILITY are required to be OPERABLE only when HPCI is required to be to OPERABLE ensure that no single instrument failure can preclude HPCI swap to suppression pool source. Refer to LCO 3.5.1 for HPCI Applicability Bases. Automatic Depressurization System (ADS) 4.a, 5.a. Reactor Vessel Water LevelLow Level 3 Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, ADS receives one of the signals necessary for initiation from this Function. The Reactor Vessel Water LevelLow Level 3 is one of the Functions assumed to be OPERABLE and capable of initiating the ADS during the events analyzed in Reference 2. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. Reactor Vessel Water LevelLow Level 3 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water LevelLow Level 3 Function are required to be OPERABLE only when ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. Two channels input to ADS trip system A, while the other two channels input to ADS trip system B. Refer to LCO 3.5.1 for ADS Applicability Bases. The Reactor Vessel Water LevelLow Level 3 Allowable Value is chosen to allow time for the low pressure core flooding systems to initiate and provide adequate cooling. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. (continued) Brunswick Unit 2 B 3.3.5.1-17 Revision No. 62

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 4.b, 5.b. ADS Timer SAFETY ANALYSES LCO, and The purpose of the ADS Timer is to delay depressurization of the reactor APPLICABILITY vessel to allow the HPCI System time to maintain reactor vessel water (continued) level. Since the rapid depressurization caused by ADS operation is one of the most severe transients on the reactor vessel, its occurrence should be limited. By delaying initiation of the ADS Function, the operator is given the chance to monitor the success or failure of the HPCI System to maintain water level, and then to decide whether or not to allow ADS to initiate, to delay initiation further by recycling the timer, or to inhibit initiation permanently. The ADS Timer Function is assumed to be OPERABLE for the accident analyses of Reference 2 that require ECCS initiation and assume unavailability of the HPCI System. There are two ADS Timer relays, one in each of the two ADS trip systems. The Allowable Value for the ADS Timer is chosen to be long enough to allow HPCI to start and avoid an inadvertent blowdown yet short enough so that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling. Two channels of the ADS Timer Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. One channel inputs to ADS trip system A, while the other channel inputs to ADS trip system B. Refer to LCO 3.5.1 for ADS Applicability Bases. 4.c, 5.c. Reactor Vessel Water LevelLow Level 1 The Reactor Vessel Water LevelLow Level 1 Function is used by the ADS only as a confirmatory low water level signal. ADS receives one of the signals necessary for initiation from Reactor Vessel Water Level Low Level 3 signals. In order to prevent spurious initiation of the ADS due to spurious Level 3 signals, a Level 1 signal must also be received before ADS initiation commences. Reactor Vessel Water LevelLow Level 1 signals are initiated from two level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Allowable Value for (continued) Brunswick Unit 2 B 3.3.5.1-18 Revision No. 62

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 4.c, 5.c. Reactor Vessel Water LevelLow Level 1 (continued) SAFETY ANALYSES, LCO, and Reactor Vessel Water LevelLow Level 1 is selected at the RPS Level 1 APPLICABILITY scram Allowable Value for convenience. Refer to LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," for the Bases discussion of this Function. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. Two channels of Reactor Vessel Water LevelLow Level 1 Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. One channel inputs to ADS trip system A, while the other channel inputs to ADS trip system B. Refer to LCO 3.5.1 for ADS Applicability Bases. 4.d, 4.e, 5.d, 5.e. Core Spray and RHR (LPCI Mode) Pump Discharge PressureHigh The Pump Discharge PressureHigh signals from the CS and RHR pumps are used as permissives for ADS initiation, indicating that there is a source of low pressure cooling water available once the ADS has depressurized the vessel. Pump Discharge PressureHigh is one of the Functions assumed to be OPERABLE and capable of permitting ADS initiation during the events analyzed in Reference 2 with an assumed HPCI unavailability. For these events the ADS depressurizes the reactor vessel so that the low pressure ECCS can perform the core cooling functions. This core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. Pump discharge pressure signals are initiated from twelve pressure switches, two on the discharge side of each of the six low pressure ECCS pumps. In order to generate an ADS permissive in one trip system, it is necessary that only one CS pump (both channels for the pump) indicate the high discharge pressure condition or two RHR pumps in one LPCI loop (one channel for each pump) indicate a high discharge pressure condition. The Pump Discharge PressureHigh Allowable Value is less than the pump discharge pressure when the pump is operating at all flow ranges and high enough to avoid any condition that results in a discharge (continued) Brunswick Unit 2 B 3.3.5.1-19 Revision No. 62

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 4.d, 4.e, 5.d, 5.e. Core Spray and RHR (LPCI Mode) Pump Discharge SAFETY ANALYSES, PressureHigh (continued) LCO, and APPLICABILITY pressure permissive when the CS and LPCI pumps are aligned for injection and the pumps are not running. The actual operating point of this function is not assumed in any transient or accident analysis. Twelve channels of Core Spray and RHR (LPCI Mode) Pump Discharge PressureHigh Functions are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. Two CS channels associated with CS pump B and four LPCI channels associated with RHR pumps B and D are required for trip system A. Two CS channels associated with CS pump A and four LPCI channels associated with RHR pumps A and C are required for trip system B. Refer to LCO 3.5.1 for ADS Applicability Bases. ACTIONS A Note has been provided to modify the ACTIONS related to ECCS instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable ECCS instrumentation channels provide appropriate compensatory measures for separate inoperable Condition entry for each inoperable ECCS instrumentation channel. A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.1-1. The applicable Condition referenced in the Table is Function dependent. Each time a channel is discovered inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition. (continued) Brunswick Unit 2 B 3.3.5.1-20 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.1, B.2, and B.3 (continued) Required Actions B.1 and B.2 are intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in redundant automatic initiation capability being lost for the feature(s). Required Action B.1 features would be those that are initiated by Functions 1.a, 1.b, 2.a, and 2.b (e.g., low pressure ECCS). The Required Action B.2 system would be HPCI. For Required Action B.1, redundant automatic initiation capability is lost if (a) two Function 1.a channels are inoperable and untripped in the same trip system, (b) two Function 2.a channels are inoperable and untripped in the same trip system, (c) two Function 1.b channels are inoperable and untripped in the same system, or (d) two Function 2.b channels are inoperable and untripped in the same trip system. For low pressure ECCS, since each inoperable channel would have Required Action B.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion of the associated system of low pressure ECCS and DGs to be declared inoperable. However, since channels in both associated low pressure ECCS subsystems (e.g., both CS subsystems) are inoperable and untripped, and the Completion Times started concurrently for the channels in both subsystems, this results in the affected portions in the associated low pressure ECCS and DGs being concurrently declared inoperable. For Required Action B.2, redundant automatic initiation capability is lost if two Function 3.a or two Function 3.b channels are inoperable and untripped in the same trip system. In this situation (loss of redundant automatic initiation capability), the 24 hour allowance of Required Action B.3 is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared inoperable within 1 hour. As noted (Note 1 to Required Action B.1), Required Action B.1 is only applicable in MODES 1, 2, and 3. In MODES 4 and 5, the specific initiation time of the low pressure ECCS is not assumed and the probability of a LOCA is lower. Thus, a total loss of initiation capability for 24 hours (as allowed by Required Action B.3) is allowed during MODES 4 and 5. There is no similar Note provided for Required Action B.2 since HPCI instrumentation is not required in MODES 4 and 5; thus, a Note is not necessary. (continued) Brunswick Unit 2 B 3.3.5.1-21 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.1, B.2, and B.3 (continued) Notes are also provided (Note 2 to Required Action B.1 and the Note to Required Action B.2) to delineate which Required Action is applicable for each Function that requires entry into Condition B if an associated channel is inoperable. This ensures that the proper loss of initiation capability check is performed. Required Action B.1 (the Required Action for certain inoperable channels in the low pressure ECCS subsystems) is not applicable to Function 2.e, since this Function provides backup to administrative controls ensuring that operators do not divert LPCI flow from injecting into the core when needed. Thus, a total loss of Function 2.e capability for 24 hours is allowed, since the LPCI subsystems remain capable of performing their intended function. The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action B.1, the Completion Time only begins upon discovery that a redundant feature in the same system (e.g., both CS subsystems) cannot be automatically initiated due to inoperable, untripped channels within the same Function as described in the paragraph above. For Required Action B.2, the Completion Time only begins upon discovery that the HPCI System cannot be automatically initiated due to two inoperable, untripped channels for the associated Function in the same trip system. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels. Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 7) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.3. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. (continued) Brunswick Unit 2 B 3.3.5.1-22 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.1, B.2, and B.3 (continued) Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition G must be entered and its Required Action taken. C.1 and C.2 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Function result in redundant automatic initiation capability being lost for the feature(s). Required Action C.1 features would be those that are initiated by Functions 1.c, 1.d, 2.c, 2.d, and 2.f (i.e., low pressure ECCS). Redundant automatic initiation capability is lost if either (a) two Function 1.c channels are inoperable in the same trip system, (b) two Function 2.c channels are inoperable in the same trip system, (c) two Function 2.d channels are inoperable in the same trip system, or (d) two or more required Function 1.d and 2.f channels associated with low pressure ECCS pumps powered from separate 4.16 kV emergency buses are inoperable. Since each inoperable channel would have Required Action C.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion of the associated system of low pressure ECCS and DGs to be declared inoperable. However, since channels for both associated low pressure ECCS subsystems are inoperable (e.g., both CS subsystems), and the Completion Times started concurrently for the channels in both subsystems, this results in the affected portions in the associated low pressure ECCS and DGs being concurrently declared inoperable. For Functions 1.d and 2.f, the affected portions are the associated low pressure ECCS pumps. In this situation (loss of redundant automatic initiation capability), the 24 hour allowance of Required Action C.2 is not appropriate and the feature(s) associated with the inoperable channels must be declared inoperable within 1 hour. As noted (Note 1 to Required Actions C.1), Required Action C.1 is only applicable in MODES 1, 2, and 3. In MODES 4 and 5, the specific initiation time of the ECCS is not assumed and the probability of a LOCA occurring during the period the channels (continued) Brunswick Unit 2 B 3.3.5.1-23 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS C.1 and C.2 (continued) are inoperable is low. Thus, a total loss of automatic initiation capability for 24 hours (as allowed by Required Action C.2) is allowed during MODES 4 and 5. Note 2 to Required Action C.1 states that it is only applicable for Functions 1.c, 1.d, 2.c, 2.d, and 2.f. Required Action C.1 is not applicable to Function 3.c (which also requires entry into this Condition if a channel in this Function is inoperable), since the loss of one channel results in a loss of the Function (two-out-of-two logic). This loss was considered during the development of Reference 7 and considered acceptable for the 24 hours allowed by Required Action C.2. The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action C.1, the Completion Time only begins upon discovery that the same feature in both subsystems (e.g., both CS subsystems) cannot be automatically initiated due to inoperable channels within the same Function as described in the paragraph above. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels. Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 7) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition G must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action would either cause the initiation or it would not necessarily result in a safe state for the channel in all events. (continued) Brunswick Unit 2 B 3.3.5.1-24 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued) Required Action D.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic component initiation capability for the HPCI System. Automatic component initiation capability is lost if two Function 3.d channels or two Function 3.e channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour allowance of Required Actions D.2.1 and D.2.2 is not appropriate and the HPCI System must be declared inoperable within 1 hour after discovery of loss of HPCI initiation capability. As noted, Required Action D.1 is only applicable if the HPCI pump suction is not aligned to the suppression pool, since, if aligned, the Function is already performed. The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action D.1, the Completion Time only begins upon discovery that the HPCI System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Function as described in the paragraph above. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels. Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 7) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1 or the suction source must be aligned to the suppression pool per Required Action D.2.2. Placing the inoperable channel in trip performs the intended function of the channel (shifting the suction source to the suppression pool). Performance of either of these two Required Actions will allow operation to continue. If Required Action D.2.1 or D.2.2 is performed, measures should be taken to ensure that the HPCI System piping remains filled with water. Alternately, if it is not desired to perform Required Actions D.2.1 (continued) Brunswick Unit 2 B 3.3.5.1-25 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued) and D.2.2 (e.g., as in the case where shifting the suction source could drain down the HPCI suction piping), Condition G must be entered and its Required Action taken. E.1 and E.2 Required Action E.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within similar ADS trip system A and B Functions result in redundant automatic initiation capability being lost for the ADS. Redundant automatic initiation capability is lost if either (a) one Function 4.a channel and one Function 5.a channel are inoperable and untripped, or (b) one Function 4.c channel and one Function 5.c channel are inoperable and untripped. In this situation (loss of automatic initiation capability), the 96 hour or 8 day allowance, as applicable, of Required Action E.2 is not appropriate and all ADS valves must be declared inoperable within 1 hour after discovery of loss of ADS initiation capability. The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action E.1, the Completion Time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable, untripped channels within similar ADS trip system Functions as described in the paragraph above. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels. Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 7) to permit restoration of any inoperable channel to OPERABLE status if both HPCI and RCIC are OPERABLE. If either HPCI or RCIC is inoperable, the time is shortened to 96 hours. If the status of HPCI or RCIC changes such that the Completion Time changes from 8 days to 96 hours, the 96 hours (continued) Brunswick Unit 2 B 3.3.5.1-26 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS E.1 and E.2 (continued) begins upon discovery of HPCI or RCIC inoperability. However, the total time for an inoperable, untripped channel cannot exceed 8 days. If the status of HPCI or RCIC changes such that the Completion Time changes from 96 hours to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable, untripped channel. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action E.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition G must be entered and its Required Action taken. F.1 and F.2 Required Action F.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within similar ADS trip system A and B Functions result in redundant automatic initiation capability being lost for the ADS. Redundant automatic initiation capability is lost if either (a) one Function 4.b channel and one Function 5.b channel are inoperable, or (b) a combination of Function 4.d, 4.e, 5.d, and 5.e channels are inoperable such that channels associated with both CS pumps and one RHR pump in each LPCI loop are inoperable. In this situation (loss of automatic initiation capability), the 96 hour or 8 day allowance, as applicable, of Required Action F.2 is not appropriate and all ADS valves must be declared inoperable within 1 hour after discovery of loss of ADS initiation capability. The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action F.1, the Completion Time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable channels within similar ADS trip system (continued) Brunswick Unit 2 B 3.3.5.1-27 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS F.1 and F.2 (continued) Functions as described in the paragraph above. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels. Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 7) to permit restoration of any inoperable channel to OPERABLE status if both HPCI and RCIC are OPERABLE (Required Action F.2). If either HPCI or RCIC is inoperable, the time shortens to 96 hours. If the status of HPCI or RCIC changes such that the Completion Time changes from 8 days to 96 hours, the 96 hours begins upon discovery of HPCI or RCIC inoperability. However, the total time for an inoperable channel cannot exceed 8 days. If the status of HPCI or RCIC changes such that the Completion Time changes from 96 hours to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable channel. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition G must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events. G.1 With any Required Action and associated Completion Time not met, the associated feature(s) may be incapable of performing the intended function, and the supported feature(s) associated with inoperable untripped channels must be declared inoperable immediately. SURVEILLANCE As noted (Note 1) in the beginning of the SRs, the SRs for each ECCS REQUIREMENTS instrumentation Function are found in the SRs column of Table 3.3.5.1-1. The Surveillances are modified by a Note (Note 2) to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours as follows: (a) for Function 3.c; (continued) Brunswick Unit 2 B 3.3.5.1-28 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE and (b) for Functions other than 3.c provided the associated Function or REQUIREMENTS redundant Function maintains ECCS initiation capability. Upon (continued) completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 7) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the ECCS will initiate when necessary. SR 3.3.5.1.1 Performance of the CHANNEL CHECK once every 24 hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK guarantees that undetected outright channel failure is limited to 24 hours; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based upon operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO. SR 3.3.5.1.2 and SR 3.3.5.1.6 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. Any (continued) Brunswick Unit 2 B 3.3.5.1-29 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.2 and SR 3.3.5.1.6 (continued) REQUIREMENTS setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The 92 day Frequency of SR 3.3.5.1.2 is based on the reliability analyses of Reference 7. The 24 month Frequency of SR 3.3.5.1.6 is based on engineering judgment and the reliability of the components. SR 3.3.5.1.3 Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.5.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analyses. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than the setting accounted for in the appropriate setpoint methodology. The Frequency of 92 days is based on the reliability analysis of Reference 7. SR 3.3.5.1.4 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The Frequency is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. (continued) Brunswick Unit 2 B 3.3.5.1-30 Revision No. 30

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.5 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic and simulated automatic operation for a specific channel. The system functional testing performed in LCO 3.5.1, LCO 3.5.2, LCO 3.8.1, and LCO 3.8.2 overlaps this Surveillance to complete testing of the assumed safety function. Based on minimal assumed risk in performing this Surveillance with the reactor at power, the surveillance is not required to be performed during a refueling outage. Operating experience has demonstrated that these components will usually pass the SR when performed at the 24 month Frequency (originally based on the refueling cycle). Therefore, the Frequency is concluded to be acceptable from a reliability standpoint. REFERENCES 1. UFSAR, Section 5.2.

2. UFSAR, Section 6.3.

3. UFSAR, Chapter 15.

4. 10 CFR 50.36(c)(2)(ii).

5. (Deleted.)

6. UFSAR, Section 9.2.6.2.

7. NEDC-30936-P-A, BWR Owners' Group Technical Specification Improvement Methodology (With Demonstration for BWR ECCS Actuation Instrumentation), Parts 1 and 2, December 1988.

Brunswick Unit 2 B 3.3.5.1-31 Revision No. 62

RCIC System Instrumentation B 3.3.5.2 B 3.3 INSTRUMENTATION B 3.3.5.2 Reactor Core Isolation Cooling (RCIC) System Instrumentation BASES BACKGROUND The purpose of the RCIC System instrumentation is to initiate actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is insufficient or unavailable, such that RCIC System initiation occurs and maintains sufficient reactor water level such that initiation of the low pressure Emergency Core Cooling Systems (ECCS) pumps does not occur. A more complete discussion of RCIC System operation is provided in the Bases of LCO 3.5.3, "RCIC System." The RCIC System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level Low Level 2. The variable is monitored by four transmitters that are connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic arrangement. The RCIC test line isolation valve is closed on a RCIC initiation signal to allow full system flow. The RCIC System also monitors the water levels in the condensate storage tank (CST) since this is the initial source of water for RCIC operation. Reactor grade water in the CST is the normal source. Upon receipt of a RCIC initiation signal, the CST suction valve is automatically signaled to open. If the water level in the CST falls below a preselected level, first the RCIC suppression pool suction valves automatically open, and then the RCIC CST suction valve automatically closes. Two level switches are used to detect low water level in the CST. Either switch can cause the suppression pool suction valves to open and the CST suction valve to close (one-out-of-two logic). To prevent losing suction to the pump, the suction valves are interlocked so that one suction path must be open before the other automatically closes. (continued) Brunswick Unit 2 B 3.3.5.2-1 Revision No. 30

RCIC System Instrumentation B 3.3.5.2 BASES BACKGROUND The RCIC System provides makeup water to the reactor until the reactor (continued) vessel water level reaches the high water level trip (two-out-of-two logic), at which time the RCIC steam supply valve closes. The RCIC System restarts if vessel level again drops to the low level initiation point (Level 2). APPLICABLE The function of the RCIC System to provide makeup coolant to the SAFETY ANALYSES, reactor is used to respond to transient events. The RCIC System is not LCO, and an Engineered Safety Feature System and no credit is taken in the safety APPLICABILITY analyses for RCIC System operation. Based on its contribution to the reduction of overall plant risk, however, the system, and therefore its instrumentation, meets Criterion 4 of 10 CFR 50.36(c)(2)(ii) (Ref. 1). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion. The OPERABILITY of the RCIC System instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.2-1. Each Function must have a required number of OPERABLE channels with their setpoints within the specified Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Allowable Values are specified for each RCIC System instrumentation Function specified in Table 3.3.5.2-1. Trip setpoints are specified in the setpoint calculations. The setpoints are selected to ensure that the trip settings do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setting is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint (continued) Brunswick Unit 2 B 3.3.5.2-2 Revision No. 30

RCIC System Instrumentation B 3.3.5.2 BASES APPLICABLE values, by accounting for calibration based errors. These calibration SAFETY ANALYSES, based errors are limited to instrument drift, errors associated with LCO, and measurement and test equipment, and calibration tolerance of loop APPLICABILITY components. The trip setpoints and Allowable Values determined in this (continued) manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation. The individual Functions are required to be OPERABLE in MODE 1, and in MODES 2 and 3 with reactor steam dome pressure > 150 psig since this is when RCIC is required to be OPERABLE. Refer to LCO 3.5.3 for Applicability Bases for the RCIC System. The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Reactor Vessel Water LevelLow Level 2 Low reactor pressure vessel (RPV) water level indicates that normal feedwater flow is insufficient to maintain reactor vessel water level and that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the RCIC System is initiated at Level 2 to assist in maintaining water level above the top of the active fuel.

Reactor Vessel Water LevelLow Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Water LevelLow Level 2 Allowable Value is set high enough such that for complete loss of feedwater flow, the RCIC System flow with high pressure coolant injection assumed to fail will be sufficient to avoid initiation of low pressure ECCS at Level 3. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. (continued) Brunswick Unit 2 B 3.3.5.2-3 Revision No. 30

RCIC System Instrumentation B 3.3.5.2 BASES APPLICABLE 1. Reactor Vessel Water LevelLow Level 2 (continued) SAFETY ANALYSES, LCO, and Four channels of Reactor Vessel Water LevelLow Level 2 Function are APPLICABILITY available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases.

2. Reactor Vessel Water LevelHigh High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel.

Therefore, the high water level signal is used to close the RCIC steam supply valve to prevent overflow into the main steam lines (MSLs). Reactor Vessel Water LevelHigh signals for RCIC are initiated from two level transmitters from the narrow range water level measurement instrumentation, which sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Water LevelHigh Allowable Value is high enough to preclude isolating the injection valve of the RCIC during normal operation, yet low enough to trip the RCIC System to prevent reactor vessel overfill. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. Two channels of Reactor Vessel Water LevelHigh Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases.

3. Condensate Storage Tank LevelLow Low level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source. Normally, the suction valve between the RCIC pump and the CST is open and, upon receiving a RCIC initiation signal, water for RCIC injection would be taken from the CST. However, if the water level in the CST falls below a preselected level, first the suppression pool suction valves automatically open, and (continued)

Brunswick Unit 2 B 3.3.5.2-4 Revision No. 30

RCIC System Instrumentation B 3.3.5.2 BASES APPLICABLE 3. Condensate Storage Tank LevelLow (continued) SAFETY ANALYSES, LCO, and then the CST suction valve automatically closes. This ensures that an APPLICABILITY adequate supply of makeup water is available to the RCIC pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valves must be open before the CST suction valve automatically closes. Two level switches are used to detect low water level in the CST. The Condensate Storage Tank LevelLow Function Allowable Value is set high enough to ensure adequate pump suction head while water is being taken from the CST. Two channels of Condensate Storage Tank LevelLow Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source. Refer to LCO 3.5.3 for RCIC Applicability Bases. ACTIONS A Note has been provided to modify the ACTIONS related to RCIC System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RCIC System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable RCIC System instrumentation channel. A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.2-1. The applicable Condition referenced in the Table is Function dependent. Each time a channel is discovered to be inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition. (continued) Brunswick Unit 2 B 3.3.5.2-5 Revision No. 30

RCIC System Instrumentation B 3.3.5.2 BASES ACTIONS B.1 and B.2 (continued) Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the RCIC System. In this case, automatic initiation capability is lost if two Function 1 channels in the same trip system are inoperable and untripped. In this situation (loss of automatic initiation capability), the 24 hour allowance of Required Action B.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour after discovery of loss of RCIC initiation capability. The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action B.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically initiated due to two inoperable, untripped Reactor Vessel Water Level Low Level 2 channels in the same trip system. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels. Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 2) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition E must be entered and its Required Action taken. (continued) Brunswick Unit 2 B 3.3.5.2-6 Revision No. 30

RCIC System Instrumentation B 3.3.5.2 BASES ACTIONS C.1 (continued) A risk based analysis was performed and determined that an allowable out of service time of 24 hours (Ref. 2) is acceptable to permit restoration of any inoperable channel to OPERABLE status (Required Action C.1). A Required Action (similar to Required Action B.1) limiting the allowable out of service time, if a loss of automatic RCIC initiation capability exists, is not required. This Condition applies to the Reactor Vessel Water Level High Function whose logic is arranged such that any inoperable channel will result in a loss of automatic RCIC initiation capability (loss of high water level trip capability). As stated above, this loss of automatic RCIC initiation capability was analyzed and determined to be acceptable. One inoperable channel may result in a loss of high water level trip capability but will not prevent RCIC System automatic start capability. However, the Required Action does not allow placing a channel in trip since this action would not necessarily result in a safe state for the channel in all events (a failure of the remaining channel could prevent a RCIC System start). D.1, D.2.1, and D.2.2 Required Action D.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in automatic component initiation capability being lost for the feature(s). For Required Action D.1, the RCIC System is the only associated feature. In this case, automatic initiation capability is lost if two Function 3 channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour allowance of Required Actions D.2.1 and D.2.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour from discovery of loss of RCIC initiation capability. As noted, Required Action D.1 is only applicable if the RCIC pump suction is not aligned to the suppression pool since, if aligned, the Function is already performed. The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." (continued) Brunswick Unit 2 B 3.3.5.2-7 Revision No. 30

RCIC System Instrumentation B 3.3.5.2 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued) For Required Action D.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Function. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels. Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 2) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1, which performs the intended function of the channel (shifting the suction source to the suppression pool). Alternatively, Required Action D.2.2 allows the manual alignment of the RCIC suction to the suppression pool, which also performs the intended function. If Required Action D.2.1 or D.2.2 is performed, measures should be taken to ensure that the RCIC System piping remains filled with water. If it is not desired to perform Required Actions D.2.1 and D.2.2 (e.g., as in the case where shifting the suction source could drain down the RCIC suction piping), Condition E must be entered and its Required Action taken. E.1 With any Required Action and associated Completion Time not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately. SURVEILLANCE As noted in the beginning of the SRs, the SRs for each RCIC System REQUIREMENTS instrumentation Function are found in the SRs column of Table 3.3.5.2-1. (continued) Brunswick Unit 2 B 3.3.5.2-8 Revision No. 30

RCIC System Instrumentation B 3.3.5.2 BASES SURVEILLANCE The Surveillances are modified by a Note to indicate that when a channel REQUIREMENTS is placed in an inoperable status solely for performance of required (continued) Surveillances, entry into associated Conditions and Required Actions may be delayed as follows: (a) for up to 6 hours for Function 2; and (b) for up to 6 hours for Functions 1 and 3, provided the associated Function maintains RCIC initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 2) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the RCIC will initiate when necessary. SR 3.3.5.2.1 Performance of the CHANNEL CHECK once every 24 hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a parameter on other similar channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based upon operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO. (continued) Brunswick Unit 2 B 3.3.5.2-9 Revision No. 30

RCIC System Instrumentation B 3.3.5.2 BASES SURVEILLANCE SR 3.3.5.2.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Frequency of 92 days is based on the reliability analysis of Reference 2. SR 3.3.5.2.3 The calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.5.2-1. If the trip setting is discovered to be less conservative than the setting accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology. The Frequency of 92 days is based on the reliability analysis of Reference 2. SR 3.3.5.2.4 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The Frequency is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. (continued) Brunswick Unit 2 B 3.3.5.2-10 Revision No. 30

RCIC System Instrumentation B 3.3.5.2 BASES SURVEILLANCE SR 3.3.5.2.5 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel and includes simulated automatic actuation of the channel. The system functional testing performed in LCO 3.5.3 overlaps this Surveillance to provide complete testing of the safety function. Based on minimal assumed risk in performing this Surveillance with the reactor at power, the surveillance is not required to be performed during a refueling outage. Operating experience has demonstrated that these components will usually pass the SR when performed at the 24 month Frequency (originally based on the refueling cycle). Therefore, the Frequency is concluded to be acceptable from a reliability standpoint. REFERENCES 1. 10 CFR 50.36(c)(2)(ii).

2. GENE-770-06-2P-A, Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications, December 1992.

Brunswick Unit 2 B 3.3.5.2-11 Revision No. 42

Primary Containment Isolation Instrumentation B 3.3.6.1 B 3.3 INSTRUMENTATION B 3.3.6.1 Primary Containment Isolation Instrumentation BASES BACKGROUND The primary containment isolation instrumentation automatically initiates closure of appropriate primary containment isolation valves (PCIVs). The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs). Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA. The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of primary containment and reactor coolant pressure boundary (RCPB) isolation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a primary containment isolation signal to the isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logics are (a) reactor vessel water level, (b) area ambient and differential temperatures, (c) main steam line (MSL) flow measurement, (d) Standby Liquid Control (SLC) System initiation, (e) condenser vacuum, (f) main steam line pressure, (g) high pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) steam line flow, (h) drywell pressure, (i) HPCI and RCIC steam line pressure, (j) HPCI and RCIC turbine exhaust diaphragm pressure, (k) reactor water cleanup (RWCU) differential flow, (l) reactor steam dome pressure, (m) main stack radiation, and (n) reactor building exhaust radiation. Redundant sensor input signals from each parameter are provided for initiation of isolation. The exceptions are SLC System initiation and main stack radiation. Primary containment isolation instrumentation has inputs to the trip logic of the isolation functions listed below. (continued) Brunswick Unit 2 B 3.3.6.1-1 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 1. Main Steam Line Isolation (continued) Most MSL Isolation Functions receive inputs from four channels. The outputs from these channels are combined in a one-out-of-two taken twice logic to initiate isolation of all main steam isolation valves (MSIVs). The outputs from the same channels are arranged into two two-out-of-two logic trip systems to isolate all MSL drain valves. Each MSL drain line has two isolation valves with one two-out-of-two logic system associated with each valve. The exceptions to this arrangement are the Main Steam Line FlowHigh Function and the Main Steam Isolation Valve Pit TemperatureHigh Function. The Main Steam Line FlowHigh Function uses 16 flow channels, four for each steam line. One channel from each steam line inputs to one of the four trip strings. Two trip strings make up each trip system and both trip systems must trip to cause an MSL isolation. Each trip string has four inputs (one per MSL), any one of which will trip the trip string. The trip strings are arranged in a one-out-of-two taken twice logic. This is effectively a one-out-of-eight taken twice logic arrangement to initiate isolation of the MSIVs. Similarly, the 16 flow channels are connected into two two-out-of-two logic trip systems (effectively, two one-out-of-four twice logic), with each trip system required to isolate one of the two MSL drain valves on the associated steam line. The Main Steam Line FlowHigh (Not in Run) Function uses four flow channels, one for each steam line. The outputs from these channels are arranged in one-out-of-two taken twice logic trip systems to isolate all MSIVs and MSL drain valves. The Main Steam Isolation Valve Pit TemperatureHigh Function consists of the four MSL tunnel temperature monitoring channels that sense temperature in the MSIV pit. Each channel receives input from an individual temperature switch. The inputs are arranged in a one-out-of-two taken twice logic to isolate all MSIVs. Similarly, the inputs are arranged in two two-out-of-two logic trip systems, with each trip system required to isolate the two MSL drain valves per drain line. MSL Isolation Functions isolate the Group 1 valves. (continued) Brunswick Unit 2 B 3.3.6.1-2 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 2. Primary Containment Isolation (continued) Primary Containment Isolation Functions associated with Reactor Vessel Water LevelLow Level 1 and Drywell PressureHigh receive inputs from four channels. The outputs from these channels are arranged into one-out-of-two taken twice logics. One trip system initiates isolation of all inboard primary containment isolation valves, while the other trip system initiates isolation of all outboard primary containment isolation valves. Each logic closes one of the two valves on each penetration, so that operation of either logic isolates the penetration. The Main Stack Radiation-High Function receives input from one channel. The output from this channel is provided to each of two one-out-of-one logic trip systems. Each trip system isolates both valves in the associated penetration. The Reactor Building Radiation-High Function receives input from two channels. The outputs from these channels are arranged into two one-out-of-one logic trip systems. Each trip system isolates one valve per associated penetration. Primary Containment Isolation Drywell PressureHigh and Reactor Vessel Water LevelLow Level 1 Functions isolate the Group 2 and 6 valves. The Drywell PressureHigh Function in conjunction with reactor low pressure isolates Group 10 valves. Primary Containment Isolation Main Stack RadiationHigh Function isolates the containment purge and vent valves. Reactor Building Exhaust RadiationHigh Function isolates the Group 6 valves. 3, 4. High Pressure Coolant Injection System Isolation and Reactor Core Isolation Cooling System Isolation Most Functions that isolate HPCI and RCIC receive input from two channels, with each channel in one trip system using a one-out-of-one logic. Each of the two trip systems in each isolation group is connected to one of the two valves on each associated penetration. The exceptions are the HPCI and RCIC Turbine Exhaust Diaphragm PressureHigh, Steam Supply Line PressureLow, and Equipment Area TemperatureHigh Functions. The HPCI and RCIC Turbine Exhaust Diaphragm PressureHigh and Steam Supply Line Pressure Low functions receive inputs from four turbine exhaust diaphragm pressure and four steam supply pressure channels for each system. The RCIC Equipment Area TemperatureHigh function receives inputs from three equipment area temperature channels for each system. The HPCI Equipment Area TemperatureHigh Function receives seven total equipment area temperature inputs broken into Channel A, which receives three inputs, and Channel B, which receives four inputs. (continued) Brunswick Unit 2 B 3.3.6.1-3 Revision No. 66

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 3, 4. High Pressure Coolant Injection System Isolation and Reactor Core Isolation Cooling System Isolation (continued) The outputs from the turbine exhaust diaphragm pressure and steam supply pressure channels are each connected to two two-out-of-two trip systems. The outputs from the equipment area temperature channels are connected to two one-out-of-two trip systems. In addition, the output from one channel per trip system of the Steam Supply Line PressureLow Function coincident with a high drywell pressure signal will initiate isolation of the associated HPCI and RCIC turbine exhaust line vacuum breaker isolation valves. Each trip system isolates one valve per associated penetration. HPCI and RCIC Functions isolate the Group 4, 5, 7, and 9 valves.

5. Reactor Water Cleanup System Isolation The Reactor Vessel Water LevelLow Level 2 Isolation Function receives input from four reactor vessel water level channels. The outputs from the reactor vessel water level channels are connected into two two-out-of-two trip systems. The Differential Flow-High Function receives input from one channel. The output from this channel is provided to each of two one-out-of-one logic trip systems. The Piping Outside RWCU Rooms Area Temperature-High Function receives input from two channels with each channel in one trip system using a one-out-of-one logic. The Area TemperatureHigh Function receives input from six temperature monitors, three to each trip system. The Area Ventilation Differential TemperatureHigh Function receives input from six differential temperature monitors, three in each trip system. These are configured so that any one input will trip the associated trip system. Each of the two trip systems is connected to one of the two valves on each RWCU penetration. The SLC System Initiation Function receives input from one channel. The output from this channel is provided to a one-out-of-one logic trip system. The trip system isolates the RWCU suction outboard isolation valve.

RWCU Functions isolate the Group 3 valves. (continued) Brunswick Unit 2 B 3.3.6.1-4 Revision No. 66

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 6. Shutdown Cooling System Isolation (continued) The Reactor Vessel Water LevelLow Level 1 Function receives input from four reactor vessel water level channels. The outputs from the reactor vessel water level channels are connected to two one-out-of-two taken twice logic trip systems. The Reactor Vessel PressureHigh Function receives input from two channels, with each channel in one trip system using a one-out-of-one logic. Each of the two trip systems is connected to one of the two valves on each shutdown cooling penetration. Shutdown Cooling System Isolation Functions isolate the Group 8 valves.

7. Traversing In-Core Probe (TIP) Isolation The Reactor Vessel Water Level - Low, Level 1 Isolation Function receives input from two reactor vessel water level channels. The outputs from the reactor vessel water level channels are connected into one two-out-of two logic trip system. The Drywell Pressure - High Isolation Function receives input from two drywell pressure channels. The outputs from the drywell pressure channels are connected into one two-out-of two logic trip system.

When either Isolation Function actuates, the TIP drive mechanisms will withdraw the TIPs, if inserted, and close the inboard TIP system isolation ball valves when the TIPs are fully withdrawn. The outboard TIP system isolation valves are manual shear valves. TIP System Isolation Functions isolate the Group 2 valves (inboard isolation ball valves). APPLICABLE The isolation signals generated by the primary containment isolation SAFETY ANALYSES, instrumentation are implicitly assumed in the safety analyses of LCO, and References 1, 2, and 3 to initiate closure of valves to limit offsite doses. APPLICABILITY Refer to LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)," Applicable Safety Analyses Bases for more detail of the safety analyses. Primary containment isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion. The OPERABILITY of the primary containment instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.6.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Each channel must also respond within its assumed response time, where appropriate. (continued) Brunswick Unit 2 B 3.3.6.1-5 Revision No. 70

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE Allowable Values are specified for each Primary Containment Isolation SAFETY ANALYSES, Function specified in Table 3.3.6.1-1. Trip setpoints are specified in the LCO, and setpoint calculations. The setpoints are selected to ensure that the trip APPLICABILITY settings do not exceed the Allowable Value between CHANNEL (continued) CALIBRATIONS. Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setting is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for calibration based errors. These calibration based instrument errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation. Certain Emergency Core Cooling Systems (ECCS) and RCIC valves (e.g., LPCI injection) also serve the dual function of automatic PCIVs. The signals that isolate these valves are also associated with the automatic initiation of the ECCS and RCIC. The instrumentation requirements and ACTIONS associated with these signals are addressed in LCO 3.3.5.1, "Emergency Core Cooling Systems (ECCS) Instrumentation," and LCO 3.3.5.2, "Reactor Core Isolation Cooling (RCIC) System Instrumentation," and are not included in this LCO. In general, the individual Functions are required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, "Primary Containment." Functions that have different Applicabilities are discussed below in the individual Functions discussion. The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis. (continued) Brunswick Unit 2 B 3.3.6.1-6 Revision No. 70

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE Main Steam Line Isolation SAFETY ANALYSES, LCO, and 1.a. Reactor Vessel Water LevelLow Level 3 APPLICABILITY (continued) Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of the MSIVs and other interfaces with the reactor vessel occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water LevelLow Level 3 Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals. The Reactor Vessel Water LevelLow Level 3 Function associated with isolation is assumed in the analysis of the recirculation line break (Ref. 1). The isolation of the MSLs on Level 3 supports actions to ensure that offsite dose limits are not exceeded for a DBA. Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water LevelLow Level 3 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Reactor Vessel Water LevelLow Level 3 Allowable Value is chosen to be the same as the ECCS Level 3 Allowable Value (LCO 3.3.5.1) to ensure that the MSLs isolate on a potential loss of coolant accident (LOCA) to prevent offsite doses from exceeding 10 CFR 50.67 limits. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. This Function isolates the Group 1 valves. 1.b. Main Steam Line PressureLow Low MSL pressure indicates that there may be a problem with the turbine pressure regulation, which could result in a low reactor vessel water level condition and the RPV cooling down more than 100°F/hr if the pressure loss is allowed to continue. The Main Steam Line PressureLow Function is directly assumed in the analysis of the pressure regulator (continued) Brunswick Unit 2 B 3.3.6.1-7 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.b. Main Steam Line PressureLow (continued) SAFETY ANALYSES LCO, and failure (Ref. 2). For this event, the closure of the MSIVs ensures that no APPLICABILITY significant thermal stresses are imposed on the RPV. In addition, this Function supports actions to ensure that Safety Limit 2.1.1.1 is not exceeded. (This Function closes the MSIVs prior to pressure decreasing below 785 psig, which results in a scram due to MSIV closure, thus reducing reactor power to < 23% RTP.) The MSL low pressure signals are initiated from four transmitters that are connected to the MSL header. The transmitters are arranged such that each transmitter is able to detect low MSL pressure. Four channels of Main Steam Line PressureLow Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Allowable Value was selected to be far enough below normal turbine inlet pressures to avoid spurious isolations, yet high enough to provide timely detection of a pressure regulator malfunction. The Main Steam Line PressureLow Function is only required to be OPERABLE in MODE 1 since this is when the assumed transient can occur (Ref. 2). This Function isolates the Group 1 valves except for sample line isolation valves B32-F019 and B32-F020. 1.c. Main Steam Line FlowHigh Main Steam Line FlowHigh is provided to detect a break of the MSL and to initiate closure of the MSIVs. If the steam were allowed to continue flowing out of the break, the reactor would depressurize and the core could uncover. If the RPV water level decreases too far, fuel damage could occur. Therefore, the isolation is initiated on high flow to prevent or minimize core damage. The Main Steam Line FlowHigh Function is directly assumed in the analysis of the main steam line break (MSLB) (Ref. 5). The isolation action, along with the scram function of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46 and offsite doses do not exceed the 10 CFR 50.67 limits. (continued) Brunswick Unit 2 B 3.3.6.1-8 Revision No. 31

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.c. Main Steam Line FlowHigh (continued) SAFETY ANALYSES, LCO, and The MSL flow signals are initiated from 16 transmitters that are connected APPLICABILITY to the four MSLs. The transmitters are arranged such that, even though physically separated from each other, all four connected to one MSL would be able to detect the high flow. Four channels of Main Steam Line FlowHigh Function for each unisolated MSL (two channels per trip system) are available and are required to be OPERABLE so that no single instrument failure will preclude detecting a break in any individual MSL. The Allowable Value is chosen to be high enough to permit isolation of one main steam line for test at rated power without causing an automatic isolation of the rest of the steam lines, yet low enough to permit early detection of a gross steam line break. This Function isolates the Group 1 valves except for sample line isolation valves B32-F019 and B32-F020. 1.d. Condenser VacuumLow The Condenser VacuumLow Function is provided to prevent overpressurization of the main condenser in the event of a loss of the main condenser vacuum. Since the integrity of the condenser is an assumption in offsite dose calculations, the Condenser VacuumLow Function is assumed to be OPERABLE and capable of initiating closure of the MSIVs. The closure of the MSIVs is initiated to prevent the addition of steam that would lead to additional condenser pressurization and possible rupture, thereby preventing a potential radiation leakage path following an accident. Condenser vacuum pressure signals are derived from four pressure transmitters that sense the pressure in the condenser. Four channels of Condenser VacuumLow Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Allowable Value is chosen to prevent damage to the condenser due to pressurization, thereby ensuring its integrity for offsite dose analysis. As noted (footnote (a) to Table 3.3.6.1-1), the channels are not required (continued) Brunswick Unit 2 B 3.3.6.1-9 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.d. Condenser VacuumLow (continued) SAFETY ANALYSES, LCO, and to be OPERABLE in MODES 2 and 3 when all turbine stop valves (TSVs) APPLICABILITY are closed, since the potential for condenser overpressurization is minimized. Therefore, the channels may be bypassed when all TSVs are closed. This Function isolates the Group 1 valves. 1.e. Main Steam Isolation Valve Pit TemperatureHigh Main steam isolation valve pit temperature is provided to detect a leak in the RCPB and provides diversity to the high flow instrumentation. The isolation occurs when a very small leak has occurred in the main steam isolation valve pit. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. However, credit for these instruments is not taken in any transient or accident analysis in the UFSAR, since bounding analyses are performed for large breaks, such as MSLBs. Main steam isolation valve pit temperature signals are initiated from temperature switches located in the area being monitored. Four channels of Main Steam Isolation Valve Pit TemperatureHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The temperature switches are located or shielded so that they are sensitive to air temperature and not in the radiated heat from hot equipment. The main steam isolation valve pit temperature monitoring Allowable Value is chosen to detect a leak equivalent to between 1% and 10% rated steam flow. This Function isolates the Group 1 valves except for sample line isolation valves B32-F019 and B32-F020. 1.f. Main Steam Line FlowHigh (Not in Run) Main Steam Line FlowHigh (Not in Run) is provided to detect a break of the MSL and to initiate closure of the MSIVs. Malfunction of the pressure regulator for the main turbine bypass valves during MODE 2 or 3 can cause depressurization of the reactor vessel. Therefore, isolation of the (continued) Brunswick Unit 2 B 3.3.6.1-10 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.f. Main Steam Line FlowHigh (Not in Run) (continued) SAFETY ANALYSES, LCO, and main steam lines is initiated on high steam line flow when the mode APPLICABILITY switch is not in run to ensure significant thermal stresses are not imposed on the RPV. This Function is bypassed when the mode switch is in the run mode. With the mode switch in the run mode, depressurization protection is provided by the Main Steam Line PressureLow Function. The MSL flow signals are initiated from four transmitters, each connected to one of the MSLs. Four channels of the Main Steam Line FlowHigh (Not in Run) Function (two channels per trip system) are available and required to be OPERABLE so that no single instrument failure will preclude the isolation function. The Allowable Value was selected to be low enough to provide timely detection of a pressure regulator malfunction. This Function isolates the Group 1 valves except for sample line isolation valves B32-F019 and B32-F020. Primary Containment Isolation 2.a. Reactor Vessel Water LevelLow Level 1 Low RPV water level indicates that the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 1 supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Reactor Vessel Water LevelLow Level 1 Function associated with isolation is implicitly assumed in the UFSAR analysis as these leakage paths are assumed to be isolated post LOCA. Reactor Vessel Water LevelLow Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor (continued) Brunswick Unit 2 B 3.3.6.1-11 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.a. Reactor Vessel Water LevelLow Level 1 (continued) SAFETY ANALYSES, LCO, and Vessel Water LevelLow Level 1 Function are available and are required APPLICABILITY to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Reactor Vessel Water LevelLow Level 1 Allowable Value was chosen to be the same as the RPS Level 1 scram Allowable Value (LCO 3.3.1.1), since isolation of these valves is not critical to orderly plant shutdown. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. This Function isolates the Group 2, 6, and 8 valves. 2.b. Drywell PressureHigh High drywell pressure can indicate a break in the RCPB inside the primary containment. The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Drywell Pressure High Function, associated with isolation of the primary containment, is implicitly assumed in the UFSAR accident analysis as these leakage paths are assumed to be isolated post LOCA. High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Four channels of Drywell Pressure High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Allowable Value was selected to be the same as the ECCS Drywell PressureHigh Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment. This Function isolates the Group 2 and 6 valves. This Function in conjunction with reactor low pressure also isolates Group 10 valves. (continued) Brunswick Unit 2 B 3.3.6.1-12 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.c. Main Stack RadiationHigh SAFETY ANALYSES, LCO, and High main stack radiation indicates increased airborne radioactivity levels APPLICABILITY in primary containment being released through the containment vent (continued) valves. Therefore, Main Stack RadiationHigh Function initiates an isolation to assure timely closure of valves to protect against substantial releases of radioactive materials to the environment. However, this Function is not assumed in any accident or transient analysis in the UFSAR because other leakage paths (e.g., MSIVs) are more limiting. The main stack radiation signal is initiated from a radiation detector that is located in the main stack. The Allowable Value is established in accordance with the methodology in the Offsite Dose Calculation Manual. This Function isolates the containment vent and purge valves. 2.d. Reactor Building Exhaust RadiationHigh High secondary containment exhaust radiation is an indication of possible gross failure of the fuel cladding. The release may have originated from the primary containment due to a break in the RCPB. When Reactor Building Exhaust RadiationHigh is detected, valves whose penetrations communicate with the primary containment atmosphere are isolated to limit the release of fission products. The Reactor Building Exhaust RadiationHigh signals are initiated from radiation detectors that are located on the ventilation exhaust piping coming from the reactor building. The signal from each detector is input to an individual monitor whose trip outputs are assigned to an isolation channel. Two channels of Reactor Building ExhaustHigh Function are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Allowable Values are chosen to promptly detect gross failure of the fuel cladding. These Functions isolate the Group 6 valves. (continued) Brunswick Unit 2 B 3.3.6.1-13 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE High Pressure Coolant Injection and Reactor Core Isolation SAFETY ANALYSES, Cooling Systems Isolation LCO, and APPLICABILITY 3.a., 3.b., 4.a., 4.b. HPCI and RCIC Steam Line FlowHigh (continued) and Time Delay Relays Steam Line FlowHigh Functions are provided to detect a break of the RCIC or HPCI steam lines and initiate closure of the steam line isolation valves of the appropriate system. If the steam is allowed to continue flowing out of the break, the reactor will depressurize and the core can uncover. Therefore, the isolations are initiated on high flow to prevent or minimize core damage. The isolation action, along with the scram function of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. Specific credit for these Functions is not assumed in any UFSAR accident analyses since the bounding analysis is performed for large breaks such as recirculation and MSL breaks. However, these instruments prevent the RCIC or HPCI steam line breaks from becoming bounding. The HPCI and RCIC Steam Line FlowHigh signals are initiated after a short time delay from differential pressure instruments (two for HPCI and two for RCIC) that are connected to the system steam lines. Two channels of both HPCI and RCIC Steam Line FlowHigh Functions and the associated Time Delay Relays are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The time delay was selected to prevent spurious isolation of HPCI and RCIC due to transient high steam flow during turbine starts and spurious operation during HPCI and RCIC operation. The Allowable Values are chosen to be low enough to ensure that the trip occurs to prevent fuel damage and maintains the MSLB event as the bounding event. These Functions isolate the Group 4 and 5 valves, as appropriate. (continued) Brunswick Unit 2 B 3.3.6.1-14 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.c., 4.c. HPCI and RCIC Steam Supply Line PressureLow SAFETY ANALYSES, LCO, and The steam line low pressure function is provided so that the steam APPLICABILITY isolation valves are automatically closed after reactor steam pressure is (continued) below that at which HPCI or RCIC can effectively operate. This closure ensures that long term containment leakage rates are within limits after a LOCA. The HPCI and RCIC Steam Supply Line PressureLow signals are initiated from pressure switches (four for HPCI and four for RCIC) that are connected to the system steam line. Four channels of both HPCI and RCIC Steam Supply Line PressureLow Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Allowable Values are selected to be below the pressure at which the system's turbine can effectively operate. The Allowable Values are also selected to be above the peak expected drywell pressure to ensure that an elevated drywell pressure during a LOCA does not prevent timely closure of the valves. These Functions isolate the Group 4 and 5 valves, as appropriate. 3.d., 4.d. HPCI and RCIC Turbine Exhaust Diaphragm PressureHigh High turbine exhaust diaphragm pressure could indicate a degraded inner rupture disc during system operation, before the redundant outer disc is significantly challenged by thermal/cyclic fatigue. These isolations are for equipment protection and are not assumed in any transient or accident analysis in the UFSAR. These instruments are included in the TS because of the potential for risk due to possible failure of the instruments preventing HPCI and RCIC initiations. Therefore, they meet Criterion 4 of Reference 4. (continued) Brunswick Unit 2 B 3.3.6.1-15 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.d., 4.d. HPCI and RCIC Turbine Exhaust Diaphragm SAFETY ANALYSES, PressureHigh (continued) LCO, and APPLICABILITY The HPCI and RCIC Turbine Exhaust Diaphragm PressureHigh signals are initiated from pressure switches (four for HPCI and four for RCIC) that are connected to the area between the rupture diaphragms on each system's turbine exhaust line. Four channels of both HPCI and RCIC Turbine Exhaust Diaphragm PressureHigh Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Allowable Values are high enough to prevent isolation of HPCI or RCIC if the associated turbine is operating, yet low enough to detect degradation of the inner rupture disc during operation. These Functions isolate the Group 4 and 5 valves, as appropriate. 3.e., 4.e. Drywell PressureHigh High drywell pressure can indicate a break in the RCPB. The HPCI and RCIC isolation of the turbine exhaust is provided to prevent communication with the drywell when high drywell pressure exists. A potential leakage path exists via the turbine exhaust. The isolation is delayed until the system becomes unavailable for injection (i.e., low steam line pressure). The isolation of the HPCI and RCIC turbine exhaust by Drywell PressureHigh is indirectly assumed in the UFSAR accident analysis because the turbine exhaust leakage path is not assumed to contribute to offsite doses. High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Two channels of both HPCI and RCIC Drywell PressureHigh Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Allowable Value was selected to be the same as the ECCS Drywell PressureHigh Allowable Value (LCO 3.3.5.1), since this is indicative of a LOCA inside primary containment. This Function isolates the Group 7 and 9 valves. (continued) Brunswick Unit 2 B 3.3.6.1-16 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.f., 3.g., 3.h., 3.i., 4.f., 4.g., 4.h., 4.i., 4.j., 4.k., Area and Differential SAFETY ANALYSES TemperatureHigh and Time Delay LCO, and APPLICABILITY Area and differential temperatures are provided to detect a leak from the (continued) associated system steam piping. The isolation occurs to prevent excessive loss of reactor coolant and the release of significant amounts of radioactive material from the nuclear system process barrier and is diverse to the high flow instrumentation. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. These Functions are not assumed in any UFSAR transient or accident analysis, since bounding analyses are performed for large breaks such as recirculation or MSL breaks. Area and Differential TemperatureHigh signals are initiated from thermocouples that are appropriately located to protect the system that is being monitored. Two instruments monitor each area. Two channels for each HPCI and RCIC Area and Differential TemperatureHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The exception is the HPCI and RCIC Equipment Area TemperatureHigh function. The RCIC Equipment Area TemperatureHigh function receives inputs from three equipment area temperature channels for each system. The HPCI Equipment Area TemperatureHigh function receives seven total equipment area temperature inputs broken into C`hannel A, which receives three inputs, and Channel B, which receives four inputs. In addition, a time delay is associated with the RCIC Steam Line Area TemperatureHigh, the RCIC Steam Line Tunnel Ambient TemperatureHigh, and the RCIC Steam Line Tunnel Differential TemperatureHigh Functions. The time delay was selected to eliminate spurious isolations which might occur when switching from normal ventilation to standby ventilation. The Allowable Values are set high enough above anticipated normal operating levels to avoid spurious isolation, yet low enough to provide timely detection of a HPCI or RCIC steam line break. These Functions isolate the Group 4 and 5 valves, as appropriate. (continued) Brunswick Unit 2 B 3.3.6.1-17 Revision No. 66

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE Reactor Water Cleanup System Isolation SAFETY ANALYSES, LCO, and 5.a., 5.b. Differential FlowHigh and Time Delay APPLICABILITY (continued) The high differential flow signal is provided to detect a break in the RWCU System. Should the reactor coolant continue to flow out of the break, offsite dose limits may be exceeded. Therefore, isolation of the RWCU System is initiated when high differential flow is sensed to prevent excessive loss of reactor coolant and release of significant amounts of radioactive material. A time delay is provided to prevent spurious trips during most RWCU operational transients. This Function is not assumed in any UFSAR transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs. The high differential flow signals are initiated from transmitters that are connected to the inlet (from the reactor vessel) and outlets (to condenser and feedwater) of the RWCU System. The outputs of the transmitters are compared (in a common summer) and the resulting output is sent to two high flow trip units. If the difference between the inlet and outlet flow is too large, each trip unit generates an isolation signal. Two channels of Differential FlowHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure downstream of the common summer can preclude the isolation function. The Differential FlowHigh Allowable Value ensures that a break of the RWCU piping is detected. This Function isolates the Group 3 valves. 5.c., 5.d., 5.e. Area, Area Ventilation Differential, and Piping Outside RWCU Rooms Area TemperatureHigh RWCU area, area ventilation differential, and piping outside RWCU area temperatures are provided to detect a leak from the RWCU System. If the small leak continues without isolation, offsite dose limits may be reached. Credit for these instruments is not taken in any transient or accident analysis in the UFSAR, since bounding analyses are performed for large breaks such as recirculation or MSL breaks. (continued) Brunswick Unit 2 B 3.3.6.1-18 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 5.c., 5.d., 5.e. Area, Area Ventilation Differential, and Piping Outside SAFETY ANALYSES, RWCU Rooms Area TemperatureHigh (continued) LCO, and APPLICABILITY Area and area ventilation differential temperature signals are initiated from temperature elements that are located in the room that is being monitored. Six thermocouples provide input to the Area TemperatureHigh Function (two per room). Six channels are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. Twelve thermocouples provide input to the Area Ventilation Differential TemperatureHigh Function. The output of these thermocouples is used to determine the differential temperature. Each channel consists of a differential temperature instrument that receives inputs from thermocouples that are located in the inlet and outlet ducts which ventilate the RWCU System rooms for a total of six available channels (two per room). However, only four channels are required to be OPERABLE. Temperature signals are initiated from temperature elements monitoring in the 20'/50' elevation RWCU System general piping areas located outside the RWCU System equipment rooms. Two thermocouples provide input to the Piping Outside RWCU Rooms Area TemperatureHigh Function. Two channels are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Area and Area Ventilation Differential TemperatureHigh Allowable Values are set low enough to provide timely detection of a break in the RWCU System within the associated room(s). The Piping Outside RWCU Rooms Area Temperature-High Function Allowable Value is set low enough to isolate a design basis high energy line break at any point in the high temperature RWCU System piping located outside of the RWCU System equipment rooms. These Functions isolate the Group 3 valves. (continued) Brunswick Unit 2 B 3.3.6.1-19 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 5.f. SLC System Initiation SAFETY ANALYSES, LCO, and The isolation of the RWCU System is required when the SLC System APPLICABILITY has been initiated to prevent dilution and removal of the boron solution (continued) by the RWCU System (Ref. 6). The SLC System initiation signal is initiated from the SLC pump start hand switch signal. There is no Allowable Value associated with this Function since the channel is mechanically actuated based solely on the position of the SLC System initiation switch. One channel of the SLC System Initiation Function is available and required to be OPERABLE only in MODES 1 and 2, since these are the only MODES where the reactor can be critical, and these MODES are consistent with the Applicability for the SLC System (LCO 3.1.7). As noted (footnote (c) to Table 3.3.6.1-1), this Function is only required to close one of the RWCU isolation valves since the signals only provide input into one trip system. 5.g. Reactor Vessel Water LevelLow Level 2 Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some interfaces with the reactor vessel occurs to isolate the potential sources of a break. The isolation of the RWCU System on Level 2 supports actions to ensure that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The Reactor Vessel Water LevelLow Level 2 Function associated with RWCU isolation is not directly assumed in the UFSAR safety analyses because the RWCU System line break is bounded by breaks of larger systems (recirculation and MSL breaks are more limiting). Reactor Vessel Water LevelLow Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water LevelLow Level 2 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. (continued) Brunswick Unit 2 B 3.3.6.1-20 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 5.g. Reactor Vessel Water LevelLow Level 2 (continued) SAFETY ANALYSES, LCO, and The Reactor Vessel Water LevelLow Level 2 Allowable Value was APPLICABILITY to be the same as the ECCS Reactor Vessel Water LevelLow Level 2 Allowable Value (LCO 3.3.5.1), since the capability to cool the fuel may be threatened. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. This Function isolates the Group 3 valves. RHR Shutdown Cooling System Isolation 6.a. Reactor Steam Dome PressureHigh The Reactor Steam Dome PressureHigh Function is provided to isolate the shutdown cooling portion of the Residual Heat Removal (RHR) System. This interlock is provided only for equipment protection to prevent an intersystem LOCA scenario, and credit for the interlock is not assumed in the accident or transient analysis in the UFSAR. The Reactor Steam Dome PressureHigh signals are initiated from two pressure switches that are connected to different taps on the RPV. Two channels of Reactor Steam Dome PressureHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Function is only required to be OPERABLE in MODES 1, 2, and 3, since these are the only MODES in which the reactor can be pressurized; thus, equipment protection is needed. The Allowable Value was chosen to be low enough to protect the system equipment from overpressurization. This Function isolates the Group 8 valves except for the LPCI injection valves E11-F015A and E11-F015B. 6.b. Reactor Vessel Water LevelLow Level 1 Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some reactor vessel interfaces occurs to begin isolating the potential sources of a break. The Reactor Vessel Water LevelLow Level 1 Function associated with RHR Shutdown (continued) Brunswick Unit 2 B 3.3.6.1-21 Revision No. 30

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 6.b. Reactor Vessel Water LevelLow Level 1 (continued) SAFETY ANALYSES, LCO, and Cooling System isolation is not directly assumed in safety analyses APPLICABILITY because a break of the RHR Shutdown Cooling System is bounded by breaks of the recirculation and MSL. The RHR Shutdown Cooling System isolation on Level 1 supports actions to ensure that the RPV water level does not drop below the top of the active fuel during a vessel draindown event caused by a leak (e.g., pipe break or inadvertent valve opening) in the RHR Shutdown Cooling System. Reactor Vessel Water LevelLow Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels (two channels per trip system) of the Reactor Vessel Water LevelLow Level 1 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. As noted (footnote (d) to Table 3.3.6.1-1), only one channel per trip system (with an isolation signal available to one RHR shutdown cooling pump suction isolation valve) of the Reactor Vessel Water LevelLow Level 1 Function is required to be OPERABLE in MODES 4 and 5, provided the RHR Shutdown Cooling System integrity is maintained. System integrity is maintained provided the piping is intact and no maintenance is being performed that has the potential for draining the reactor vessel through the system. The Reactor Vessel Water LevelLow Level 1 Allowable Value was chosen to be the same as the RPS Reactor Vessel Water LevelLow Level 1 Allowable Value (LCO 3.3.1.1), since the capability to cool the fuel may be threatened. The Allowable Values is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. The Reactor Vessel Water LevelLow Level 1 Function is only required to be OPERABLE in MODES 3, 4, and 5 to prevent this potential flow path from lowering the reactor vessel level to the top of the fuel. In MODES 1 and 2, another isolation (i.e., Reactor Steam Dome Pressure High) and administrative controls ensure that this flow path remains isolated to prevent unexpected loss of inventory via this flow path. This Function isolates the Group 8 valves. (continued) Brunswick Unit 2 B 3.3.6.1-22 Revision No. 70

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE Traversing In-Core Probe System Isolation SAFETY ANALYSES, LCO, and 7.a. Reactor Vessel Water Level - Low, Level 1 APPLICABILITY (continued) Low RPV water level indicates that the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 1 supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Reactor Vessel Water Level - Low, Level 1 Function associated with isolation is implicitly assumed in the UFSAR analysis as these leakage paths are assumed to be isolated post-LOCA. Reactor Vessel Water Level - Low, Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level - Low Level 1 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The isolation function is ensured by the manual shear valve in each penetration. The Reactor Vessel Water Level - Low Level 1 Allowable Value was chosen to be the same as the RPS Level 1 scram Allowable Value (LCO 3.3.1.1), since isolation of these valves is not critical to orderly plant shutdown. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. This Function isolates the Group 2, 6, and 8 valves. 7.b. Drywell Pressure - High High drywell pressure can indicate a break in the RCPB inside the primary containment. The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Drywell Pressure - High Function, associated with isolation of the primary containment, is implicitly assumed in the UFSAR accident analysis as these leakage paths are assumed to be isolated post-LOCA. High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Four channels of Drywell Pressure - High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The isolation function is ensured by the manual shear valve in each penetration. The Allowable Value was selected to be the same as the ECCS Drywell Pressure - High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment. This Function isolates the Group 2 and 6 valves. This Function in conjunction with reactor low pressure also isolates Group 10 valves. (continued) Brunswick Unit 2 B 3.3.6.1-23 Revision No. 70

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES (continued) ACTIONS The ACTIONS are modified by two NOTES. Note 1 allows penetration flow path(s) to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated. Note 2 has been provided to modify the ACTIONS related to primary containment isolation instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable primary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable primary containment isolation instrumentation channel. A.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours for Functions 2.a, 2.b, 6.b, 7.a, and 7.b, and 24 hours for Functions other than Functions 2.a, 2.b, 6.b, 7.a, and 7.b has been shown to be acceptable (Refs. 7 and 8) to permit restoration of any inoperable channel to OPERABLE status. This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, (continued) Brunswick Unit 2 B 3.3.6.1-24 Revision No. 70

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS A.1 (continued) and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation), Condition C must be entered and its Required Action taken. B.1 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in redundant automatic isolation capability being lost for the associated penetration flow path(s). The MSL Isolation Functions are considered to be maintaining isolation capability when sufficient channels are OPERABLE or in trip, such that both trip systems will generate a trip signal from the given Function on a valid signal. The other isolation functions are considered to be maintaining isolation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate a trip signal from the given Function on a valid signal. This ensures that one of the two PCIVs in the associated penetration flow path can receive an isolation signal from the given Function. For Functions 1.a, 1.b, 1.d, and 1.e, this would require both trip systems to have a total of three channels OPERABLE or in trip. For Functions 2.a, 2.b, 6.b, 7.a, and 7.b, this would require both trip systems to have one channel OPERABLE or in trip. For Function 1.c, this would require both trip systems to have a total of three channels, associated with each MSL, OPERABLE or in trip. For Function 1.f, this would require both trip systems to have one channel, associated with each MSL, OPERABLE or in trip. For Functions 3.c, 3.d, 4.c, 4.d, and 5.g, this would require one trip system to have two channels, each OPERABLE or in trip. For Functions 2.c, 2.d, 3.a, 3.b, 3.e, 3.f, 3.g, 3.h, 3.i, 4.a, 4.b, 4.e, 4.f, 4.g, 4.h, 4.i, 4.j, 4.k, 5.a, 5.b, 5.e, 5.f, and 6.a, this would require one trip system to have one channel OPERABLE or in trip. For Functions 5.c and 5.d, each Function consists of channels that monitor several different locations. Therefore, this would require one channel per location to be OPERABLE or in trip (the channels are not required to be in the same trip system). (continued) Brunswick Unit 2 B 3.3.6.1-25 Revision No. 70

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS B.1 (continued) The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels. C.1 Required Action C.1 directs entry into the appropriate Condition referenced in Table 3.3.6.1-1. The applicable Condition specified in Table 3.3.6.1-1 is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time an inoperable channel has not met any Required Action of Condition A or B and the associated Completion Time has expired, Condition C will be entered for that channel and provides for transfer to the appropriate subsequent Condition. D.1, D.2.1, and D.2.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours and in MODE 4 within 36 hours (Required Actions D.2.1 and D.2.2). Alternately, the associated MSLs may be isolated (Required Action D.1), and, if allowed (i.e., plant safety analysis allows operation with an MSL isolated), operation with that MSL isolated may continue. Isolating the affected MSL accomplishes the safety function of the inoperable channel. The Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. (continued) Brunswick Unit 2 B 3.3.6.1-26 Revision No. 70

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS E.1 (continued) If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 2 within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems. F.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels. For the RWCU Area and Area Ventilation Differential TemperatureHigh Functions, the affected penetration flow path(s) may be considered isolated by isolating only that portion of the system in the associated room monitored by the inoperable channel. That is, if the RWCU pump room A area channel is inoperable, the pump room A area can be isolated while allowing continued RWCU operation utilizing the B RWCU pump. Alternately, if it is not desired to isolate the affected penetration flow path(s) (e.g., as in the case where isolating the penetration flow path(s) could result in a reactor scram), Condition H must be entered and its Required Actions taken. The 1 hour Completion Time is acceptable because it minimizes risk while allowing sufficient time for plant operations personnel to isolate the affected penetration flow path(s). G.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels. The 24 hour Completion Time is acceptable due to the fact that these Functions are either not assumed in any accident or transient analysis in the UFSAR or, in the case of the TIP system isolation, the TIP system penetration is a small bore (approximately 1/2 inch), its isolation in a design basis event (with loss of offsite power) would be via the manually operated shear valves, and the ability to manually isolate by either the normal isolation valve or the shear valve is unaffected by the inoperable instrumentation. Alternately, if it is not desired to isolate the affected penetration flow path(s) (e.g., as in the case where isolating the penetration flow path(s) could result in a reactor scram), Condition G must be entered and its Required Actions taken. (continued) Brunswick Unit 2 B 3.3.6.1-27 Revision No. 70

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS H.1 and H.2 (continued) If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, or the Required Action of Condition F is not met and the associated Completion Time has expired, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. I.1 and I.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated SLC subsystem(s) is declared inoperable or the RWCU System is isolated. Since this Function is required to ensure that the SLC System performs its intended function, sufficient remedial measures are provided by declaring the associated SLC subsystems inoperable or isolating the RWCU System. The 1 hour Completion Time is acceptable because it minimizes risk while allowing sufficient time for personnel to isolate the RWCU System. J.1 and J.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path should be closed. However, if the shutdown cooling function is needed to provide core cooling, these Required Actions allow the penetration flow path to remain unisolated provided action is immediately initiated to restore the channel to OPERABLE status or to isolate the RHR Shutdown Cooling System (i.e., provide alternate decay heat removal capabilities so the penetration flow path can be isolated). Actions must continue until the channel is restored to OPERABLE status or the RHR Shutdown Cooling System is isolated. (continued) Brunswick Unit 2 B 3.3.6.1-28 Revision No. 70

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES (continued) SURVEILLANCE As noted at the beginning of the SRs, the SRs for each Primary REQUIREMENTS Containment Isolation instrumentation Function are found in the SRs column of Table 3.3.6.1-1. The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed as follows: (a) for up to 2 hours for Functions with a design that provides only one channel per trip system and (b) for up to 6 hours for all other Functions provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 2 hour allowance for Functions with a design that provides only one channel per trip system or the 6 hour allowance for all other Functions, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 7 and 8) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 2 and 6 hour testing allowances do not significantly reduce the probability that the PCIVs will isolate the penetration flow path(s) when necessary. SR 3.3.6.1.1 Performance of the CHANNEL CHECK once every 24 hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. (continued) Brunswick Unit 2 B 3.3.6.1-29 Revision No. 70

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.1 (continued) REQUIREMENTS The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO. SR 3.3.6.1.2, SR 3.3.6.1.5, and SR 3.3.6.1.9 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The 92 day Frequency of SR 3.3.6.1.2 is based on the reliability analysis described in References 7 and 8. The 184 day Frequency of SR 3.3.6.1.5 and the 24 month Frequency of SR 3.3.6.1.9 are based on engineering judgment and the reliability of the components. SR 3.3.6.1.3 Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than that accounted for in the appropriate setpoint methodology. The Frequency of 92 days is based on the reliability analysis of References 7 and 8. SR 3.3.6.1.4 and SR 3.3.6.1.6 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL (continued) Brunswick Unit 2 B 3.3.6.1-30 Revision No. 70

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.4 and SR 3.3.6.1.6 (continued) REQUIREMENTS CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The Frequency of SR 3.3.6.1.4 is based on the assumption of a 92 day calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. The Frequency of SR 3.3.6.1.6 is based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. SR 3.3.6.1.7 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel and includes simulated automatic operation of the channel. The system functional testing performed on PCIVs in LCO 3.6.1.3 overlaps this Surveillance to provide complete testing of the assumed safety function. The 24 month Frequency was developed considering it is prudent that this Surveillance be performed during a unit outage. Operating experience has demonstrated that these components will pass this Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. SR 3.3.6.1.8 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. Testing is performed only on channels where the assumed response time does not correspond to the diesel generator (DG) start time. For channels assumed to respond within the DG start time, sufficient margin exists in the 10 second start time when compared to the typical channel response time (milliseconds) so as to assure adequate response without a specific measurement test (Ref. 9). (continued) Brunswick Unit 2 B 3.3.6.1-31 Revision No. 70

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.8 (continued) REQUIREMENTS Note 1 to the Surveillance states that the radiation detectors are excluded from ISOLATION INSTRUMENTATION RESPONSE TIME testing. This Note is necessary because of the difficulty of generating an appropriate detector input signal and because the principles of detector operation virtually ensure an instantaneous response time. Response times for radiation detector channels shall be measured from detector output or the input of the first electronic component in the channel. In addition, Note 2 to the Surveillance states that the response time of the sensors for Functions 1.a, 1.c, and 1.f may be assumed to be the design sensor response time and therefore, are excluded from the ISOLATION INSTRUMENTATION RESPONSE TIME testing. This is allowed since the sensor response time is a small part of the overall ISOLATION INSTRUMENTATION RESPONSE TIME (Ref. 9). ISOLATION INSTRUMENTATION RESPONSE TIME tests are conducted on a 24 month STAGGERED TEST BASIS. The 24 month Frequency is consistent with the BNP refueling cycle and is based upon plant operating experience that shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences. REFERENCES 1. UFSAR, Section 6.3.

2. UFSAR, Chapter 15.

3. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, September 1995.

4. 10 CFR 50.36(c)(2)(ii).

5. UFSAR, Section 6.2.4.3.

6. UFSAR, Section 7.3.1.1.6.18.

7. NEDC-31677P-A, Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation, July 1990.

8. NEDC-30851P-A Supplement 2, Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation, March 1989.

9. NEDO-32291-A, System Analyses for Elimination of Selected Response Time Requirements, October 1995.

Brunswick Unit 2 B 3.3.6.1-32 Revision No. 70

Secondary Containment Isolation Instrumentation B 3.3.6.2 B 3.3 INSTRUMENTATION B 3.3.6.2 Secondary Containment Isolation Instrumentation BASES BACKGROUND The secondary containment isolation instrumentation automatically initiates closure of appropriate secondary containment isolation dampers (SCIDs) and starts the Standby Gas Treatment (SGT) System. The function of these systems, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Refs. 1, 2, and 3). Secondary containment isolation and establishment of vacuum with the SGT System ensures that fission products that leak from primary containment following a DBA, or are released outside primary containment, or are released during certain operations when primary containment is not required to be OPERABLE are maintained within applicable limits. The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of secondary containment isolation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a secondary containment isolation signal to the isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logic are (1) reactor vessel water level, (2) drywell pressure, and (3) reactor building exhaust radiation. Redundant sensor input signals from each parameter are provided for initiation of isolation. The Secondary Containment System instrumentation has two trip systems. One trip system initiates isolation of one automatic secondary containment isolation damper in each penetration and starts both SGT subsystems while the other trip system initiates isolation of the other automatic secondary containment isolation damper in each penetration and starts both SGT subsystems. Each logic closes one of the two dampers in each penetration and starts both SGT subsystems, so that operation of either logic isolates the secondary containment and provides for the necessary filtration of fission products. The outputs of the channels associated with the Reactor Vessel Water LevelLow Level 2 and the Drywell PressureHigh signals are arranged in such a manner that opening of either A and B, or C and D, relay contacts of either the Reactor Vessel Water LevelLow Level 2 or the Drywell Pressure High will provide the Secondary Containment Isolation signal. Thus, the automatic Secondary Containment Isolation provides redundant/diverse protection in the event of a LOCA. (continued) Brunswick Unit 2 B 3.3.6.2-1 Revision No. 76

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES BACKGROUND The outputs of the channels associated with the Reactor Building (continued) Exhaust Radiation-High Function are arranged in two one-out-of-one trip system logics. Each trip system initiates isolation of one automatic secondary containment isolation damper in each penetration and starts both SGT subsystems while the other trip system initiates isolation of the other secondary containment isolation damper in each penetration and starts both SGT subsystems. Each logic closes one of the two dampers in each penetration and starts both SGT subsystems, so that operation of either logic isolates the secondary containment and provides for the necessary filtration of fission products. APPLICABLE The isolation signals generated by the secondary containment isolation SAFETY ANALYSES, instrumentation are implicitly assumed in the safety analyses of LCO, and References 1 and 3 to initiate closure of dampers and start the SGT APPLICABILITY System to limit offsite doses. Refer to LCO 3.6.4.2, "Secondary Containment Isolation Dampers (SCIDs)," and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System," Applicable Safety Analyses Bases for more detail of the safety analyses. The secondary containment isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion. The OPERABILITY of the secondary containment isolation instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions. Each Function must have the required number of OPERABLE channels with their setpoints set within the specified Allowable Values, as shown in Table 3.3.6.2-1. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Allowable Values are specified for each Function specified in the Table. Trip setpoints are specified in the setpoint calculations. The setpoints are selected to ensure that the trip settings do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, (continued) Brunswick Unit 2 B 3.3.6.2-2 Revision No. 30

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE is acceptable. A channel is inoperable if its actual trip setting is not within SAFETY ANALYSES, its required Allowable Value. LCO, and APPLICABILITY Trip setpoints are those predetermined values of output at which an (continued) action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for calibration based errors. These calibration based errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation. In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions when SCIDs and the SGT System are required. The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Reactor Vessel Water LevelLow Level 2 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The Reactor Vessel (continued)

Brunswick Unit 2 B 3.3.6.2-3 Revision No. 30

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 1. Reactor Vessel Water LevelLow Level 2 (continued) SAFETY ANALYSES, LCO, and Water LevelLow Level 2 Function is one of the Functions assumed APPLICABILITY to be OPERABLE and capable of providing isolation and initiation signals. The isolation and initiation systems on Reactor Vessel Water LevelLow Level 2 support actions to ensure that any offsite releases are within the limits calculated in the safety analysis. Reactor Vessel Water LevelLow Level 2 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water LevelLow Level 2 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Reactor Vessel Water LevelLow Level 2 Allowable Value was chosen to be the same at the High Pressure Coolant Injection/Reactor Core Isolation Cooling (HPCI/RCIC) Reactor Vessel Water LevelLow Level 2 Allowable Value (LCO 3.3.5.1 and LCO 3.3.5.2), since this could indicate that the capability to cool the fuel is being threatened. The Allowable Value is referenced from reference level zero. Reference level zero is 367 inches above the vessel zero point. The Reactor Vessel Water LevelLow Level 2 Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the Reactor Coolant System (RCS); thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, this Function is not required.

2. Drywell PressureHigh High drywell pressure can indicate a break in the reactor coolant pressure boundary (RCPB). An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The isolation on high drywell (continued)

Brunswick Unit 2 B 3.3.6.2-4 Revision No. 30

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 2. Drywell PressureHigh (continued) SAFETY ANALYSES, LCO, and pressure supports actions to ensure that any offsite releases are within APPLICABILITY the limits calculated in the safety analysis. However, the Drywell PressureHigh Function associated with isolation is not assumed in any UFSAR accident or transient analyses. It is retained for the overall redundancy and diversity of the secondary containment isolation instrumentation as required by the NRC approved licensing basis. High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Four channels of Drywell Pressure High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude performance of the isolation function. The Allowable Value was chosen to be the same as the ECCS Drywell PressureHigh Function Allowable Value (LCO 3.3.5.1) since this is indicative of a loss of coolant accident (LOCA). The Drywell PressureHigh Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the RCS; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. This Function is not required in MODES 4 and 5 because the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES.

3. Reactor Building Exhaust RadiationHigh High secondary containment exhaust radiation is an indication of possible gross failure of the fuel cladding. The release may have originated from the primary containment due to a break in the RCPB or the refueling floor due to a fuel handling accident. When Reactor Building Exhaust RadiationHigh is detected, secondary containment isolation and actuation of the SGT System are initiated to limit the release of fission products.

(continued) Brunswick Unit 2 B 3.3.6.2-5 Revision No. 30

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 3. Reactor Building Exhaust RadiationHigh (continued) SAFETY ANALYSES, LCO, and The Reactor Building Exhaust RadiationHigh signals are initiated from APPLICABILITY radiation detectors that are located in the ventilation exhaust ductwork plenum coming from the reactor building. The signal from each detector is input to an individual monitor whose trip outputs are assigned to an isolation channel. Two channels of Reactor Building Exhaust Radiation High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Allowable Values are chosen to promptly detect gross failure of the fuel cladding. The Reactor Building Exhaust RadiationHigh Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, the o be OPERABLE during OPDRVs and movement of recently irradiated fuel assemblies in the secondary containment, because the capability of detecting radiation releases due to fuel failures (due to fuel uncovery or dropped fuel assemblies) must be provided to ensure that offsite dose limits are not exceeded. Due to radioactive decay, this function is only required to isolate secondary containment during fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours). ACTIONS A Note has been provided to modify the ACTIONS related to secondary containment isolation instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. (continued) Brunswick Unit 2 B 3.3.6.2-6 Revision No. 30

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES ACTIONS However, the Required Actions for inoperable secondary containment (continued) isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable secondary containment isolation instrumentation channel. A.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours for Function 2, and 24 hours for Functions other than Function 2, has been shown to be acceptable (Refs. 5 and 6) to permit restoration of any inoperable channel to OPERABLE status. This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation), Condition C must be entered and its Required Actions taken. B.1 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic isolation capability for the associated penetration flow path(s) or a complete loss of automatic initiation capability for the SGT System. A Function is considered to be maintaining isolation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate a trip signal from the given Function on a valid signal. This ensures that one of the two SCIDs in the associated penetration flow path and both SGT subsystems can be initiated on an isolation signal from the given Function. For Functions 1 and 2, this would require all channels to be operable or the inoperable channels in the tripped condition. An inoperable channel need not be placed in the tripped condition where this would cause the trip Function to occur. In these cases, if the inoperable channel is not restored within the required Completion Time, Condition C shall be entered. The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels. (continued) Brunswick Unit 2 B 3.3.6.2-7 Revision No. 76

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES ACTIONS C.1.1, C.1.2, C.2.1, and C.2.2 (continued) If any Required Action and associated Completion Time of Condition A or B are not met, the ability to isolate the secondary containment and start the SGT System cannot be ensured. Therefore, further actions must be performed to ensure the ability to maintain the secondary containment function. Isolating the associated dampers and starting the associated SGT subsystem (Required Actions C.1.1 and C.2.1) performs the intended function of the instrumentation and allows operation to continue. Alternately, declaring the associated SCIDs or SGT subsystem(s) inoperable (Required Actions C.1.2 and C.2.2) is also acceptable since the Required Actions of the respective LCOs (LCO 3.6.4.2 and LCO 3.6.4.3) provide appropriate actions for the inoperable components. One hour is sufficient for plant operations personnel to establish required plant conditions or to declare the associated components inoperable without unnecessarily challenging plant systems. SURVEILLANCE As noted at the beginning of the SRs, the SRs for each Secondary REQUIREMENTS Containment Isolation instrumentation Function are located in the SRs column of Table 3.3.6.2-1. The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed as follows: (a) for up to 2 hours for Function 3 and (b) for up to 6 hours for Functions 1 and 2 provided the associated Function maintains isolation capability. Upon completion of the Surveillance, or expiration of the 2 hour allowance for Function 3 or the 6 hour allowance for Functions 1 and 2, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 5 and 6) assumption of the average time required to perform channel surveillance. That analysis demonstrated the 2 hour testing allowance for Function 3 and the 6 hour testing allowance for Functions 1 and 2 do not significantly reduce the probability that the SCIDs will isolate the associated penetration flow paths and that the SGT System will initiate when necessary. (continued) Brunswick Unit 2 B 3.3.6.2-8 Revision No. 76

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE SR 3.3.6.2.1 REQUIREMENTS (continued) Performance of the CHANNEL CHECK once every 24 hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel status during normal operational use of the displays associated with channels required by the LCO. SR 3.3.6.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Frequency of 92 days is based on the reliability analysis of References 5 and 6. SR 3.3.6.2.3 Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.2-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology. The Frequency of 92 days is based on the reliability analysis of References 5 and 6. (continued) Brunswick Unit 2 B 3.3.6.2-9 Revision No. 76

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE SR 3.3.6.2.4 REQUIREMENTS (continued) A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The Frequency is based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. SR 3.3.6.2.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel and includes simulated automatic operation of the channel. The system functional testing performed on SCIDs and the SGT System in LCO 3.6.4.2 and LCO 3.6.4.3, respectively, overlaps this Surveillance to provide complete testing of the assumed safety function. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the 24 month Frequency. REFERENCES 1. UFSAR, Section 15.6.4.

2. Not used.

3. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, September 1995.

4. 10 CFR 50.36(c)(2)(ii).

5. NEDC-31677P-A, Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation, July 1990.

6. NEDC-30851P-A Supplement 2, Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation, March 1989.

Brunswick Unit 2 B 3.3.6.2-10 Revision No. 76

CREV System Instrumentation B 3.3.7.1 B 3.3 INSTRUMENTATION B 3.3.7.1 Control Room Emergency Ventilation (CREV) System Instrumentation BASES BACKGROUND The CREV System is designed to provide a radiologically controlled environment to ensure the habitability of the control room for the safety of control room operators under all plant conditions. Two independent CREV subsystems are each capable of fulfilling the stated safety function. The instrumentation and controls for the CREV System automatically initiate action to pressurize the main control room (MCR) to minimize the consequences of radioactive material in the control room environment. In the event of a loss of coolant accident (LOCA), the Unit 2 Secondary Containment IsolationCREV Auto-Start signal will automatically start the CREV System in the radiation smoke/protection mode. The automatic CREV actuation is generated from the portion of the secondary containment isolation logic associated with Reactor Vessel Water Level Low Level 2 and the Drywell PressureHigh. CREV automatic actuation will not occur as a result of secondary containment isolations due to Reactor Building Exhaust RadiationHigh signals. The Control Building Air IntakeRadiation High function provides protection for non-LOCA events. In the event of a Control Building Air Intake RadiationHigh signal, the CREV System is automatically started in the radiation/smoke protection mode. Air is then recirculated through the charcoal filter, and sufficient outside air is drawn in through the normal intake to maintain the MCR slightly pressurized with respect to outside atmosphere. The CREV System instrumentation has two trip systems, either of which can initiate the CREV System. The Reactor Vessel Water LevelLow Level 2 and the Drywell PressureHigh signals are arranged in such a manner that opening of either A and B, or C and D, relay contacts of either the Reactor Vessel Water LevelLow Level 2 or the Drywell Pressure High will provide the CREV start signal. Thus, the automatic CREV initiation, using signals from the secondary containment isolation logic, provides redundant/diverse protection for control room operators in the event of a LOCA. The Control Building Air Intake RadiationHigh Function is arranged in a one-out-of-two logic for each trip system. The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a CREV System initiation signal to the initiation logic. APPLICABLE The ability of the CREV System to maintain the habitability of the MCR is SAFETY ANALYSES, explicitly assumed for the design basis accident as discussed in the LCO, and UFSAR safety analyses (Refs. 1 and 2). CREV System operation APPLICABILITY ensures that the radiation exposure of control room personnel, through (continued) Brunswick Unit 2 B 3.3.7.1-1 Revision No. 43

CREV System Instrumentation B 3.3.7.1 BASES APPLICABLE the duration of any one of the postulated accidents, does not exceed the SAFETY ANALYSES, limits set by GDC 19 of 10 CFR 50, Appendix A. LCO, and APPLICABILITY CREV System instrumentation satisfies Criterion 3 of (continued) 10 CFR 50.36(c)(2)(ii) (Ref. 3). The OPERABILITY of the CREV System instrumentation is dependent upon the OPERABILITY of the individual instrumentation Channel Functions specified in Table 3.3.7.1-1. The Functions must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values provided in Tables 3.3.7.1-1 and 3.3.6.2-1. The actual setpoints are calibrated consistent with applicable setpoint methodology assumptions. Allowable Values are specified for each Function specified in Tables 3.3.7.1-1 and 3.3.6.2-1. Trip setpoints are specified in the setpoint calculations. The setpoints are selected to ensure that the trip settings do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setting is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., control building air intake radiation), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for calibration based errors. These calibration based instrument errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation. The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Control Building Air Intake RadiationHigh The control building air intake radiation monitors measure radiation levels in the control building air intake plenum. A high radiation level may pose a threat to MCR personnel; thus, automatically initiating the CREV System.

(continued) Brunswick Unit 2 B 3.3.7.1-2 Revision No. 43

CREV System Instrumentation B 3.3.7.1 BASES APPLICABLE The Control Building Air Intake RadiationHigh Function consists of two SAFETY ANALYSES, independent monitors. Two channels per trip system of Control Building LCO, and Air Intake RadiationHigh are available and are required to be APPLICABILITY OPERABLE to ensure that no single instrument failure can preclude (continued) CREV System initiation. The Allowable Value was selected to ensure protection of the control room personnel. The Control Building Air Intake RadiationHigh Function is required to be OPERABLE in MODES 1, 2, and 3 and during OPDRVs and movement of recently irradiated fuel assemblies in the secondary containment, to ensure that control room personnel are protected during a LOCA, fuel handling event, or vessel draindown event. During MODES 4 and 5, when these specified conditions are not in progress (e.g., OPDRVs), the probability of a LOCA, main steam line break accident, or control rod drop accident is low; thus, the Function is not required. Also due to radioactive decay, this Function is only required to initiate the CREV System during fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours).

2. Unit 2 Secondary Containment IsolationCREV Auto-Start The Unit 2 Secondary Containment IsolationCREV Auto-Start Function provides post-LOCA operator protection. Since Reactor Vessel Water LevelLow Level 2 and Drywell PressureHigh provide primary indication of a LOCA, only secondary containment isolations resulting from these signals provide CREV Auto-Start. The Reactor Vessel Water LevelLow Level 2 and the Drywell PressureHigh signals are arranged in such a manner that opening of either A and B, or C and D, relay contacts of either the Reactor Vessel Water LevelLow Level 2 or the Drywell PressureHigh will provide the CREV start signal. Thus, automatic CREV initiation, using signals from the secondary containment isolation logic, provides redundant/diverse protection for control room operators in the event of a LOCA.

The Allowable Values for the Secondary Containment Isolation Instrumentation are provided in Table 3.3.6.2-1. The Unit 2 Secondary Containment IsolationCREV Auto-Start Function is required to be OPERABLE in MODES 1,2, and 3 to ensure that control room personnel are protected in the event of a LOCA. ACTIONS A Note has been provided to modify the ACTIONS related to CREV System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions (continued) Brunswick Unit 2 B 3.3.7.1-3 Revision No. 43

CREV System Instrumentation B 3.3.7.1 BASES ACTIONS of the Condition continue to apply for each additional failure, with (continued) Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable CREV System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable CREV System instrumentation channel. A.1 Because of the redundancy of sensors available to provide initiation signals and the redundancy of the CREV System design, an allowable out of service time of 7 days is provided to permit restoration of any inoperable channel to OPERABLE status. This out of service time is only acceptable provided the affected Function is still maintaining CREV System initiation capability (refer to Required Action B.1 Bases). If the Function is not maintaining CREV System initiation capability, Condition B must be entered. If the inoperable channel cannot be restored to OPERABLE status within the 7 day allowable out of service time, one CREV subsystem must be placed in the radiation/smoke protection mode of operation per Required Action A.1. The method used to place the CREV subsystem in operation must provide for automatically re-initiating the subsystem upon restoration of power following a loss of power to the CREV subsystem. Placing one CREV subsystem in the radiation/smoke protection mode of operation provides a suitable compensatory action to ensure that the automatic radiation protection function of the CREV System is not lost. B.1 Required Action B.1 is intended to ensure that appropriate action is taken if multiple, inoperable, untripped channels result in the affected Function not maintaining CREV System initiation capability. The Function is considered to be maintaining CREV System initiation capability when sufficient channels are OPERABLE or in trip such that one trip system will generate an initiation signal for one CREV subsystem from the Function on a valid signal. For the Control Building Air Intake RadiationHigh Function, this would require one trip system to have one channel OPERABLE or in trip. For the Unit 2 Secondary Containment Isolation CREV Auto Start Reactor Vessel Water LevelLow Level 2 or Drywell PressureHigh, this would require all channels to be operable or the inoperable channels in the tripped condition. With CREV System initiation capability not maintained, one CREV subsystem must be placed in the radiation/smoke protection mode of operation per Required Action B.1 to ensure that control room personnel will be protected in the event of a Design Basis Accident. The method used to place the CREV subsystem in operation must provide for automatically re-initiating the subsystem upon restoration of power following a loss of power to the CREV subsystem. (continued) Brunswick Unit 2 B 3.3.7.1-4 Revision No. 43

CREV System Instrumentation B 3.3.7.1 BASES ACTIONS B.1 (continued) The 1 hour Completion Time is intended to allow the operator time to place the CREV subsystem in operation. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels, or for placing one CREV subsystem in operation. SURVEILLANCE The Surveillances are modified by a Note to indicate that when a channel REQUIREMENTS is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains CREV System initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 4) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the CREV System will initiate when necessary. SR 3.3.7.1.1 Performance of the CHANNEL CHECK once every 24 hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. (continued) Brunswick Unit 2 B 3.3.7.1-5 Revision No. 30

CREV System Instrumentation B 3.3.7.1 BASES SURVEILLANCE SR 3.3.7.1.1 (continued) REQUIREMENTS The Frequency is based upon operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with channels required by the LCO. SR 3.3.7.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Frequency of 92 days is based on the reliability analyses of Reference 4. SR 3.3.7.1.3 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The Frequency is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. SR 3.3.7.1.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.7.3, "Control Room Emergency Ventilation (CREV) System," overlaps this Surveillance to provide complete testing of the assumed safety function. (continued) Brunswick Unit 2 B 3.3.7.1-6 Revision No. 30

CREV System Instrumentation B 3.3.7.1 BASES SURVEILLANCE SR 3.3.7.1.4 (continued) REQUIREMENTS While this surveillance can be performed with the reactor at power, operating experience has demonstrated these components will usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was found to be acceptable from a reliability standpoint. REFERENCES 1. UFSAR, Section 6.4.4.1.

2. UFSAR, Section 15.7.1

3. 10 CFR 50.36(c)(2)(ii).

4. GENE-770-06-1-A, Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications, December 1992.

Brunswick Unit 2 B 3.3.7.1-7 Revision No. 33

Condenser Vacuum Pump Isolation Instrumentation B 3.3.7.2 B 3.3 INSTRUMENTATION B 3.3.7.2 Condenser Vacuum Pump Isolation Instrumentation BASES BACKGROUND The condenser vacuum pump isolation instrumentation initiates a trip of the respective condenser vacuum pump and isolation of the common isolation valve following events in which main steam radiation monitors exceed a predetermined value. Tripping and isolating the condenser vacuum pumps limits control room doses in the event of a control rod drop accident (CRDA). The condenser vacuum pump isolation instrumentation includes sensors, relays and switches that are necessary to cause initiation of condenser vacuum pump isolation. The channels include electronic equipment that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an isolation signal to the condenser vacuum pump isolation logic. The isolation logic consists of two independent trip systems, with two channels of the Main Steam Line RadiationHigh Function in each trip system. Each trip system is a one-out-of-two logic for this Function. Thus, either channel of the Main Steam Line RadiationHigh Function in each trip system are needed to trip a trip system. The outputs of the channels in a trip system are arranged in a logic so that both trip systems must trip to result in an isolation signal. There are two condenser vacuum pumps and one isolation valve associated with this function. APPLICABLE The condenser vacuum pump isolation is assumed in the safety analysis SAFETY ANALYSES for the CRDA. The condenser vacuum pump isolation instrumentation initiates an isolation of the condenser vacuum pumps to limit control room doses resulting from fuel cladding failure in a CRDA. The condenser vacuum pump isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 1). (continued) Brunswick Unit 2 B 3.3.7.2-1 Revision No. 30

Condenser Vacuum Pump Isolation Instrumentation B 3.3.7.2 BASES (continued) LCO The OPERABILITY of the condenser vacuum pump isolation instrumentation is dependent on the OPERABILITY of the individual Main Steam Line RadiationHigh Function instrumentation channels, which must have a required number of OPERABLE channels in each trip system, with their setpoints within the specified Allowable Value of SR 3.3.7.2.3. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Channel OPERABILITY also includes the condenser vacuum pump trip breakers and isolation valve. Allowable Values are specified for the condenser vacuum pump isolation Function specified in the LCO. Trip setpoints are specified in the setpoint calculations. The setpoints are selected to ensure that the actual trip settings do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setting is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (i.e., main steam line radiation), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These calibration based errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerances of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation. (continued) Brunswick Unit 2 B 3.3.7.2-2 Revision No. 30

Condenser Vacuum Pump Isolation Instrumentation B 3.3.7.2 BASES (continued) APPLICABILITY The condenser vacuum pump isolation is required to be OPERABLE in MODES 1 and 2 when the condenser vacuum pump is in service to mitigate the consequences of a postulated CRDA. In this condition, fission products released during a CRDA could be discharged directly to the environment. Therefore, the condenser vacuum pump isolation is necessary to assure conformance with the radiological evaluation of the CRDA. In MODE 3, 4 or 5 the consequences of a control rod drop are insignificant, and are not expected to result in any fuel damage or fission product releases. When the condenser vacuum pump is not in operation in MODE 1 or 2, fission product releases via this pathway would not occur. ACTIONS A Note has been provided to modify the ACTIONS related to condenser vacuum pump isolation instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable condenser vacuum pump isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable condenser vacuum pump isolation instrumentation channel. A.1 and A.2 With one or more channels inoperable, but with condenser vacuum pump isolation capability maintained (refer to Required Actions B.1, B.2, and B.3 Bases), the condenser vacuum pump isolation instrumentation is capable of performing the intended function. However, the reliability and redundancy of the condenser vacuum pump isolation instrumentation is reduced, such that a single failure in one of the remaining channels could result in the inability of the condenser vacuum pump isolation instrumentation to perform the intended function. Therefore, only a limited time is allowed to restore the inoperable channels to OPERABLE (continued) Brunswick Unit 2 B 3.3.7.2-3 Revision No. 30

Condenser Vacuum Pump Isolation Instrumentation B 3.3.7.2 BASES ACTIONS A.1 and A.2 (continued) status. Because of the low probability of extensive number of inoperabilities affecting multiple channels, and the low probability of an event requiring the initiation of condenser vacuum pump isolation, 12 hours has been shown to be acceptable (Ref. 2) to permit restoration of any inoperable channel to OPERABLE status (Required Action A.1). Alternately, the inoperable channel, or associated trip system, may be placed in trip (Required Action A.2), since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. As noted, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable condenser vacuum pump trip breaker or isolation valve, since this may not adequately compensate for the inoperable condenser vacuum pump trip breaker or isolation valve (e.g., the trip breaker may be inoperable such that it will not trip). If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel would result in loss of condenser vacuum), or if the inoperable channel is the result of an inoperable condenser vacuum pump trip breaker or isolation valve, Condition B must be entered and its Required Actions taken. B.1, B.2, and B.3 With any Required Action and associated Completion Time of Condition A not met, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 with 12 hours (Required Action B.3). Alternately, the associated condenser vacuum pumps may be removed from service since this performs the intended function of the instrumentation (Required Action B.1). An additional option is provided to isolate the main steam lines (Required Action B.2), which may allow operation to continue. Isolating the main steam lines effectively provides an equivalent level of protection by precluding fission product transport to the condenser. This isolation is accomplished by isolation of all main steam lines and main steam line drains which bypass the main steam isolation valves. (continued) Brunswick Unit 2 B 3.3.7.2-4 Revision No. 30

Condenser Vacuum Pump Isolation Instrumentation B 3.3.7.2 BASES ACTIONS B.1, B.2, and B.3 (continued) Condition B is also intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels result in the Function not maintaining condenser vacuum pump isolation capability. The Function is considered to be maintaining condenser vacuum pump isolation capability when sufficient channels are OPERABLE or in trip such that the condenser vacuum pump isolation instruments will generate a trip signal from a valid Main Steam Line RadiationHigh signal, and the condenser vacuum pumps will trip. This requires one channel of the Function in each trip system to be OPERABLE or in trip, and the condenser vacuum pump trip breakers to be OPERABLE. SURVEILLANCE The Surveillances are modified by a Note to indicate that when a channel REQUIREMENTS is placed in an inoperable status solely for performance of required Surveillances, entry into the associated Conditions and Required Actions may be delayed for up to 6 hours provided the associated Function maintains condenser vacuum pump isolation trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 2) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the condenser vacuum pumps will isolate when necessary. SR 3.3.7.2.1 Performance of the CHANNEL CHECK once every 24 hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in (continued) Brunswick Unit 2 B 3.3.7.2-5 Revision No. 30

Condenser Vacuum Pump Isolation Instrumentation B 3.3.7.2 BASES SURVEILLANCE SR 3.3.7.2.1 (continued) REQUIREMENTS one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff based on combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based on the CHANNEL CHECK Frequency requirement of other instrumentation. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the required channels of this LCO. SR 3.3.7.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Frequency of 92 days is based on the reliability analysis of Reference 2. SR 3.3.7.2.3 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The Frequency is based upon the assumption of an 18 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. (continued) Brunswick Unit 2 B 3.3.7.2-6 Revision No. 30

Condenser Vacuum Pump Isolation Instrumentation B 3.3.7.2 BASES SURVEILLANCE SR 3.3.7.2.3 (continued) REQUIREMENTS For the purposes of this SR, background is the dose level experienced at 100% RATED THERMAL POWER with hydrogen water chemistry at the maximum injection rate. Under these conditions, an Allowable Value of 6 x background will ensure that General Design Criterion 19 limits of 10 CFR 50, Appendix A, will not be exceeded in the control room in the event of a CRDA. SR 3.3.7.2.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers and actuation of the associated isolation valve are included as part of this Surveillance and overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the assumed safety function. Therefore, if a breaker is incapable of operating or the isolation valve is incapable of actuating, the instrument channel would be inoperable. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. REFERENCES 1. 10 CFR 50.36(c)(2)(ii).

2. NEDC-30851P-A, Supplement 2, Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation, March 1989.

Brunswick Unit 2 B 3.3.7.2-7 Revision No. 30

LOP Instrumentation B 3.3.8.1 B 3.3 INSTRUMENTATION B 3.3.8.1 Loss of Power (LOP) Instrumentation BASES BACKGROUND Successful operation of the required safety functions of the Emergency Core Cooling Systems (ECCS) is dependent upon the availability of adequate power sources for energizing the various components such as pump motors, motor operated valves, and the associated control components. The LOP instrumentation monitors the 4.16 kV emergency buses. Offsite power is the preferred source of power for the 4.16 kV emergency buses. If monitors determine that insufficient offsite power is available, the LOP instrumentation allows the onsite diesel generator (DG) to connect to the emergency bus. Initiation of the DGs for loss of offsite power or degraded voltage conditions is not a function of the LOP instrumentation. The initiation of the DGs for loss of offsite power or degraded voltage conditions is performed by the 27HS relay as well as other non-safety related relays on the BOP bus. Initiation of the DGs is also performed by the opening of the feeder and incoming line breakers with the diesel engine shutdown. Each 4.16 kV emergency bus has its own independent LOP instrumentation and associated trip logic. The voltage for each bus is monitored at two levels, which can be considered as two different undervoltage Functions: Loss of Voltage and 4.16 kV Emergency Bus Undervoltage Degraded Voltage. Each Function causes various bus transfers and disconnects. The Loss of Voltage Function is monitored by one inverse time delay undervoltage relay (27/59E) and the Degraded Voltage Function is monitored by three definite time undervoltage relays (27DVA, 27DVB, and 27DVC) for each emergency bus. The Loss of Voltage Function is a one-out-of-one logic configuration and the Degraded Voltage Function output is arranged as a two-out-of-three logic configuration. The channels include electronic equipment (e.g., internal relay contacts, coils, etc.) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a LOP trip signal to the trip logic. APPLICABLE The LOP instrumentation is required for Engineered Safety Features to SAFETY ANALYSES, function in any accident with a loss of offsite power. The required LCO, and channels of LOP instrumentation ensure the ability of the ECCS and other APPLICABILITY assumed systems powered from the DGs to provide plant protection in the event of any of the Reference 1 and 2 analyzed accidents in which a loss of offsite power is assumed. The ability to initiate the DGs on loss of offsite power, and subsequent initiation of the ECCS, ensure that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. (continued) Brunswick Unit 2 B 3.3.8.1-1 Revision No. 78

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE Accident analyses credit the loading of the DG based on the loss of offsite SAFETY ANALYSES, power during a loss of coolant accident. The diesel starting and loading LCO, and times have been included in the delay time associated with each safety APPLICABILITY system component requiring DG supplied power following a loss of offsite (continued) power. The LOP instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). The OPERABILITY of the LOP instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.8.1-1. Each Function must have a required number of OPERABLE channels per 4.16 kV emergency bus, with their setpoints within the specified Allowable Values. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. The Allowable Values are specified for each Function in the Table. Trip setpoints are specified in the setpoint calculations. The setpoints are selected to ensure that the trip settings do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setting less conservative than the trip setpoint, but within the Allowable Value, is acceptable. A channel is inoperable if its actual trip setting is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., degraded voltage), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for calibration based errors. These calibration based instrument errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation. The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis. (continued) Brunswick Unit 2 B 3.3.8.1-2 Revision No. 78

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE 1. 4.16 kV Emergency Bus Undervoltage (Loss of Voltage) SAFETY ANALYSES, LCO, and A loss of voltage on a 4.16 kV emergency bus indicates that offsite power APPLICABILITY may be completely lost to the respective emergency bus and is unable to (continued) supply sufficient power for proper operation of the applicable equipment. The loss of voltage relay strips the rotating loads and cross-tie breakers from the emergency bus to provide a permissive for the diesel generator output breaker to close and restore power to the bus and applicable equipment when the bus voltage the bus drops below the Loss of Voltage Function Allowable Values (loss of voltage with a short inverse time delay). The loss of voltage relay also provides a trip signal to the incoming line breaker to the associated emergency bus to allow the diesel generator to connect to the emergency bus. The Bus Undervoltage Allowable Values are set low enough to prevent inadvertent load shedding and opening of the incoming line breaker. The Time Delay Allowable Values are set long enough to prevent inadvertent power supply transfer, but short enough to minimize the delay in providing backup power to the emergency bus. One channel of 4.16 kV Emergency Bus Undervoltage (Loss of Voltage) Function per associated emergency bus is only required to be OPERABLE when the associated DG is required to be OPERABLE to ensure that no single instrument failure can preclude the loading capability of three of the four DGs. (One channel inputs to each of the four DGs.) Refer to LCO 3.8.1, "AC SourcesOperating," and 3.8.2, "AC SourcesShutdown," for Applicability Bases for the DGs.

2. 4.16 kV Emergency Bus Undervoltage (Degraded Voltage)

A degraded voltage condition on a 4.16 kV emergency bus indicates that, while offsite power may not be completely lost to the respective emergency bus, available power may be insufficient for starting large ECCS motors without risking damage to the motors that could disable the ECCS function. When the bus voltage drops below the Degraded Voltage Function Allowable Values (degraded voltage with a fixed time delay), the degraded voltage relays will operate to separate the emergency bus from offsite power after a sufficient time delay to allow for recovery of the normal offsite power supply. The emergency bus loss of voltage relay strips the rotating loads and provides a trip signal to the cross-tie breakers. The load shedding provides a permissive to allow the diesel generator to connect to the bus. The Bus Undervoltage Allowable Values of the degraded voltage relays are set low enough to prevent inadvertent power supply transfer, but high enough to ensure that sufficient power is available to the required equipment. The Time Delay Allowable Values are long enough to allow (continued) Brunswick Unit 2 B 3.3.8.1-3 Revision No. 78

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE 2. 4.16 kV Emergency Bus Undervoltage (Degraded Voltage) SAFETY ANALYSES, (continued) LCO, and APPLICABILITY recovery of the normal offsite power supply and to prevent actuation during transient voltages created by starting large motors, but short enough to ensure that sufficient power is provided to the required equipment. Three channels of 4.16 kV Emergency Bus Undervoltage (Degraded Voltage) Function per associated emergency bus are only required to be OPERABLE when the associated DG is required to be OPERABLE to ensure that no single instrument failure can preclude the DG function. (Three channels input to each of the four emergency buses and DGs.) Refer to LCO 3.8.1, "AC Sources-Operating," and LCO 3.8.2, "AC Sources-Shutdown," for Applicability Bases for the DGs. ACTIONS A Note has been provided to modify the ACTIONS related to LOP instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable LOP instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable LOP instrumentation channel. A.1 With one or more channels of a Function inoperable, the Function is not capable of performing the intended function. Therefore, only 1 hour is allowed to restore the inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip would result in a DG initiation), Condition B must be entered and its Required Action taken. The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels. (continued) Brunswick Unit 2 B 3.3.8.1-4 Revision No. 78

LOP Instrumentation B 3.3.8.1 BASES ACTIONS B.1 (continued) If any Required Action and associated Completion Time are not met, the associated Function is not capable of performing the intended function. Therefore, the associated DG(s) is declared inoperable immediately. This requires entry into applicable Conditions and Required Actions of LCO 3.8.1 and LCO 3.8.2, which provide appropriate actions for the inoperable DG(s). SURVEILLANCE As noted at the beginning of the SRs, the SRs for each LOP REQUIREMENTS instrumentation Function are located in the SRs column of Table 3.3.8.1-1. The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 2 hours provided: (a) for Function 1, the associated Function maintains initiation capability for three DGs; and (b) for Function 2, the associate Function maintains DG initiation capability. For Function 1, the loss of function for one DG for this short period is appropriate since only three of four DGs are required to start within the required times and because there is no appreciable impact on risk. Also, upon completion of the Surveillance, or expiration of the 2 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. SR 3.3.8.1.1 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Frequency of 31 days is based on operating experience with regard to channel OPERABILITY and drift, which demonstrates that failure of more than one channel of a given Function is a rare event. (continued) Brunswick Unit 2 B 3.3.8.1-5 Revision No. 78

LOP Instrumentation B 3.3.8.1 BASES SURVEILLANCE SR 3.3.8.1.2 and SR 3.3.8.1.3 REQUIREMENTS (continued) A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Frequencies of SR 3.3.8.1.2 and SR 3.3.8.1.3 are based upon the assumptions of 18 and 24 month calibration intervals, respectively, in the determination of the magnitude of equipment drift in the setpoint analyses. SR 3.3.8.1.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel and includes simulated automatic operation of the channel. The system functional testing performed in LCO 3.8.1 and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety functions. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated these components will pass the Surveillance when performed at the 24 month Frequency. REFERENCES 1. UFSAR, Section 6.3.

2. UFSAR, Chapter 15.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.3.8.1-6 Revision No. 78

RPS Electric Power Monitoring B 3.3.8.2 B 3.3 INSTRUMENTATION B 3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring BASES BACKGROUND RPS Electric Power Monitoring System is provided to isolate the RPS bus from the motor generator (MG) set or an alternate power supply in the event of overvoltage, undervoltage, or underfrequency. This system protects the loads connected to the RPS bus against unacceptable voltage and frequency conditions (Ref. 1) and forms an important part of the primary success path of the essential safety circuits. Some of the essential equipment powered from the RPS buses includes the RPS logic and scram solenoids. RPS electric power monitoring assembly will detect any abnormal high or low voltage or low frequency condition in the outputs of the two MG sets or the alternate power supply and will de-energize its respective RPS bus, thereby causing all safety functions normally powered by this bus to de-energize. In the event of failure of an RPS Electric Power Monitoring System (e.g., both in series electric power monitoring assemblies), the RPS loads may experience significant effects from the unregulated power supply. Deviation from the nominal conditions can potentially cause damage to the scram solenoids and other Class 1E devices. In the event of a low voltage condition for an extended period of time, the scram solenoids can chatter and potentially lose their pneumatic control capability, resulting in a loss of primary scram action. In the event of an overvoltage condition, the RPS logic relays and scram solenoids may experience a voltage higher than their design voltage. If the overvoltage condition persists for an extended time period, it may cause equipment degradation and the loss of plant safety function. Two redundant Class 1E circuit breakers are connected in series between each RPS bus and its MG set, and between each RPS bus and the alternate power supply. Each of these circuit breakers has an associated independent set of Class 1E overvoltage, undervoltage, and underfrequency sensing logic. Together, a circuit breaker and its sensing logic constitute an electric power monitoring assembly. If the output of (continued) Brunswick Unit 2 B 3.3.8.2-1 Revision No. 30

RPS Electric Power Monitoring B 3.3.8.2 BASES BACKGROUND the MG set or the alternate power supply exceeds predetermined limits (continued) of overvoltage, undervoltage, or underfrequency, a trip coil driven by this logic circuitry opens the circuit breaker, which removes the associated power supply from service. APPLICABLE The RPS electric power monitoring is necessary to meet the assumptions SAFETY ANALYSES of the safety analyses by ensuring that the RPS equipment powered from the RPS buses can perform its intended function. RPS electric power monitoring provides protection to the RPS components, by acting to disconnect the RPS from the power supply under specified conditions that could damage the RPS equipment. RPS electric power monitoring satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 2). LCO The OPERABILITY of each RPS electric power monitoring assembly is dependent on the OPERABILITY of the overvoltage, undervoltage, and underfrequency logic, as well as the OPERABILITY of the associated circuit breaker. Two electric power monitoring assemblies are required to be OPERABLE for each inservice power supply. This provides redundant protection against any abnormal voltage or frequency conditions to ensure that no single RPS electric power monitoring assembly failure can preclude the function of RPS components. Each of the inservice electric power monitoring assembly trip logic setpoints is required to be within the specified Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Allowable Values are specified for each RPS electric power monitoring assembly trip logic (refer to SR 3.3.8.2.2 and SR 3.3.8.2.3). Trip setpoints are specified in the setpoint calculations. The setpoints are selected to ensure that the trip settings do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setting is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., overvoltage), and when the measured output value of the process parameter exceeds the (continued) Brunswick Unit 2 B 3.3.8.2-2 Revision No. 30

RPS Electric Power Monitoring B 3.3.8.2 BASES LCO setpoint, the associated device (e.g., trip unit) changes state. The (continued) analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for calibration based errors. These calibration based instrument errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation. The Allowable Values for the instrument settings of the normal power supply (RPS MG set) electric power monitoring assembly are based on the RPS MG sets providing 57 Hz and 117 V +/- 10%. The Allowable Values for the instrument settings of the alternate power supply electric power monitoring assembly are based on the alternate power supply providing 57 Hz and 120 V +/- 10%. The most limiting voltage requirement and associated line losses determine the settings of the electric power monitoring instrument channels. The settings are calculated based on the line resistance losses at the downstream locations of the solenoids and relays. APPLICABILITY The operation of the RPS electric power monitoring assemblies is essential to disconnect the RPS components from the MG set or alternate power supply during abnormal voltage or frequency conditions. Since the degradation of a nonclass 1E source supplying power to the RPS bus can occur as a result of any random single failure, the OPERABILITY of the RPS electric power monitoring assemblies is required when the RPS components are required to be OPERABLE. This results in the RPS Electric Power Monitoring System OPERABILITY being required in MODES 1 and 2; and in MODES 3, 4, and 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies. (continued) Brunswick Unit 2 B 3.3.8.2-3 Revision No. 30

RPS Electric Power Monitoring B 3.3.8.2 BASES (continued) ACTIONS A.1 If one RPS electric power monitoring assembly for an inservice power supply (MG set or alternate) is inoperable, or one RPS electric power monitoring assembly on each inservice power supply is inoperable, the OPERABLE assembly will still provide protection to the RPS components under degraded voltage or frequency conditions. However, the reliability and redundancy of the RPS Electric Power Monitoring System is reduced, and only a limited time (72 hours) is allowed to restore the inoperable assembly to OPERABLE status. If the inoperable assembly cannot be restored to OPERABLE status, the associated power supply(s) must be removed from service (Required Action A.1). This places the RPS bus in a safe condition. An alternate power supply with OPERABLE powering monitoring assemblies may then be used to power the RPS bus. The 72 hour Completion Time takes into account the remaining OPERABLE electric power monitoring assembly and the low probability of an event requiring RPS electric power monitoring protection occurring during this period. It allows time for plant operations personnel to take corrective actions or to place the plant in the required condition in an orderly manner and without challenging plant systems. Alternately, if it is not desired to remove the power supply from service (e.g., as in the case where removing the power supply(s) from service would result in a scram or isolation), Condition C or D, as applicable, must be entered and its Required Actions taken. B.1 If both power monitoring assemblies for an inservice power supply (MG set or alternate) are inoperable or both power monitoring assemblies in each inservice power supply are inoperable, the system protective function is lost. In this condition, 1 hour is allowed to restore one assembly to OPERABLE status for each inservice power supply. If one inoperable assembly for each inservice power supply cannot be restored to OPERABLE status, the associated power supply(s) must be removed (continued) Brunswick Unit 2 B 3.3.8.2-4 Revision No. 30

RPS Electric Power Monitoring B 3.3.8.2 BASES ACTIONS B.1 (continued) from service within 1 hour (Required Action B.1). An alternate power supply with OPERABLE assemblies may then be used to power one RPS bus. The 1 hour Completion Time is sufficient for the plant operations personnel to take corrective actions and is acceptable because it minimizes risk while allowing time for restoration or removal from service of the electric power monitoring assemblies. Alternately, if it is not desired to remove the power supply(s) from service (e.g., as in the case where removing the power supply(s) from service would result in a scram or isolation), Condition C or D, as applicable, must be entered and its Required Actions taken. C.1 and C.2 If any Required Action and associated Completion Time of Condition A or B are not met in MODE 1 or 2, a plant shutdown must be performed. This places the plant in a condition where minimal equipment, powered through the inoperable RPS electric power monitoring assembly(s), is required and ensures that the safety function of the RPS (e.g., scram of control rods) is not required. The plant shutdown is accomplished by placing the plant in MODE 3 within 12 hours. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. D.1 If any Required Action and associated Completion Time of Condition A or B are not met in MODE 3, 4, or 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, the operator must immediately initiate action to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Required Action D.1 results in the least reactive condition for the reactor core and ensures that the safety function of the RPS (e.g., scram of control rods) is not required. (continued) Brunswick Unit 2 B 3.3.8.2-5 Revision No. 30

RPS Electric Power Monitoring B 3.3.8.2 BASES (continued) SURVEILLANCE SR 3.3.8.2.1 REQUIREMENTS A CHANNEL FUNCTIONAL TEST is performed on each overvoltage, undervoltage, and underfrequency channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. As noted in the Surveillance, the CHANNEL FUNCTIONAL TEST is only required to be performed while the plant is in a condition in which the loss of the RPS bus will not jeopardize steady state power operation (the design of the system is such that the power source must be removed from service to conduct the Surveillance). The 24 hours is intended to indicate an outage of sufficient duration to allow for scheduling and proper performance of the Surveillance. The 184 day Frequency and the Note in the Surveillance are based on guidance provided in Generic Letter 91-09 (Ref. 3). BNP has evaluated as acceptable the performance of this evolution on-line, while maintaining the 184 day frequency if in cold shutdown. SR 3.3.8.2.2 and SR 3.3.8.2.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The Frequencies are based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. SR 3.3.8.2.4 Performance of a system functional test demonstrates that, with a required system actuation (simulated or actual) signal, the logic of the system will automatically trip open the associated power monitoring assembly. Only one signal per power monitoring assembly is required to (continued) Brunswick Unit 2 B 3.3.8.2-6 Revision No. 30

RPS Electric Power Monitoring B 3.3.8.2 BASES SURVEILLANCE SR 3.3.8.2.4 (continued) REQUIREMENTS be tested. This Surveillance overlaps with the CHANNEL CALIBRATION to provide complete testing of the safety function. The system functional test of the Class 1E circuit breakers is included as part of this test to provide complete testing of the safety function. If the breakers are incapable of operating, the associated electric power monitoring assembly would be inoperable. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that minimize the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the 24 month Frequency. REFERENCES 1. UFSAR, Section 7.2.1.1.1.3.

2. 10 CFR 50.36(c)(2)(ii).

3. NRC Generic Letter 91-09, Modification of Surveillance Interval for the Electrical Protective Assemblies in Power Supplies for the Reactor Protection System.

Brunswick Unit 2 B 3.3.8.2-7 Revision No. 30

Recirculation Loops Operating B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.1 Recirculation Loops Operating BASES BACKGROUND The Reactor Recirculation System is designed to provide a forced coolant flow through the core to remove heat from the fuel. The forced coolant flow removes heat at a faster rate from the fuel than would be possible with just natural circulation. The forced flow, therefore, allows operation at significantly higher power than would otherwise be possible. The Reactor Recirculation System also controls reactivity over a wide span of reactor power by varying the recirculation flow rate to control the void content of the moderator. The Reactor Recirculation System consists of two recirculation pump loops external to the reactor vessel. These loops provide the piping path for the driving flow of water to the reactor vessel jet pumps. Each external loop contains one variable speed motor driven recirculation pump, associated piping, valves, and instrumentation. The recirculation loops are part of the reactor coolant pressure boundary and are located inside the drywell structure. The jet pumps are reactor vessel internals. The speed of each recirculation pump is controlled by a motor generator (MG) set. The recirculated coolant consists of saturated water from the steam separators and dryers that has been subcooled by incoming feedwater. This water passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold, from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the driven flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the driving flow. The drive flow and driven flow are mixed in the jet pump throat section resulting in a partial pressure recovery. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core. The subcooled water enters the bottom of the fuel channels and contacts the fuel cladding, where heat is transferred to the coolant. As it rises, the (continued) Brunswick Unit 2 B 3.4.1-1 Revision No. 30

Recirculation Loops Operating B 3.4.1 BASES BACKGROUND coolant begins to boil, creating steam voids within the fuel channel that (continued) continue until the coolant exits the core. Because of reduced moderation, the steam voiding introduces negative reactivity that must be compensated for to maintain or to increase reactor power. The recirculation flow control allows operators to increase recirculation flow which increases the overall core heat transfer. As a result, core voiding is reduced thereby overcoming the negative reactivity void effect. Thus, the reason for having variable recirculation flow is to compensate for reactivity effects of boiling over a wide range of power generation (i.e., approximately 60 to 100% of RTP) without having to move control rods and disturb desirable flux patterns. Each recirculation loop is manually started from the control room. The MG set provides regulation of individual recirculation loop drive flows. The flow in each loop is manually controlled. APPLICABLE The operation of the Reactor Recirculation System is an initial condition SAFETY ANALYSES assumed in the design basis loss of coolant accident (LOCA). During a LOCA caused by a recirculation loop pipe break, the intact loop is assumed to provide coolant flow during the first few seconds of the accident. The initial core flow decrease is rapid because the recirculation pump in the broken loop ceases to pump reactor coolant to the vessel almost immediately. The pump in the intact loop coasts down relatively slowly. This pump coastdown governs the core flow response for the next several seconds until the jet pump suction is uncovered. The AREVA LOCA analyses assume mismatched flow in the recirculation loops. Mismatched flow has an insignificant impact on the fuel thermal margin during abnormal operational transients which are analyzed in Chapter 15 of the UFSAR (Ref. 2). Plant specific LOCA analyses have been performed assuming only one operating recirculation loop. The COLR presents single loop operation APLHGR limits in the form of a multiplier that is applied to the two loop operation APLHGR limits. This multiplier restricts the peak clad temperature for a LOCA with a single recirculation loop operating below the corresponding temperature for both loops operating. (continued) Brunswick Unit 2 B 3.4.1-2 Revision No. 79

Recirculation Loops Operating B 3.4.1 BASES APPLICABLE The transient analyses of Chapter 15 of the UFSAR have also been SAFETY ANALYSES evaluated for single recirculation loop operation. The evaluation (continued) concludes that results of the transient analyses are not significantly affected by the single recirculation loop operation. There is, however, an impact on the fuel cladding integrity SL since some of the uncertainties for the parameters used in the critical power determination are higher in single loop operation. The net result is an increase in the MCPR operating limit. During single recirculation loop operation, modification to the Reactor Protection System (RPS) average power range monitor (APRM) Simulated Thermal PowerHigh Allowable Value is required to account for the different analyzed limits between two-recirculation drive flow loop operation and operation with only one loop. The APRM channel subtracts the W value from the measured recirculation drive flow to effectively shift the limits and uses the adjusted recirculation drive flow value to determine the APRM Simulated Thermal PowerHigh Function trip setpoint. Recirculation loops operating satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). LCO Two recirculation loops are normally required to be in operation with their flows matched within the limits specified in SR 3.4.1.1 to ensure that that during a LOCA caused by a break of the piping of one recirculation loop the assumptions of the LOCA analysis are satisfied. Alternately, with only one recirculation loop in operation, modifications to the required APLHGR limits (LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)"), MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), LHGR limits (LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), and APRM Simulated Thermal Power High Allowable Value (LCO 3.3.1.1), as applicable, must be applied to allow continued operation. The COLR defines adjustments or modifications required for the APLHGR, MCPR, and LHGR limits for the current operating cycle. (continued) Brunswick Unit 2 B 3.4.1-3 Revision No. 79

Recirculation Loops Operating B 3.4.1 BASES APPLICABILITY In MODES 1 and 2, requirements for operation of the Reactor Coolant Recirculation System are necessary since there is considerable energy in the reactor core and the limiting design basis transients and accidents are assumed to occur. In MODES 3, 4, and 5, the consequences of an accident are reduced and the coastdown characteristics of the recirculation loops are not important. ACTIONS A.1 With the requirements of the LCO not met, the recirculation loops must be restored to operation with matched flows within 6 hours. A recirculation loop is considered not in operation when the pump in that loop is idle or when the mismatch between total jet pump flows of the two loops is greater than the required limits. The loop with the lower flow must be considered not in operation. Should a LOCA occur with one recirculation loop not in operation, the core flow coastdown and resultant core response may not be bounded by the LOCA analyses. Therefore, only a limited time is allowed to restore the inoperable loop to operating status. Alternatively, if the single loop requirements of the LCO are applied to operating limits and RPS setpoints, as applicable, operation with only one recirculation loop would satisfy the requirements of the LCO and the initial conditions of the accident sequence. The 6 hour Completion Time is based on the low probability of an accident occurring during this time period, on a reasonable time to complete the Required Action (i.e., reset the applicable limits or setpoints for single recirculation loop operation), and on frequent core monitoring by operators allowing abrupt changes in core flow conditions to be quickly detected. This Required Action does not require tripping the recirculation pump in the lowest flow loop when the mismatch between the total jet pump flows of the two loops is greater than the required limits. However, in cases where large flow mismatches occur, low flow or reverse flow can occur in the low flow loop jet pumps, causing vibration of the jet pumps. If zero or reverse flow is detected, the condition should be alleviated by changing pump speeds to re-establish forward flow. (continued) Brunswick Unit 2 B 3.4.1-4 Revision No. 62

Recirculation Loops Operating B 3.4.1 BASES ACTIONS B.1 With no recirculation loops in operation or the Required Action and associated Completion Time of Condition A not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours. In this condition, the recirculation loops are not required to be operating because of the reduced severity of DBAs and minimal dependence on the recirculation loop coastdown characteristics. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.4.1.1 REQUIREMENTS This SR ensures the recirculation loops are within the allowable limits for mismatch. At low core flow (i.e., < 75% of rated core flow), the MCPR requirements provide larger margins to the fuel cladding integrity Safety Limit such that the potential adverse effect of early boiling transition during a LOCA is reduced. A larger flow mismatch can, therefore, be allowed when core flow is < 75% of rated core flow. The recirculation loop jet pump flow, as used in this Surveillance, is the summation of the flows from all of the jet pumps associated with a single recirculation loop. The mismatch is measured in terms of the percent of rated core flow. If the flow mismatch exceeds the specified limits, the loop with the lower flow is considered not in operation. The SR is not required when both loops are not in operation since the mismatch limits are meaningless during single loop or natural circulation operation. The Surveillance must be performed within 24 hours after both loops are in operation. The 24 hour Frequency is consistent with the Surveillance Frequency for jet pump OPERABILITY verification and has been shown by operating experience to be adequate to detect off normal jet pump loop flows in a timely manner. REFERENCES 1. UFSAR, Section 5.4.1.3.

2. UFSAR, Chapter 15.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.4.1-5 Revision No. 79

Jet Pumps B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.2 Jet Pumps BASES BACKGROUND The Reactor Recirculation System is described in the Background section of the Bases for LCO 3.4.1, "Recirculation Loops Operating," which discusses the operating characteristics of the system and how these characteristics affect the Design Basis Accident (DBA) analyses. The jet pumps are part of the Reactor Recirculation System and are designed to provide forced circulation through the core to remove heat from the fuel. The jet pumps are located in the annular region between the core shroud and the vessel inner wall. Because the jet pump suction elevation is at two-thirds core height, the vessel can be reflooded and coolant level maintained at two-thirds core height even with the complete break of the recirculation loop pipe that is located below the jet pump suction elevation. Each reactor recirculation loop contains ten jet pumps. Recirculated coolant passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the driven flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the drive flow. The drive flow and driven flow are mixed in the jet pump throat section resulting in a partial pressure recovery. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core. APPLICABLE Jet pump OPERABILITY is an explicit assumption in the design basis loss SAFETY ANALYSES of coolant accident (LOCA) analysis evaluated in Reference 1. (continued) Brunswick Unit 2 B 3.4.2-1 Revision No. 30

Jet Pumps B 3.4.2 BASES APPLICABLE The capability of reflooding the core to two-thirds core height is SAFETY ANALYSES dependent upon the structural integrity of the jet pumps. If the structural (continued) system, including the beam holding a jet pump nozzle assembly in place, fails, jet pump displacement and performance degradation could occur, resulting in an increased flow area through the jet pump and a lower core flooding elevation. This could adversely affect the water level in the core during the reflood phase of a LOCA as well as the assumed blowdown flow during a LOCA. Jet pumps satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 2). LCO The structural failure of any of the jet pumps could cause significant degradation in the ability of the jet pumps to allow reflooding to two-thirds core height during a LOCA. OPERABILITY of all jet pumps is required to ensure that operation of the Reactor Recirculation System will be consistent with the assumptions used in the licensing basis analysis (Ref. 1). APPLICABILITY In MODES 1 and 2, the jet pumps are required to be OPERABLE since there is a large amount of energy in the reactor core and since the limiting DBAs are assumed to occur in these MODES. This is consistent with the requirements for operation of the Reactor Recirculation System (LCO 3.4.1). In MODES 3, 4, and 5, the Reactor Recirculation System is not required to be in operation, and when not in operation, sufficient flow is not available to evaluate jet pump OPERABILITY. ACTIONS A.1 An inoperable jet pump can increase the blowdown area and reduce the capability to reflood during a design basis LOCA. If one or more of the jet pumps are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours. The Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. (continued) Brunswick Unit 2 B 3.4.2-2 Revision No. 30

Jet Pumps B 3.4.2 BASES (continued) SURVEILLANCE SR 3.4.2.1 REQUIREMENTS This SR is designed to detect significant degradation in jet pump performance that precedes jet pump failure (Ref. 3). This SR is only required to be performed when the loop has forced recirculation flow since surveillance checks and measurements can only be performed during jet pump operation. The jet pump failure of concern is a complete mixer displacement due to jet pump beam failure. Jet pump plugging is also of concern since it adds flow resistance to the recirculation loop. Significant degradation is indicated if the specified criteria confirm unacceptable deviations from established patterns or relationships. The allowable deviations from the established patterns have been developed based on the variations experienced at plants during normal operation and with jet pump assembly failures (Ref. 3). Each recirculation loop must satisfy one of the performance criteria provided. Since refueling activities (fuel assembly replacement or shuffle, as well as any modifications to fuel support orifice size or core plate bypass flow) can affect the relationship between core flow, jet pump flow, and recirculation loop flow, these relationships may need to be re-established each cycle. Similarly, initial entry into extended single loop operation may also require establishment of these relationships. During the initial weeks of operation under such conditions, while base-lining new "established patterns", engineering judgement of the daily Surveillance results is used to detect significant abnormalities which could indicate a jet pump failure. The recirculation pump speed operating characteristics (pump flow and loop flow versus pump speed) are determined by the flow resistance from the loop suction through the jet pump nozzles. A change in the relationship may indicate a plug, flow restriction, loss in pump hydraulic performance, leakage, or new flow path between the recirculation pump discharge and jet pump nozzle. For this criterion, the pump flow and loop flow versus pump speed relationship must be verified. The generator speed associated with the recirculation pump motor-generator set may be used to measure recirculation pump speed. (continued) Brunswick Unit 2 B 3.4.2-3 Revision No. 30

Jet Pumps B 3.4.2 BASES SURVEILLANCE SR 3.4.2.1 (continued) REQUIREMENTS Individual jet pumps in a recirculation loop normally do not have the same flow. The unequal flow is due to the drive flow manifold, which does not distribute flow equally to all risers. The jet pump diffuser to lower plenum differential pressure pattern or relationship of one jet pump to the loop differential pressure ratio is repeatable. An appreciable change in this relationship is an indication that increased (or reduced) resistance has occurred in one of the jet pumps. The deviations from normal are considered indicative of a potential problem in the recirculation drive flow or jet pump system (Ref. 3). Normal flow ranges and established jet pump flow and differential pressure patterns are established by plotting historical data as discussed in Reference 3. The 24 hour Frequency has been shown by operating experience to be timely for detecting jet pump degradation and is consistent with the Surveillance Frequency for recirculation loop OPERABILITY verification. This SR is modified by two Notes. Note 1 allows this Surveillance not to be performed until 4 hours after the associated recirculation loop is in operation, since these checks can only be performed during jet pump operation. The 4 hours is an acceptable time to establish conditions appropriate for data collection and evaluation. Note 2 allows this SR not to be performed when THERMAL POWER is

                < 25% of RTP. During low flow conditions, jet pump noise approaches the threshold response of the associated flow instrumentation and precludes the collection of repeatable and meaningful data.

REFERENCES 1. UFSAR, Section 6.3.3.

2. 10 CFR 50.36(c)(2)(ii).

3. GE Service Information Letter No. 330, June 9, 1980.

Brunswick Unit 2 B 3.4.2-4 Revision No. 30

SRVs B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.3 Safety/Relief Valves (SRVs) BASES BACKGROUND The ASME Boiler and Pressure Vessel Code requires the reactor pressure vessel be protected from overpressure during upset conditions by self-actuated safety valves. As part of the nuclear pressure relief system, the size and number of SRVs are selected such that peak pressure in the nuclear system will not exceed the ASME Code limits for the reactor coolant pressure boundary (RCPB). The SRVs are located on the main steam lines between the reactor vessel and the first isolation valve within the drywell. The SRVs can actuate by either of two modes: the safety mode or the relief mode (However, for the purposes of this LCO, only the safety mode is required). In the safety mode (or spring mode of operation), the spring loaded pilot valve opens when steam pressure at the valve inlet overcomes the spring force holding the pilot valve closed. Opening the pilot valve allows a pressure differential to develop across the main valve piston and opens the main valve. This satisfies the Code requirement. Each SRV discharges steam through a discharge line to a point below the minimum water level in the suppression pool. The SRVs that provide the relief mode are the Automatic Depressurization System (ADS) valves. The ADS requirements are specified in LCO 3.5.1, "ECCSOperating." APPLICABLE The overpressure protection system must accommodate the most SAFETY ANALYSES severe pressurization transient. Evaluations have determined that the most severe transient is the closure of all main steam isolation valves (MSIVs), followed by reactor scram on high neutron flux (i.e., failure of the direct scram associated with MSIV position) (Ref. 1). For the purpose of the analyses, 10 SRVs are assumed to operate in the safety mode. The analysis results demonstrate that the design SRV capacity is capable of maintaining reactor pressure below the ASME Code limit of 110% of vessel design pressure (110% x 1250 psig = 1375 psig). This LCO helps to ensure that the acceptance limit of 1375 psig is met during the Design Basis Event. (continued) Brunswick Unit 2 B 3.4.3-1 Revision No. 72

SRVs B 3.4.3 BASES APPLICABLE For overpressurization associated with an ATWS event, 10 SRVs are SAFETY ANALYSES assumed to operate in the safety mode. The analysis (Ref. 2) (continued) results demonstrate that the design capacity is capable of maintaining reactor pressure below the ASME Section III Code Service Level C limits (1500 psig). From an overpressure standpoint, the design basis events are bounded by the overpressurization associated with the ATWS event described above. Reference 3 discusses additional events that are expected to actuate the SRVs. SRVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). LCO The safety function of 10 SRVs are required to be OPERABLE to satisfy the assumptions of the safety analysis (Refs. 1, 2, and 3). The requirements of this LCO are applicable only to the capability of the SRVs to mechanically open to relieve excess pressure when the lift setpoint is exceeded (safety function). The SRV setpoints are established to ensure that the ASME Code limit on peak reactor pressure is satisfied. The ASME Code specifications require the lowest safety valve setpoint to be at or below vessel design pressure (1250 psig) and the highest safety valve to be set so that the total accumulated pressure does not exceed 110% of the design pressure for overpressurization conditions. These setpoints also ensure that in the event of an ATWS, the reactor pressure remains below the ATWS limit of 1500 psig. The transient evaluations in the UFSAR involving the safety mode are based on these setpoints, but also include the additional uncertainties of +/- 3% of the nominal setpoint drift to provide an added degree of conservatism. Operation with fewer valves OPERABLE than specified, or with setpoints outside the ASME limits, could result in a more severe reactor response to a transient than predicted, possibly resulting in the ASME Code limit on reactor pressure being exceeded. APPLICABILITY In MODES 1, 2, and 3, all required SRVs must be OPERABLE, since considerable energy may be in the reactor core and the limiting design basis transients are assumed to occur in these MODES. The SRVs may (continued) Brunswick Unit 2 B 3.4.3-2 Revision No. 30

SRVs B 3.4.3 BASES APPLICABILITY be required to provide pressure relief to discharge energy from the core (continued) until such time that the Residual Heat Removal (RHR) System is capable of dissipating the core heat. In MODE 4, decay heat is low enough for the RHR System to provide adequate cooling, and reactor pressure is low enough that the overpressure limit is unlikely to be approached by assumed operational transients or accidents. In MODE 5, the reactor vessel head is unbolted or removed and the reactor is at atmospheric pressure. The SRV function is not needed during these conditions. ACTIONS A.1 and A.2 With less than the minimum number of required SRVs OPERABLE, a transient may result in the violation of the ASME Code limits on reactor pressure. If the safety function of one or more required SRVs is inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.4.3.1 REQUIREMENTS This Surveillance requires that the required 10 SRVs will open at the pressures assumed in the safety analysis of References 1, 2, and 3. The demonstration of the SRV safety function lift settings must be performed during shutdown, since this is a bench test, in accordance with the Inservice Testing Program. The lift setting pressure shall correspond to ambient conditions of the valves at nominal operating temperatures and pressures. SR 3.4.3.2 A manual actuation of each required SRV is performed to verify that, mechanically, the valve is functioning properly and no blockage exists in the valve discharge line. This can be demonstrated by the response of (continued) Brunswick Unit 2 B 3.4.3-3 Revision No. 30

SRVs B 3.4.3 BASES SURVEILLANCE SR 3.4.3.2 (continued) REQUIREMENTS the turbine control valves or bypass valves, by a change in the measured steam flow, or by any other method suitable to verify steam flow. Adequate reactor steam dome pressure must be available to perform this test to avoid damaging the valve. Sufficient time is therefore allowed after the required pressure is achieved to perform this test. Adequate pressure at which this test is to be performed, to avoid damaging the valve, is 945 psig. Plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME Code requirements, prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours after reactor steam pressure is adequate to perform the test. The 12 hours allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SR. If a valve fails to actuate due only to the failure of the solenoid but is capable of opening on overpressure, the safety function of the SRV is considered OPERABLE. The 24 month Frequency was developed based on the SRV tests required by the ASME OM Code (Ref. 5). Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. REFERENCES 1. UFSAR, Section 5.2.2.2.

2. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, Supplement 1, March 1996.

3. UFSAR, Chapter 15.

4. 10 CFR 50.36(c)(2)(ii).

5. ASME Code for Operation and Maintenance of Nuclear Power Plants.

Brunswick Unit 2 B 3.4.3-4 Revision No. 56

RCS Operational LEAKAGE B 3.4.4 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.4 RCS Operational LEAKAGE BASES BACKGROUND The RCS includes systems and components that contain or transport the coolant to or from the reactor core. The pressure containing components of the RCS and the portions of connecting systems out to and including the isolation valves define the reactor coolant pressure boundary (RCPB). The joints of the RCPB components are welded or bolted. During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. Limits on RCS operational LEAKAGE are required to ensure appropriate action is taken before the integrity of the RCPB is impaired. This LCO specifies the types and limits of LEAKAGE. This protects the RCPB described in 10 CFR 50.2, 10 CFR 50.55a(c), and the UFSAR (Refs. 1, 2, and 3). The safety significance of RCS LEAKAGE from the RCPB varies widely depending on the source, rate, and duration. Therefore, detection of LEAKAGE in the primary containment is necessary. Methods for quickly separating the identified LEAKAGE from the unidentified LEAKAGE are necessary to provide the operators quantitative information to permit them to take corrective action should a leak occur that is detrimental to the safety of the facility or the public. A limited amount of leakage inside primary containment is expected from auxiliary systems that cannot be made 100% leaktight. Leakage from these systems should be detected and isolated from the primary containment atmosphere, if possible, so as not to mask RCS operational LEAKAGE detection. This LCO deals with protection of the RCPB from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident. (continued) Brunswick Unit 2 B 3.4.4-1 Revision No. 30

RCS Operational LEAKAGE B 3.4.4 BASES (continued) APPLICABLE The allowable RCS operational LEAKAGE limits are based on the SAFETY ANALYSES predicted and experimentally observed behavior of pipe cracks. The normally expected background LEAKAGE due to equipment design and the detection capability of the instrumentation for determining system LEAKAGE were also considered. The evidence from experiments suggests that, for LEAKAGE even greater than the specified unidentified LEAKAGE limits, the probability is small that the imperfection or crack associated with such LEAKAGE would grow rapidly. The unidentified LEAKAGE flow limit allows time for corrective action before the RCPB could be significantly compromised. The 5 gpm limit is a small fraction of the calculated flow from a critical crack in the primary system piping. Crack behavior from experimental programs (Refs. 4 and 5) shows that leakage rates of hundreds of gallons per minute will precede crack instability. The low limit on increase in unidentified LEAKAGE assumes a failure mechanism of intergranular stress corrosion cracking (IGSCC) that produces tight cracks. This flow increase limit is capable of providing an early warning of such deterioration. No applicable safety analysis assumes the total LEAKAGE limit. The total LEAKAGE limit considers RCS inventory makeup capability and the capacity of the drywell sumps. RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 6). LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being indicative of material degradation. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE. Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

(continued) Brunswick Unit 2 B 3.4.4-2 Revision No. 30

RCS Operational LEAKAGE B 3.4.4 BASES LCO b. Unidentified LEAKAGE (continued) The 5 gpm of unidentified LEAKAGE (averaged over the previous 24 hour period) is allowed as a reasonable minimum detectable amount that the containment air monitoring and drywell sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO could result in continued degradation of the RCPB.

c. Total LEAKAGE The total LEAKAGE limit (averaged over the previous 24 hour period) is based on a reasonable minimum detectable amount and takes into consideration RCS inventory makeup capability and the capacity of the drywell sumps. The limit also accounts for LEAKAGE from known sources (identified LEAKAGE). Violation of this LCO indicates an unexpected amount of LEAKAGE and, therefore, could indicate new or additional degradation in an RCPB component or system.

d. Unidentified LEAKAGE Increase An unidentified LEAKAGE increase of > 2 gpm within the previous 24 hour period indicates a potential flaw in the RCPB and must be quickly evaluated to determine the source and extent of the LEAKAGE. The increase is measured relative to the steady state value; temporary changes in LEAKAGE rate as a result of transient conditions (e.g., startup) are not considered. As such, the 2 gpm increase limit is only applicable in MODE 1 when operating pressures and temperatures are established. Violation of this LCO could result in continued degradation of the RCPB.

APPLICABILITY In MODES 1, 2, and 3, the RCS operational LEAKAGE LCO applies, because the potential for RCPB LEAKAGE is greatest when the reactor is pressurized. In MODES 4 and 5, RCS operational LEAKAGE limits are not required since the reactor is not pressurized and stresses in the RCPB materials and potential for LEAKAGE are reduced. (continued) Brunswick Unit 2 B 3.4.4-3 Revision No. 30

RCS Operational LEAKAGE B 3.4.4 BASES (continued) ACTIONS A.1 With RCS unidentified or total LEAKAGE greater than the limits, actions must be taken to reduce the leak. Because the LEAKAGE limits are conservatively below the LEAKAGE that would constitute a critical crack size, 8 hours is allowed to reduce the LEAKAGE rates before the reactor must be shut down. If an unidentified LEAKAGE has been identified and quantified, it may be reclassified and considered as identified LEAKAGE; however, the total LEAKAGE limit would remain unchanged. An unidentified LEAKAGE increase of > 2 gpm within a 24 hour period is an indication of a potential flaw in the RCPB and action must be taken to reduce the leak. Although the increase does not necessarily violate the absolute unidentified LEAKAGE limit, it does provide an early warning of potential IGSCC. For an unidentified LEAKAGE increase greater than required limits, reducing the LEAKAGE rate such that the current rate is less than the "2 gpm increase in the previous 24 hours" limit may be performed either by isolating the source or other possible methods. The 8 hour Completion Time is reasonable to properly reduce the LEAKAGE increase before the reactor must be shut down without unduly jeopardizing plant safety. B.1 and B.2 If the Required Action and associated Completion Time of Condition A is not met or if pressure boundary LEAKAGE exists, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant safety systems. (continued) Brunswick Unit 2 B 3.4.4-4 Revision No. 30

RCS Operational LEAKAGE B 3.4.4 BASES (continued) SURVEILLANCE SR 3.4.4.1 REQUIREMENTS The RCS LEAKAGE is monitored by a variety of instruments designed to provide alarms when LEAKAGE is indicated and to quantify the various types of LEAKAGE. Leakage detection instrumentation is discussed in more detail in the Bases for LCO 3.4.5, "RCS Leakage Detection Instrumentation." Sump level and flow rate of the drywell and equipment drain sumps are monitored to determine actual LEAKAGE rates; however, any method may be used to quantify LEAKAGE within the guidelines of Reference 7. In conjunction with alarms and other administrative controls (monitoring the primary containment atmosphere particulate and gaseous radioactivity on a 24 hour Frequency), an 8 hour Frequency for this Surveillance is appropriate for identifying LEAKAGE and for tracking required trends (Ref. 8). REFERENCES 1. 10 CFR 50.2

2. 10 CFR 50.55a(c).

3. UFSAR, Chapter 5.0.

4. GEAP-5620, Failure Behavior in ASTM A106B Pipes Containing Axial ThroughWall Flaws, April 1968.

5. NUREG-75/067, Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactors, October 1975.

6. 10 CFR 50.36(c)(2)(ii).

7. Regulatory Guide 1.45, May 1973.

8. Generic Letter 88-01, Supplement 1, February 1992.

Brunswick Unit 2 B 3.4.4-5 Revision No. 30

RCS Leakage Detection Instrumentation B 3.4.5 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.5 RCS Leakage Detection Instrumentation BASES BACKGROUND The UFSAR (Ref. 1), requires means for detecting RCS LEAKAGE. Regulatory Guide 1.45, Revision 0, (Ref. 2) describes acceptable methods for selecting leakage detection systems. Limits on LEAKAGE from the reactor coolant pressure boundary (RCPB) are required so that appropriate action can be taken before the integrity of the RCPB is impaired (Ref. 2). Leakage detection systems for the RCS are provided to alert the operators when LEAKAGE rates above normal background levels are detected and also to supply quantitative measurement of LEAKAGE rates. In addition to meeting the OPERABILITY requirements, the monitors are typically set to provide the most sensitive response without causing an excessive number of spurious alarms. The Bases for LCO 3.4.4, "RCS Operational LEAKAGE," discuss the limits on RCS LEAKAGE rates. Systems for separating the LEAKAGE of an identified source from an unidentified source are necessary to provide prompt and quantitative information to the operators to permit them to take corrective action. LEAKAGE from the RCPB inside the drywell is detected by at least one of two independently monitored variables, such as drywell floor drain sump flow changes and drywell gaseous or particulate radioactivity levels. The primary means of quantifying LEAKAGE in the drywell is the drywell floor drain sump flow monitoring system. The drywell floor drain sump flow monitoring system monitors the LEAKAGE collected in the floor drain sump. This unidentified LEAKAGE consists of LEAKAGE from control rod drives, valve flanges, floor drains, the Reactor Building Closed Cooling Water System, and drywell cooler drains, and any LEAKAGE not collected in the drywell equipment drain sump. The drywell floor drain sump is provided with two sump pumps. A flow transmitter in the common discharge line of the drywell floor drain sump pumps inputs to a flow integrator. In addition to the required instrumentation, the starting frequency and run duration of a sump pump motor are monitored by timer circuitry to provide a signal (alarm) in the control room indicating that LEAKAGE has reached a specified limit. (continued) Brunswick Unit 2 B 3.4.5-1 Revision No. 75

RCS Leakage Detection Instrumentation B 3.4.5 BASES BACKGROUND The primary containment atmosphere radioactivity monitoring systems (continued) (particulate and gaseous) continuously monitor the primary containment atmosphere for airborne particulate and gaseous radioactivity. A significant increase of radioactivity, which may be attributed to a sudden increase in RCPB steam or reactor water LEAKAGE, is annunciated in the control room. APPLICABLE A threat of significant compromise to the RCPB exists if the barrier SAFETY ANALYSES contains a crack that is large enough to propagate rapidly. LEAKAGE rate limits are set low enough to detect the LEAKAGE emitted from a single crack in the RCPB (Refs. 3 and 4). A control room alarm/indication allows the operators to evaluate the significance of the indicated LEAKAGE and, if necessary, shut down the reactor for further investigation and corrective action. The allowed LEAKAGE rates are well below the rates predicted for critical crack sizes (Ref. 5). Therefore, these actions provide adequate response before a significant break in the RCPB can occur. RCS leakage detection instrumentation satisfies Criterion 1 of 10 CFR 50.36(c)(2)(ii) (Ref. 6). LCO This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide confidence that small amounts of unidentified LEAKAGE are detected in time to allow actions to place the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation. The LCO requires two instruments to be OPERABLE. The drywell floor drain sump monitoring system is required to quantify the unidentified LEAKAGE rate from the RCS. Thus, for the system to be considered OPERABLE, the flow transmitter and integrator, as well as a flow totalizer, must be OPERABLE and capable of determining the leakage rate. The identification of an increase in unidentified LEAKAGE will be delayed by the time required for the unidentified LEAKAGE to travel to the drywell floor drain sump and it may take longer than one hour to detect a 1 gpm increase in unidentified LEAKAGE, depending on the origin and magnitude of the LEAKAGE. This sensitivity is acceptable for containment sump monitor OPERABILITY. The reactor coolant contains radioactivity that, when released to the primary containment, can be detected by the gaseous or particulate primary containment atmosphere radioactivity monitor. Only one of the two detectors is required to be OPERABLE. Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and rapid responses to RCS (continued) Brunswick Unit 2 B 3.4.5-2 Revision No. 75

RCS Leakage Detection Instrumentation B 3.4.5 BASES LCO LEAKAGE, but have recognized limitations. Reactor coolant radioactivity (continued) levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects. If there are few fuel element cladding defects and low levels of activation products, it may not be possible for the gaseous or particulate primary containment atmosphere radioactivity monitors to detect a 1 gpm increase within 1 hour during normal operation. However, the gaseous or particulate containment primary atmosphere radioactivity monitor is OPERABLE when it is capable of detecting a 1 gpm increase in unidentified LEAKAGE within 1 hour given an RCS activity equivalent to that assumed in the design calculations for the monitors. The LCO is satisfied when monitors of diverse measurement means are available. Thus, the drywell floor drain sump monitoring system, in combination with a gaseous or particulate primary containment atmosphere radioactivity monitor, provides an acceptable minimum. APPLICABILITY In MODES 1, 2, and 3, leakage detection systems are required to be OPERABLE to support LCO 3.4.4. This Applicability is consistent with that for LCO 3.4.4. ACTIONS A.1 With the drywell floor drain sump flow monitoring system inoperable, no other required instrumentation can provide the equivalent information to quantify LEAKAGE. However, the primary containment atmosphere radioactivity monitor will provide indication of changes in LEAKAGE. With the drywell floor drain sump flow monitoring system inoperable, but with RCS unidentified and total LEAKAGE being determined every 8 hours (SR 3.4.4.1), operation may continue for 30 days. The 30 day Completion Time of Required Action A.1 is acceptable, based on operating experience, considering the multiple forms of leakage detection that are still available. B.1 and B.2 With both gaseous and particulate primary containment atmosphere radioactivity monitoring channels inoperable (i.e., the required primary containment atmosphere monitoring system), grab samples of the primary containment atmosphere must be taken and analyzed to provide periodic LEAKAGE information. Provided a sample is obtained and analyzed once every 12 hours, the plant may be operated for up to 30 days to allow restoration of at least one of the required monitors. (continued) Brunswick Unit 2 B 3.4.5-3 Revision No. 75

RCS Leakage Detection Instrumentation B 3.4.5 BASES (continued) ACTIONS B.1 and B.2 (continued) The 12 hour interval provides periodic information that is adequate to detect LEAKAGE. The 30 day Completion Time for restoration recognizes that at least one other form of leakage detection is available. C.1, C.2, and C.3 With the drywell floor drain sump monitoring system and the primary containment atmosphere particulate monitor inoperable, the only means of detecting LEAKAGE is the primary containment atmosphere gaseous radioactivity monitor. A Note clarifies this applicability of the Condition. The primary containment atmosphere gaseous radioactivity monitor typically cannot detect a 1 gpm leak within one hour when RCS activity is low. In addition, this configuration does not provide the required diverse means of leakage detection. Indirect methods of monitoring RCS leakage must be implemented. Grab samples of the primary containment atmosphere must be taken and analyzed and monitoring of RCS leakage by administrative means must be performed every 12 hours to provide alternate periodic information. Administrative means of monitoring RCS leakage include monitoring and trending parameters that may indicate an increase in RCS leakage. There are diverse alternative mechanisms from which appropriate indicators may be selected based on plant conditions. It is not necessary to utilize all of these methods, but a method or methods should be selected considering the current plant conditions and historical or expected sources of unidentified leakage. The administrative methods are drywell pressure, drywell temperature, Reactor Building Closed Cooling Water (RBCCW) system cooling water temperature to and from the primary containment atmosphere coolers, and reactor water level. These indications, coupled with the atmosphere grab samples, are sufficient to alert the operating staff to an unexpected increase in unidentified LEAKAGE. The 12 hour interval is sufficient to detect increasing RCS leakage. The Required Action provides 7 days to restore another RCS leakage monitor to OPERABLE status to regain the intended leakage detection diversity. The 7 day Completion Time ensures that the plant will not be operated in a degraded configuration for a lengthy time period. D.1 and D.2 If any Required Action and associated Completion Time of Condition A, B, or C cannot be met, or with all required monitors inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to perform the actions in an orderly manner and without challenging plant systems. (continued) Brunswick Unit 2 B 3.4.5-4 Revision No. 75

RCS Leakage Detection Instrumentation B 3.4.5 BASES (continued) SURVEILLANCE SR 3.4.5.1 REQUIREMENTS This SR is for the performance of a CHANNEL CHECK of the required primary containment atmosphere radioactivity monitoring system. The check gives reasonable confidence that the channel is operating properly. The Frequency of 12 hours is based on instrument reliability and is reasonable for detecting off normal conditions. SR 3.4.5.2 This SR is for the performance of a CHANNEL FUNCTIONAL TEST of the required RCS leakage detection instrumentation. The test ensures that the monitors can perform their function in the desired manner. The test also verifies, for the radioactivity monitoring channels only, the required alarm function of the instrument string. A source check along with a channel check will be used to determine the relative accuracy of the instrument. Failure of the source check not attributed to an instrument indication problem (e.g., problem with source check mechanism and not the detector), would not immediately result in instrument inoperability. The Frequency of 31 days considers instrument reliability, and operating experience has shown it proper for detecting degradation. SR 3.4.5.3 This SR is for the performance of a CHANNEL CALIBRATION of required leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Frequency of 24 months is consistent with the Brunswick refueling cycle and considers channel reliability. Operating experience has proven this Frequency is acceptable. REFERENCES 1. UFSAR, Section 5.2.5.

2. Regulatory Guide 1.45, Revision 0, "Reactor Coolant Pressure Boundary Leakage Detections Systems," May 1973.

3. GEAP-5620, Failure Behavior in ASTM A106B Pipes Containing Axial ThroughWall Flaws, April 1968.

4. NUREG-75/067, Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping in Boiling Water Reactors, October 1975.

5. UFSAR, Section 5.2.5.2.2.

6. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.4.5-5 Revision No. 75

RCS Specific Activity B 3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.6 RCS Specific Activity BASES BACKGROUND During circulation, the reactor coolant acquires radioactive materials due to release of fission products from fuel leaks into the reactor coolant and activation of corrosion products in the reactor coolant. These radioactive materials in the reactor coolant can plate out in the RCS, and, at times, an accumulation will break away to spike the normal level of radioactivity. The release of coolant during a Design Basis Accident (DBA) could send radioactive materials into the environment. Limits on the maximum allowable level of radioactivity in the reactor coolant are established to ensure that in the event of a release of any radioactive material to the environment during a DBA, radiation doses are maintained within the limits of 10 CFR 50.67 (Ref. 1). This LCO contains iodine specific activity limits. The iodine isotopic activities per gram of reactor coolant are expressed in terms of a DOSE EQUIVALENT I-131. The allowable levels are intended to limit the 2 hour radiation dose to an individual at the site boundary to a small fraction of the 10 CFR 50.67 limit. APPLICABLE Analytical methods and assumptions involving radioactive material in the SAFETY ANALYSES primary coolant are presented in References 2 and 3. The specific activity in the reactor coolant (the source term) is an initial condition for evaluation of the consequences of an accident due to a main steam line break (MSLB) outside containment. No fuel damage is postulated in the MSLB accident, and the release of radioactive material to the environment is assumed to end when the main steam isolation valves (MSIVs) close completely. This MSLB release forms the basis for determining offsite doses (Ref. 2). The limits on the specific activity of the primary coolant, assumed in the Reference 3 analyses, ensure that the 2 hour thyroid and whole body doses at the site boundary, resulting from an MSLB outside containment during steady state operation, will not exceed 10% of the dose guidelines of 10 CFR 50.67. RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). (continued) Brunswick Unit 2 B 3.4.6-1 Revision No. 39

RCS Specific Activity B 3.4.6 BASES (continued) LCO The specific iodine activity is limited to 0.2 µCi/gm DOSE EQUIVALENT I-131. This limit ensures the source term assumed in the safety analysis for the MSLB is not exceeded, so any release of radioactivity to the environment during an MSLB is less than a small fraction of the 10 CFR 50.67 limits. APPLICABILITY In MODE 1, and MODES 2 and 3 with any main steam line not isolated, limits on the primary coolant radioactivity are applicable since there is an escape path for release of radioactive material from the primary coolant to the environment in the event of an MSLB outside of primary containment. In MODES 2 and 3 with the main steam lines isolated, such limits do not apply since an escape path does not exist. In MODES 4 and 5, no limits are required since the reactor is not pressurized and the potential for leakage is reduced. ACTIONS A.1 and A.2 When the reactor coolant specific activity exceeds the LCO DOSE EQUIVALENT I-131 limit, but is 4.0 µCi/gm, samples must be analyzed for DOSE EQUIVALENT I-131 at least once every 4 hours. In addition, the specific activity must be restored to the LCO limit within 48 hours. The Completion Time of once every 4 hours is based on the time needed to take and analyze a sample. The 48 hour Completion Time to restore the activity level provides a reasonable time for temporary coolant activity increases (iodine spikes or crud bursts) to be cleaned up with the normal processing systems. The upper limit of 4.0 µCi/gm ensures that the thyroid dose from an MSLB will not exceed the dose guidelines of 10 CFR 50.67 or control room operator dose limits specified in GDC 19 of 10 CFR 50, Appendix A (Ref. 5). A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODE(S) while relying on the ACTIONS. This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to power operation. (continued) Brunswick Unit 2 B 3.4.6-2 Revision No. 39

RCS Specific Activity B 3.4.6 BASES ACTIONS B.1, B.2.1, B.2.2.1, and B.2.2.2 (continued) If the DOSE EQUIVALENT I-131 cannot be restored to 0.2 µCi/gm within 48 hours, or if at any time it is > 4.0 µCi/gm, it must be determined at least once every 4 hours and all the main steam lines must be isolated within 12 hours. Isolating the main steam lines precludes the possibility of releasing radioactive material to the environment in an amount that is more than a small fraction of the requirements of 10 CFR 50.67 during a postulated MSLB accident. Alternatively, the plant can be placed in MODE 3 within 12 hours and in MODE 4 within 36 hours. This option is provided for those instances when isolation of main steam lines is not desired (e.g., due to the decay heat loads). In MODE 4, the requirements of the LCO are no longer applicable. The Completion Time of once every 4 hours is the time needed to take and analyze a sample. The 12 hour Completion Time is reasonable, based on operating experience, to isolate the main steam lines in an orderly manner and without challenging plant systems. Also, the allowed Completion Times for Required Actions B.2.2.1 and B.2.2.2 for placing the unit in MODES 3 and 4 are reasonable, based on operating experience, to achieve the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.4.6.1 REQUIREMENTS This Surveillance is performed to ensure iodine remains within limit during normal operation. The 7 day Frequency is adequate to trend changes in the iodine activity level. This SR is modified by a Note that requires this Surveillance to be performed only in MODE 1 because the level of fission products generated in other MODES is much less. REFERENCES 1. 10 CFR 50.67.

2. UFSAR, Section 15.6.3.

3. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, dated September 1995.

4. 10 CFR 50.36(c)(2)(ii).

5. 10 CFR 50, Appendix A, GDC 19.

Brunswick Unit 2 B 3.4.6-3 Revision No. 39

RHR Shutdown Cooling SystemHot Shutdown B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.7 Residual Heat Removal (RHR) Shutdown Cooling SystemHot Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to reduce the temperature of the reactor coolant to 212°F in preparation for performing Refueling or Cold Shutdown maintenance operations. The RHR System has two loops with each loop consisting of two motor driven pumps, a heat exchanger, and associated piping and valves. There are two RHR shutdown cooling subsystems per RHR System loop. Both loops have a common suction from the same recirculation loop. The four redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal. Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the RHR Service Water System. Any one of the four RHR shutdown cooling subsystems can provide the required decay heat removal function. APPLICABLE Decay heat removal by operation of the RHR System in the shutdown SAFETY ANALYSES cooling mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important function that must be accomplished or boiling and ultimately core damage could result. The RHR shutdown cooling subsystems meet Criterion 4 of 10 CFR 50.36(c)(2)(ii) (Ref. 1). LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and when no recirculation pump is in operation, one shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one OPERABLE RHR pump, one heat exchanger, and the associated piping and valves. The two subsystems have a common suction source and are allowed to have a common heat exchanger and common discharge piping. Thus, to meet the LCO, both pumps in one loop or one pump in each of the two loops must be (continued) Brunswick Unit 2 B 3.4.7-1 Revision No. 30

RHR Shutdown Cooling SystemHot Shutdown B 3.4.7 BASES LCO OPERABLE. Since the piping and heat exchangers are passive (continued) components that are assumed not to fail, they are allowed to be common to both subsystems. Each shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. In MODE 3, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain or reduce the reactor coolant temperature as required. To ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. Note 1 permits both required RHR shutdown cooling subsystems and recirculation pumps to be removed from operation for a cumulative period of 2 hours in an 8 hour period. Note 2 allows one required RHR shutdown cooling subsystem to be inoperable for up to 2 hours for the performance of Surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation may be low enough and the heatup rate slow enough to allow changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy. APPLICABILITY In MODE 3 with reactor steam dome pressure below the RHR shutdown cooling isolation pressure (i.e., the actual pressure at which the isolation trip resets) the RHR System must be OPERABLE and shall be operated in the shutdown cooling mode to remove decay heat to reduce or maintain coolant temperature. Otherwise, a recirculation pump is required to be in operation. In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR shutdown cooling isolation pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the RHR System suction piping. Decay heat removal at reactor pressures greater than or equal to the RHR shutdown cooling isolation pressure is typically accomplished by (continued) Brunswick Unit 2 B 3.4.7-2 Revision No. 30

RHR Shutdown Cooling SystemHot Shutdown B 3.4.7 BASES APPLICABILITY condensing the steam in the main condenser. Additionally, in MODE 2 (continued) below this pressure, the OPERABILITY requirements for the Emergency Core Cooling Systems (ECCS) (LCO 3.5.1, "ECCSOperating") do not allow placing an RHR shutdown cooling subsystem into operation. The requirements for decay heat removal in MODES 4 and 5 are discussed in LCO 3.4.8, "Residual Heat Removal (RHR) Shutdown Cooling SystemCold Shutdown"; LCO 3.9.7, "Residual Heat Removal (RHR)High Water Level"; and LCO 3.9.8, "Residual Heat Removal (RHR)Low Water Level." ACTIONS A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem. A.1, A.2, and A.3 With one required RHR shutdown cooling subsystem inoperable for decay heat removal, except as permitted by LCO Note 2, the inoperable subsystem must be restored to OPERABLE status without delay. In this condition, the remaining OPERABLE subsystem can provide the necessary decay heat removal. The overall reliability is reduced, however, because a single failure in the OPERABLE subsystem could result in reduced RHR shutdown cooling capability. Therefore, an alternate method of decay heat removal must be provided. With both required RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability. This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities. (continued) Brunswick Unit 2 B 3.4.7-3 Revision No. 39

RHR Shutdown Cooling SystemHot Shutdown B 3.4.7 BASES ACTIONS A.1, A.2, and A.3 (continued) The required cooling capacity of the alternate method should be ensured by verifying (by calculation or demonstration) its capability to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability. Alternate methods are described in plant procedures. However, due to the potentially reduced reliability of the alternate methods of decay heat removal, it is also required to reduce the reactor coolant temperature to the point where MODE 4 is entered. B.1, B.2, and B.3 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as permitted by LCO Note 1, reactor coolant circulation by the RHR shutdown cooling subsystem or recirculation pump must be restored without delay. Until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant temperature. The 1 hour Completion Time is based on the coolant circulation function and is modified such that the 1 hour is applicable separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours thereafter. This will provide assurance of continued temperature monitoring capability. During the period when the reactor coolant is being circulated by an alternate method (other than by an RHR shutdown cooling subsystem or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate. (continued) Brunswick Unit 2 B 3.4.7-4 Revision No. 39

RHR Shutdown Cooling SystemHot Shutdown B 3.4.7 BASES (continued) SURVEILLANCE SR 3.4.7.1 REQUIREMENTS This Surveillance verifies that one required RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Frequency of 12 hours is sufficient in view of other visual and audible indications available to the operator for monitoring the RHR subsystem in the control room. This Surveillance is modified by a Note allowing sufficient time to align the RHR System for shutdown cooling operation after the pressure setpoint that isolates the shutdown cooling mode of the RHR System is reset, or for placing a recirculation pump in operation. The Note takes exception to the requirements of the Surveillance being met (i.e., forced coolant circulation is not required for this initial 2 hour period), which also allows entry into the Applicability of this Specification in accordance with SR 3.0.4 since the Surveillance will not be "not met" at the time of entry into the Applicability. REFERENCES 1. 10 CFR 50.36(c)(2)(ii). Brunswick Unit 2 B 3.4.7-5 Revision No. 39

RHR Shutdown Cooling SystemCold Shutdown B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.8 Residual Heat Removal (RHR) Shutdown Cooling SystemCold Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to maintain the temperature of the reactor coolant 212°F in preparation for performing Refueling or maintenance operations or the decay heat must be removed in order to maintain the reactor in the Cold Shutdown condition. The RHR System has two loops with each loop consisting of two motor driven pumps, a heat exchanger, and associated piping and valves. There are two RHR shutdown cooling subsystems per RHR System loop. Both loops have a common suction from the same recirculation loop. The four redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal. Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the RHR Service Water System. Any one of the four RHR shutdown cooling subsystems can provide the required decay heat removal function. APPLICABLE Decay heat removal by operation of the RHR System in the shutdown SAFETY ANALYSES cooling mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important function that must be accomplished or boiling and ultimately core damage could result. The RHR shutdown cooling subsystems meet Criterion 4 of 10 CFR 50.36(c)(2)(ii) (Ref. 1). LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and when no recirculation pump is in operation, one RHR shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one OPERABLE RHR pump, one heat exchanger, one RHR Service Water pump capable of cooling the heat exchanger, and the associated piping and valves. The two subsystems have a common suction source and are allowed to have a common heat (continued) Brunswick Unit 2 B 3.4.8-1 Revision No. 30

RHR Shutdown Cooling SystemCold Shutdown B 3.4.8 BASES LCO exchanger and common discharge piping. Thus, to meet the LCO, both (continued) pumps in one loop or one pump in each of the two loops must be OPERABLE. Since the piping and heat exchangers are passive components that are assumed not to fail, they are allowed to be common to both subsystems. In MODE 4, the RHR cross tie valve may be opened to allow pumps in one RHR loop to discharge through the opposite RHR and recirculation loops to make a complete subsystem. Additionally, each shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. In MODE 4, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain or reduce the reactor coolant temperature as required. To ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. Note 1 permits both required RHR shutdown cooling subsystems and recirculation pumps to be removed from operation for a cumulative period of 2 hours in an 8 hour period. Note 2 allows one required RHR shutdown cooling subsystem to be inoperable for up to 2 hours for the performance of Surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation may be low enough and the heatup rate slow enough to allow changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy. APPLICABILITY In MODE 4, the RHR Shutdown Cooling System may be operated in the shutdown cooling mode to remove decay heat to maintain coolant temperature below 212°F. Otherwise, a recirculation pump is required to be in operation. In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR shutdown cooling isolation pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the RHR System suction piping. Decay heat removal at reactor pressures greater than or equal to the RHR shutdown cooling isolation pressure is typically accomplished by (continued) Brunswick Unit 2 B 3.4.8-2 Revision No. 30

RHR Shutdown Cooling SystemCold Shutdown B 3.4.8 BASES APPLICABILITY condensing the steam in the main condenser. Additionally, in MODE 2 (continued) below this pressure, the OPERABILITY requirements for the Emergency Core Cooling Systems (ECCS) (LCO 3.5.1, "ECCSOperating") do not allow placing an RHR shutdown cooling subsystem into operation. The requirements for decay heat removal in MODE 3 below the shutdown cooling isolation pressure and in MODE 5 are discussed in LCO 3.4.7, "Residual Heat Removal (RHR) Shutdown Cooling SystemHot Shutdown"; LCO 3.9.7, "Residual Heat Removal (RHR)High Water Level"; and LCO 3.9.8, "Residual Heat Removal (RHR)Low Water Level." ACTIONS A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem. A.1 With one of the two required RHR shutdown cooling subsystems inoperable, except as permitted by LCO Note 2, the remaining subsystem is capable of providing the required decay heat removal. However, the overall reliability is reduced. Therefore, an alternate method of decay heat removal must be provided. With both required RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to the alternate method provided for the initial RHR shutdown cooling subsystem inoperability. This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour Completion Time is based on the (continued) Brunswick Unit 2 B 3.4.8-3 Revision No. 30

RHR Shutdown Cooling SystemCold Shutdown B 3.4.8 BASES ACTIONS A.1 (continued) decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of these alternate method(s) must be reconfirmed every 24 hours thereafter. This will provide assurance of continued heat removal capability. The required cooling capacity of the alternate method should be ensured by verifying (by calculation or demonstration) its capability to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability. Alternate methods are described in plant procedures. B.1 and B.2 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as permitted by LCO Note 1, and until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant temperature. The 1 hour Completion Time is based on the coolant circulation function and is modified such that the 1 hour is applicable separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours thereafter. This will provide assurance of continued temperature monitoring capability. During the period when the reactor coolant is being circulated by an alternate method (other than by an RHR shutdown cooling subsystem or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate. (continued) Brunswick Unit 2 B 3.4.8-4 Revision No. 30

RHR Shutdown Cooling SystemCold Shutdown B 3.4.8 BASES (continued) SURVEILLANCE SR 3.4.8.1 REQUIREMENTS This Surveillance verifies that one required RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Frequency of 12 hours is sufficient in view of other visual and audible indications available to the operator for monitoring the RHR subsystem in the control room. REFERENCES 1. 10 CFR 50.36(c)(2)(ii). Brunswick Unit 2 B 3.4.8-5 Revision No. 30

RCS P/T Limits B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.9 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation. This Specification contains P/T limit curves for heatup, cooldown, and inservice leakage and hydrostatic testing, and data for the maximum rate of change of reactor coolant temperature. The criticality curve provides limits for both heatup and cooldown during criticality. Development of the curves considered instrument uncertainty values of 10°F for temperature and 15 psig for pressure plus an additional 15 psig for pressure instrument location (Ref. 1). Each P/T limit curve defines an acceptable region for normal operation. The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region. The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel (including its appurtenances) is the component most subject to brittle failure. Therefore, the LCO limits apply mainly to the vessel (including its appurtenances). 10 CFR 50, Appendix G (Ref. 2), requires the establishment of P/T limits for material fracture toughness requirements of the RCPB materials. Reference 2 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the ASME Code, Section XI, Appendix G (Ref. 3). The P/T limit curves in this Specification were developed in accordance with the 1989 Edition of the ASME Code, Section XI, Appendix G (Ref. 3). These P/T limit curves were developed using the initiation fracture toughness, KIC, for the allowable material fracture toughness. The use of (continued) Brunswick Unit 2 B 3.4.9-1 Revision No. 30

RCS P/T Limits B 3.4.9 BASES BACKGROUND KIC for development of P/T limit curves has been approved by the ASME (continued) through Code Case N-640 (Ref. 4). The actual shift in the RTNDT of the vessel plate and weld materials will be established periodically by removing and evaluating representative irradiated reactor specimens from selected reactors in accordance with BWRVIP-86A (Reference 5) and Appendix H of 10 CFR 50 (Reference 6). For BNP, the limiting reactor vessel material with respect to P/T curves is the N16 nozzle material. The shift in the RTNDT of this material has been established in accordance with Regulatory Guide 1.99, Revision 2 (RG 1.99) (Reference 7). In development of the P/T curves (Reference 8), it is assumed that the 1/4t (ID) flaw with a cooldown is controlling based on the following:

1. Due to attenuation effects, the fluence is significantly higher at the 1/4t location compared to the 3/4t location. Therefore, the ARTNDT is significantly higher at the 1/4t location.

2. The thermal tensile stress due to a 100°F/hr heatup (for a 3/4t flaw) is about the same as the thermal tensile stress due to a 100°F/hr cooldown (for a 1/4t flaw).

3. The allowable material property (i.e., KIA or KIC) is lower at the end of a cooldown transient where thermal stresses are a maximum compared to the end of the heatup transient.

4. For the reactor pressure vessel (reactor pressure vessel ) (i.e., a thin cylinder), the pressure stress is essentially constant through the wall, so the 1/4t and 3/4t pressure stresses are not significantly different.

The criticality limits include the Reference 2 requirement that they be at least 40°F above the noncritical heatup curve or the cooldown curve and not lower than the minimum permissible temperature for the inservice leakage and hydrostatic testing. The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components. ASME Code, Section XI, Appendix E (Ref. 9), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits. (continued) Brunswick Unit 2 B 3.4.9-2 Revision No. 35

RCS P/T Limits B 3.4.9 BASES (continued) APPLICABLE The P/T limits are not derived from Design Basis Accident (DBA) SAFETY ANALYSES analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB, a condition that is unanalyzed. Reference 8 provides the curves and limits in this Specification. Since the P/T limits are not derived from any DBA, there are no acceptance limits related to the P/T limits. Rather, the P/T limits are acceptance limits themselves since they preclude operation in an unanalyzed condition. RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 10). LCO The elements of this LCO are:

a. RCS pressure and temperature are within the applicable limits specified in Figures 3.4.9-1 and 3.4.9-2, and heatup or cooldown rates are 100°F in any 1 hour period, during RCS heatup and cooldown;

b. RCS pressure and temperature are within the applicable limits in Figure 3.4.9-3, 3.4.9-4, or 3.4.9-5 and heatup or cooldown rates are 30°F in any 1 hour period, during RCS inservice leak and hydrostatic testing;

c. The temperature difference between the reactor vessel bottom head coolant and the RPV coolant is 145°F during recirculation pump startup;

d. The temperature difference between the reactor coolant in the respective recirculation loop and in the reactor vessel is 50°F during recirculation pump startup;

e. RCS pressure and temperature are within the criticality limits specified in Figure 3.4.9-2, prior to achieving criticality; and

f. The reactor vessel flange and the head flange temperatures are 70°F when tensioning the reactor vessel head bolting studs.

(continued) Brunswick Unit 2 B 3.4.9-3 Revision No. 35

RCS P/T Limits B 3.4.9 BASES LCO These limits define allowable operating regions and permit a large (continued) number of operating cycles while also providing a wide margin to nonductile failure. The rate of change of temperature limits control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and inservice leakage and hydrostatic testing P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves. Violation of the limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCS components. The consequences depend on several factors, as follows:

a. The severity of the departure from the allowable operating pressure temperature regime or the severity of the rate of change of temperature;

b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and

c. The existences, sizes, and orientations of flaws in the vessel material.

APPLICABILITY The potential for violating a P/T limit exists at all times. For example, P/T limit violations could result from ambient temperature conditions that result in the reactor vessel metal temperature being less than the minimum allowed temperature for boltup. Therefore, this LCO is applicable even when fuel is not loaded in the core. ACTIONS A.1 and A.2 Operation outside the P/T limits while in MODES 1, 2, and 3 must be corrected so that the RCPB is returned to a condition that has been verified as safe by stress analyses. The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner. (continued) Brunswick Unit 2 B 3.4.9-4 Revision No. 30

RCS P/T Limits B 3.4.9 BASES ACTIONS A.1 and A.2 (continued) Besides restoring operation within acceptable limits, an engineering evaluation is required to determine if RCS operation can continue. This engineering evaluation will determine the effect of the P/T limit violation on the fracture toughness properties of the RCS. The evaluation must verify the RCPB integrity remains acceptable and must be completed if continued operation is desired. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components. ASME Code, Section XI, Appendix E (Ref. 9), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline. The 72 hour Completion Time is reasonable to accomplish the evaluation of a mild violation. More severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed if continued operation is desired. Condition A is modified by a Note requiring Required Action A.2 be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity. B.1 and B.2 If a Required Action and associated Completion Time of Condition A are not met, the plant must be placed in a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of increased stress, or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. With the reduced pressure and temperature conditions, the possibility of propagation of undetected flaws is decreased. (continued) Brunswick Unit 2 B 3.4.9-5 Revision No. 35

RCS P/T Limits B 3.4.9 BASES ACTIONS B.1 and B.2 (continued) Pressure and temperature are reduced by placing the plant in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. C.1 and C.2 Operation outside the P/T limits in other than MODES 1, 2, and 3 (including defueled conditions) must be corrected so that the RCPB is returned to a condition that has been verified as safe by stress analyses. The Required Action must be initiated without delay and continued until the limits are restored. With the applicable limits of Figure 3.4.9-3, 3.4.9-4, or 3.4.9-5 exceeded during inservice hydrostatic and leak testing operations, the maximum temperature change shall be limited to 10°F in any 1 hour period during restoration of the P/T limit parameters to within limits. Besides restoring the P/T limit parameters to within limits, an engineering evaluation is required to determine if RCS operation is allowed. This engineering evaluation will determine the effect of the P/T limit violation on the fracture toughness properties of the RCS. This evaluation must verify that the RCPB integrity is acceptable and must be completed before approaching criticality or heating up to > 212°F. Several methods may be used, including comparison with pre-analyzed transients, new analyses, or inspection of the components. ASME Code, Section XI, Appendix E (Ref. 9), may be used to support the evaluation; however, its use is restricted to evaluation of the beltline. Condition C is modified by a Note requiring Required Action C.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action C.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity. (continued) Brunswick Unit 2 B 3.4.9-6 Revision No. 35

RCS P/T Limits B 3.4.9 BASES (continued) SURVEILLANCE SR 3.4.9.1 and SR 3.4.9.2 REQUIREMENTS Verification that operation is within limits is required every 30 minutes when RCS pressure and temperature conditions are undergoing planned changes. This Frequency is considered reasonable in view of the control room indication available to monitor RCS status. Also, since temperature rate of change limits are specified in hourly increments, 30 minutes permits a reasonable time for assessment and correction of minor deviations. Surveillance for heatup, cooldown, or inservice leakage and hydrostatic testing may be discontinued when the criteria given in the relevant plant procedure for ending the activity are satisfied. SR 3.4.9.1 is modified by a Note that requires the Surveillance to be performed only during system heatup and cooldown operations. SR 3.4.9.2 is modified by a Note that requires the Surveillance to be performed only during inservice leakage and hydrostatic testing. SR 3.4.9.3 A separate limit is used when the reactor is approaching criticality. Consequently, the RCS pressure and temperature must be verified within the appropriate limits before withdrawing control rods that will make the reactor critical. Performing the Surveillance within 15 minutes before control rod withdrawal for the purpose of achieving criticality provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the control rod withdrawal. SR 3.4.9.4 and SR 3.4.9.5 Differential temperatures within the applicable limits ensure that thermal stresses resulting from the startup of an idle recirculation pump will not exceed design allowances. (continued) Brunswick Unit 2 B 3.4.9-7 Revision No. 30

RCS P/T Limits B 3.4.9 BASES SURVEILLANCE SR 3.4.9.4 and SR 3.4.9.5 (continued) REQUIREMENTS Performing the Surveillance within 30 minutes before starting the idle recirculation pump provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the idle pump start. An acceptable means of demonstrating compliance with the differential temperature requirement of SR 3.4.9.4 is to compare the temperature of the reactor coolant in the dome to the bottom head drain temperature. As specified in procedures, an acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.9.5 is to compare the temperatures of the operating recirculation loop and the idle loop. SR 3.4.9.4 and SR 3.4.9.5 are modified by a Note that requires the Surveillance to be met only in MODES 1, 2, 3, and 4. In MODE 5, the overall stress on limiting components is lower. Therefore, T limits are not required. The Note also states the SR is only required to be met during recirculation pump startup, since this is when the stresses occur. SR 3.4.9.6, SR 3.4.9.7, and SR 3.4.9.8 Limits on the reactor vessel flange and head flange temperatures are generally bounded by the other P/T limits during system heatup and cooldown. However, operations approaching MODE 4 from MODE 5 and in MODE 4 with RCS temperature less than or equal to certain specified values require assurance that these temperatures meet the LCO limits. The flange temperatures must be verified to be above the limits 30 minutes before and while tensioning the vessel head bolting studs to ensure that once the head is tensioned the limits are satisfied. When in MODE 4 with RCS temperature 80F, 30 minute checks of the flange temperatures are required because of the reduced margin to the limits. When in MODE 4 with RCS temperature 100F, monitoring of the flange temperature is required every 12 hours to ensure the temperature is within the specified limits. SR 3.4.9.8 applies only to the reactor vessel flange and head flange temperatures; TS 3.4.9 does not limit the temperature of any other areas of the vessel when RCS temperature is 100F in MODE 4 or MODE 5, or when defueled. (continued) Brunswick Unit 2 B 3.4.9-8 Revision No. 87

RCS P/T Limits B 3.4.9 BASES SURVEILLANCE SR 3.4.9.6, SR 3.4.9.7, and SR 3.4.9.8 (continued) REQUIREMENTS The 30 minute Frequency reflects the urgency of maintaining the temperatures within limits, and also limits the time that the temperature limits could be exceeded. The 12 hour Frequency is reasonable based on the rate of temperature change possible at these temperatures. SR 3.4.9.6 is modified by a Note that requires the Surveillance to be performed only when tensioning the reactor vessel head bolting studs. SR 3.4.9.7 is modified by a Note that requires the Surveillance to be initiated 30 minutes after RCS temperature is 80°F in MODE 4. SR 3.4.9.8 is modified by a Note that requires the Surveillance to be initiated 12 hours after RCS temperature is 100°F in MODE 4. The Notes contained in these SRs are necessary to specify when the reactor vessel flange and head flange temperatures are required to be verified to be within the specified limits. REFERENCES 1. Calculation 0B21-1029, "Instrument Uncertainty for RCS Pressure/Temperature Limits Curve," Revision 0

2. 10 CFR 50, Appendix G.

3. 1989 Edition of the ASME Code, Section XI, Appendix G.

4. ASME Code Case N-640, "Alternative Reference Fracture Toughness for Development of P-T Limit Curves Section XI, Division 1."

5. EPRI Report TR-1003346, BWRVIP-86-A: BWR Vessel and Internals Project, Updated BWR Integrated Surveillance Program (ISP) Implementation Plan, October 2002.

6. 10 CFR 50, Appendix H.

7. Regulatory Guide 1.99, Revision 2, May 1988.

8. Calculation 0B11-0005, "Development of RPV Pressure-Temperature Curves For BNP Units 1 and 2 For Up To 32 EFPY of Plant Operation," Revision 1.

9. ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E.

10. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.4.9-9 Revision No. 35

Reactor Steam Dome Pressure B 3.4.10 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.10 Reactor Steam Dome Pressure BASES BACKGROUND The reactor steam dome pressure is an assumed value in the determination of compliance with reactor pressure vessel overpressure protection criteria and is also an assumed initial condition of design basis accidents and transients. APPLICABLE The reactor steam dome pressure of 1045 psig is an initial condition SAFETY ANALYSES of the vessel overpressure protection analysis of Reference 1. This analysis assumes an initial maximum reactor steam dome pressure and evaluates the response of the pressure relief system, primarily the safety/relief valves, during the limiting pressurization transient. The determination of compliance with the overpressure criteria is dependent on the initial reactor steam dome pressure; therefore, the limit on this pressure ensures that the assumptions of the overpressure protection analysis are conserved. Reference 2 also assumes an initial reactor steam dome pressure for the analyses of design basis accidents and transients used to determine the limits for fuel cladding integrity (see Bases for LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and 1% fuel cladding plastic strain (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)") and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)." Reactor steam dome pressure satisfies the requirements of Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). LCO The specified reactor steam dome pressure limit of 1045 psig ensures the plant is operated within the assumptions of the vessel overpressure protection analysis. Operation above the limit may result in a transient response more severe than analyzed. APPLICABILITY In MODES 1 and 2, the reactor steam dome pressure is required to be less than or equal to the limit. In these MODES, the reactor may be generating significant steam and events which may challenge the overpressure limits are possible. (continued) Brunswick Unit 2 B 3.4.10-1 Revision No. 62

Reactor Steam Dome Pressure B 3.4.10 BASES APPLICABILITY In MODES 3, 4, and 5, the limit is not applicable because the reactor is (continued) shut down. In these MODES, the reactor pressure is well below the required limit, and no anticipated events will challenge the overpressure limits. ACTIONS A.1 With the reactor steam dome pressure greater than the limit, prompt action should be taken to reduce pressure to below the limit and return the reactor to operation within the bounds of the analyses. The 15 minute Completion Time is reasonable considering the importance of maintaining the pressure within limits. This Completion Time also ensures that the probability of an accident occurring while pressure is greater than the limit is minimized. B.1 If the reactor steam dome pressure cannot be restored to within the limit within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.4.10.1 REQUIREMENTS Verification that reactor steam dome pressure is 1045 psig ensures that the initial conditions of the vessel overpressure protection analysis are met. Operating experience has shown the 12 hour Frequency to be sufficient for identifying trends and verifying operation within safety analyses assumptions. REFERENCES 1. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, dated September 1995.

2. UFSAR, Chapter 15.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.4.10-2 Revision No. 30

ECCSOperating B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.1 ECCSOperating BASES BACKGROUND The ECCS is designed, in conjunction with the primary and secondary containment, to limit the release of radioactive materials to the environment following a loss of coolant accident (LOCA). The ECCS uses two diverse methods (flooding and spraying) to cool the core during a LOCA. The ECCS consist of the High Pressure Coolant Injection (HPCI) System, the Core Spray (CS) System, the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System, and the Automatic Depressurization System (ADS). The suppression pool provides the required source of water for the ECCS. Although no credit is taken in the safety analyses for the condensate storage tank (CST), it is capable of providing a source of water for the HPCI and CS systems. On receipt of an initiation signal, ECCS pumps automatically start, the systems align, and the pumps inject water, taken either from the CST or suppression pool, into the Reactor Coolant System (RCS) as RCS pressure is overcome by the discharge pressure of the ECCS pumps. Although the system is initiated, ADS action is delayed, allowing the operator to interrupt the timed sequence if the system is not needed. The HPCI pump discharge pressure almost immediately exceeds that of the RCS, and the pump injects coolant into the vessel to cool the core. If the break is small, the HPCI System will maintain coolant inventory as well as vessel level while the RCS is still pressurized. If HPCI fails, it is backed up by ADS in combination with LPCI and CS. In this event, the ADS timed sequence would be allowed to time out and open the selected safety/relief valves (SRVs) depressurizing the RCS, thus allowing the LPCI and CS to overcome RCS pressure and inject coolant into the vessel. If the break is large, RCS pressure drops rapidly and the LPCI and CS Systems inject to cool the core. Water from the break returns to the suppression pool where it is reused. Water in the suppression pool is circulated through a heat exchanger cooled by the RHR Service Water System. Depending on the location and size of the break, portions of the ECCS may be ineffective; however, (continued) Brunswick Unit 2 B 3.5.1-1 Revision No. 30

ECCSOperating B 3.5.1 BASES BACKGROUND the overall design is effective in cooling the core regardless of the size or (continued) location of the piping break. All ECCS subsystems are designed to ensure that no single active component failure will prevent automatic initiation and successful operation of the minimum required ECCS equipment. The CS System (Ref. 1) is composed of two independent subsystems. Each subsystem consists of a motor driven pump, a spray sparger above the core, and piping and valves to transfer water from the suppression pool to the sparger. The CS System is designed to provide cooling to the reactor core when reactor pressure is low. Upon receipt of an initiation signal, the CS pumps in both subsystems are automatically started approximately 15 seconds after AC power is available. When the RPV pressure drops sufficiently, CS System flow to the RPV begins. A full flow test line is provided to route water to the suppression pool to allow testing of the CS System without spraying water in the RPV. LPCI is an operating mode of the RHR System. There are two LPCI subsystems (Ref. 2), each consisting of two motor driven pumps and required piping and valves to transfer water from the suppression pool to the RPV via the corresponding recirculation loop. The two LPCI subsystems can be interconnected via the RHR System cross tie valve; however, the cross tie valve is maintained closed and locked to prevent loss of both LPCI subsystems during a LOCA. The LPCI subsystems are designed to provide core cooling at low RPV pressure. Upon receipt of an initiation signal, all four LPCI pumps are automatically started approximately 10 seconds after AC power is available. RHR System valves in the LPCI flow path are automatically positioned to ensure the proper flow path for water from the suppression pool to inject into the recirculation loops except the LPCI pump suction valves which are keylocked and administratively controlled. Additionally, the recirculation pump discharge valves and recirculation pump discharge bypass valves automatically close to prevent diverting LPCI flow from the RPV. When the RPV pressure drops sufficiently, the LPCI flow to the RPV begins via the corresponding recirculation loop. The water then enters the core (continued) Brunswick Unit 2 B 3.5.1-2 Revision No. 30

ECCSOperating B 3.5.1 BASES BACKGROUND through the jet pumps. Full flow test lines (one in each LPCI subsystem) (continued) are provided for the four LPCI pumps to route water to the suppression pool, to allow testing of the LPCI pumps without injecting water into the RPV. These test lines also provide suppression pool cooling capability, as described in LCO 3.6.2.3, "RHR Suppression Pool Cooling." The HPCI System (Ref. 3) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the feedwater system line, where the coolant is distributed within the RPV through the feedwater sparger. Suction piping for the system is provided from the CST and the suppression pool. Pump suction for HPCI is normally aligned to the CST source to minimize injection of suppression pool water into the RPV. However, if the CST water supply is low, or if the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the HPCI System. The steam supply to the HPCI turbine is piped from a main steam line upstream of the associated inboard main steam isolation valve. The HPCI System is designed to provide core cooling for a wide range of reactor pressures (150 psid to 1164 psid, vessel to drywell). Upon receipt of an initiation signal, the HPCI turbine stop valve and turbine control valve open and the turbine accelerates to a specified speed. As the HPCI flow increases, the turbine governor valve is automatically adjusted to maintain design flow. Exhaust steam from the HPCI turbine is discharged to the suppression pool. A full flow test line is provided to route water to the CST to allow testing of the HPCI System during normal operation without injecting water into the RPV. The ECCS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open to prevent pump damage due to overheating when flow through the associated pump is insufficient for pump cooling. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, all ECCS pump discharge lines are filled with water. The ECCS pump discharge lines are maintained full of water using a "keep fill" system. (continued) Brunswick Unit 2 B 3.5.1-3 Revision No. 30

ECCSOperating B 3.5.1 BASES BACKGROUND The ADS (Ref. 4) consists of 7 of the 11 SRVs. It is designed to provide (continued) depressurization of the RCS during a small break LOCA if HPCI fails or is unable to maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating pressure range of the low pressure ECCS subsystems so that these subsystems can provide coolant inventory makeup. Each of the SRVs used for automatic depressurization is equipped with one air accumulator and associated inlet check valves. The accumulator provides the pneumatic power to actuate the valves. APPLICABLE The ECCS performance is evaluated for the entire spectrum of break SAFETY ANALYSES sizes for a postulated LOCA. The accidents for which ECCS operation is required are presented in References 5 and 6. The required analyses and assumptions are defined in Reference 7. The results of these analyses are also described in Reference 8. This LCO helps to ensure that the following acceptance criteria for the ECCS, established by 10 CFR 50.46 (Ref. 9), will be met following a LOCA, assuming the worst case single active component failure in the ECCS:

a. Maximum fuel element cladding temperature is 2200°F;

b. Maximum cladding oxidation is 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. The core is maintained in a coolable geometry; and

e. Adequate long term cooling capability is maintained.

The limiting single failures are discussed in Reference 8. No mitigation credit for HPCI activation is assumed in any LOCA analysis. The remaining OPERABLE ECCS subsystems provide the capability to adequately cool the core and prevent excessive fuel damage. The ECCS satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 11). (continued) Brunswick Unit 2 B 3.5.1-4 Revision No. 62

ECCSOperating B 3.5.1 BASES LCO Each ECCS injection/spray subsystem and six of seven ADS valves are required to be OPERABLE. The ECCS injection/spray subsystems are defined as the two CS subsystems, the two LPCI subsystems, and one HPCI System. The low pressure ECCS injection/spray subsystems are defined as the two CS subsystems and the two LPCI subsystems. With less than the required number of ECCS subsystems OPERABLE, the potential exists that during a limiting design basis LOCA concurrent with the worst case single failure, the limits specified in Reference 9 could be exceeded. All ECCS subsystems must therefore be OPERABLE to satisfy the single failure criterion required by Reference 9. LPCI subsystems may be considered OPERABLE during alignment and operation for decay heat removal when below the actual RHR shutdown cooling isolation pressure in MODE 3, if they are capable of being manually realigned (remote or local) to the LPCI mode and not otherwise inoperable. Alignment and operation for decay heat removal includes the period when the required RHR pump is not operating and the period when the system is being realigned to or from the RHR shutdown cooling mode. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling when necessary. APPLICABILITY All ECCS subsystems are required to be OPERABLE during MODES 1, 2, and 3, when there is considerable energy in the reactor core and core cooling would be required to prevent fuel damage in the event of a break in the primary system piping. In MODES 2 and 3, when reactor steam dome pressure is 150 psig, ADS and HPCI are not required to be OPERABLE because the low pressure ECCS subsystems can provide sufficient flow below this pressure. ECCS requirements for MODES 4 and 5 are specified in LCO 3.5.2, "ECCSShutdown." (continued) Brunswick Unit 2 B 3.5.1-5 Revision No. 62

ECCSOperating B 3.5.1 BASES (continued) ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable HPCI subsystem. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable HPCI subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance. A.1 If any one low pressure ECCS injection/spray subsystem is inoperable or if one LPCI pump in each subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days (e.g., if one LPCI pump in each subsystem is inoperable, both pumps must be restored within 7 days). In this Condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced because a single failure in one of the remaining OPERABLE subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 12) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times). B.1 and B.2 If any CS subsystem is inoperable concurrent with one LPCI pump, the CS subsystem or the LPCI pump must be restored in 72 hours. In this condition, the remaining OPERABLE low pressure ECCS subsystems and the remaining pump in the inoperable LPCI subsystem provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced because a single active component failure in any of the low pressure ECCS subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function. The 72 hour Completion Time is based on a reliability study (Ref. 12) that evaluated the impact on the ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times). (continued) Brunswick Unit 2 B 3.5.1-6 Revision No. 39

ECCSOperating B 3.5.1 BASES ACTIONS C.1 and C.2 (continued) If any Required Action and associated Completion Time of Condition A or B are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. D.1 and D.2 If the HPCI System is inoperable and the RCIC System is verified to be OPERABLE, the HPCI System must be restored to OPERABLE status within 14 days. In this condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with ADS. Also, the RCIC System will automatically provide makeup water at most reactor operating pressures. Immediate verification of RCIC OPERABILITY is therefore required when HPCI is inoperable. This may be performed as an administrative check by examining logs or other information to determine if RCIC is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. However, if the OPERABILITY of the RCIC System cannot be immediately verified, Condition I must be immediately entered. If a single active component fails concurrent with a design basis LOCA, there is a potential, depending on the specific failure, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on a reliability study cited in Reference 12 and has been found to be acceptable through operating experience. E.1 and E.2 If any one low pressure ECCS injection/spray subsystem is inoperable in addition to an inoperable HPCI System, the inoperable low pressure ECCS injection/spray subsystem or the HPCI System must be restored to OPERABLE status within 72 hours. In this condition, adequate core (continued) Brunswick Unit 2 B 3.5.1-7 Revision No. 30

ECCSOperating B 3.5.1 BASES ACTIONS E.1 and E.2 (continued) cooling is ensured by the OPERABILITY of the ADS and the remaining low pressure ECCS subsystems. However, the overall ECCS reliability is significantly reduced because a single failure in one of the remaining OPERABLE subsystems concurrent with a design basis LOCA may result in the ECCS not being able to perform its intended safety function. Since both a high pressure system (HPCI) and a low pressure subsystem are inoperable, a more restrictive Completion Time of 72 hours is required to restore either the HPCI System or the low pressure ECCS injection/spray subsystem to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 12 and has been found to be acceptable through operating experience. F.1 The LCO requires six of seven ADS valves to be OPERABLE in order to provide the ADS function. Reference 8 contains the results of an analysis that evaluated the effect of two ADS valves being out of service. This analysis showed that assuming a failure of the HPCI System, operation of only five ADS valves will provide the required depressurization. However, overall reliability of the ADS is reduced with one required ADS valve inoperable because a single failure in the OPERABLE ADS valves may result in a reduction in depressurization capability. Therefore, operation is only allowed for a limited time. The 14 day Completion Time is based on a reliability study cited in Reference 12 and has been found to be acceptable through operating experience. G.1 and G.2 If any one low pressure ECCS injection/spray subsystem is inoperable in addition to one required ADS valve inoperable, adequate core cooling is ensured by the OPERABILITY of the HPCI System and the remaining low pressure ECCS injection/spray subsystems. However, overall ECCS reliability is reduced because a single active component failure concurrent with a design basis LOCA may result in the minimum required ECCS equipment not being available. (continued) Brunswick Unit 2 B 3.5.1-8 Revision No. 62

ECCSOperating B 3.5.1 BASES ACTIONS G.1 and G.2 (continued) Since both a high pressure system (ADS) and a low pressure subsystem are inoperable, a more restrictive Completion Time of 72 hours is required to restore either the low pressure ECCS subsystem or the required ADS valve to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 12 and has been found to be acceptable through operating experience. H.1 and H.2 If the HPCI System is inoperable in addition to one required ADS valve inoperable, adequate core cooling is ensured by the OPERABILITY of the remaining ADS valves and the low pressure ECCS subsystems. However, overall ECCS reliability is reduced because a single active component failure concurrent with a design basis LOCA may result in the minimum required ECCS equipment not being available. Since a high pressure system is inoperable (HPCI) and the ADS cannot withstand a single active component failure, a more restrictive Completion Time of 72 hours is required to restore either the HPCI System or the required ADS valve to OPERABLE status. The Completion Time is based on a reliability study cited in Reference 12 and has been found to be acceptable through operating experience. I.1 and I.2 If any Required Action and associated Completion Time of Condition D, E, F, G, or H is not met, or if two or more required ADS valves are inoperable, the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and reactor steam dome pressure reduced to 150 psig within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. (continued) Brunswick Unit 2 B 3.5.1-9 Revision No. 30

ECCSOperating B 3.5.1 BASES ACTIONS J.1 (continued) When multiple ECCS subsystems are inoperable, as stated in Condition J, the plant is in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately. SURVEILLANCE SR 3.5.1.1 REQUIREMENTS The flow path piping of each ECCS has the potential to develop voids and pockets of entrained air. Maintaining the pump discharge lines of the HPCI System, CS subsystems, and LPCI subsystems full of water ensures that the ECCS will perform properly, injecting its full capacity into the RCS upon demand. This SR also prevents water hammer in the piping following an ECCS initiation signal. One acceptable method of ensuring that the lines are full is to vent at the high points. The 31 day Frequency is based on the gradual nature of void buildup in the ECCS piping, the procedural controls governing system operation, and operating experience. SR 3.5.1.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these are verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition to the accident position in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the HPCI System, this SR also includes the steam flow path for the turbine and the flow controller position. (continued) Brunswick Unit 2 B 3.5.1-10 Revision No. 30

ECCSOperating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.2 (continued) REQUIREMENTS The 31 day Frequency of this SR was derived from the Inservice Testing Program requirements for performing valve testing at least once every 92 days. The Frequency of 31 days is further justified because the valves are operated under procedural control and because improper valve position typically only affects a single subsystem. This Frequency has been shown to be acceptable through operating experience. In MODE 3 with reactor steam dome pressure less than the RHR shutdown cooling isolation pressure, the RHR System may be required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. Therefore, this SR is modified by a Note that allows LPCI subsystems to be considered OPERABLE during alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the LPCI mode and not otherwise inoperable. Alignment and operation for decay heat removal includes the period when the required RHR pump is not operating and the period when the system is being realigned to or from the RHR shutdown cooling mode. At low reactor pressure and with a low decay heat load associated with operation in MODE 3 with reactor steam dome pressure less than the RHR shutdown cooling isolation pressure, a reduced complement of low pressure ECCS subsystems should provide the required core cooling in the unlikely event of a LOCA, thereby, allowing operation of the shutdown cooling mode of the RHR System, when necessary. SR 3.5.1.3 Verification every 31 days that ADS pneumatic supply header pressure is 95 psig ensures adequate pneumatic pressure for reliable ADS operation. The accumulator on each ADS valve provides pneumatic pressure for valve actuation. The design pneumatic supply pressure requirements for the accumulator are such that, following a failure of the pneumatic supply to the accumulator, at least three valve actuations can occur with the drywell at 70% of design pressure. The ECCS safety analysis assumes only one actuation to achieve the depressurization required for operation of the low pressure ECCS. This minimum required pressure of 95 psig is provided by the non-interruptible Reactor (continued) Brunswick Unit 2 B 3.5.1-11 Revision No. 30

ECCSOperating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.3 (continued) REQUIREMENTS Instrument Air System, the Pneumatic Nitrogen System, or the Nitrogen Backup System. This SR may be satisfied by verifying the absence of all associated pneumatic low pressure alarms. The 31 day Frequency takes into consideration administrative controls over operation of the pneumatic systems and alarms for low air and nitrogen pressure. SR 3.5.1.4 Verification every 31 days that the RHR System cross tie valve is locked closed ensures that each LPCI subsystem remains independent and a failure of the flow path in one subsystem will not affect the flow path of the other LPCI subsystem. If the RHR System cross tie valve is open, both LPCI subsystems must be considered inoperable. The 31 day Frequency has been found acceptable, considering that this manual valve is under strict administrative controls that will ensure the valve continues to remain locked closed. SR 3.5.1.5 Cycling the recirculation pump discharge and bypass valves through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and will close when required. Upon initiation of an automatic LPCI subsystem injection signal, these valves are required to be closed to ensure full LPCI subsystem flow injection in the RPV. De-energizing the valves in the closed position will also ensure the proper flow path for the LPCI subsystem. Acceptable methods of de-energizing a valve include de-energizing breaker control power, racking out the breaker or removing the breaker. The specified Frequency is once each reactor startup before THERMAL POWER is > 25% RTP. However, this SR is modified by a Note that states the Surveillance is only required to be performed if the last performance was more than 31 days ago. Verification prior to or during each reactor startup prior to reaching > 25% RTP is an exception to the normal Inservice Testing Program generic valve cycling Frequency of (continued) Brunswick Unit 2 B 3.5.1-12 Revision No. 30

ECCSOperating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.5 (continued) REQUIREMENTS 92 days, but is considered acceptable due to the demonstrated reliability of these valves. If the valve is inoperable and in the open position, the associated LPCI subsystem must be declared inoperable. SR 3.5.1.6, SR 3.5.1.7, and SR 3.5.1.8 The performance requirements of the low pressure ECCS pumps are determined through application of the 10 CFR 50, Appendix K criteria (Ref. 7). This periodic Surveillance is performed (in accordance with the ASME Code requirements for the ECCS pumps) to verify that the ECCS pumps will develop the flow rates required by the respective analyses. The low pressure ECCS pump flow rates ensure that adequate core cooling is provided to satisfy the acceptance criteria of Reference 9. The pump flow rates are verified against a system head equivalent to the RPV pressure expected during a LOCA. The test includes starting the associated low pressure ECCS pump from the control room. The total system pump outlet pressure is adequate to overcome the elevation head pressure between the pump suction and the vessel discharge, the piping friction losses, and RPV pressure present during a LOCA. For the test that verifies the combined flow rate of both LPCI pumps in a LPCI subsystem, the flow is verified by monitoring the flow through the common loop discharge header. The flow tests for the HPCI System are performed at two different pressure ranges such that system capability to provide rated flow is tested at both the higher and lower operating ranges of the system. Reactor steam pressure must be 945 psig to perform SR 3.5.1.7 and 150 psig to perform SR 3.5.1.8. Therefore, sufficient time is allowed after adequate pressure is achieved to perform these tests. Reactor startup is allowed prior to performing the low pressure Surveillance test because the reactor pressure is low and the time allowed to satisfactorily perform the Surveillance test is relatively short. Reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure HPCI test has been satisfactorily completed and there is no indication or reason to believe that the HPCI System is inoperable. (continued) Brunswick Unit 2 B 3.5.1-13 Revision No. 56

ECCSOperating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.6, SR 3.5.1.7, and SR 3.5.1.8 (continued) REQUIREMENTS Therefore, SR 3.5.1.7 and SR 3.5.1.8 are modified by Notes that state the Surveillances are not required to be performed until 48 hours after the reactor steam pressure is adequate to perform the test. The 92 day Frequency for SR 3.5.1.6 and SR 3.5.1.7 is consistent with the Inservice Testing Program requirements. The 24 month Frequency for SR 3.5.1.8 is based on the need to perform the Surveillance under the conditions that apply just prior to or during a startup from a plant outage. Operating experience has demonstrated that these components will usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency is considered to be acceptable from a reliability standpoint. SR 3.5.1.9 The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCI, CS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup and actuation of all automatic valves to their required positions. This SR also ensures that the HPCI System will automatically restart on an RPV low water level signal received subsequent to an RPV high water level trip and that the suction is automatically transferred from the CST to the suppression pool on a CST low level signal or a suppression pool high water level signal. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1, "ECCS Instrumentation," overlaps this Surveillance to provide complete testing of the assumed safety function. Based on minimal assumed risk in performing this Surveillance with the reactor at power, the surveillance is not required to be performed during a refueling outage. Operating experience has demonstrated that these components will usually pass the SR when performed at the 24 month Frequency (originally based on the refueling cycle). Therefore, the Frequency is concluded to be acceptable from a reliability standpoint. (continued) Brunswick Unit 2 B 3.5.1-14 Revision No. 42

ECCSOperating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.9 (continued) REQUIREMENTS This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance. SR 3.5.1.10 The ADS designated SRVs are required to actuate automatically upon receipt of specific initiation signals. A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e., solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.11 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function. The 24 month Frequency is based on the need to perform the Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency is considered to be acceptable from a reliability standpoint. This SR is modified by a Note that excludes valve actuation since the valves are individually tested in accordance with SR 3.5.1.11. This also prevents an RPV pressure blowdown. (continued) Brunswick Unit 2 B 3.5.1-15 Revision No. 42

ECCSOperating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.11 REQUIREMENTS (continued) A manual actuation of each required ADS valve is performed to verify that the valve and solenoid are functioning properly and that no blockage exists in the SRV discharge lines. This is demonstrated by the response of the turbine control or bypass valve; by a change in the measured flow; or by any other method suitable to verify steam flow. Adequate reactor steam dome pressure must be available to perform this test to avoid damaging the valve. Sufficient time is therefore allowed after the required pressure is achieved to perform this SR. Adequate pressure at which this SR is to be performed, to avoid damaging the valve, is 945 psig. Reactor startup is allowed prior to performing this SR because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements, prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours after reactor steam pressure is adequate to perform the test. The 12 hours allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions and provides adequate time to complete the Surveillance. SR 3.5.1.10 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function. The Frequency of 24 months is based on the need to perform the Surveillance under the conditions that apply just prior to or during a startup from a plant outage. Operating experience has demonstrated that these components will usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency is considered to be acceptable from a reliability standpoint. SR 3.5.1.12 This SR ensures that the ECCS RESPONSE TIME for each ECCS injection/spray subsystem is less than or equal to the maximum value assumed in the accident analysis. Response time testing acceptance criteria are included in Reference 13. This SR is modified by a Note that allows the instrumentation portion of the response time to be assumed to be the design instrumentation response time. Therefore, the instrumentation response time is excluded from the ECCS RESPONSE (continued) Brunswick Unit 2 B 3.5.1-16 Revision No. 30

ECCSOperating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.12 (continued) REQUIREMENTS TIME testing. This exception is allowed since the ECCS instrumentation response time is a small part of the ECCS RESPONSE TIME (e.g., sufficient margin exists in the emergency diesel generator start time when compared to the instrumentation response time) (Ref. 14). ECCS RESPONSE TIME tests are conducted every 24 months. The 24 month Frequency is consistent with the Brunswick refueling cycle. REFERENCES 1. UFSAR, Section 6.3.2.2.3.

2. UFSAR, Section 6.3.2.2.4.

3. UFSAR, Section 6.3.2.2.1.

4. UFSAR, Section 6.3.2.2.2.

5. UFSAR, Section 15.2.

6. UFSAR, Section 15.6.

7. 10 CFR 50, Appendix K.

8. UFSAR, Section 6.3.3.

9. 10 CFR 50.46.

10. (Deleted.)

11. 10 CFR 50.36(c)(2)(ii).

12. Memorandum from R.L. Baer (NRC) to V. Stello, Jr. (NRC),

Recommended Interim Revisions to LCOs for ECCS Components, December 1, 1975.

13. UFSAR, Section 6.3.3.7.

14. NEDO-32291-A, System Analyses for the Elimination of Selected Response Time Testing Requirements, October 1995.

Brunswick Unit 2 B 3.5.1-17 Revision No. 62

ECCSShutdown B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.2 ECCSShutdown BASES BACKGROUND A description of the Core Spray (CS) System and the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System is provided in the Bases for LCO 3.5.1, "ECCSOperating." APPLICABLE The ECCS performance is evaluated for the entire spectrum of break SAFETY ANALYSES sizes for a postulated loss of coolant accident (LOCA). The long term cooling analysis following a design basis LOCA (Ref. 1) demonstrates that only one low pressure ECCS injection/spray subsystem is required, post LOCA, to maintain adequate reactor vessel water level in the event of an inadvertent vessel draindown. It is reasonable to assume, based on engineering judgement, that while in MODES 4 and 5, one low pressure ECCS injection/spray subsystem can maintain adequate reactor vessel water level. To provide redundancy, a minimum of two low pressure ECCS injection/spray subsystems are required to be OPERABLE in MODES 4 and 5. The low pressure ECCS subsystems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 2). LCO Two low pressure ECCS injection/spray subsystems are required to be OPERABLE. A low pressure ECCS injection/spray subsystem consists of a CS subsystem or a LPCI subsystem. Each CS subsystem consists of one motor driven pump, piping, and valves to transfer water from the suppression pool or condensate storage tank (CST) to the reactor pressure vessel (RPV). Each LPCI subsystem consists of one motor driven pump, piping, and valves to transfer water from the suppression pool to the RPV. The necessary portions of the Service Water System are required to provide appropriate cooling to the required low pressure ECCS injection/spray subsystems. Only a single LPCI pump is required per LPCI subsystem because of the larger injection capacity in relation to a CS subsystem. In MODES 4 and 5, the RHR System cross tie valve is not required to be closed. (continued) Brunswick Unit 2 B 3.5.2-1 Revision No. 30

ECCSShutdown B 3.5.2 BASES LCO One LPCI subsystem may be considered OPERABLE during alignment (continued) and operation for decay heat removal if it is capable of being manually realigned (remote or local) to the LPCI mode and not otherwise inoperable. Alignment and operation for decay heat removal includes the period when the required RHR pump is not operating and the period when the system is being realigned to or from the RHR shutdown cooling mode. Because of low pressure and low temperature conditions in MODES 4 and 5, sufficient time is available to manually align and initiate LPCI subsystem operation to provide core cooling prior to postulated fuel uncovery. APPLICABILITY OPERABILITY of the low pressure ECCS injection/spray subsystems is required in MODES 4 and 5 to ensure adequate coolant inventory and sufficient heat removal capability for the irradiated fuel in the core in case of an inadvertent draindown of the vessel. Requirements for ECCS OPERABILITY during MODES 1, 2, and 3 are discussed in the Applicability section of the Bases for LCO 3.5.1. ECCS subsystems are not required to be OPERABLE during MODE 5 with the spent fuel storage pool gates removed and the water level maintained at 21 feet 10 inches above the RPV flange. This condition provides sufficient coolant inventory to allow operator action to terminate the inventory loss prior to fuel uncovery in case of an inadvertent draindown. The water level of 21 feet 10 inches above the RPV flange corresponds to 115 feet 7 7/16 inches plant elevation. A spent fuel storage pool level of 37 feet 1 inch is slightly more conservative with respect to the corresponding specified water level above the RPV flange. The Automatic Depressurization System is not required to be OPERABLE during MODES 4 and 5 because the RPV pressure is 150 psig, and the CS System and the LPCI subsystems can provide core cooling without any depressurization of the primary system. The High Pressure Coolant Injection System is not required to be OPERABLE during MODES 4 and 5 since the low pressure ECCS injection/spray subsystems can provide sufficient flow to the vessel. (continued) Brunswick Unit 2 B 3.5.2-2 Revision No. 30

ECCSShutdown B 3.5.2 BASES (continued) ACTIONS A.1 and B.1 If any one required low pressure ECCS injection/spray subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status in 4 hours. In this condition, the remaining OPERABLE subsystem can provide sufficient vessel flooding capability to recover from an inadvertent vessel draindown. However, overall system reliability is reduced because a single failure in the remaining OPERABLE subsystem concurrent with a vessel draindown could result in the ECCS not being able to perform its intended function. The 4 hour Completion Time for restoring the required low pressure ECCS injection/spray subsystem to OPERABLE status is based on engineering judgment considering the remaining available subsystem and the low probability of a vessel draindown event. With the inoperable subsystem not restored to OPERABLE status in the required Completion Time, action must be immediately initiated to suspend operations with a potential for draining the reactor vessel (OPDRVs) to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Action must continue until OPDRVs are suspended. C.1, C.2, D.1, D.2, and D.3 With both of the required ECCS injection/spray subsystems inoperable, all coolant inventory makeup capability may be unavailable. Therefore, action must immediately be initiated to suspend OPDRVs to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Action must continue until OPDRVs are suspended. One ECCS injection/spray subsystem must also be restored to OPERABLE status within 4 hours. The 4 hour Completion Time to restore at least one low pressure ECCS injection/spray subsystem to OPERABLE status ensures that prompt action will be taken to provide the required cooling capacity or to initiate action to place the plant in a condition that minimizes any potential fission product release to the environment. (continued) Brunswick Unit 2 B 3.5.2-3 Revision No. 30

ECCSShutdown B 3.5.2 BASES ACTIONS C.1, C.2, D.1, D.2, and D.3 (continued) If at least one low pressure ECCS injection/spray subsystem is not restored to OPERABLE status within the 4 hour Completion Time, additional actions are required to minimize any potential fission product release to the environment. These actions include ensuring secondary containment is OPERABLE; one standby gas treatment subsystem is OPERABLE; and secondary containment isolation capability is available in each associated penetration flow path not isolated that is assumed to be isolated to mitigate radioactivity releases (i.e., one secondary containment isolation damper and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability. These administrative controls consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated). OPERABILITY may be verified by an administrative check, or by examining logs or other information, to determine whether the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the Surveillance may need to be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE. SURVEILLANCE SR 3.5.2.1 and SR 3.5.2.2 REQUIREMENTS The minimum water level of -31 inches required for the suppression pool is periodically verified to ensure that the suppression pool will provide adequate net positive suction head (NPSH) for the CS System and LPCI subsystem pumps, recirculation volume, and vortex prevention. With the suppression pool water level less than the required limit, all ECCS injection/spray subsystems are inoperable unless they are aligned to an OPERABLE CST. When suppression pool level is < -31 inches, the CS System is considered OPERABLE only if it can take suction from the CST, and the CST water level is sufficient to provide the required NPSH for the CS pump. Therefore, a verification that either the suppression pool water (continued) Brunswick Unit 2 B 3.5.2-4 Revision No. 30

ECCSShutdown B 3.5.2 BASES SURVEILLANCE SR 3.5.2.1 and SR 3.5.2.2 (continued) REQUIREMENTS level is -31 inches or that the CS pump is aligned to take suction from the CST and the CST contains a total volume, which includes both usable and unusable volumes, of 228,200 gallons of water, ensures that the CS System can supply at least 50,000 gallons of makeup water to the RPV. CS System air ingestion is expected to occur at the level which corresponds to a CST volume of 178,200 gallons. However, as noted, only one required CS subsystem may take credit for the CST option during OPDRVs. During OPDRVs, the volume in the CST may not provide adequate makeup if the RPV was completely drained. Therefore, only one CS subsystem is allowed to use the CST. This ensures the other required ECCS subsystem has adequate makeup volume. The 12 hour Frequency of these SRs was developed considering operating experience related to suppression pool water level and CST water level variations. Furthermore, the 12 hour Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool or CST water level condition. SR 3.5.2.3, SR 3.5.2.5, SR 3.5.2.6, and SR 3.5.2.7 The Bases provided for SR 3.5.1.1, SR 3.5.1.6, SR 3.5.1.9, and SR 3.5.1.12 are applicable to SR 3.5.2.3, SR 3.5.2.5, SR 3.5.2.6, and SR 3.5.2.7, respectively. SR 3.5.2.4 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed (continued) Brunswick Unit 2 B 3.5.2-5 Revision No. 30

ECCSShutdown B 3.5.2 BASES SURVEILLANCE SR 3.5.2.4 (continued) REQUIREMENTS to be in a nonaccident position provided the valve will automatically reposition to the accident position in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The 31 day Frequency is appropriate because the valves are operated under procedural control and the probability of their being mispositioned during this time period is low. In MODES 4 and 5, the RHR System may be required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. Therefore, this SR is modified by a Note that allows one LPCI subsystem to be considered OPERABLE if it is capable of being manually realigned (remote or local) to the LPCI mode and not otherwise inoperable. Alignment and operation for decay heat removal includes the period when the required RHR pump is not operating and the period when the system is being realigned to or from the RHR shutdown cooling mode. Because of the low pressure and low temperature conditions in MODES 4 and 5, sufficient time is available to manually align and initiate LPCI subsystem operation to provide core cooling prior to postulated fuel uncovery. This will ensure adequate core cooling if an inadvertent RPV draindown should occur. REFERENCES 1. NEDO-20566A; General Electric Company Analytical Model for Loss-of-Coolant Analysis in Accordance with 10 CFR 50 Appendix K, Vols. 1, 2, and 3; September 1986.

2. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.5.2-6 Revision No. 30

RCIC System B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.3 RCIC System BASES BACKGROUND The RCIC System is not part of the ECCS; however, the RCIC System is included with the ECCS section because of their similar functions. The RCIC System is designed to operate either automatically or manually following reactor pressure vessel (RPV) isolation accompanied by a loss of normal coolant flow from the reactor feedwater system to provide adequate core cooling and control of the RPV water level. Under these conditions, the High Pressure Coolant Injection (HPCI) and RCIC systems perform similar functions. The RCIC System design requirements ensure that the criteria of Reference 1 are satisfied. The RCIC System (Ref. 2) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the feedwater system line, where the coolant is distributed within the RPV through the feedwater sparger. Suction piping is provided from the condensate storage tank (CST) and the suppression pool. Pump suction is normally aligned to the CST to minimize injection of suppression pool water into the RPV. However, if the CST water supply is low, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the RCIC System. The steam supply to the turbine is piped from a main steam line upstream of the associated inboard main steam line isolation valve. The RCIC System is designed to provide core cooling for a wide range of reactor pressures 150 psig to 1164 psig. Upon receipt of an initiation signal, the RCIC turbine accelerates to a specified speed. As the RCIC flow increases, the turbine control valve is automatically adjusted to maintain design flow. Exhaust steam from the RCIC turbine is discharged to the suppression pool. A full flow test line is provided to route water to the CST to allow testing of the RCIC System during normal operation without injecting water into the RPV. (continued) Brunswick Unit 2 B 3.5.3-1 Revision No. 30

RCIC System B 3.5.3 BASES BACKGROUND The RCIC pump is provided with a minimum flow bypass line, which (continued) discharges to the suppression pool. The valve in this line automatically opens to prevent pump damage due to overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the RCIC System discharge piping is maintained full of water using a "keep fill" system. APPLICABLE The function of the RCIC System is to respond to transient events by SAFETY ANALYSES providing makeup coolant to the reactor. The RCIC System is not an Engineered Safety Feature System and no credit is taken in the safety analyses for RCIC System operation. Based on its contribution to the reduction of overall plant risk, however, the system satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii) (Ref. 3) and is therefore included in the Technical Specifications. LCO The OPERABILITY of the RCIC System provides adequate core cooling such that actuation of any of the low pressure ECCS subsystems is not required in the event of RPV isolation accompanied by a loss of feedwater flow. The RCIC System has sufficient capacity for maintaining RPV inventory during an isolation event. APPLICABILITY The RCIC System is required to be OPERABLE during MODE 1, and MODES 2 and 3 with reactor steam dome pressure > 150 psig, since RCIC is the primary non-ECCS water source for core cooling when the reactor is isolated and pressurized. In MODES 2 and 3 with reactor steam dome pressure 150 psig, and in MODES 4 and 5, RCIC is not required to be OPERABLE since the low pressure ECCS injection/spray subsystems can provide sufficient flow to the RPV. ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable RCIC system. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable RCIC system and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance. A.1 and A.2 If the RCIC System is inoperable during MODE 1, or MODE 2 or 3 with reactor steam dome pressure > 150 psig, and the HPCI System is verified immediately to be OPERABLE, the RCIC System must be restored to (continued) Brunswick Unit 2 B 3.5.3-2 Revision No. 39

RCIC System B 3.5.3 BASES ACTIONS A.1 and A.2 (continued) OPERABLE status within 14 days. In this condition, loss of the RCIC System will not affect the overall plant capability to provide makeup inventory at high reactor pressure since the HPCI System is available to function during a loss of coolant accident (LOCA). OPERABILITY of the HPCI System is therefore verified immediately when the RCIC System is inoperable. This may be performed as an administrative check, by examining logs or other information, to determine if the HPCI System is out of service for maintenance or other reasons. It does not mean it is necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the HPCI System. If the OPERABILITY of the HPCI System cannot be immediately verified, however, Condition B must be immediately entered. For transients and certain abnormal events with no LOCA, RCIC (as opposed to HPCI) is the preferred source of makeup coolant because of its relatively small capacity, which allows easier control of the RPV water level. Therefore, a limited time is allowed to restore the inoperable RCIC to OPERABLE status. The 14 day Completion Time is based on the availability of the HPCI System and the low probability of the occurrence of an event that would require the RCIC System. B.1 and B.2 If the RCIC System cannot be restored to OPERABLE status within the associated Completion Time, or if the HPCI System is simultaneously inoperable, the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and reactor steam dome pressure reduced to 150 psig within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. (continued) Brunswick Unit 2 B 3.5.3-3 Revision No. 30

RCIC System B 3.5.3 BASES (continued) SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The flow path piping has the potential to develop voids and pockets of entrained air. Maintaining the pump discharge line of the RCIC System full of water ensures that the system will perform properly, injecting its full capacity into the reactor vessel upon demand. This SR will also prevent water hammer in the piping following an initiation signal. One acceptable method of ensuring the line is full is to vent at the high points. The 31 day Frequency is based on the gradual nature of void buildup in the RCIC System piping, the procedural controls governing system operation, and operating experience. SR 3.5.3.2 Verifying the correct alignment for manual, power operated, and automatic valves in the RCIC flow path provides assurance that the proper flow path exists for RCIC System operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves are verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition to the accident position in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR also includes the steam flow path for the turbine and the flow controller position. The 31 day Frequency of this SR was derived from the Inservice Testing Program requirements for performing valve testing at least once every 92 days. The Frequency of 31 days is further justified because the valves are operated under procedural control and because improper valve position typically affects only the RCIC System. This Frequency has been shown to be acceptable through operating experience. (continued) Brunswick Unit 2 B 3.5.3-4 Revision No. 30

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.3 and SR 3.5.3.4 REQUIREMENTS (continued) The RCIC pump flow rate ensures that the system can maintain reactor coolant inventory during pressurized conditions with the RPV isolated. The flow tests are performed by utilizing the full flow test line and are performed at two different pressure ranges such that system capability to provide rated flow is tested both at the higher and lower operating ranges of the system. The requirements include verifying that the pump discharge pressure is greater than or equal to a pressure that would produce the desired injection flow including allowances for the flow and elevation head losses of the injection line. This provides adequate assurance of RCIC System OPERABILITY based on performance at nominal conditions. Reactor steam pressure must be 945 psig to perform SR 3.5.3.3 and 135 psig to perform SR 3.5.3.4 when the turbine steam supply is reactor steam. Therefore, sufficient time is allowed after adequate pressure is achieved to perform these SRs when the turbine steam supply is reactor steam. Reactor startup is allowed prior to performing the low pressure Surveillance test with the turbine being supplied with reactor steam from the Main Steam System because the reactor pressure is low and the time allowed to satisfactorily perform the Surveillance is short. Reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure Surveillance has been satisfactorily completed and there is no indication or reason to believe that the RCIC System is inoperable. As such, Note 2 to SR 3.5.3.3 and Note 2 to SR 3.5.3.4 state the Surveillances are not required to be performed until 24 hours after the reactor steam pressure is adequate to perform the test. The 24 hours allowed for the flow tests after the required pressure is reached is sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SRs when the turbine steam supply is reactor steam. The low pressure Surveillance test may be performed with the turbine steam being supplied from the Auxiliary Steam System. However, the allowance of Note 2 to SR 3.5.3.4 is not applicable in this case and SR 3.0.4 applies. As a result, Note 1 to SR 3.5.3.4 only allows the use of auxiliary steam when reactor pressure is < 150 psig. To ensure the RCIC System steam flow path from the Main Steam System to the RCIC turbine (continued) Brunswick Unit 2 B 3.5.3-5 Revision No. 30

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.3 and SR 3.5.3.4 (continued) REQUIREMENTS inlet is OPERABLE, Note 1 to SR 3.5.3.3 requires the high pressure test to be performed with the turbine steam being supplied with reactor steam from the Main Steam System. A 92 day Frequency for SR 3.5.3.3 is consistent with the Inservice Testing Program requirements. The 24 month Frequency for SR 3.5.3.4 is based on the need to perform the Surveillance under conditions that apply just prior to or during a startup from a plant outage. Operating experience has demonstrated that these components will usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency is considered to be acceptable from a reliability standpoint. SR 3.5.3.5 The RCIC System is required to actuate automatically in order to verify its design function satisfactorily. This Surveillance verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic will cause the system to operate as designed, including actuation of the system throughout its emergency operating sequence; that is, automatic pump startup and actuation of all automatic valves to their required positions. This SR also ensures the RCIC System will automatically restart on an RPV low water level signal received subsequent to an RPV high water level trip and that the suction is automatically transferred from the CST to the suppression pool on a CST low level signal. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.2, "Reactor Core Isolation Cooling (RCIC) System Instrumentation," overlaps this Surveillance to provide complete testing of the assumed design function. While this Surveillance can be performed with the reactor at power, operating experience has demonstrated that these components will usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. (continued) Brunswick Unit 2 B 3.5.3-6 Revision No. 30

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.5 (continued) REQUIREMENTS This SR is modified by a Note that excludes vessel injection during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance. REFERENCES 1. UFSAR, Section 3.1.2.4.4.

2. UFSAR, Section 5.4.6.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.5.3-7 Revision No. 30

Primary Containment B 3.6.1.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.1 Primary Containment BASES BACKGROUND The function of the primary containment is to isolate and contain fission products released from the Reactor Primary System following a design basis Loss of Coolant Accident and to confine the postulated release of radioactive material. The primary containment consists of a steel lined, reinforced concrete vessel, which surrounds the Reactor Primary System and provides an essentially leak tight barrier against an uncontrolled release of radioactive material to the environment. The isolation devices for the penetrations in the primary containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier:

a. All penetrations required to be closed during accident conditions are either:

1. capable of being closed by an OPERABLE automatic containment isolation system, or

2. closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)";

b. The primary containment air lock is OPERABLE, except as provided in LCO 3.6.1.2, "Primary Containment Air Lock";

c. All equipment hatches are closed; and

d. The sealing mechanism associated with a penetration (e.g.,

welds, bellows or O-rings) is OPERABLE. This Specification ensures that the performance of the primary containment, in the event of a Design Basis Accident (DBA), meets the assumptions used in the safety analyses of References 1 and 2. SR 3.6.1.1.1 leakage rate requirements are in conformance with (continued) Brunswick Unit 2 B 3.6.1.1-1 Revision No. 30

Primary Containment B 3.6.1.1 BASES BACKGROUND 10 CFR 50, Appendix J, Option B (Ref. 3), as modified by exceptions (continued) listed in Specification 5.5.12, "Primary Containment Leakage Rate Testing Program." APPLICABLE The safety design basis for the primary containment is that it must SAFETY ANALYSES withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate. The DBA that postulates the maximum release of radioactive material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE such that release of fission products to the environment is controlled by the rate of primary containment leakage. Analytical methods and assumptions involving the primary containment are presented in References 1, 2, and 4. The safety analyses assume a nonmechanistic fission product release following a DBA, which forms the basis for determination of offsite doses. The fission product release is, in turn, based on an assumed leakage rate from the primary containment. OPERABILITY of the primary containment ensures that the leakage rate assumed in the safety analyses is not exceeded. The maximum allowable leakage rate for the primary containment (La) is 0.5% by weight of the containment air per 24 hours at the maximum peak containment pressure (Pa) of 49 psig. The value of Pa (49 psig) is conservative with respect to the current calculated peak drywell pressure of 46.4 psig (Ref 4). Primary containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 5). LCO Primary containment OPERABILITY is maintained by limiting leakage to 1.0 La, except prior to the first startup after performing a required Primary Containment Leakage Rate Testing Program leakage test. At this time, the applicable leakage limits must be met. In addition, the leakage from the drywell to the suppression chamber must be limited to ensure the pressure suppression function is accomplished and the suppression chamber pressure does not exceed design limits. (continued) Brunswick Unit 2 B 3.6.1.1-2 Revision No. 30

Primary Containment B 3.6.1.1 BASES LCO Compliance with this LCO will ensure a primary containment (continued) configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analyses. Individual leakage rates specified for the primary containment air lock are addressed in LCO 3.6.1.2. APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, primary containment is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment. ACTIONS A.1 In the event primary containment is inoperable, primary containment must be restored to OPERABLE status within 2 hours. The 2 hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining primary containment OPERABILITY during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring primary containment OPERABILITY) occurring during periods where primary containment is inoperable is minimal. B.1 and B.2 If primary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. (continued) Brunswick Unit 2 B 3.6.1.1-3 Revision No. 30

Primary Containment B 3.6.1.1 BASES (continued) SURVEILLANCE SR 3.6.1.1.1 REQUIREMENTS Maintaining the primary containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Primary Containment Leakage Rate Testing Program. The primary containment concrete examinations may be performed during either power operation, e.g., performed concurrently with other primary containment inspection-related activities, or during a maintenance or refueling outage. The visual examinations of penetrations on the exterior of the containment and appurtenances may be performed concurrently with other primary containment inspection-related activities, or during a maintenance or refueling outage. The visual examinations of the metallic shell, as well as penetrations on the interior of the containment, are performed during maintenance or refueling outages since this is the only time these areas are fully accessible. The Primary Containment Leakage Rate Testing Program has been established in accordance with 10 CFR 50.54(o) to implement the requirements of 10 CFR Part 50, Appendix J, Option B (Ref. 3). The Primary Containment Leakage Rate Testing Program also conforms with Regulatory Guide 1.163 (Ref. 6) and Nuclear Energy Institute (NEI) 94-01 (Ref. 7) except for the following:

a. BNP may use the criteria and Total Time method specified in Bechtel Topical Report BN-TOP-1 (Ref. 8) for calculating the primary containment leakage during reduced duration Type A testing. This is an exemption from the requirements of 10 CFR 50 Appendix J (Ref. 3) which, in accordance with NEI 94-01 (Ref. 7),

requires the methods for calculating primary containment leakage described in ANSI/ANS 56.8-1994 (Ref. 9). The basis for this exemption is described in References 10 and 11.

b. Type C testing is not required for the hydrogen and oxygen monitor isolation valves. This is an exemption from the requirements of 10 CFR 50 Appendix J (Ref. 3). The basis for this exemption is described in Reference 12.

Failure to meet air lock leakage limits (SR 3.6.1.2.1) or main steam isolation valve leakage (SR 3.6.1.3.9) does not necessarily result in a failure of this SR. The impact of the failure to meet SR 3.6.1.2.1 must be evaluated against the Type A, B, and C acceptance criteria of the Primary Containment Leakage Rate Testing Program, and failure to meet SR 3.6.1.3.9 must be evaluated against Type A acceptance criteria of the Primary Containment Leakage Rate Testing Program. As left leakage prior to the first startup after performing required leakage testing is required to be < 0.6 La for combined Type B and C leakage, and 0.75 La for overall Type A leakage. At all other times between required (continued) Brunswick Unit 2 B 3.6.1.1-4 Revision No. 55

Primary Containment B 3.6.1.1 BASES SURVEILLANCE SR 3.6.1.1.1 (continued) REQUIREMENTS (continued) leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of 1.0 La. At 1.0 La the offsite dose consequences are bounded by the assumptions of the safety analysis. The Frequency is required by the Primary Containment Leakage Rate Testing Program. SR Frequencies are as required by the Containment Leakage Rate Testing Program. These periodic testing requirements verify that the containment leakage rate does not exceed the leakage rate assumed in the safety analysis. SR 3.6.1.1.2 Maintaining the pressure suppression function of primary containment requires limiting the leakage from the drywell to the suppression chamber. Thus, if an event were to occur that pressurized the drywell, the steam would be directed through the downcomers into the suppression pool. This SR measures drywell to suppression chamber differential pressure during a 10 minute period to ensure that the leakage paths that would bypass the suppression pool (downcomers) are within allowable limits. Satisfactory performance of this SR can be achieved by establishing a known differential pressure between the drywell and the suppression chamber and verifying that the differential pressure between the suppression chamber and the drywell does not decrease by more than 0.25 inch of water per minute over a 10 minute period. The leakage test is performed every 24 months. The 24 month Frequency was developed considering it is prudent that this Surveillance be performed during a unit outage and also in view of the fact that component failures that might have affected this test are identified by other primary containment SRs. REFERENCES 1. UFSAR, Section 6.2.

2. UFSAR, Section 15.6.

3. 10 CFR 50, Appendix J, Option B.

4. NEDC-33039P, Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, Extended Power Uprate, August 2001.

5. 10 CFR 50.36(c)(2)(ii).

6. NRC Regulatory Guide 1.163, Performance-Based Containment Leak-Rate Testing Program, September 1995.

7. Nuclear Energy Institute (NEI) 94-01, Industry Guideline for Implementing Performance-Based Option of 10 CFR 50 Appendix J, July 26, 1995.

(continued) Brunswick Unit 2 B 3.6.1.1-5 Revision No. 55

Primary Containment B 3.6.1.1 BASES REFERENCES 8. Bechtel Topical Report BN-TOP-1, Revision 1, November 1, 1972. (continued)

9. ANSI/ANS 56.8-1994.

10. NRC SER; Issuance of Amendment No. 181 to Facility Operating License No. DPR-71 and Amendment No. 213 to Facility Operating License No. DPR-62 Regarding 10 CFR 50 Appendix J, Option B - Brunswick Steam Electric Plant, Units 1 and 2 (BSEP 95-0316) (TAC Nos. M93679 and M93680); dated February 1, 1996.

11. NRC SER, Exemption from the Requirements of Appendix J for Brunswick Steam Electric Plant, Units 1 and 2, dated February 17, 1988.

12. NRC SER, Technical Exemption from the Requirements of Appendix J, dated May 12, 1987.

Brunswick Unit 2 B 3.6.1.1-6 Revision No. 55

Primary Containment Air Lock B 3.6.1.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.2 Primary Containment Air Lock BASES BACKGROUND One double door primary containment air lock has been built into the primary containment to provide personnel access to the drywell and to provide primary containment isolation during the process of personnel entering and exiting the drywell. The air lock is designed to withstand the same loads, temperatures, and peak design internal and external pressures as the primary containment (Ref. 1). As part of the primary containment, the air lock limits the release of radioactive material to the environment during normal unit operation and through a range of transients and accidents up to and including postulated Design Basis Accidents (DBAs). Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a DBA in primary containment. Each of the doors contains double gasketed seals and local leakage rate testing capability to ensure pressure integrity. To effect a leak tight seal, the air lock design uses pressure seated doors (i.e., an increase in primary containment internal pressure results in increased sealing force on each door). Each air lock is nominally a right circular cylinder, 10 ft in diameter, with doors at each end that are interlocked to prevent simultaneous opening. The air lock is provided with limit switches on both doors that provide control room indication of door position. During periods when primary containment is not required to be OPERABLE, the air lock interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent primary containment entry is necessary. Under some conditions as allowed by this LCO, the primary containment may be accessed through the air lock, when the interlock mechanism has failed, by manually performing the interlock function. The primary containment air lock forms part of the primary containment pressure boundary. As such, air lock integrity and leak tightness are essential for maintaining the primary containment leakage rate within limits in the event of a DBA. Not maintaining air lock integrity or leak (continued) Brunswick Unit 2 B 3.6.1.2-1 Revision No. 30

Primary Containment Air Lock B 3.6.1.2 BASES BACKGROUND tightness may result in a leakage rate in excess of that assumed in the (continued) safety analysis. APPLICABLE The DBA that postulates the maximum release of radioactive material SAFETY ANALYSES within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE, such that release of fission products to the environment is controlled by the rate of primary containment leakage. The primary containment is designed with a maximum allowable leakage rate (La) of 0.5% by weight of the containment air per 24 hours at the calculated maximum peak containment pressure (Pa) of 49 psig. The value of Pa (49 psig) is conservative with respect to the current calculated peak drywell pressure of 46.4 psig (Ref. 2). This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air lock. Primary containment air lock OPERABILITY is also required to minimize the amount of fission product gases that may escape primary containment through the air lock and contaminate and pressurize the secondary containment. The primary containment air lock satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). LCO As part of the primary containment pressure boundary, the air lock safety function is related to control of containment leakage rates following a DBA. Thus, the air lock structural integrity and leak tightness are essential to the successful mitigation of such an event. The primary containment air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door to be opened at a time. This provision ensures that a gross breach of primary containment does not exist when primary containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier (continued) Brunswick Unit 2 B 3.6.1.2-2 Revision No. 30

Primary Containment Air Lock B 3.6.1.2 BASES LCO following postulated events. Nevertheless, both doors are kept closed (continued) when the air lock is not being used for normal entry or exit from primary containment. APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the primary containment air lock is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment. ACTIONS The ACTIONS are modified by Note 1, which allows entry and exit to perform repairs of the affected air lock component. If the outer door is inoperable, then it may be easily accessed to repair. If the inner door is the one that is inoperable, however, then a short time exists when the containment boundary is not intact (during access through the outer door). The ability (allowance) to open the OPERABLE door, even if it means the primary containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the primary containment during the short time in which the OPERABLE door is expected to be open. The OPERABLE door must be immediately closed after each entry and exit. The ACTIONS are modified by a second Note, which ensures appropriate remedial measures are taken when necessary, if air lock leakage results in exceeding overall containment leakage rate acceptance criteria. Pursuant to LCO 3.0.6, actions are not required, even if primary containment leakage is exceeding La. Therefore, the Note is added to require ACTIONS for LCO 3.6.1.1, "Primary Containment," to be taken in this event. A.1, A.2, and A.3 With one primary containment air lock door inoperable, the OPERABLE door must be verified closed (Required Action A.1) in the air lock. This ensures that a leak tight primary containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed (continued) Brunswick Unit 2 B 3.6.1.2-3 Revision No. 30

Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS A.1, A.2, and A.3 (continued) within 2 hours. The 2 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, which requires that primary containment be restored to OPERABLE status within 2 hours. In addition, the air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour Completion Time. The 24 hour Completion Time is considered reasonable for locking the OPERABLE air lock door, considering that the OPERABLE door is being maintained closed. Required Action A.3 ensures that the air lock penetration has been isolated by the use of a locked closed OPERABLE air lock door. This ensures that an acceptable primary containment leakage boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate given the low likelihood of a locked door being mispositioned and other administrative controls. Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas or areas with limited access due to inerting and allows these doors to be verified locked closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small. Required Actions A.1, A.2, and A.3 have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. With both doors in the air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls. Primary containment entry may be required to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on equipment inside primary containment that are required by TS or activities on equipment that support TS required equipment. (continued) Brunswick Unit 2 B 3.6.1.2-4 Revision No. 30

Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS A.1, A.2, and A.3 (continued) This Note is not intended to preclude performing other activities (i.e., non-TS related activities) if the primary containment was entered, using the inoperable air lock, to perform an allowed activity listed above. The required administrative controls consist of stationing a dedicated individual to assure closure of the OPERABLE door except during the entry and exit, and to assure the OPERABLE door is relocked after completion of the containment entry and exit. This allowance is acceptable due to the low probability of an event that could pressurize the primary containment during the short time that the OPERABLE door is expected to be open. B.1, B.2, and B.3 With an air lock interlock mechanism inoperable, the Required Actions and associated Completion Times are consistent with those specified in Condition A. Required Actions B.1, B.2, and B.3 have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. With both doors in the air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from the primary containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock). Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas or areas with limited access due to inerting and that allows these doors to be verified locked closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small. (continued) Brunswick Unit 2 B 3.6.1.2-5 Revision No. 30

Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS C.1, C.2, and C.3 (continued) If the air lock is inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be immediately initiated to evaluate containment overall leakage rates using current air lock leakage test results. An evaluation is acceptable since it is overly conservative to immediately declare the primary containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), primary containment remains OPERABLE, yet only 2 hours (according to LCO 3.6.1.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits. Required Action C.2 requires that one door in the primary containment air lock must be verified closed. This action must be completed within the 2 hour Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1.1, which require that primary containment be restored to OPERABLE status within 2 hours. Additionally, the air lock must be restored to OPERABLE status within 24 hours (Required Action C.3). The 24 hour Completion Time is reasonable for restoring the inoperable air lock to OPERABLE status considering that at least one door is maintained closed in the air lock. D.1 and D.2 If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. (continued) Brunswick Unit 2 B 3.6.1.2-6 Revision No. 30

Primary Containment Air Lock B 3.6.1.2 BASES (continued) SURVEILLANCE SR 3.6.1.2.1 REQUIREMENTS Maintaining the primary containment air lock OPERABLE requires compliance with the leakage rate test requirements of the Primary Containment Leakage Rate Testing Program. The Primary Containment Leakage Rate Testing Program has been established in accordance with 10 CFR 50.54(o) to implement the requirements of 10 CFR Part 50, Appendix J, Option B (Ref. 4), and conforms with Regulatory Guide 1.163 (Ref. 5) and Nuclear Energy Institute (NEI) 94-01 (Ref. 6) except for the following:

a. The local leak rate testing requirements of the primary containment air lock doors may be modified to perform the tests at a pressure less than Pa following replacement of the air lock door seals. This is an exception from the requirements of NEI 94-01 (Ref. 6). The basis for this exception is described in Reference 7.

This SR reflects the leakage rate testing requirements with respect to air lock leakage (Type B leakage tests). The acceptance criteria were established as a small fraction of the total allowable primary containment leakage. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall primary containment leakage rate. The Frequency is required by the Primary Containment Leakage Rate Testing Program. The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR, requiring results to be evaluated against the acceptance criteria which are applicable to SR 3.6.1.1.1. This ensures that air lock leakage is properly accounted for in determining the combined Type B and C primary containment leakage rate. (continued) Brunswick Unit 2 B 3.6.1.2-7 Revision No. 44

Primary Containment Air Lock B 3.6.1.2 BASES SURVEILLANCE SR 3.6.1.2.2 REQUIREMENTS (continued) The air lock interlock mechanism is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of the air lock are designed to withstand the maximum expected post accident primary containment pressure, closure of either door will support primary containment OPERABILITY. Thus, the interlock feature supports primary containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur. Due to the purely mechanical nature of this interlock, and given that the interlock mechanism is not normally challenged when the primary containment airlock door is used for entry and exit (procedures require strict adherence to single door opening), this test is only required to be performed every 24 months. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage, and the potential for loss of primary containment OPERABILITY if the Surveillance were performed with the reactor at power. The 24 month Frequency for the interlock is justified based on generic operating experience. The Frequency is based on engineering judgment and is considered adequate given that the interlock is not challenged during use of the air lock. REFERENCES 1. UFSAR, Section 3.8.2.4.3.2.

2. NEDC-33039P, Safety Analysis Report for Brunswick Units 1 and 2 Extended Power Uprate, August 2001.

3. 10 CFR 50.36(c)(2)(ii).

4. 10 CFR 50, Appendix J, Option B.

5. NRC Regulatory Guide 1.163, Performance-Based Containment Leak-Rate Testing Program, September 1995.

6. Nuclear Energy Institute (NEI) 94-01, Industry Guideline for Implementing Performance-Based Option of 10 CFR 50 Appendix J, July 26, 1995.

7. NRC SER, Brunswick 1 & 2 - Amendments No. 10 and 36 to Operating Licenses Revising Technical Specifications to Grant Exemptions from Specific Requirements of 10 CFR 50 Appendix J, dated November 8, 1977.

Brunswick Unit 2 B 3.6.1.2-8 Revision No. 44

PCIVs B 3.6.1.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.3 Primary Containment Isolation Valves (PCIVs) BASES BACKGROUND The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) to within limits. Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA. The OPERABILITY requirements for PCIVs help ensure that an adequate primary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. Therefore, the OPERABILITY requirements provide assurance that primary containment function assumed in the safety analyses will be maintained. These isolation devices are either passive or active (automatic). Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), blind flanges, and closed systems are considered passive devices. Check valves, or other automatic valves designed to close without operator action following an accident, are considered active devices. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses. One of these barriers may be a closed system. The reactor building-to-suppression chamber vacuum breakers serve a dual function, one of which is primary containment isolation. However, since the other safety function of the vacuum breakers would not be available if the normal PCIV actions were taken, the PCIV OPERABILITY requirements are not applicable to the reactor building-to-suppression chamber vacuum breakers valves. Similar surveillance requirements in the LCO for reactor building-to-suppression chamber vacuum breakers provide assurance that the isolation capability is available without conflicting with the vacuum relief function. (continued) Brunswick Unit 2 B 3.6.1.3-1 Revision No. 30

PCIVs B 3.6.1.3 BASES BACKGROUND The primary containment purge valves are 18, 20, and 24 inches in (continued) diameter; vent valves are 3, 18, and 20 inches in diameter. Primary containment purge and vent valves > 8 inches are normally maintained closed in MODES 1, 2, and 3 to ensure the primary containment boundary is maintained. The isolation valves on the 18 and 20 inch vent lines have 2 inch bypass lines around them for use during normal reactor operation. Use of the valves in the 2 inch bypass lines or the 3 inch vent valves will prevent high pressure from reaching the SGT System filter trains in the unlikely event of a loss of coolant accident (LOCA) during venting. APPLICABLE The PCIVs LCO was derived from the assumptions related to minimizing SAFETY ANALYSES the loss of reactor coolant inventory, and establishing the primary containment boundary during major accidents. As part of the primary containment boundary, PCIV OPERABILITY supports leak tightness of primary containment. Therefore, the safety analysis of any event requiring isolation of primary containment is applicable to this LCO. The DBAs that result in a release of radioactive material within primary containment are a LOCA and a main steam line break (MSLB). In the analysis for each of these accidents, it is assumed that PCIVs are either closed or close within the required isolation times following event initiation. This ensures that potential paths to the environment through PCIVs (including primary containment purge valves) are minimized. The closure time of the main steam isolation valves (MSIVs) is a significant variable from a radiological standpoint. The MSIVs are required to close within 3 to 5 seconds. The closure time assumed depends on the event being analyzed. For the minimum MSlV closure time, 2.7 seconds is assumed for the most severe overpressurization transient analysis as specified by the cycle specific Plant Parameters Documents. The analytical limit for this event is 2.7 seconds where 0.3 second margin exists between the testing condition and the analytical limit to account for variations in MSlV stroke times from effects such as changes in air operator hydraulic fluid viscosity. The 5 second closure time is assumed in the containment pressure and temperature analyses (Ref. 2). The maximum stroke time of 5 seconds is twofold in that it serves to minimize the inventory loss from the reactor vessel and minimize the radioactive releases to the environment. It should be noted that the 5 seconds excludes logic actuation times, which vary depending on the event. For the main steam line break, the MSlVs must close within 10.5 seconds (including as much as 0.5 seconds for the instrumentation to initiate valve closure after the break). The safety analyses assume that the purge valves were closed at event initiation. Likewise, it is assumed that the primary containment isolates such that release of fission products to the environment is controlled. (continued) Brunswick Unit 2 B 3.6.1.3-2 Revision No. 77

PCIVs B 3.6.1.3 BASES APPLICABLE The single failure criterion required to be imposed in the conduct of unit SAFETY ANALYSES safety analyses was considered in the original design of the primary (continued) containment purge valves. Two valves in series on each purge line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred. PCIVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). LCO PCIVs form a part of the primary containment boundary. The PCIV safety function is related to minimizing the loss of reactor coolant inventory and establishing the primary containment boundary during a DBA. The power operated, automatic isolation valves are required to have isolation times within limits and actuate on an automatic isolation signal. Primary containment purge and vent valves > 8 inches must be blocked to prevent opening > 50° (approximately 55%). While the reactor building-to-suppression chamber vacuum breakers isolate primary containment penetrations, they are excluded from this Specification. Controls on their isolation function are adequately addressed in LCO 3.6.1.5, "Reactor Building-to-Suppression Chamber Vacuum Breakers." The valves covered by this LCO are listed with their associated stroke times in Reference 4. The normally closed PCIVs are considered OPERABLE when any one of the following conditions is met: (1) manual valves are closed or opened in accordance with appropriate administrative controls; (2) automatic valves are de-activated and secured in their closed position; (3) blind flanges are in place, or (4) closed systems are intact. MSIVs are exempt from Type C testing limits and must meet specific leakage rate requirements. Other PCIV leakage rates are addressed by LCO 3.6.1.1, "Primary Containment," as Type B or C testing. This LCO provides assurance that the PCIVs will perform their designed safety functions to minimize the loss of reactor coolant inventory and establish the primary containment boundary during accidents. (continued) Brunswick Unit 2 B 3.6.1.3-3 Revision No. 77

PCIVs B 3.6.1.3 BASES (continued) APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, most PCIVs are not required to be OPERABLE in MODES 4 and 5. Certain valves, however, are required to be OPERABLE to prevent inadvertent reactor vessel draindown. These valves are those whose associated instrumentation is required to be OPERABLE per LCO 3.3.6.1, "Primary Containment Isolation Instrumentation." (This does not include the valves that isolate the associated instrumentation.) ACTIONS The ACTIONS are modified by a Note allowing penetration flow path(s) to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated. A second Note has been added to provide clarification that, for the purpose of this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable PCIV. Complying with the Required Actions may allow for continued operation, and subsequent inoperable PCIVs are governed by subsequent Condition entry and application of associated Required Actions. The ACTIONS are modified by Notes 3 and 4. Note 3 ensures that appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable PCIV (e.g., an Emergency Core Cooling System subsystem is inoperable due to a failed open test return valve). Note 4 ensures appropriate remedial actions are taken when the primary containment leakage limits are exceeded. Pursuant to LCO 3.0.6, these actions are not required even when the associated LCO is not met. Therefore, Notes 3 and 4 are added to require the proper actions be taken. (continued) Brunswick Unit 2 B 3.6.1.3-4 Revision No. 30

PCIVs B 3.6.1.3 BASES ACTIONS A.1 and A.2 (continued) With one or more penetration flow paths with one PCIV inoperable, except for inoperability due to MSIV leakage not within the limit specified in the associated SR to this LCO; the affected penetration flow paths must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For a penetration isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available valve to the primary containment. The Required Action must be completed within the 8 hour Completion Time. The Completion Time of 8 hours is reasonable considering the time required to isolate the penetration and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3. For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration flow path(s) must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident, and no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those devices outside containment and capable of potentially being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside primary containment" is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low. For the devices inside primary containment, the time period specified "prior to entering MODE 2 or 3 from MODE 4, if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the devices and other administrative controls ensuring that device misalignment is an unlikely possibility. (continued) Brunswick Unit 2 B 3.6.1.3-5 Revision No. 30

PCIVs B 3.6.1.3 BASES ACTIONS A.1 and A.2 (continued) Condition A is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two PCIVs. For penetration flow paths with one PCIV, Condition C provides the appropriate Required Actions. Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas, and allows them to be verified by use of administrative means. High radiation areas include the MSIV pit, the RWCU penetration triangle room, the TIP room, and the area between the drywell head and the drywell head shield blocks. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is low. B.1 With one or more penetration flow paths with two PCIVs inoperable, except for inoperability due to MSIV leakage not within the limit specified in the associated SR to this LCO; either the inoperable PCIVs must be restored to OPERABLE status or the affected penetration flow path must be isolated within 2 hours. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 2 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1.1. Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two PCIVs. For penetration flow paths with one PCIV, Condition C provides the appropriate Required Actions. C.1 and C.2 With one or more penetration flow paths with one PCIV inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must (continued) Brunswick Unit 2 B 3.6.1.3-6 Revision No. 30

PCIVs B 3.6.1.3 BASES ACTIONS C.1 and C.2 (continued) include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. Required Action C.1 must be completed within the 8 hour Completion Time for lines other than excess flow check valve (EFCV) lines and within the 12 hour Completion Time for EFCV lines. The Completion Time of 8 hours is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3. The Completion Time of 12 hours is reasonable considering the mitigating effects of the small pipe diameter and restrictive orifice, and the isolation boundary provided by the instrument. In the event the affected penetration flow path is isolated in accordance with Required Action C.1, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration is isolated is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low. Condition C is modified by a Note indicating that this Condition is only applicable to penetration flow paths with only one PCIV. For penetration flow paths with two PCIVs, Conditions A and B provide the appropriate Required Actions. Required Action C.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative means. High radiation areas include the MSIV pit, the RWCU penetration triangle room, the TIP room, and the area between the drywell head and the drywell head shield blocks. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is low. (continued) Brunswick Unit 2 B 3.6.1.3-7 Revision No. 30

PCIVs B 3.6.1.3 BASES ACTIONS D.1 (continued) With one or more penetration flow paths with MSIV leakage rate not within limit, the assumptions of the safety analysis may not be met. Therefore, the leakage must be restored to within limit within 8 hours. Restoration can be accomplished by isolating the penetration that caused the limit to be exceeded by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. When a penetration is isolated, the leakage rate for the isolated penetration is assumed to be the actual pathway leakage through the isolation device. If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the lesser actual pathway leakage of the two devices. The 8 hour Completion Time allows a period of time to restore the leakage to within limits given the fact that MSIV closure will result in isolation of the main steam line(s) and a potential for plant shutdown. E.1 and E.2 If any Required Action and associated Completion Time cannot be met in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. F.1 and F.2 If any Required Action and associated Completion Time cannot be met for PCIV(s) required to be OPERABLE in MODE 4 or 5, the unit must be placed in a condition in which the LCO does not apply. Action must be immediately initiated to suspend operations with a potential for draining the reactor vessel (OPDRVs) to minimize the probability of a vessel draindown and subsequent potential for fission product release. Action must continue until OPDRVs are suspended and valve(s) are restored to OPERABLE status. If suspending an OPDRV would result in closing the residual heat removal (RHR) shutdown cooling isolation valves, an alternative Required Action is provided to immediately initiate action to (continued) Brunswick Unit 2 B 3.6.1.3-8 Revision No. 30

PCIVs B 3.6.1.3 BASES ACTIONS F.1 and F.2 (continued) restore the valve(s) to OPERABLE status. This allows RHR shutdown cooling to remain in service while actions are being taken to restore the valve. SURVEILLANCE SR 3.6.1.3.1 REQUIREMENTS This SR verifies that each primary containment isolation manual valve and blind flange that is located outside primary containment and not locked, sealed, or otherwise secured and is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification that those devices outside primary containment, and capable of being mispositioned, are in the correct position. Since verification of valve position for devices outside primary containment is relatively easy, the 31 day Frequency was chosen to provide added assurance that the devices are in the correct positions. Two Notes have been added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since the primary containment is inerted and access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is low. A second Note has been included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open. These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated. This SR does not apply to valves and blind flanges that are locked, sealed, or otherwise secured in the correct position, since these devices were verified to be in the correct position upon locking, sealing, or securing. (continued) Brunswick Unit 2 B 3.6.1.3-9 Revision No. 30

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.2 REQUIREMENTS (continued) This SR verifies that each primary containment manual isolation valve and blind flange that is located inside primary containment and not locked, sealed, or otherwise secured and is required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits. For devices inside primary containment, the Frequency defined as "prior to entering MODE 2 or 3 from MODE 4 if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is appropriate since these devices are operated under administrative controls and the probability of their misalignment is low. This SR does not apply to valves and blind flanges that are locked, sealed, or otherwise secured in the correct position, since these devices were verified to be in the correct position upon locking, sealing, or securing. Two Notes have been added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since the primary containment is inerted and access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these devices, once they have been verified to be in their proper position, is low. A second Note has been included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open. These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated. SR 3.6.1.3.3 The traversing incore probe (TIP) shear isolation valves are actuated by explosive charges. Surveillance of explosive charge continuity provides assurance that TIP valves will actuate when required. This may be performed by verification of absence of OPERABLE alarms. Other (continued) Brunswick Unit 2 B 3.6.1.3-10 Revision No. 30

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.3 (continued) REQUIREMENTS administrative controls, such as those that limit the shelf life of the explosive charges, must be followed. The 31 day Frequency is based on operating experience that has demonstrated the reliability of the explosive charge continuity. SR 3.6.1.3.4 Verifying the isolation time of each power operated and each automatic PCIV is within limits is required to demonstrate OPERABILITY. MSIVs may be excluded form this SR since MSIV full closure solicitation time is demonstrated by SR 3.6.1.3.5. The isolation time test ensures that each valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the requirements of the Inservice Testing Program. SR 3.6.1.3.5 Verifying that the isolation time of each MSIV is within the specified limits is required to demonstrate OPERABILITY. The isolation time test ensures that the MSIV will isolate in a time period that does not exceed the times assumed in the DBA and transient analyses. This ensures that the calculated radiological consequences of these events remain within 10 CFR 50.67 limits. The Frequency of this SR is in accordance with the requirements of the Inservice Testing Program. SR 3.6.1.3.6 Automatic PCIVs close on a primary containment isolation signal to prevent leakage of radioactive material from primary containment following a DBA. This SR ensures that each automatic PCIV will actuate to its isolation position on a primary containment isolation signal. This SR includes verifying that each automatic PCIV in the Containment Atmosphere Dilution System flow path will actuate to its isolation position on the associated Group 2 and 6 primary containment isolation signals. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.6.1, Primary Containment Isolation Instrumentation," overlaps this SR to provide (continued) Brunswick Unit 2 B 3.6.1.3-11 Revision No. 30

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.6 (continued) REQUIREMENTS complete testing of the safety function. The 24 month Frequency was developed considering it is prudent that this Surveillance be performed only during a unit outage since isolation of penetrations would eliminate cooling water flow and disrupt the normal operation of many critical components. Operating experience has demonstrated that these components will pass this Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. SR 3.6.1.3.7 This SR requires a demonstration that a representative sample of reactor instrumentation line excess flow check valves (EFCVs) is OPERABLE by verifying that the valves actuate to the isolation position on an actual or simulated instrument line break signal. This may be accomplished by cycling the EFCVs through one complete cycle of full travel. The representative sample consists of an approximately equal number of EFCVs, such that each EFCV is tested at least once every 10 years (nominal). In addition, the EFCVs in the samples are representative of the various plant configurations, models, sizes, and operating environments. This ensures that any potentially common problem with a specific type or application of EFCV is detected at the earliest possible time. This SR provides assurance that the instrumentation line EFCVs will perform so that predicted radiological consequences will not be exceeded during a postulated instrument line break event. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will pass this Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. The nominal 10-year interval is based on performance testing as discussed in NEDO-32977-A (Ref. 5). Furthermore, any EFCV failures will be evaluated to determine if additional testing in that test interval is warranted to ensure overall reliability is maintained. Operating experience has demonstrated that these components are highly reliable and that failures to isolate are very infrequent. Therefore, testing of a representative sample was concluded to be acceptable from a reliability standpoint. (continued) Brunswick Unit 2 B 3.6.1.3-12 Revision No. 44

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.8 REQUIREMENTS (continued) The TIP shear isolation valves are actuated by explosive charges. An in place functional test is not possible with this design. The explosive squib is removed and tested to provide assurance that the valves will actuate when required. The replacement charge for the explosive squib shall be from the same manufactured batch as the one fired or from another batch that has been certified by having one of the batch successfully fired. The Frequency of this SR is in accordance with the requirements of the Inservice Testing Program. SR 3.6.1.3.9 The analyses in References 2, 6, 7, and 8 are based on leakage that is less than the specified leakage rate. Leakage through each main steam line must be 100 scfh when tested at Pt (25 psig). The combined leakage rate for all four mains steam lines must be 150 scfh when tested at 25 psig in accordance with the Primary Containment Leakage Rate Testing Program. The Primary Containment Leakage Rate Testing Program has been established in accordance with 10 CFR 50.54(o) to implement the requirements of 10 CFR Part 50, Appendix J, Option B (Ref. 9), and conforms with Regulatory Guide 1.163 (Ref. 10) and Nuclear Energy Institute (NEI) 94-01 (Ref. 11) except for the following:

a. Local leak rate testing of the MSIVs may be performed at a pressure less than Pa. This is an exemption from the requirements of 10 CFR 50 Appendix J (Ref. 7). The basis for this exemption is described in Reference 10.

The Frequency is required by the Primary Containment Leakage Rate Testing Program. (continued) Brunswick Unit 2 B 3.6.1.3-13 Revision No. 44

PCIVs B 3.6.1.3 BASES REFERENCES 1. UFSAR, Chapter 15.

2. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, September 1995.

3. 10 CFR 50.36(c)(2)(ii).

4. Technical Requirements Manual.

5. NEDO-32977-A, "Excess Flow Check Valve Testing Relaxation,"

June 2000.

6. UFSAR, Section 15.2.3.

7. NRC letter, Brunswick Steam Electric Plant, Units 1 and 2 -

Issuance of Amendment Re: Alternative Source Term, May 30, 2002.

8. BNP Calculation No. BNP-RAD-007, Rev. 1B, DBA-LOCA Radiological Dose With Alternate Source Term.

9. 10 CFR 50, Appendix J, Option B.

10. NRC Regulatory Guide 1.163, Performance-Based Containment Leak-Rate Testing Program, September 1995.

11. Nuclear Energy Institute (NEI) 94-01, Industry Guideline for Implementing Performance-Based Option of 10 CFR 50 Appendix J, July 26, 1995.

12. NRC SER, Brunswick 1 & 2 - Amendments No. 10 and 36 to Operating Licenses Revising Technical Specifications to Grant Exemptions from Specific Requirements of 10 CFR 50 Appendix J, dated November 8, 1977.

Brunswick Unit 2 B 3.6.1.3-14 Revision No. 71

Drywell Air Temperature B 3.6.1.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.4 Drywell Air Temperature BASES BACKGROUND The drywell contains the reactor vessel and piping, which add heat to the airspace. Drywell coolers remove heat and maintain a suitable environment. The average airspace temperature affects the calculated response to postulated Design Basis Accidents (DBAs). The limitation on the drywell average air temperature was developed as reasonable, based on operating experience. The limitation on drywell air temperature is used in the Reference 1 and 2 safety analyses. APPLICABLE Primary containment performance is evaluated for a spectrum of break SAFETY ANALYSES sizes for postulated loss of coolant accidents (LOCAs) (Refs. 1 and 2). Among the inputs to the design basis analysis is the initial drywell average air temperature (Refs. 1 and 2). Analyses assume an initial average drywell air temperature of 150°F. This limitation ensures that the safety analysis remains valid by maintaining the expected initial conditions and ensures that the peak LOCA drywell temperature does not exceed the maximum allowable temperature of 300°F (Ref. 3). Exceeding this design temperature may result in the degradation of the primary containment structure under accident loads. Equipment inside primary containment required to mitigate the effects of a DBA is designed to operate and be capable of operating under environmental conditions expected for the accident. Drywell air temperature satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). LCO In the event of a DBA, with an initial drywell average air temperature less than or equal to the LCO temperature limit, the resultant peak accident temperature is maintained below the drywell design temperature. As a result, the ability of primary containment to perform its design function is ensured. (continued) Brunswick Unit 2 B 3.6.1.4-1 Revision No. 30

Drywell Air Temperature B 3.6.1.4 BASES (continued) APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining drywell average air temperature within the limit is not required in MODE 4 or 5. ACTIONS A.1 With drywell average air temperature not within the limit of the LCO, drywell average air temperature must be restored within 8 hours. The Required Action is necessary to return operation to within the bounds of the primary containment analysis. The 8 hour Completion Time is acceptable, considering the sensitivity of the analysis to allow significant variations in this parameter, and provides sufficient time to correct minor problems. B.1 and B.2 If the drywell average air temperature cannot be restored to within the limit within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.6.1.4.1 REQUIREMENTS Verifying that the drywell average air temperature is within the LCO limit ensures that operation remains within the limits assumed for the primary containment analyses. Drywell air temperature is monitored in all quadrants and at various elevations (referenced to mean sea level). Due to the shape of the drywell, a volumetric average is used to determine an accurate representation of the actual average temperature. (continued) Brunswick Unit 2 B 3.6.1.4-2 Revision No. 30

Drywell Air Temperature B 3.6.1.4 BASES SURVEILLANCE SR 3.6.1.4.1 (continued) REQUIREMENTS The following locations are monitored to obtain the drywell average temperature:

a. Below 5 ft elevation;

b. Between 10 ft and 23 ft elevation;

c. Between 28 ft and 45 ft elevation;

d. Between 70 ft and 80 ft elevation; and

e. Above 90 ft elevation.

The 24 hour Frequency of the SR is based on operating experience related to drywell average air temperature variations and temperature instrument drift during the applicable MODES and the low probability of a DBA occurring between surveillances. Furthermore, the 24 hour Frequency is considered adequate in view of other indications available in the control room to alert the operator to an abnormal drywell air temperature condition. REFERENCES 1. UFSAR, Section 6.2.

2. GE-NE-A22-00113-22-01, Brunswick Nuclear Plant Units 1 and 2, Extended Power Uprate - Task T0400 - Containment System Response, May 2001.

3. UFSAR, Section 6.2.1.1.1.

4. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.6.1.4-3 Revision No. 30

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.5 Reactor Building-to-Suppression Chamber Vacuum Breakers BASES BACKGROUND The function of the reactor building-to-suppression chamber vacuum breakers is to relieve vacuum when primary containment depressurizes below reactor building pressure. If the drywell depressurizes below reactor building pressure, the negative differential pressure is mitigated by flow through the reactor building-to-suppression chamber vacuum breakers and through the suppression chamber-to-drywell vacuum breakers. The design of the external (reactor building-to-suppression chamber) vacuum relief provisions consists of two vacuum breakers (a mechanical vacuum breaker and a pneumatically operated butterfly valve), located in series in each of two 20 inch lines. The two lines from the reactor building merge to a common 20 inch line which connects to the suppression chamber airspace. Each path is capable of relieving 100% of design flow. The butterfly valve is actuated by a differential pressure switch. The normal pneumatic supply for the butterfly valve is the Non-interruptible Instrument Air System. A Nitrogen Backup System is provided to each butterfly valve and is automatically aligned to the valves following a loss of coolant accident (LOCA) signal and a subsequent primary containment isolation or following a loss of offsite power. Additionally, the Nitrogen Backup System automatically aligns to the valves to maintain system pressure when the Non-interruptible Instrument Air System pressure drops to approximately 95 psig. The mechanical vacuum breaker is self actuating similar to a check valve. Both mechanical vacuum breakers can be locally operated for testing purposes. The two vacuum breakers in series must be closed to maintain a leak tight primary containment boundary. The Nitrogen Backup System is of safety grade quality and complies with the intent of Generic Letter 84-09 (Ref. 1). This system consists of two independent and redundant subsystems. Each subsystem supplies safety grade nitrogen from a nitrogen bottle rack to one pneumatic butterfly valve via a pressure control valve and has sufficient capacity to provide 22 hours of valve operation including design system leakage. The pressure control valve reduces the nitrogen bottle supply pressure of 1130 psig to a normal system pressure of approximately 95 psig. (continued) Brunswick Unit 2 B 3.6.1.5-1 Revision No. 30

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES BACKGROUND A negative differential pressure across the drywell wall is caused by (continued) depressurization of the drywell. Events that cause this depressurization are cooling cycles, inadvertent primary containment spray actuation, and steam condensation in the event of a primary system rupture. Reactor building-to-suppression chamber vacuum breakers prevent an excessive negative differential pressure across the primary containment boundary. Cooling cycles result in minor pressure transients in the drywell, which occur slowly and are normally controlled by heating and ventilation equipment. Spray actuation following a small break LOCA results in a significant pressure transient and becomes important in sizing the external (reactor building-to-suppression chamber) vacuum breakers. The external vacuum breakers are sized on the basis of the air flow from the secondary containment that is required to mitigate the depressurization transient and limit the maximum negative containment (drywell and suppression chamber) pressure to within design limits. The maximum depressurization rate is a function of the primary containment spray flow rate and temperature and the assumed initial conditions of the primary containment atmosphere. Low spray temperatures and atmospheric conditions that yield the minimum amount of contained noncondensible gases are assumed for conservatism. APPLICABLE Analytical methods and assumptions involving the reactor SAFETY ANALYSES building-to-suppression chamber vacuum breakers are presented in Reference 2 as part of the accident response of the containment systems. Internal (suppression chamber-to-drywell) and external (reactor building-to-suppression chamber) vacuum breakers are provided as part of the primary containment to limit the negative differential pressure across the drywell and suppression chamber walls, which form part of the primary containment boundary. The safety analyses assume the external vacuum breakers to be closed initially and to be fully open at 0.5 psid (Ref. 2). Additionally, of the two series reactor building-to-suppression chamber vacuum breakers, one is assumed to fail in a closed position to satisfy the single active failure criterion. Design Basis Accident (DBA) analyses assume the vacuum breakers to be closed initially and to remain closed and leak tight with positive primary containment pressure. (continued) Brunswick Unit 2 B 3.6.1.5-2 Revision No. 30

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES APPLICABLE Two cases were considered in the safety analyses to determine the SAFETY ANALYSES adequacy of the external vacuum breakers: (continued)

a. A small break loss of coolant accident followed by actuation of both primary containment spray loops and

b. A large break loss of coolant accident followed by actuation of both primary containment spray loops.

The results of these two cases show that the external vacuum breakers, with a full open setpoint of 0.5 psid, are capable of maintaining the differential pressure within design limits. The reactor building-to-suppression chamber vacuum breakers satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). LCO All reactor building-to-suppression chamber vacuum breakers are required to be OPERABLE to satisfy the assumptions used in the safety analyses. The requirement ensures that the two vacuum breakers (mechanical vacuum breaker and pneumatic butterfly valve) in each of the two lines from the reactor building to the common line connected to the suppression chamber airspace are closed (except during testing or when performing their intended function). Also, the requirement ensures both vacuum breakers in each line will open to relieve a negative pressure in the suppression chamber. For a pneumatic butterfly valve to be OPERABLE for opening, both the Non-interruptible Instrument Air System and the Nitrogen Backup System shall be capable of supplying the pneumatic operator. APPLICABILITY In MODES 1, 2, and 3, a DBA could result in excessive negative differential pressure across the drywell wall caused by the rapid depressurization of the drywell. The event that results in the limiting rapid depressurization of the drywell is the primary system rupture, which purges the drywell atmosphere and fills the drywell free airspace with steam. Subsequent condensation of the steam would result in depressurization of the drywell, which, after the suppression chamber-to-drywell vacuum breakers open (due to differential pressure between the suppression chamber and drywell), would result in (continued) Brunswick Unit 2 B 3.6.1.5-3 Revision No. 30

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES APPLICABILITY depressurization of the suppression chamber. The limiting pressure and (continued) temperature of the primary system prior to a DBA occur in MODES 1, 2, and 3. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining reactor building-to-suppression chamber vacuum breakers OPERABLE is not required in MODE 4 or 5. ACTIONS A.1 A Note has been added to provide clarification that, for the purpose of this LCO, separate Condition entry is allowed for each of the two lines from the reactor building to the common line connected to the suppression chamber air space. With one or more lines with one vacuum breaker not closed, the leak tight primary containment boundary may be threatened. Therefore, the inoperable vacuum breaker must be restored to OPERABLE status or the open vacuum breaker closed within 72 hours. The 72 hour Completion Time is consistent with requirements for inoperable suppression chamber-to-drywell vacuum breakers in LCO 3.6.1.6, "Suppression Chamber-to-Drywell Vacuum Breakers." The 72 hour Completion Time takes into account the redundant capability afforded by the remaining breakers, the fact that the OPERABLE breaker in each of the lines is closed, and the low probability of an event occurring that would require the vacuum breaker to be OPERABLE during this period. B.1 With one or more lines with two vacuum breakers not closed, primary containment integrity is not maintained. Therefore, one open vacuum breaker in each line must be closed within 2 hours. This Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, "Primary Containment," which requires that primary containment be restored to OPERABLE status within 2 hours. (continued) Brunswick Unit 2 B 3.6.1.5-4 Revision No. 30

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES ACTIONS C.1 (continued) With one vacuum breaker inoperable solely due to its associated nitrogen backup subsystem being inoperable, the leak tight primary containment boundary is intact. In this Condition, the vacuum breakers in the redundant line are adequate to mitigate the primary containment depressurization. However, overall reliability is reduced because a single failure could result in a loss of the capability to mitigate an event that causes a containment depressurization following a LOCA and a subsequent primary containment isolation. The 31 day Completion Time is acceptable because of the OPERABLE vacuum breakers in the redundant line, the normal pneumatic supply is available to the vacuum breaker, and the low probability of a LOCA and a subsequent primary containment isolation occurring during the period the nitrogen backup subsystem is inoperable. D.1 With two vacuum breakers inoperable solely due to their associated nitrogen backup subsystems being inoperable, the leak tight primary containment boundary is intact. Since the normal pneumatic supply is available to each vacuum breaker, the vacuum breakers are still capable of mitigating any event that causes a containment depressurization except following a LOCA and a subsequent primary containment isolation. The 7 day Completion Time is acceptable because the normal pneumatic supply is available to each vacuum breaker and because of the low probability of a LOCA and a subsequent primary containment isolation occurring during the period the nitrogen backup subsystems are inoperable. E.1 With one line with one or more vacuum breakers inoperable for opening, the leak tight primary containment boundary is intact. However, with one line with one or more vacuum breakers inoperable for opening for reasons other than its associated nitrogen backup subsystem being inoperable (Condition C), overall system reliability is reduced because a single failure in one of the vacuum breakers in the redundant line could (continued) Brunswick Unit 2 B 3.6.1.5-5 Revision No. 30

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES ACTIONS E.1 (continued) threaten the ability to mitigate an event that causes a containment depressurization. Therefore, the inoperable vacuum breaker must be restored to OPERABLE status within 72 hours. This is consistent with the Completion Time for Condition A and the fact that the leak tight primary containment boundary is being maintained. F.1 With two lines with one or more vacuum breakers inoperable for opening, the primary containment boundary is intact. However, in the event of a containment depressurization, the function of the vacuum breakers is lost if the vacuum breakers are inoperable for reasons other than the Nitrogen Backup System being inoperable (Condition D). Therefore, all vacuum breakers in one line must be restored to OPERABLE status within 2 hours. This Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, which requires that primary containment be restored to OPERABLE status within 2 hours. G.1 and G.2 If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.6.1.5.1 REQUIREMENTS The bank of nitrogen bottles supplying each nitrogen backup subsystem header is required to be verified to be pressurized to 1130 psig to ensure sufficient motive force is available to the pneumatic butterfly valve actuators following a LOCA and subsequent primary containment isolation. A nitrogen bottle pressure of 1130 psig assures sufficient capacity to actuate and cycle the pneumatic butterfly valve for 22 hours including design system leakage. This Surveillance may be satisfied by (continued) Brunswick Unit 2 B 3.6.1.5-6 Revision No. 30

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES SURVEILLANCE SR 3.6.1.5.1 (continued) REQUIREMENTS verifying the absence of the Nitrogen Backup System low pressure alarms. The 24 hour Frequency is based on engineering judgment in view of the fact that adequate indication of pressure is available to the operator and the Frequency has also been shown to be acceptable through operating experience. SR 3.6.1.5.2 Each vacuum breaker is verified to be closed to ensure that a potential breach in the primary containment boundary is not present. This Surveillance is performed by observing local or control room indications of vacuum breaker position. The 14 day Frequency is based on engineering judgment, is considered adequate in view of other indications of vacuum breaker status available to operations personnel, and has been shown to be acceptable through operating experience. Two Notes are added to this SR. The first Note allows reactor building-to-suppression chamber vacuum breakers opened in conjunction with the performance of a Surveillance to not be considered as failing this SR. These periods of opening vacuum breakers are controlled by plant procedures and do not represent inoperable vacuum breakers. The second Note is included to clarify that vacuum breakers open due to an actual differential pressure are not considered as failing this SR. SR 3.6.1.5.3 Each vacuum breaker must be cycled to ensure that it opens properly to perform its design function and returns to its fully closed position. This SR ensures that the safety analysis assumptions are valid. This is accomplished by manually verifying that each mechanical vacuum breaker is free to open and verifying each pneumatic butterfly valve operates through at least one complete cycle of full travel. The 92 day Frequency of this SR was developed based upon Inservice Testing Program requirements to perform valve testing at least once every 92 days. (continued) Brunswick Unit 2 B 3.6.1.5-7 Revision No. 30

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES SURVEILLANCE SR 3.6.1.5.4 REQUIREMENTS (continued) Demonstration of vacuum breaker opening setpoint is necessary to ensure that the safety analysis assumption regarding vacuum breaker full open differential pressure of 0.5 psid is valid. This is accomplished by demonstrating that the force required to open each mechanical vacuum breaker is 0.5 psid and demonstrating that each pneumatic butterfly valve opens at 0.4 psid and 0.5 psid with drywell pressure negative with respect to reactor building pressure. The 24 month Frequency has been demonstrated to be acceptable, based on operating experience, and is further justified because of other Surveillances performed more frequently that convey the proper functioning status of each vacuum breaker. SR 3.6.1.5.5 To ensure the pneumatic butterfly valves have sufficient capacity to actuate and cycle following a LOCA and subsequent primary containment isolation, Nitrogen Backup System leakage must be within the design limit. This SR ensures that overall system leakage is within a design limit of 0.65 scfm. This is accomplished by measuring the nitrogen bottle supply pressure decrease while maintaining approximately 95 psig to the nitrogen backup subsystem during the test with an initial nitrogen bottle supply pressure of 1130 psig. The system leakage test is performed every 24 months. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage. Operating experience has demonstrated that these components will pass this Surveillance when performed at the 24 month Frequency. Therefore, the Frequency is concluded to be acceptable from a reliability standpoint. SR 3.6.1.5.6 This SR ensures that in the event a LOCA and subsequent primary containment isolation occurs, the Nitrogen Backup System will actuate to perform its design function and supply nitrogen gas at the required pressure to the pneumatic operators of the butterfly valves. The (continued) Brunswick Unit 2 B 3.6.1.5-8 Revision No. 33

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES SURVEILLANCE SR 3.6.1.5.6 (continued) REQUIREMENTS 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage. Operating experience has demonstrated that these components will pass this Surveillance when performed at the 24 month Frequency. Therefore, the Frequency is concluded to be acceptable from a reliability standpoint. REFERENCES 1. NRC Generic Letter GL 84-09, Recombiner Capability requirements of 10 CFR 50.44(c)(3)(ii).

2. UFSAR, Section 6.2.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.6.1.5-9 Revision No. 30

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.6 Suppression Chamber-to-Drywell Vacuum Breakers BASES BACKGROUND The function of the suppression-chamber-to-drywell vacuum breakers is to relieve vacuum in the drywell. There are 10 internal vacuum breakers located on the vent header of the vent system between the drywell and the suppression chamber, which allow flow from the suppression chamber atmosphere to the drywell when the drywell is at a negative pressure with respect to the suppression chamber. Therefore, suppression chamber-to-drywell vacuum breakers prevent an excessive negative differential pressure across the suppression chamber-drywell boundary. Each vacuum breaker is a self actuating valve, similar to a check valve, which can be remotely operated for testing purposes. A negative differential pressure across the drywell wall is caused by depressurization of the drywell. Events that cause this depressurization are cooling cycles, inadvertent drywell spray actuation, and steam condensation from sprays or subcooled water reflood of a break in the event of a primary system rupture. Cooling cycles result in minor pressure transients in the drywell that occur slowly and are normally controlled by heating and ventilation equipment. Spray actuation or spill of subcooled water out of a break results in more significant pressure transients and becomes important in sizing the internal vacuum breakers. In the event of a primary system rupture, steam condensation within the drywell results in the most severe pressure transient. Following a primary system rupture, the drywell atmosphere is purged into the suppression chamber free airspace, leaving the drywell full of steam. Subsequent condensation of the steam can be caused in two possible ways, namely, Emergency Core Cooling Systems flow from a recirculation line break, or drywell spray actuation following a loss of coolant accident (LOCA). These two cases determine the maximum depressurization rate of the drywell. In addition, the waterleg in the Mark I Vent System downcomer is controlled by the drywell-to-suppression chamber differential pressure. If the drywell pressure is less than the suppression chamber pressure, there will be an increase in the height of the downcomer waterleg. (continued) Brunswick Unit 2 B 3.6.1.6-1 Revision No. 30

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES BACKGROUND This will result in an increase in the water clearing inertia in the event (continued) of a postulated LOCA, resulting in an increase in the peak drywell pressure. This in turn will result in an increase in the pool swell dynamic loads. The internal vacuum breakers limit the height of the waterleg in the vent system during normal operation. APPLICABLE Analytical methods and assumptions involving the suppression SAFETY ANALYSES chamber-to-drywell vacuum breakers are presented in Reference 1 as part of the accident response of the primary containment systems. Internal (suppression chamber-to-drywell) and external (reactor building-to-suppression chamber) vacuum breakers are provided as part of the primary containment to limit the negative differential pressure across the drywell and suppression chamber walls that form part of the primary containment boundary. The safety analyses assume that the internal vacuum breakers are closed initially and are fully open at a differential pressure of 0.5 psid (Ref. 1). Additionally, 3 of the 10 internal vacuum breakers are assumed to fail in a closed position (Ref. 1). The results of the analyses show that the design pressure is not exceeded even under the worst case accident scenario. The vacuum breaker opening differential pressure setpoint and the requirement that 8 of 10 vacuum breakers be OPERABLE (the additional vacuum breaker is required to meet the single failure criterion) are a result of the requirement placed on the vacuum breakers to limit the vent system waterleg height. The total cross sectional area of the main vent system between the drywell and suppression chamber needed to fulfill this requirement has been established as a minimum of 51.5 times the total break area. In turn, the vacuum relief capacity between the drywell and suppression chamber should be 1/16 of the total main vent cross sectional area, with the valves set to operate at 0.5 psid differential pressure. Design Basis Accident (DBA) analyses assume the vacuum breakers to be closed initially and to remain closed and leak tight, until the suppression pool is at a positive pressure relative to the drywell. The suppression chamber-to-drywell vacuum breakers satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 2). (continued) Brunswick Unit 2 B 3.6.1.6-2 Revision No. 30

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES (continued) LCO Only 8 of the 10 vacuum breakers must be OPERABLE for opening. All suppression chamber-to-drywell vacuum breakers, however, are required to be closed (except when the vacuum breakers are performing their intended design function). The vacuum breaker OPERABILITY requirement provides assurance that the drywell-to-suppression chamber negative differential pressure remains below the design value. The requirement that the vacuum breakers be closed ensures that there is no excessive bypass leakage should a LOCA occur. APPLICABILITY In MODES 1, 2, and 3, a DBA could result in excessive negative differential pressure across the drywell wall, caused by the rapid depressurization of the drywell. The event that results in the limiting rapid depressurization of the drywell is the primary system rupture that purges the drywell atmosphere and fills the drywell free airspace with steam. Subsequent condensation of the steam would result in depressurization of the drywell. The limiting pressure and temperature of the primary system prior to a DBA occur in MODES 1, 2, and 3. In MODES 4 and 5, the probability and consequences of these events are reduced by the pressure and temperature limitations in these MODES; therefore, maintaining suppression chamber-to-drywell vacuum breakers OPERABLE is not required in MODE 4 or 5. ACTIONS A.1 With one of the required vacuum breakers inoperable for opening (e.g., the vacuum breaker is not open and may be stuck closed or not within its opening setpoint limit, so that it would not function as designed during an event that depressurized the drywell), the remaining seven OPERABLE vacuum breakers are capable of providing the vacuum relief function. However, overall system reliability is reduced because a single failure in one of the remaining vacuum breakers could result in an excessive suppression chamber-to-drywell differential pressure during a DBA. Therefore, with one of the eight required vacuum breakers inoperable, 72 hours is allowed to restore at least one of the inoperable vacuum breakers to OPERABLE status so that plant conditions are consistent (continued) Brunswick Unit 2 B 3.6.1.6-3 Revision No. 30

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES ACTIONS A.1 (continued) with those assumed for the design basis analysis. The 72 hour Completion Time is considered acceptable due to the low probability of an event in which the remaining vacuum breaker capability would not be adequate. B.1 With one vacuum breaker not closed, communication between the drywell and suppression chamber airspace could occur, and, as a result, there is the potential for primary containment overpressurization due to this bypass leakage if a LOCA were to occur. Therefore, the open vacuum breaker must be closed. A short time is allowed to close the vacuum breaker due to the low probability of an event that would pressurize primary containment. If vacuum breaker position indication is not available, an alternate method of verifying that the vacuum breakers are closed is to verify that the differential pressure between the suppression chamber and drywell is maintained > 0.5 times the initial differential pressure for 1 hour without nitrogen makeup. The 4 hour Completion Time is considered adequate to perform this test. C.1 and C.2 If any Required Action and associated Completion Time can not be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.6.1.6.1 REQUIREMENTS Each vacuum breaker is verified closed (except when the vacuum breaker is performing its intended design function) to ensure that this potential large bypass leakage path is not present. This Surveillance is performed by observing the vacuum breaker position indication or by verifying that the differential pressure between the suppression chamber (continued) Brunswick Unit 2 B 3.6.1.6-4 Revision No. 30

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES SURVEILLANCE SR 3.6.1.6.1 (continued) REQUIREMENTS and drywell is maintained > 0.5 times the initial differential pressure for 1 hour without nitrogen makeup. The 14 day Frequency is based on engineering judgment, is considered adequate in view of other indications of vacuum breaker status available to operations personnel and procedural controls to ensure the drywell is normally maintained at a higher pressure than the suppression chamber, and has been shown to be acceptable through operating experience. This verification is also required within 6 hours after any discharge of steam to the suppression chamber from any source, and within 6 hours after an operation that causes any of the vacuum breakers to open. A Note is added to this SR which allows suppression chamber-to-drywell vacuum breakers opened in conjunction with the performance of a Surveillance to not be considered as failing this SR. These periods of opening vacuum breakers are controlled by plant procedures and do not represent inoperable vacuum breakers. SR 3.6.1.6.2 Each required vacuum breaker must be cycled to ensure that it opens adequately to perform its design function and returns to the fully closed position. This is accomplished by verifying each required vacuum breaker operates through at least one complete cycle of full travel. This SR ensures that the safety analysis assumptions are valid. The 92 day Frequency of this SR was developed, based on Inservice Testing Program requirements to perform valve testing at least once every 92 days. In addition, this functional test is required within 12 hours after a discharge of steam to the suppression chamber from the SRVs. SR 3.6.1.6.3 Verification of the vacuum breaker opening setpoint is necessary to ensure that the safety analysis assumption regarding vacuum breaker full open differential pressure of 0.5 psid is valid. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 24 month Frequency has been demonstrated to be acceptable, based on operating experience, and is further justified because of other surveillances performed more frequently that convey the proper functioning status of each vacuum breaker. REFERENCES 1. UFSAR, Section 6.2.

2. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.6.1.6-5 Revision No. 63

Suppression Pool Average Temperature B 3.6.2.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.1 Suppression Pool Average Temperature BASES BACKGROUND The suppression chamber is a toroidal shaped, steel pressure vessel containing a volume of water called the suppression pool. The suppression pool is designed to absorb the decay heat and sensible energy released during a reactor blowdown from safety/relief valve discharges or from Design Basis Accidents (DBAs). The suppression pool must quench all the steam released through the downcomer lines during a loss of coolant accident (LOCA). This is the essential mitigative feature of a pressure suppression containment that ensures that the peak containment pressure is maintained below the maximum allowable pressure for DBAs (62 psig). The suppression pool must also condense steam from steam exhaust lines in the turbine driven systems (i.e., the High Pressure Coolant Injection System and Reactor Core Isolation Cooling System). Suppression pool average temperature (along with LCO 3.6.2.2, "Suppression Pool Water Level") is a key indication of the capacity of the suppression pool to fulfill these requirements. The technical concerns that lead to the development of suppression pool average temperature limits are as follows:

a. Complete steam condensation - the original limit for the end of a LOCA blowdown was 170°F, based on the Bodega Bay and Humboldt Bay Tests;

b. Primary containment peak pressure and temperature - design pressure is 62 psig and design temperature is 340°F (Ref. 1);

c. Condensation oscillation loads - maximum allowable initial temperature is 110°F; and

d. Chugging loads - these only occur at < 135°F; therefore, there is no initial temperature limit because of chugging.

(continued) Brunswick Unit 2 B 3.6.2.1-1 Revision No. 30

Suppression Pool Average Temperature B 3.6.2.1 BASES (continued) APPLICABLE The postulated DBA against which the primary containment performance SAFETY ANALYSES is evaluated is a spectrum of postulated pipe breaks within the primary containment. Inputs to the safety analyses include initial suppression pool water volume and suppression pool temperature (Reference 1 for LOCAs and for the pool temperature analyses required by Reference 2). An initial pool temperature of 95°F is assumed for the Reference 1 containment analyses. Reactor shutdown at a pool temperature of 110°F and vessel depressurization at a pool temperature of 120°F are assumed for the Reference 1 analyses. The limit of 105°F, at which testing is terminated, is not used in the safety analyses because DBAs are assumed to not initiate during unit testing. Suppression pool average temperature satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). LCO A limitation on the suppression pool average temperature is required to provide assurance that the containment conditions assumed for the safety analyses are met. This limitation subsequently ensures that peak primary containment pressures and temperatures do not exceed maximum allowable values during a postulated DBA or any transient resulting in heatup of the suppression pool. The LCO requirements are:

a. Average temperature 95°F with THERMAL POWER > 1%

RATED THERMAL POWER (RTP) and no testing that adds heat to the suppression pool is being performed. This requirement ensures that licensing bases initial conditions are met.

b. Average temperature 105°F with THERMAL POWER > 1% RTP and testing that adds heat to the suppression pool is being performed. This required value ensures that the unit has testing flexibility, and was selected to provide margin below the 110°F limit at which reactor shutdown is required. When testing ends, temperature must be restored to 95°F within 24 hours according to Required Action A.2. Therefore, the time period that the temperature is > 95°F is short enough not to cause a significant increase in unit risk.

(continued) Brunswick Unit 2 B 3.6.2.1-2 Revision No. 30

Suppression Pool Average Temperature B 3.6.2.1 BASES LCO c. Average temperature 110°F with THERMAL POWER 1% (continued) RTP. This requirement ensures that the unit will be shut down at

                         > 110°F. The pool is designed to absorb decay heat and sensible heat but could be heated beyond design limits by the steam generated if the reactor is not shut down.

At 1% RTP, heat input is approximately equal to normal system heat losses. APPLICABILITY In MODES 1, 2, and 3, a DBA could cause significant heatup of the suppression pool. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining suppression pool average temperature within limits is not required in MODE 4 or 5. ACTIONS A.1 and A.2 With the suppression pool average temperature above the specified limit when not performing testing that adds heat to the suppression pool and when above the specified power, the initial conditions exceed the conditions assumed for the Reference 1 analyses. However, primary containment cooling capability still exists, and the primary containment pressure suppression function will occur at temperatures well above those assumed for safety analyses. Therefore, continued operation is allowed for a limited time. The 24 hour Completion Time is adequate to allow the suppression pool average temperature to be restored below the limit. Additionally, when suppression pool temperature is > 95°F, increased monitoring of the suppression pool temperature is required to ensure that it remains 110°F. The once per hour Completion Time is adequate based on past experience, which has shown that pool temperature increases relatively slowly except when testing that adds heat to the suppression pool is being performed. Furthermore, the once per hour Completion Time is considered adequate in view of other indications in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition. (continued) Brunswick Unit 2 B 3.6.2.1-3 Revision No. 30

Suppression Pool Average Temperature B 3.6.2.1 BASES ACTIONS B.1 (continued) If the suppression pool average temperature cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the power must be reduced to 1% RTP within 12 hours. The 12 hour Completion Time is reasonable, based on operating experience, to reduce power from full power conditions in an orderly manner and without challenging plant systems. C.1 Suppression pool average temperature is allowed to be > 95°F with THERMAL POWER > 1% RTP, and when testing that adds heat to the suppression pool is being performed. However, if temperature is

                > 105°F, all testing must be immediately suspended to preserve the heat absorption capability of the suppression pool. With the testing suspended, Condition A is entered and the Required Actions and associated Completion Times are applicable.

D.1 and D.2 Suppression pool average temperature > 110°F requires that the reactor be shut down immediately. This is accomplished by manually scramming the reactor. Further cooldown to Mode 4 within 36 hours is required at normal cooldown rates (provided pool temperature remains 120°F). Additionally, when suppression pool temperature is > 110°F, increased monitoring of pool temperature is required to ensure that it remains 120°F. The once per 30 minute Completion Time is adequate, based on operating experience. Given the high suppression pool average temperature in this condition, the monitoring Frequency is increased to twice that of Condition A. Furthermore, the 30 minute Completion Time is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition. (continued) Brunswick Unit 2 B 3.6.2.1-4 Revision No. 30

Suppression Pool Average Temperature B 3.6.2.1 BASES ACTIONS E.1 and E.2 (continued) If suppression pool average temperature cannot be maintained at 120°F, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the reactor pressure must be reduced to

                < 200 psig within 12 hours, and the plant must be brought to at least MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Continued addition of heat to the suppression pool with suppression pool temperature > 120°F could result in exceeding the design basis maximum allowable values for primary containment temperature or pressure. Furthermore, if a blowdown were to occur when the temperature was

                > 120°F, the maximum allowable bulk and local temperatures could be exceeded very quickly.

SURVEILLANCE SR 3.6.2.1.1 REQUIREMENTS The suppression pool average temperature is regularly monitored to ensure that the required limits are satisfied. The average temperature is determined using an algorithm with inputs from OPERABLE suppression pool water temperature channels. The 24 hour Frequency has been shown, based on operating experience, to be acceptable. When heat is being added to the suppression pool by testing, however, it is necessary to monitor suppression pool temperature more frequently. The 5 minute Frequency during testing is justified by the rates at which tests will heat up the suppression pool, has been shown to be acceptable based on operating experience, and provides assurance that allowable pool temperatures are not exceeded. The Frequencies are further justified in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition. REFERENCES 1. NEDC-33039P, Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, Extended Power Uprate, August 2001.

2. NUREG-0783.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.6.2.1-5 Revision No. 30

Suppression Pool Water Level B 3.6.2.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.2 Suppression Pool Water Level BASES BACKGROUND The suppression chamber is a toroidal shaped, steel pressure vessel containing a volume of water called the suppression pool. The suppression pool is designed to absorb the energy associated with decay heat and sensible heat released during a reactor blowdown from safety/relief valve (SRV) discharges or from a Design Basis Accident (DBA). The suppression pool must quench all the steam released through the downcomer lines during a loss of coolant accident (LOCA). This is the essential mitigative feature of a pressure suppression containment, which ensures that the peak containment pressure is maintained below the maximum allowable pressure for DBAs (62 psig). The suppression pool must also condense steam from the steam exhaust lines in the turbine driven systems (i.e., High Pressure Coolant Injection (HPCI) System and Reactor Core Isolation Cooling (RCIC) System) and provides the main emergency water supply source for the reactor vessel. The suppression pool volume ranges between 86,450 ft3 at the low water level limit of -31 inches and 89,750 ft3 at the high water level limit of

                  -27 inches.

If the suppression pool water level is too low, an insufficient amount of water would be available to adequately condense the steam from the SRV quenchers, main vents, or HPCI and RCIC turbine exhaust lines. Low suppression pool water level could also result in an inadequate emergency makeup water source to the Emergency Core Cooling System. The lower volume would also absorb less steam energy before heating up excessively. Therefore, a minimum suppression pool water level is specified. If the suppression pool water level is too high, it could result in excessive clearing loads from SRV discharges and excessive pool swell loads during a DBA LOCA. Therefore, a maximum pool water level is specified. This LCO specifies an acceptable range to prevent the suppression pool water level from being either too high or too low. (continued) Brunswick Unit 2 B 3.6.2.2-1 Revision No. 30

Suppression Pool Water Level B 3.6.2.2 BASES (continued) APPLICABLE Initial suppression pool water level affects suppression pool temperature SAFETY ANALYSES response calculations, calculated drywell pressure during vent clearing for a DBA, calculated pool swell loads for a DBA LOCA, and calculated loads due to SRV discharges. Suppression pool water level must be maintained within the limits specified so that the safety analysis of References 1 and 2 remains valid. Suppression pool water level satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). LCO A limit that suppression pool water level be -31 inches and -27 inches is required to ensure that the primary containment conditions assumed for the safety analyses are met. Either the high or low water level limits were used in the safety analyses, depending upon which is more conservative for a particular calculation. APPLICABILITY In MODES 1, 2, and 3, a DBA would cause significant loads on the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. The requirements for maintaining suppression pool water level within limits in MODE 4 or 5 is addressed in LCO 3.5.2, "ECCS-Shutdown." ACTIONS A.1 With suppression pool water level outside the limits, the conditions assumed for the safety analyses are not met. If water level is below the minimum level, the pressure suppression function still exists as long as main vents are covered, HPCI and RCIC turbine exhausts are covered, and SRV quenchers are covered. If suppression pool water level is above the maximum level, protection against overpressurization still exists due to the margin in the peak containment pressure analysis and the capability of the Drywell Spray System. Therefore, continued operation for a limited time is allowed. The 2 hour Completion Time is sufficient to restore suppression pool water level to within limits. Also, it takes into account the low probability of an event impacting the suppression pool water level occurring during this interval. (continued) Brunswick Unit 2 B 3.6.2.2-2 Revision No. 30

Suppression Pool Water Level B 3.6.2.2 BASES ACTIONS B.1 and B.2 (continued) If suppression pool water level cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.6.2.2.1 REQUIREMENTS Verification of the suppression pool water level is to ensure that the required limits are satisfied. The 24 hour Frequency of this SR has been shown to be acceptable based on operating experience. Furthermore, the 24 hour Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool water level condition. REFERENCES 1. UFSAR, Section 6.2.1.1.3.2.

2. NEDC-33039P, Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, Extended Power Uprate, August 2001.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.6.2.2-3 Revision No. 30

RHR Suppression Pool Cooling B 3.6.2.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling BASES BACKGROUND Following a Design Basis Accident (DBA), the RHR Suppression Pool Cooling System removes heat from the suppression pool. The suppression pool is designed to absorb the sudden input of heat from the primary system. In the long term, the pool continues to absorb residual heat generated by fuel in the reactor core. Some means must be provided to remove heat from the suppression pool so that the temperature inside the primary containment remains within design limits. This function is provided by two redundant RHR suppression pool cooling subsystems. The purpose of this LCO is to ensure that both subsystems are OPERABLE in applicable MODES. Each RHR subsystem contains two pumps and one heat exchanger and is manually initiated and independently controlled. The two subsystems perform the suppression pool cooling function by circulating water from the suppression pool through the RHR heat exchangers and returning it to the suppression pool. Service water, circulating through the tube side of the heat exchangers, exchanges heat with the suppression pool water and discharges this heat to the external heat sink. The heat removal capability of two RHR pumps in one subsystem is sufficient to meet the overall DBA pool cooling requirement for loss of coolant accidents (LOCAs) and transient events such as a turbine trip or stuck open safety/relief valve (SRV). With only one RHR pump in one subsystem OPERABLE, the available heat removal capability results in suppression pool temperatures, after a DBA LOCA, for which inadequate NPSH would be available for required RHR and Core Spray pumps. Therefore, to ensure adequate NPSH is available for required RHR and Core Spray pumps, two RHR pumps are required to be OPERABLE in a subsystem. SRV leakage and High Pressure Coolant Injection System and Reactor Core Isolation Cooling System testing increase suppression pool temperature more slowly. The RHR Suppression Pool Cooling System is also used to lower the suppression pool water bulk temperature following such events. (continued) Brunswick Unit 2 B 3.6.2.3-1 Revision No. 30

RHR Suppression Pool Cooling B 3.6.2.3 BASES (continued) APPLICABLE References 1 and 2 contain the results of analyses used to predict SAFETY ANALYSES primary containment pressure and temperature following large and small break LOCAs. The intent of the analyses is to demonstrate that the heat removal capacity of the RHR Suppression Pool Cooling System is adequate to maintain the primary containment conditions within design limits. The suppression pool temperature is calculated to remain below the design limit. The RHR Suppression Pool Cooling System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). LCO During a DBA, a minimum of one RHR suppression pool cooling subsystem is required to maintain the primary containment peak pressure and temperature below design limits (Refs. 1 and 2). To ensure that these requirements are met, two independent RHR suppression pool cooling subsystems must be OPERABLE with power from two safety related independent power supplies. Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR suppression pool cooling subsystem is OPERABLE when two pumps, the heat exchanger, and associated piping, valves, instrumentation, and controls are OPERABLE. APPLICABILITY In MODES 1, 2, and 3, a DBA could cause both a release of radioactive material to the primary containment and a heatup and pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, the RHR Suppression Pool Cooling System is not required to be OPERABLE in MODE 4 or 5. ACTIONS A.1 With one RHR suppression pool cooling subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining RHR suppression pool cooling subsystem is adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced primary containment cooling capability. The 7 day Completion Time is acceptable in light of the redundant RHR suppression pool cooling capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period. (continued) Brunswick Unit 2 B 3.6.2.3-2 Revision No. 39

RHR Suppression Pool Cooling B 3.6.2.3 BASES ACTIONS B.1 (continued) With two RHR suppression pool cooling subsystems inoperable, one subsystem must be restored to OPERABLE status within 8 hours. In this condition, there is a substantial loss of the primary containment pressure and temperature mitigation function. The 8 hour Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and because alternative methods to remove heat from primary containment are available. C.1 and C.2 If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.6.2.3.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the RHR suppression pool cooling mode flow path provides assurance that the proper flow path exists for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position provided it can be aligned to the accident position within the time assumed in the accident analysis. This is acceptable since the RHR suppression pool cooling mode is manually initiated. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The Frequency of 31 days is justified because the valves are operated under procedural control, improper valve position would affect only a single subsystem, the probability of an event requiring initiation of the system is low, and the system is a manually initiated system. This Frequency has been shown to be acceptable based on operating experience. (continued) Brunswick Unit 2 B 3.6.2.3-3 Revision No. 39

RHR Suppression Pool Cooling B 3.6.2.3 BASES SURVEILLANCE SR 3.6.2.3.2 REQUIREMENTS (continued) Verifying that each RHR pump develops a flow rate 7700 gpm while operating in the suppression pool cooling mode with flow through the associated heat exchanger ensures that the primary containment pressure and temperature can be maintained below the design limits during a DBA (Ref. 2). The normal test of centrifugal pump performance required by ASME OM Code (Ref . 4) is covered by the requirements of LCO 3.5.1, "ECCSOperating." This test confirms one point on the pump design curve, and the results are indicative of overall performance. Such tests confirm component OPERABILITY, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is 92 days. REFERENCES 1. UFSAR, Section 6.2.1.1.3.2.

2. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, September 1995.

3. 10 CFR 50.36(c)(2)(ii).

4. ASME Code for Operation and Maintenance of Nuclear Power Plants.

Brunswick Unit 2 B 3.6.2.3-4 Revision No. 56

Primary Containment Oxygen Concentration B 3.6.3.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.3.1 Primary Containment Oxygen Concentration BASES BACKGROUND The primary containment is designed to withstand events that generate hydrogen either due to the zirconium metal water reaction in the core or due to radiolysis. The primary method to control hydrogen is to inert the primary containment. With the primary containment inert, that is, oxygen concentration < 4.0 volume percent (v/o), a combustible mixture cannot be present in the primary containment for any hydrogen concentration. For example, an event that rapidly generates hydrogen from zirconium metal water reaction could result in excessive hydrogen in primary containment, but oxygen concentration will remain < 5.0 v/o and no combustion can occur. This LCO ensures that oxygen concentration does not exceed 4.0 v/o during operation in the applicable conditions. APPLICABLE The Reference 1 calculations assume that the primary containment is SAFETY ANALYSES inerted when a Design Basis Accident (DBA) loss of coolant accident occurs. Thus, the hydrogen assumed to be released to the primary containment as a result of metal water reaction in the reactor core will not produce combustible gas mixtures in the primary containment. Primary containment oxygen concentration satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 2). LCO The primary containment oxygen concentration is maintained < 4.0 v/o to ensure that an event that produces any amount of hydrogen and oxygen does not result in a combustible mixture inside primary containment. APPLICABILITY The primary containment oxygen concentration must be within the specified limit when primary containment is inerted, except as allowed by the relaxations during startup and shutdown addressed below. The primary containment must be inert in MODE 1, since this is the condition with the highest probability of an event that could produce hydrogen and oxygen. Inerting the primary containment is an operational problem because it prevents containment access without an appropriate breathing apparatus. Therefore, the primary containment is inerted as late as possible in the plant startup and de-inerted as soon as possible during a scheduled power reduction to 15% RTP. As long as reactor power is 15% RTP, the potential for an event that generates significant hydrogen and oxygen the potential for an event that generates significant hydrogen and oxygen is low and the primary containment need not be inert. Furthermore, the probability of an event that generates hydrogen occurring within the first (continued) Brunswick Unit 2 B 3.6.3.1-1 Revision No. 64

Primary Containment Oxygen Concentration B 3.6.3.1 BASES APPLICABILITY 24 hours of a startup, or within the last 24 hours before a scheduled (continued) power reduction 15% RTP, is low enough that these "windows," when the primary containment is not inerted, are also justified. The 24 hour time period is a reasonable amount of time to allow plant personnel to perform inerting or de-inerting. ACTIONS A.1 If oxygen concentration is 4.0 v/o at any time while operating in MODE 1, with the exception of the relaxations allowed during startup and shutdown, oxygen concentration must be restored to < 4.0 v/o within 24 hours. The 24 hour Completion Time is allowed when oxygen concentration is 4.0 v/o because of the availability of other hydrogen and oxygen mitigating systems and the low probability and long duration of an event that would generate significant amounts of hydrogen and oxygen occurring during this period. B.1 If oxygen concentration cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, power must be reduced to 15% RTP within 8 hours. The 8 hour Completion Time is reasonable, based on operating experience, to reduce reactor power from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR 3.6.3.1.1 REQUIREMENTS The primary containment must be determined to be inerted by verifying that oxygen concentration is < 4.0 v/o. The 7 day Frequency is based on the slow rate at which oxygen concentration can change and on other indications of abnormal conditions (which would lead to more frequent checking by operators in accordance with plant procedures). Also, this Frequency has been shown to be acceptable through operating experience. REFERENCES 1. UFSAR, Section 6.2.5.

2. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.6.3.1-2 Revision No. 64

CAD System B 3.6.3.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.3.2 Containment Atmosphere Dilution (CAD) System The requirement for the CAD System is deleted. Brunswick Unit 2 B 3.6.3.2-1 Revision No. 64

Secondary Containment B 3.6.4.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.1 Secondary Containment BASES BACKGROUND The function of the secondary containment is to contain and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA). In conjunction with operation of the Standby Gas Treatment (SGT) System and closure of certain valves whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be OPERABLE, or that take place outside primary containment. The secondary containment is a structure that completely encloses the primary containment and those components that may be postulated to contain primary system fluid. This structure forms a control volume that serves to hold up the fission products. It is possible for the pressure in the control volume to rise relative to the environmental pressure. To prevent ground level exfiltration while allowing the secondary containment to be designed as a conventional structure, the secondary containment requires support systems to maintain the control volume pressure at less than the external pressure. Requirements for these systems are specified separately in LCO 3.6.4.2, "Secondary Containment Isolation Dampers (SCIDs)," and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System." APPLICABLE There are two principal accidents for which credit is taken for secondary SAFETY ANALYSES containment OPERABILITY. These are a loss of coolant accident (LOCA) (Refs. 1 and 2) and a fuel handling accident involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) inside secondary containment. The secondary containment performs no active function in response to each of these limiting events; however, its leak tightness is required to ensure that fission products entrapped within the secondary containment structure will be treated by the SGT System prior to discharge to the environment. (continued) Brunswick Unit 2 B 3.6.4.1-1 Revision No. 30

Secondary Containment B 3.6.4.1 BASES APPLICABLE Secondary containment satisfies Criterion 3 of10 CFR 50.36(c)(2)(ii) SAFETY ANALYSES (Ref. 4). (continued) LCO An OPERABLE secondary containment provides a control volume into which fission products that leak from primary containment, or are released from the reactor coolant pressure boundary components or irradiated fuel assemblies located in secondary containment, can be processed prior to release to the environment. For the secondary containment to be considered OPERABLE, it must have adequate leak tightness to ensure that the required vacuum can be established and maintained. APPLICABILITY In MODES 1, 2, and 3, a LOCA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, secondary containment OPERABILITY is required during the same operating conditions that require primary containment OPERABILITY. In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining secondary containment OPERABLE is not required in MODE 4 or 5 to ensure a control volume, except for other situations for which significant releases of radioactive material can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs) or during movement of recently irradiated fuel assemblies in the secondary containment. Due to radioactive decay, secondary containment is only required to be OPERABLE during fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours). ACTIONS A.1 If secondary containment is inoperable, it must be restored to OPERABLE status within 8 hours. The 8 hour Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during MODES 1, 2, (continued) Brunswick Unit 2 B 3.6.4.1-2 Revision No. 52

Secondary Containment B 3.6.4.1 BASES ACTIONS A.1 (continued) and 3. This time period also ensures that the probability of an accident (requiring secondary containment OPERABILITY) occurring during periods where secondary containment is inoperable is minimal. B.1 and B.2 If secondary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. C.1 and C.2 Movement of recently irradiated fuel assemblies in the secondary containment and OPDRVs can be postulated to cause significant fission product release to the secondary containment. In such cases, the secondary containment is the only barrier to release of fission products to the environment. Therefore, movement of recently irradiated fuel assemblies must be immediately suspended if the secondary containment is inoperable. Suspension of this activity shall not preclude completing an action that involves moving a component to a safe position. Also, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended. LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since recently irradiated fuel assembly movement can occur in MODE 1, 2, or 3, Required Action C.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel (continued) Brunswick Unit 2 B 3.6.4.1-3 Revision No. 30

Secondary Containment B 3.6.4.1 BASES ACTIONS C.1 and C.2 (continued) assemblies would not be a sufficient reason to require a reactor shutdown. SURVEILLANCE SR 3.6.4.1.1 and SR 3.6.4.1.2 REQUIREMENTS Verifying that secondary containment equipment hatches and one secondary containment access door in each access opening are closed ensures that the infiltration of outside air of such magnitude as to prevent maintaining the desired negative pressure does not occur. Verifying that all such openings are closed provides adequate assurance that exfiltration from the secondary containment will not occur. In this application, the term "sealed" has no connotation of leak tightness. Maintaining secondary containment OPERABILITY requires verifying one door in each access opening is closed. The 24 month Frequency for these SRs has been shown to be adequate, based on operating experience, and is considered adequate in view of other indications of door and hatch status that are available to the operator. SR 3.6.4.1.3 The SGT System exhausts the secondary containment atmosphere to the environment through appropriate treatment equipment. To ensure that fission products are treated, SR 3.6.4.1.3 verifies that the SGT System will establish and maintain a negative pressure in the secondary containment. This is confirmed by demonstrating that one SGT subsystem can maintain 0.25 inches of vacuum water gauge for 1 hour at a flow rate 3000 cfm. The 1 hour test period allows secondary containment to be in thermal equilibrium at steady state conditions. Therefore, this test is used to ensure secondary containment boundary integrity. Since this SR is a secondary containment test, it need not be performed with each SGT subsystem. The SGT subsystems are tested on a STAGGERED TEST BASIS, however, to ensure that in addition to the requirements of LCO 3.6.4.3, either SGT subsystem will perform this test. Operating experience has demonstrated these components will usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. (continued) Brunswick Unit 2 B 3.6.4.1-4 Revision No. 30

Secondary Containment B 3.6.4.1 BASES (continued) REFERENCES 1. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, September 1995.

2. UFSAR, Section 15.6.4.

3. Not used.

4. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.6.4.1-5 Revision No. 30

SCIDs B 3.6.4.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.2 Secondary Containment Isolation Dampers (SCIDs) BASES BACKGROUND The function of the SCIDs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Refs. 1, 2, and 3). Secondary containment isolation within the time limits specified for those isolation dampers designed to close automatically ensures that fission products that leak from primary containment following a DBA, or that are released during certain operations when primary containment is not required to be OPERABLE or take place outside primary containment, are maintained within the secondary containment boundary. The OPERABILITY requirements for SCIDs help ensure that an adequate secondary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. These isolation devices consist of active (automatic) devices. Automatic SCIDs close on a secondary containment isolation signal to establish a boundary for untreated radioactive material within secondary containment following a DBA or other accidents. APPLICABLE The SCIDs must be OPERABLE to ensure the secondary containment SAFETY ANALYSES barrier to fission product releases is established. The principal accidents for which the secondary containment boundary is required are a loss of coolant accident (Refs. 1 and 2) and a fuel handling accident involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) inside secondary containment. The secondary containment performs no active function in response to either of these limiting events, but the boundary established by SCIDs is required to ensure that leakage from the primary containment is processed by the Standby Gas Treatment (SGT) System before being released to the environment. (continued) Brunswick Unit 2 B 3.6.4.2-1 Revision No. 30

SCIDs B 3.6.4.2 BASES APPLICABLE Maintaining SCIDs OPERABLE with isolation times within limits ensures SAFETY ANALYSES that fission products will remain trapped inside secondary containment so (continued) that they can be treated by the SGT System prior to discharge to the environment. SCIDs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). LCO SCIDs form a part of the secondary containment boundary. The SCID safety function is related to control of offsite radiation releases resulting from DBAs. The isolation dampers are considered OPERABLE when their associated accumulators are pressurized, their isolation times are within limits, and the dampers are capable of actuating on an automatic isolation signal. The dampers covered by this LCO, along with their associated stroke times, are listed in Reference 5. APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to the primary containment that leaks to the secondary containment. Therefore, the OPERABILITY of SCIDs is required. In MODES 4 and 5, the probability and consequences of these events are reduced due to pressure and temperature limitations in these MODES. Therefore, maintaining SCIDs OPERABLE is not required in MODE 4 or 5, except for other situations under which significant radioactive releases can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs) or during movement of recently irradiated fuel assemblies in the secondary containment. Moving recently irradiated fuel assemblies in the secondary containment may also occur in MODES 1, 2, and 3. Due to radioactive decay, SCIDs are only required to be OPERABLE during fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours). ACTIONS The ACTIONS are modified by three Notes. The first Note allows penetration flow paths to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated operator, who (continued) Brunswick Unit 2 B 3.6.4.2-2 Revision No. 30

SCIDs B 3.6.4.2 BASES ACTIONS is in continuous communication with the control room, at the controls of (continued) the isolation device. In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated. The second Note provides clarification that for the purpose of this LCO separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SCID. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SCIDs are governed by subsequent Condition entry and application of associated Required Actions. The third Note ensures appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable SCID. A.1 and A.2 In the event that there are one or more penetration flow paths with one SCID inoperable, the affected penetration flow path(s) must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic SCID, a closed manual damper, and a blind flange. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available device to secondary containment. The Required Action must be completed within the 8 hour Completion Time. The specified time period is reasonable considering the time required to isolate the penetration, and the probability of a DBA, which requires the SCIDs to close, occurring during this short time is very low. For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that secondary containment penetrations required to be isolated following an accident, but no longer capable of being automatically isolated, will be in the isolation position should an event occur. The Completion Time of once (continued) Brunswick Unit 2 B 3.6.4.2-3 Revision No. 30

SCIDs B 3.6.4.2 BASES ACTIONS A.1 and A.2 (continued) per 92 days is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low. This Required Action does not require any testing or device manipulation. Rather, it involves verification that the affected penetration remains isolated. Required Action A.2 is modified by a Note that applies to devices located in high radiation areas and allows them to be verified closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low. B.1 With two SCIDs in one or more penetration flow paths inoperable, the affected penetration flow path must be isolated within 4 hours. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic damper, a closed manual damper, and a blind flange. The 4 hour Completion Time is reasonable considering the time required to isolate the penetration and the probability of a DBA, which requires the SCIDs to close, occurring during this short time, is very low. The Condition has been modified by a Note stating that Condition B is only applicable to penetration flow paths with two isolation dampers. This clarifies that only Condition A is entered if one SCID is inoperable in each of two penetrations. C.1 and C.2 If any Required Action and associated Completion Time cannot be met in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating (continued) Brunswick Unit 2 B 3.6.4.2-4 Revision No. 30

SCIDs B 3.6.4.2 BASES ACTIONS C.1 and C.2 (continued) experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. D.1 and D.2 If any Required Action and associated Completion Time are not met, the plant must be placed in a condition in which the LCO does not apply. If applicable, the movement of recently irradiated fuel assemblies in the secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be immediately initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until OPDRVs are suspended. LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since recently irradiated fuel assembly movement can occur in MODE 1, 2, or 3, Required Action D.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown. SURVEILLANCE SR 3.6.4.2.1 REQUIREMENTS Verifying that the isolation time of each automatic SCID is within limits, by cycling each SCID through one complete cycle of full travel and measuring the isolation time, is required to demonstrate OPERABILITY. The isolation time test ensures that the SCID will isolate in the required time period. The Frequency of this SR is once per 24 months. Operating experience has demonstrated these components will usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. (continued) Brunswick Unit 2 B 3.6.4.2-5 Revision No. 30

SCIDs B 3.6.4.2 BASES SURVEILLANCE SR 3.6.4.2.2 REQUIREMENTS (continued) Verifying that each automatic SCID closes on a secondary containment isolation signal is required to minimize leakage of radioactive material from secondary containment following a DBA or other accidents. This SR ensures that each automatic SCID will actuate to the isolation position on a secondary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.6.2, "Secondary Containment Isolation Instrumentation," overlaps this SR to provide complete testing of the safety function. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated these components will usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. REFERENCES 1. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, September 1995.

2. UFSAR, Section 15.6.4.

3. Not used.

4. 10 CFR 50.36(c)(2)(ii).

5. Technical Requirements Manual.

Brunswick Unit 2 B 3.6.4.2-6 Revision No. 30

SGT System B 3.6.4.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.3 Standby Gas Treatment (SGT) System BASES BACKGROUND The function of the SGT System is to ensure that the release of radioactive materials that leak from the primary containment into the secondary containment following a Design Basis Accident (DBA) is minimized by filtration and adsorption prior to exhausting to the environment. The SGT System consists of a suction duct, two parallel and independent filter trains with associated blowers, valves and controls, and a discharge vent. Each filter train consists of (components listed in order of the direction of the air flow):

a. A moisture separator;

b. An electric heater;

c. A prefilter;

d. A high efficiency particulate air (HEPA) filter;

e. Two in-line charcoal adsorber beds;

f. A second HEPA filter; and

g. A centrifugal fan.

The SGT System is designed to restore and maintain secondary containment at a negative pressure of at least 0.25 inches water gauge relative to the atmosphere following a secondary containment isolation signal. Maintaining this negative pressure is based on a SGT System flow rate of at least 3000 cfm. A secondary containment negative pressure of 0.25 inches water gauge minimizes the release of radioactivity from secondary containment by ensuring primary containment leakage is treated prior to release. The moisture separator is provided to remove entrained water in the air, while the electric heater reduces the relative humidity of the airstream to less than 70% (Ref. 1). The prefilter removes large particulate matter, while the HEPA filter removes fine particulate matter and protects (continued) Brunswick Unit 2 B 3.6.4.3-1 Revision No. 30

SGT System B 3.6.4.3 BASES BACKGROUND the charcoal from fouling. The charcoal adsorber beds remove gaseous (continued) elemental iodine and organic iodides, and the final HEPA filter collects any carbon fines exhausted from the charcoal adsorber. The SGT System automatically starts and operates in response to actuation signals indicative of conditions or an accident that could require operation of the system. Following an initiation signal, both SGT charcoal filter train fans start. APPLICABLE The design basis for the SGT System is to mitigate the consequences of SAFETY ANALYSES a loss of coolant accident and fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) (Refs. 2 and 3). For all events analyzed, the SGT System is shown to be automatically initiated to reduce, via filtration and adsorption, the radioactive material released to the environment. The SGT System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 5). LCO Following a DBA, a minimum of one SGT subsystem is required to maintain the secondary containment at a negative pressure with respect to the environment and to process gaseous releases. Meeting the LCO requirements for two OPERABLE subsystems ensures operation of at least one SGT subsystem in the event of a single active failure. APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, SGT System OPERABILITY is required during these MODES. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the SGT System in OPERABLE status is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as during operations with a potential for draining the reactor vessel (continued) Brunswick Unit 2 B 3.6.4.3-2 Revision No. 30

SGT System B 3.6.4.3 BASES APPLICABILITY (OPDRVs) or during movement of recently irradiated fuel assemblies in (continued) the secondary containment. Due to radioactive decay, the SGT System is only required to be OPERABLE during fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours). ACTIONS A.1 With one SGT subsystem inoperable in MODE 1, 2, or 3, the inoperable subsystem must be restored to OPERABLE status in 7 days. In this condition, the remaining OPERABLE SGT subsystem is adequate to perform the required radioactivity release control function. However, the overall system reliability is reduced because a single failure in the OPERABLE subsystem could result in the radioactivity release control function not being adequately performed. The 7 day Completion Time is based on consideration of such factors as the availability of the OPERABLE redundant SGT subsystem and the low probability of a DBA occurring during this period. B.1 and B.2 In MODE 1, 2, or 3, if one SGT subsystem cannot be restored to OPERABLE status within the required Completion Time or both SGT subsystems are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. C.1 With one SGT subsystem inoperable during movement of recently irradiated fuel assemblies in secondary containment, or during OPDRVs, the inoperable subsystem must be restored to OPERABLE status in 31 days. In this condition, the remaining OPERABLE SGT subsystem is adequate to perform the required radioactivity release control function. However, the overall system reliability is reduced because a single (continued) Brunswick Unit 2 B 3.6.4.3-3 Revision No. 30

SGT System B 3.6.4.3 BASES ACTIONS C.1 (continued) failure in the OPERABLE subsystem could result in the radioactivity release control function not being adequately performed. The 31 day Completion Time is based on consideration of such factors as the availability of the OPERABLE redundant SGT subsystem and the probability and consequences of an event requiring the radioactivity release control function during this period. D.1, D.2.1 and D.2.2 During movement of recently irradiated fuel assemblies, in the secondary containment or during OPDRVs, when Required Action C.1 cannot be completed within the required Completion Time, the OPERABLE SGT subsystem should immediately be placed in operation. This action ensures that the remaining subsystem is OPERABLE, that no failures that could prevent automatic actuation have occurred, and that any other failure would be readily detected. An alternative to Required Action D.1 is to immediately suspend activities that represent a potential for releasing a significant amount of radioactive material to the secondary containment, thus placing the plant in a condition that minimizes risk. If applicable, movement of recently irradiated fuel assemblies must immediately be suspended. Suspension of these activities must not preclude completion of movement of a component to a safe position. Also, if applicable, actions must immediately be initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended. LCO 3.0.3 is not applicable in MODE 4 or 5. However, since recently irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the Required Actions of Condition D have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel (continued) Brunswick Unit 2 B 3.6.4.3-4 Revision No. 30

SGT System B 3.6.4.3 BASES ACTIONS D.1, D.2.1 and D.2.2 (continued) assemblies would not be a sufficient reason to require a reactor shutdown. E.1 and E.2 When two SGT subsystems are inoperable, if applicable, movement of recently irradiated fuel assemblies in secondary containment must immediately be suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must immediately be initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended. LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since recently irradiated fuel assembly movement can occur in MODE 1, 2, or 3, Required Action E.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown. SURVEILLANCE SR 3.6.4.3.1 REQUIREMENTS Operating each SGT subsystem, by initiating (from the control room) flow through the HEPA filters and charcoal adsorbers, for 10 continuous hours ensures that both subsystems are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. Operation with the heaters on automatic control for 10 continuous hours every 31 days eliminates moisture on the adsorbers and HEPA filters. The 31 day Frequency was developed in consideration of the known reliability of fan motors and controls and the redundancy available in the system. (continued) Brunswick Unit 2 B 3.6.4.3-5 Revision No. 30

SGT System B 3.6.4.3 BASES SURVEILLANCE SR 3.6.4.3.2 REQUIREMENTS (continued) This SR verifies that the required SGT filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The SGT System filter tests are in accordance with Regulatory Guide 1.52 (Ref. 6), except as specified in Specification 5.5.7, "Ventilation Filter Testing Program (VFTP)". The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). It is noted that, per the basis provided by ESR 99-00055 (Ref. 7), system flow rate is determined using installed calibrated flow orifice plates. Specific test frequencies and additional information are discussed in detail in the VFTP. SR 3.6.4.3.3 This SR verifies that each SGT subsystem starts on receipt of an actual or simulated initiation signal. While this Surveillance can be performed with the reactor at power, operating experience has demonstrated that these components will usually pass the Surveillance when performed at the 24 month Frequency. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.6.2, "Secondary Containment Isolation Instrumentation," overlaps this SR to provide complete testing of the safety function. Therefore, the Frequency was found to be acceptable from a reliability standpoint. REFERENCES 1. UFSAR, Section 6.5.1.

2. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, September 1995.

3. UFSAR Section 15.6.4.

4. Not used.

5. 10 CFR 50.36(c)(2)(ii).

6. Regulatory Guide 1.52, Revision 1.

7. ESR 99-00055, SBGT and CBEAF Technical Specification Surveillance Flow Measurement.

Brunswick Unit 2 B 3.6.4.3-6 Revision No. 30

RHRSW System B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 Residual Heat Removal Service Water (RHRSW) System BASES BACKGROUND The RHRSW System is designed to provide cooling water for the Residual Heat Removal (RHR) System heat exchangers, required for a safe reactor shutdown following a Design Basis Accident (DBA) or transient. The RHRSW System is operated whenever the RHR heat exchangers are required to operate in the shutdown cooling mode or in the suppression pool cooling or spray mode of the RHR System. The RHRSW System consists of two independent and redundant subsystems. Each subsystem is made up of a header, two 4000 gpm pumps, a suction source, valves, piping, heat exchanger, and associated instrumentation. Either of the two subsystems is capable of providing the required cooling capacity with two pumps operating to maintain safe shutdown conditions. The suction headers to the two subsystems are separated from each other by a motor operated cross tie valve, so that failure of one subsystem will not affect the OPERABILITY of the other subsystem. The RHRSW System is designed with sufficient redundancy so that no single active component failure can prevent it from achieving its design function. The RHRSW System is described in UFSAR (Ref. 1). Cooling water is pumped by the RHRSW pumps from the intake canal via the Service Water (SW) System and the RHRSW header through the tube side of the RHR heat exchangers, and discharges to the circulating water discharge tunnel. A minimum flow line is not provided to the RHRSW pumps. The starting logic associated with each pump prevents starting the pump without the heat exchanger outlet valve open which prevents the pump from overheating due to pumping against a closed discharge valve. The system is initiated manually from the control room. If operating during a loss of coolant accident (LOCA), the system is automatically tripped to allow the diesel generators to automatically power only that equipment necessary to reflood the core. The system can be manually started any time the LOCA signal is manually overridden or clears. (continued) Brunswick Unit 2 B 3.7.1-1 Revision No. 30

RHRSW System B 3.7.1 BASES (continued) APPLICABLE The RHRSW System removes heat from the suppression pool to limit the SAFETY ANALYSES suppression pool temperature and primary containment pressure following a LOCA. This ensures that the primary containment can perform its function of limiting the release of radioactive materials to the environment following a LOCA. The ability of the RHRSW System to support long term cooling of the reactor or primary containment is discussed in Reference 2. These analyses explicitly assume that the RHRSW System will provide adequate cooling support to the equipment required for safe shutdown. These analyses include the evaluation of the long term primary containment response after a design basis LOCA. The safety analyses for long term cooling were performed for various combinations of RHR System failures. The worst case single failure that would affect the performance of the RHRSW System is any failure that would disable one subsystem of the RHRSW System. As discussed in the UFSAR (Ref. 2) for these analyses, manual initiation of the OPERABLE RHRSW subsystem and the associated RHR System is assumed to occur 10 minutes after a DBA. The RHRSW flow assumed in the analyses is 4500 gpm from two pumps operating in one loop. In this case, the maximum suppression chamber water temperature and pressure are 189.4°F and 14.0 psig, respectively, well below the design temperature of 220°F and maximum allowable pressure of 62 psig (Refs. 3 and 4). The RHRSW System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 5). LCO Two independent RHRSW subsystems are required to be OPERABLE to provide the required redundancy to ensure that the system functions to remove post accident heat loads, assuming the worst case single active failure occurs coincident with the loss of offsite power. An RHRSW subsystem is considered OPERABLE when:

a. Two pumps are OPERABLE; and

b. An OPERABLE flow path is capable of taking suction from the intake canal via the SW System and transferring the water through the RHR heat exchangers at the assumed flow rate. Additionally, the RHRSW cross tie valve (which allows the suction headers of (continued)

Brunswick Unit 2 B 3.7.1-2 Revision No. 30

RHRSW System B 3.7.1 BASES LCO the two RHRSW loops to be connected) must be available to (continued) provide the ability to isolate one subsystem from the other subsystem in the event of an RHRSW System suction line break. The RHRSW cross tie valve may be opened provided the cross tie valve is capable of being closed from the control room. The SW System must be capable of providing the proper RHRSW suction pressure for an RHRSW subsystem to be considered OPERABLE. The requirements for an adequate suction source are addressed in LCO 3.7.2, "Service Water (SW) System and Ultimate Heat Sink (UHS)". APPLICABILITY In MODES 1, 2, and 3, the RHRSW System is required to be OPERABLE to support the OPERABILITY of the RHR System for primary containment cooling (LCO 3.6.2.3, "Residual Heat Removal (RHR) Suppression Pool Cooling" and decay heat removal (LCO 3.4.7, "Residual Heat Removal (RHR) Shutdown Cooling SystemHot Shutdown"). The Applicability is therefore consistent with the requirements of these systems. In MODES 4 and 5, the OPERABILITY requirements of the RHRSW System are determined by the systems it supports. ACTIONS A.1 With one RHRSW pump inoperable, the inoperable pump must be restored to OPERABLE status within 14 days. With the unit in this condition, the remaining OPERABLE RHRSW pumps are adequate to perform the RHRSW heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced RHRSW capability. A risk based analysis was performed and determined that an allowable out of service time of 14 days (Ref. 6) is acceptable to permit restoration of an inoperable RHRSW pump to OPERABLE status. (continued) Brunswick Unit 2 B 3.7.1-3 Revision No. 39

RHRSW System B 3.7.1 BASES ACTIONS B.1 (continued) Required Action B.1 is intended to handle the inoperability of one RHRSW subsystem for reasons other than Condition A. The Completion Time of 7 days is allowed to restore the RHRSW subsystem to OPERABLE status. With the unit in this condition, the remaining OPERABLE RHRSW subsystem is adequate to perform the RHRSW heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE RHRSW subsystem could result in loss of RHRSW function. The 7 day Completion Time is based on the Completion Time provided for the RHR suppression pool cooling function, the redundant RHRSW capabilities afforded by the OPERABLE subsystem, and the low probability of an event occurring requiring RHRSW during this period. A Note to the Required Action indicates that the applicable Conditions of LCO 3.4.7, be entered and Required Actions taken if the inoperable RHRSW subsystem results in inoperable RHR shutdown cooling. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components. C.1 With both RHRSW subsystems inoperable (e.g., one or two RHRSW pumps inoperable in each subsystem), the RHRSW System is not capable of performing its intended function. At least one subsystem must be restored to OPERABLE status within 8 hours. The 8 hour Completion Time for restoring one RHRSW subsystem to OPERABLE status, is based on the Completion Time provided for the RHR suppression pool cooling function. The Required Action is modified by a Note indicating that the applicable Conditions of LCO 3.4.7, be entered and Required Actions taken if the inoperable RHRSW subsystem results in inoperable RHR shutdown cooling. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components. D.1 and D.2 If the RHRSW subsystems cannot be not restored to OPERABLE status within the associated Completion Times, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. (continued) Brunswick Unit 2 B 3.7.1-4 Revision No. 39

RHRSW System B 3.7.1 BASES (continued) SURVEILLANCE SR 3.7.1.1 REQUIREMENTS Verifying the correct alignment for each manual, power operated, and automatic valve in each RHRSW subsystem flow path provides assurance that the proper flow paths exist for RHRSW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position, and yet considered in the correct position, provided it can be realigned to its accident position. This is acceptable because the RHRSW System is a manually initiated system. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions. REFERENCES 1. UFSAR, Section 9.2.1.2.

2. UFSAR, Chapter 6.2.

3. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, September 1995; and Supplement 1, March 1996.

4. Letter BR5-96-074, Long Term Suppression Pool Temperature-Suppression Pool Cooling Mode for Long Term Containment Cooling, from M. E. Ball (GE) to R. E. Helme (CP&L),

September 19, 1996.

5. 10 CFR 50.36(c)(2)(ii).

6. GENE-B2100565-09, Technical Specification Improvements to the Emergency Core Cooling System for the Carolina Power and Light Brunswick Steam Electric Plant Units 1 and 2, Revision 1, October 1996.

Brunswick Unit 2 B 3.7.1-5 Revision No. 39

SW System and UHS B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Service Water (SW) System and Ultimate Heat Sink (UHS) BASES BACKGROUND The SW System is designed to provide cooling water for the removal of heat from equipment, such as the diesel generators (DGs), residual heat removal (RHR) pump seal coolers, room cooling units for Emergency Core Cooling System (ECCS) equipment, and residual heat removal service water (RHRSW) heat exchangers, required for a safe reactor shutdown following a Design Basis Accident (DBA) or transient. The SW System also provides cooling to unit components, as required, during normal operation. The SW System consists of four 8000 gpm site nuclear service water (NSW) pumps (two Unit 1 pumps and two Unit 2 pumps), three 8000 gpm unit conventional service water (CSW) pumps, a suction source, valves, piping, associated instrumentation, and two independent headers; the NSW header and the CSW header. The NSW header normally supplies cooling water to the Reactor Building Closed Cooling Water (RBCCW) System and the CSW header normally supplies cooling water to the Turbine Building Closed Cooling Water System. The NSW pumps are capable of supplying only the NSW header. However, each CSW pump can be manually aligned to the CSW header or the NSW header which provides additional operating flexibility. Upon receipt of a loss of offsite power (LOOP) signal, the inlet valves to the RBCCW heat exchangers associated with both units automatically close when power is available to isolate nonessential loads; the NSW pumps associated with both units automatically start immediately after power is restored; and cooling water is supplied to the DGs and the ECCS loads for each unit. Upon receipt of a unit loss of coolant accident (LOCA) signal (with or without a LOOP), the inlet valves to the RBCCW heat exchangers associated with the affected unit automatically close when power is available to isolate nonessential loads; the NSW pumps, associated with the unit receiving the LOCA signal, automatically start 5 seconds after power is restored (if the pumps are not already running); and cooling water is supplied to the DGs and the associated unit ECCS loads. Upon receipt of a LOCA or LOOP signal, the CSW pumps are assumed to trip and flow to the TBCCW heat exchangers stops. Operator action is not assumed to occur during the first 10 minutes after initiation of the event. After 10 minutes, (continued) Brunswick Unit 2 B 3.7.2-1 Revision No. 30

SW System and UHS B 3.7.2 BASES BACKGROUND operators are assumed to isolate flow to the TBCCW heat exchangers (continued) and align the CSW pumps, as necessary, to the required SW header and provide cooling to the ECCS loads or DGs. The Cape Fear River estuary is the UHS. Cooling water is supplied from the Cape Fear River estuary to both units via a common intake canal. Service water is discharged to a common discharge canal from each unit via separate circulating water discharge tunnels. At least two pumps (NSW and/or CSW pumps) are required to support long term cooling requirements. This includes the vital header, which supplies cooling water to the RHR pump seal coolers and ECCS room coolers, and the RHRSW header, which provides a suction source to the RHRSW pumps. If the NSW header is supplying the above, it will also be providing cooling for the Unit specific DGs. If the CSW header is providing long term cooling, the NSW header with one NSW pump will provide DG cooling. Although both unit NSW headers are expected to be available for all single active failures, it has been shown that one site NSW pump (a Unit 1 or Unit 2 NSW pump) is capable of providing the required cooling capacity to support all four DGs (Refs. 1 and 2). Cooling water is pumped from the intake canal by the SW pumps to the vital and RHRSW headers through either the CSW or NSW headers. After removing heat from the components, the water is discharged to the circulating water discharge tunnel. The vital and RHRSW headers can be aligned, using remotely operated valves, in configurations where cooling water is supplied by the NSW header alone, the CSW header alone, or a combination of the NSW and CSW headers such that each header serves only one safety related division. The normal cooling water supply for two of the four DGs is provided by the Unit 1 NSW header and the normal cooling water supply for the remaining two DGs is provided by the Unit 2 NSW header. If a low SW supply pressure is sensed at a DG after the DG starts, an automatic transfer is initiated after a time delay which causes the alternate cooling water supply valve for the affected DG(s) to open and the normal cooling water supply valve to close thereby providing a cooling water flow path from the opposite unit's NSW header to the affected DG(s). APPLICABLE The ability of the SW System to support long term cooling of the reactor SAFETY ANALYSES containment is assumed in evaluations of the equipment required for safe reactor shutdown presented in the UFSAR, Chapter 6 (Ref. 3). These (continued) Brunswick Unit 2 B 3.7.2-2 Revision No. 58

SW System and UHS B 3.7.2 BASES APPLICABLE analyses include the evaluation of the long term primary containment SAFETY ANALYSES response after a design basis LOCA. (continued) The ability of the SW System to provide adequate cooling to the identified safety equipment is an implicit assumption for the safety analyses evaluated in References 1 and 2. During the first 10 minutes of a design basis LOCA, the ability to provide onsite emergency AC power is dependent on the ability of the SW System to cool the DGs. Ten minutes following a LOCA, the long term cooling capability of the RHR, core spray, and RHRSW subsystems is dependent on the cooling provided by the SW System. The SW System, together with the UHS, satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). LCO In the event of a DBA, the NSW header and associated components are adequate to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. However, the CSW header and associated components are required to ensure maximum reliability in the event of a single failure. To ensure this requirement is met, the appropriate equipment to supply the unit NSW and CSW headers must be OPERABLE. In addition, at least three site NSW pumps are required to ensure adequate NSW pump redundancy is available to ensure cooling to the DGs in the event of an active single failure. The SW System is considered OPERABLE when it has two OPERABLE CSW pumps (specifically the CSW 2A and CSW 2C pumps), three site NSW pumps (any combination of Unit 1 and Unit 2 NSW pumps), and an OPERABLE flow path capable of taking suction from the intake structure and transferring the water to the ECCS equipment and the DGs. In addition, for a site NSW pump to be considered OPERABLE, it must be capable of supplying its associated unit NSW header. For a CSW pump to be considered OPERABLE, it must be capable of supplying the CSW header and the NSW header. The CSW 2A and CSW 2C pumps must be OPERABLE to ensure that two pumps can supply the CSW header with one specific postulated single failure, Loss of Division II power. This failure disables both the flow path from the NSW header to the RHRSW pumps and it disables the CSW 2B pump. The OPERABILITY of the UHS is based on having a minimum water level in the pump well of the intake structure of -6 ft mean sea level and a maximum UHS 24-hour average water temperature of 90.5°F with the maximum UHS actual water temperature not to exceed 92°F. (continued) Brunswick Unit 2 B 3.7.2-3 Revision No. 58

SW System and UHS B 3.7.2 BASES LCO The isolation of the SW System to components or systems may render (continued) those components or systems inoperable, but does not affect the OPERABILITY of the SW System. APPLICABILITY In MODES 1, 2, and 3, the SW System and UHS are required to be OPERABLE to support OPERABILITY of the equipment serviced by the SW System. Therefore, the SW System and UHS are required to be OPERABLE in these MODES. In MODES 4 and 5, the OPERABILITY requirements of the SW System and UHS are determined by the systems they support. ACTIONS A.1 The normal cooling water supply for two DGs and the alternate cooling water supply for two DGs are provided by the opposite unit NSW pumps via the associated NSW header. Therefore, this Required Action provides a 14 day period to perform maintenance on the opposite unit NSW header and associated NSW pumps. This is acceptable because performing maintenance on the opposite unit NSW header and NSW pumps will increase the reliability of the DGs cooling water supply. However, if this condition results in two required site NSW pumps being incapable of providing cooling water to the DGs, Condition I is entered. The 14 day Completion Time takes into account the capacity and capability of the remaining NSW pumps to supply cooling to all four DGs and a reasonable time for performance of maintenance. The Note to Condition A only allows the 14 day Completion Time to apply when the opposite unit is in MODE 4 or 5. When a required NSW pump becomes inoperable or incapable of providing cooling water to the DGs while Unit 1 is in MODE 1, 2, or 3, Condition B or I of Unit 2 Specification 3.7.2 must be entered, as applicable, and the associated Required Action(s) performed. Pursuant to LCO 3.0.6, the AC SourcesOperating ACTIONS would not be entered even if cooling capability were lost to the DGs, resulting in one or more inoperable DGs. Therefore, Required Action A.1 is modified by a Note to indicate that when Condition A is entered and NSW cooling (continued) Brunswick Unit 2 B 3.7.2-4 Revision No. 30

SW System and UHS B 3.7.2 BASES ACTIONS A.1 (continued) capability is unavailable to one or more DGs, ACTIONS for LCO 3.8.1, "AC SourcesOperating," must be immediately entered. This allows Condition A to provide requirements for an inoperable NSW pump without regard to whether a cooling water supply is available to the DGs. LCO 3.8.1 provides the appropriate restrictions for one or more inoperable DGs. B.1 With one required NSW pump inoperable for reasons other than Condition A, one inoperable pump must be restored to OPERABLE status within 7 days and 14 days from discovery of failure to meet the LCO. With the unit in this condition, the remaining OPERABLE NSW and CSW pumps are adequate to perform the SW heat removal function. However, the overall reliability is reduced. The 7 day Completion Time is based on the remaining SW heat removal capability, a reasonable time for repairs, and the low probability of an event occurring during this time period requiring the SW System. The second Completion Time for Required Action B.1 establishes a limit on the maximum time allowed for any combination of required NSW and CSW pumps to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, a required CSW pump is inoperable, and that CSW pump is subsequently returned OPERABLE, the LCO may already have been not met for up to 7 days. This situation could lead to a total of 14 days, since initial failure to meet the LCO, to restore the NSW pump. At this time, a required CSW pump could again become inoperable, the NSW pump restored OPERABLE, and an additional 7 days (for a total of 21 days) allowed prior to complete restoration of the LCO. The 14 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions B and C or Conditions B and D are entered concurrently. The "AND" connector between the 7 day and the 14 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met. (continued) Brunswick Unit 2 B 3.7.2-5 Revision No. 30

SW System and UHS B 3.7.2 BASES ACTIONS B.1 (continued) The second Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This exception results in establishing the "time zero" at the time LCO 3.7.2 was initially not met, instead of at the time that Condition B was entered. Pursuant to LCO 3.0.6, the AC SourcesOperating ACTIONS would not be entered even if cooling capability were lost to the DGs, resulting in one or more inoperable DGs. Therefore, Required Action B.1 is modified by a Note to indicate that when Condition B is entered and NSW cooling capability is unavailable to one or more DGs, ACTIONS for LCO 3.8.1, "AC SourcesOperating," must be immediately entered. This allows Condition B to provide requirements for an inoperable NSW pump without regard to whether a cooling water supply is available to the DGs. LCO 3.8.1 provides the appropriate restrictions for one or more inoperable DGs. C.1 and C.2 With one required CSW pump inoperable, the inoperable pump must be restored to OPERABLE status within 7 days and 14 days from discovery of failure to meet the LCO. With the unit in this condition, the OPERABLE CSW pump and NSW pumps are adequate to perform the heat removal function. However, the overall reliability is reduced. The 7 day Completion Time is based on the availability of two Unit 2 SW pumps (an OPERABLE CSW pump and an OPERABLE Unit 2 NSW pump), each powered from separate 4.16 kV emergency buses, to support the unit's service water loads. Immediate verification that the OPERABLE CSW pump and one OPERABLE Unit 2 NSW pump are powered from separate emergency buses is therefore required when one required CSW pump is inoperable. If the OPERABLE CSW pump and one Unit 2 NSW pump can not be immediately verified to be powered from separate 4.16 kV emergency buses, Condition D must be immediately entered. The 7 day Completion Time is based on the remaining SW heat removal capability, a reasonable time for repairs, and the low probability of an event occurring during this time period requiring the SW System. (continued) Brunswick Unit 2 B 3.7.2-6 Revision No. 30

SW System and UHS B 3.7.2 BASES ACTIONS C.1 and C.2 (continued) The second Completion Time for Required Action C.1 establishes a limit on the maximum time allowed for any combination of required NSW and CSW pumps to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition C is entered while, for instance, a required NSW pump is inoperable, and that NSW pump is subsequently returned OPERABLE, the LCO may already have been not met for up to 7 days. This situation could lead to a total of 14 days, since initial failure to meet the LCO, to restore the CSW pump. At this time, a required NSW pump could again become inoperable, the CSW pump restored OPERABLE, and an additional 7 days (for a total of 21 days) allowed prior to complete restoration of the LCO. The 14 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions B and C are entered concurrently. The "AND" connector between the 7 day and the 14 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met. The second Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This exception results in establishing the "time zero" at the time LCO 3.7.2 was initially not met, instead of at the time that Condition C was entered. D.1 If Required Action C.1 cannot be completed within the associated Completion Time or if the status of the Unit 2 SW pumps changes after Required Action C.1 is initially met, one required CSW pump must be restored to OPERABLE status within 72 hours. With the unit in this condition, the OPERABLE SW pumps are adequate to perform the heat removal function. However, overall reliability is reduced as compared to Condition C and a reduced Completion Time of 72 hours is provided. The 72 hour Completion Time is based on the remaining SW System heat removal capability, a reasonable time for repairs, and the low probability of an event occurring during the time period requiring the SW System. (continued) Brunswick Unit 2 B 3.7.2-7 Revision No. 30

SW System and UHS B 3.7.2 BASES ACTIONS E.1 (continued) With two required CSW pumps inoperable, the one required inoperable pump must be restored to OPERABLE status within 72 hours and 14 days from discovery of failure to meet the LCO. With the unit in this condition, the OPERABLE NSW pumps are adequate to perform the heat removal function. The 72 hour Completion Time is based on the availability of the remaining NSW pumps to support the unit's service water loads. The 72 hour Completion Time is based on the remaining SW System heat removal capability, a reasonable time for repairs, and the low probability of an event occurring during this time period requiring the SW System. The second Completion Time for Required Action E.1 establishes a limit on the maximum time allowed for any combination of required NSW and CSW pumps to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition E is entered while, for instance, a required NSW pump is inoperable, and that NSW pump is subsequently returned OPERABLE, the LCO may already have been not met for up to 7 days. This situation could lead to a total of 14 days, since initial failure to meet the LCO, to restore the CSW pump. At this time, a required NSW pump could again become inoperable, the CSW pump restored OPERABLE, and an additional 7 days (for a total of 21 days) allowed prior to complete restoration of the LCO. The 14 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions B and E are entered concurrently. The "AND" connector between the 7 day and the 14 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met. The second Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This exception results in establishing the "time zero" at the time LCO 3.7.2 was initially not met, instead of at the time that Condition E was entered. Pursuant to LCO 3.0.6, the RHRSW ACTIONS would not be entered even if cooling capability were lost to the RHRSW heat exchangers, resulting in one or more inoperable RHRSW subsystems. Therefore, Required (continued) Brunswick Unit 2 B 3.7.2-8 Revision No. 30

SW System and UHS B 3.7.2 BASES ACTIONS E.1 (continued) Action E.1 is modified by a Note to indicate that when Condition E is entered and cooling capability is unavailable to one or more RHRSW subsystems, ACTIONS for LCO 3.7.1, "Residual Heat Removal Service Water (RHRSW) System," must be immediately entered. This allows Condition E to provide requirements for one or more required inoperable CSW pumps without regard to whether a cooling water supply is available to the RHRSW heat exchangers. LCO 3.7.1 provides the appropriate restrictions for one or more inoperable RHRSW subsystems. F.1 and F.2 If one required CSW pump and one required NSW pump are concurrently inoperable, one of the inoperable pumps must be restored to OPERABLE status within 72 hours. With the unit in this condition, the OPERABLE SW pumps are adequate to perform the heat removal function. The 72 hour Completion Time is based on the remaining SW System heat removal capability, a reasonable time for repairs, and the low probability of an event occurring during this time period requiring the SW System. G.1, G.2.1, and G.2.2 If two required CSW pumps are inoperable concurrent with one required NSW pump inoperable and both Unit 2 NSW pumps are verified OPERABLE, one of the required CSW pumps must be restored to OPERABLE status within 72 hours or the required NSW pump must be returned to OPERABLE status within 72 hours. Since loss of the two required CSW pumps and one required NSW pump could result in a loss of cooling capability to the vital and RHRSW headers, immediate verification that two Unit 2 NSW pumps are OPERABLE is required to ensure cooling capability to the vital and RHRSW headers is maintained. This may be performed as an administrative check by examining logs or other information to determine if one or both Unit 2 NSW pumps are out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate the OPERABILITY of the NSW (continued) Brunswick Unit 2 B 3.7.2-9 Revision No. 30

SW System and UHS B 3.7.2 BASES ACTIONS G.1, G.2.1, and G.2.2 (continued) pumps. However, if the OPERABILITY of both Unit 2 NSW pumps cannot be verified, cooling capability to the ECCS loads cannot be assured. As such, Condition I must be immediately entered. With two required CSW pumps inoperable concurrent with one required NSW pump inoperable and both Unit 2 NSW pumps are OPERABLE, adequate heat removal capability is ensured by the OPERABILITY of the remaining OPERABLE SW pumps. However, the overall SW System reliability is significantly reduced because of the reduction in SW pump redundancy and operational diversity such that the SW System may not be able to perform its required support function. Therefore, a more restrictive Completion Time of 72 hours is required to restore at least one required CSW pump or the required NSW pump to OPERABLE status. H.1 With water temperature of the UHS > 90.5°F and 92°F, the design basis assumption associated with initial UHS temperature are bounded provided the temperature of the UHS averaged over the previous 24 hour period is 90.5°F. With the water temperature of the UHS > 90.5°F, long term cooling capability of the ECCS loads and DGs may be affected. Therefore, to ensure long term cooling capability is provided to the ECCS loads when water temperature of the UHS is > 90.5°F, Required Action H.1 is provided to more frequently monitor the water temperature of the UHS and verify the temperature is 90.5°F when averaged over the previous 24 hour period. The once per hour Completion Time takes into consideration UHS temperature variations and the increased monitoring frequency needed to ensure design basis assumptions are not exceeded in this condition. If the water temperature of the UHS exceeds 90.5°F when averaged over the previous 24 hour period or the water temperature of the UHS exceeds 92°F, Condition I must be entered immediately. (continued) Brunswick Unit 2 B 3.7.2-10 Revision No. 30

SW System and UHS B 3.7.2 BASES ACTIONS I.1 and I.2 (continued) If Required Actions cannot be completed within the associated Completion Time of Condition A, B, D, E, F, G, and H; Required Action C.2 cannot be completed within the associated Completion Time; two or more required NSW pumps are inoperable; the SW System is inoperable for reasons other than Conditions A, B, C, D, E, F, and G; or the UHS is inoperable for reasons other than Condition H (e.g., low water level); the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies the water level in the SW pump suction bay of the intake structure to be sufficient for the proper operation of the SW pumps (net positive suction head and pump vortexing are considered in determining this limit). This SR may be accomplished by measuring intake canal water level provided the deviation in water level between the intake canal and the pump suction bay due to the differential pressure of the traveling screens is taken into account. The 24 hour Frequency is based on operating experience related to trending of the parameter variations during the applicable MODES. SR 3.7.2.2 Verification of the UHS temperature ensures that the heat removal capability of the SW System is within the assumptions of the DBA analysis. The 24 hour Frequency is based on operating experience related to trending of the parameter variations during the applicable MODES. (continued) Brunswick Unit 2 B 3.7.2-11 Revision No. 30

SW System and UHS B 3.7.2 BASES SURVEILLANCE SR 3.7.2.3 REQUIREMENTS (continued) Verifying the correct alignment for each manual, power operated, and automatic valve in the SW System flow paths provide assurance that the proper flow paths will exist for SW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position, and yet considered in the correct position, provided it can be automatically realigned to its accident position within the required time. This SR does not require testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR is modified by a Note indicating that isolation of the SW System to components or systems may render those components or systems inoperable, but does not affect the OPERABILITY of the SW System. As such, when all SW pumps, valves, and piping are OPERABLE, but a branch connection off the NSW or CSW header is isolated, the SW System is still OPERABLE. The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions. SR 3.7.2.4 The dominant contributor to a loss of DG cooling is a failure of the normal and alternate cooling water supply valves to open on demand from their normally closed position. As a result, since only three site NSW pumps are required to be OPERABLE, the capability to automatically transfer the cooling water supply to the DG jacket water coolers from the NSW header of one unit to the NSW header of the opposite unit is necessary to meet single failure criteria. (continued) Brunswick Unit 2 B 3.7.2-12 Revision No. 30

SW System and UHS B 3.7.2 BASES SURVEILLANCE SR 3.7.2.4 (continued) REQUIREMENTS The 92 day Frequency was chosen to provide additional assurance that the capability to provide cooling water to each DG under accident conditions is maintained. The 92 day Frequency is consistent with the Inservice Testing Program Frequency for testing of valves. To minimize testing of the cooling water supply valves to each DG, Note 1 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. Note 2 indicates that isolation of the SW System to a DG renders the DG inoperable but does not affect the OPERABILITY of the SW System. As such, if the automatic transfer of the cooling water supply valves associated with a DG fails this Surveillance, the DG should be considered inoperable. However, the SW System is still OPERABLE. It is not necessary to declare the DG inoperable if the service water supply valves to the affected DG are administratively controlled to ensure cooling water is supplied to the DG and two NSW pumps are operable on the corresponding NSW header that the DG is aligned to. This ensures that a single active failure will not result in more than one DG not receiving cooling water (Ref. 5). SR 3.7.2.5 This SR verifies that the automatic isolation valves of the SW System will automatically align to the safety or emergency position to provide cooling water exclusively to the safety related equipment during an accident event. This is demonstrated by the use of an actual or simulated initiation signal. This SR also verifies the automatic start capability of the required NSW pumps. Operating experience has demonstrated that these components will usually pass the SR when performed at the 24 month Frequency. Therefore, this Frequency is concluded to be acceptable from a reliability standpoint. (continued) Brunswick Unit 2 B 3.7.2-13 Revision No. 30

SW System and UHS B 3.7.2 BASES SURVEILLANCE SR 3.7.2.5 (continued) REQUIREMENTS A Note indicates that the isolation of the SW System to individual components (e.g., an RBCCW heat exchanger) does not affect the OPERABILITY of the SW System. Isolation of SW System flow to an individual component must be performed such that an active component failure will not result in diverting SW System flow from the safety related components. REFERENCES 1. BNP Calculation G0050A-10, BSEP Unit No. 1 Service Water System Hydraulic Analysis.

2. BNP Calculation G0050A-12, BSEP Unit No. 2 Service Water System Hydraulic Analysis.

3. UFSAR, Chapter 6.2.

4. 10 CFR 50.36(c)(2)(ii).

5. TRM 3.16.

Brunswick Unit 2 B 3.7.2-14 Revision No. 58

CREV System B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 Control Room Emergency Ventilation (CREV) System BASES BACKGROUND The CREV System provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals, or smoke. The safety related function of the CREV System is the radiation protection portion of the radiation/smoke protection mode and includes two redundant high efficiency air filtration subsystems for emergency treatment of recirculated air or outside supply air and a control room envelope (CRE) boundary that limits the inleakage of unfiltered air. Each CREV subsystem consists of a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber bank, an emergency recirculation fan, and the associated ductwork, valves or dampers, doors, barriers, and instrumentation. HEPA filters remove particulate matter, which may be radioactive. The charcoal adsorber banks provide a holdup period for gaseous iodine, allowing time for decay. The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations, and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program. The CREV System is a standby system that is common to both Unit 1 and Unit 2, parts of which also operate during normal unit operations to maintain the CRE environment. The two CREV subsystems must be OPERABLE if conditions requiring CREV System OPERABILITY exist in either Unit 1 or Unit 2. Upon receipt of the initiation signal(s) (indicative of conditions that could result in radiation exposure to CRE occupants), the CREV System automatically switches to the radiation/smoke protection mode of operation to minimize infiltration of contaminated air into the CRE. A system of dampers isolates the CRE, and a part of the recirculated air is routed through either of the two filter subsystems. Outside air is taken in at the normal ventilation intake and is mixed with the recirculated air before being passed through one of the CREV subsystems for removal of airborne radioactive particles. (continued) Brunswick Unit 2 B 3.7.3-1 Revision No. 61

CREV System B 3.7.3 BASES BACKGROUND The CREV System is designed to maintain a habitable environment in the (continued) CRE for a 30 day continuous occupancy after a DBA without exceeding 5 rem total effective dose equivalent (TEDE). A single CREV subsystem operating at a flow rate of 2200 cfm will slightly pressurize the CRE relative to outside atmosphere to minimize infiltration of air from surrounding areas adjacent to the CRE boundary. CREV System operation in maintaining CRE habitability is discussed in the UFSAR, Sections 6.4 and 9.4, (Refs. 1 and 2, respectively). APPLICABLE The ability of the CREV System to maintain the habitability of the CRE SAFETY ANALYSES is an explicit assumption for the design basis accident presented in the UFSAR (Ref. 3). The radiation/smoke protection mode of the CREV System is assumed (explicitly or implicitly) to operate following a DBA. The radiological doses to the CRE occupants as a result of a DBA are summarized in Reference 3. Postulated single active failures that may cause the loss of outside or recirculated air from the CRE are bounded by BNP radiological dose calculations for CRE occupants. The CREV System provides protection from smoke and hazardous chemicals to the CRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release (Ref. 1). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the CRE occupants to control the reactor either from the control room or from the remote shutdown panels (Ref. 2). The CREV System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). LCO Two redundant subsystems of the CREV System are required to be OPERABLE to ensure that at least one is available if a single active failure disables the other subsystem. Total CREV System failure, such as from a loss of both ventilation subsystems or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem TEDE to the CRE occupants in the event of a DBA if unfiltered leakage into the CRE is

                > 2,000 cfm.

Each CREV subsystem is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE. A subsystem is considered OPERABLE when its associated:

a. Emergency recirculation fan is OPERABLE;

b. HEPA filter and charcoal adsorber bank are not excessively restricting flow and are capable of performing their filtration and adsorption functions; and (continued)

Brunswick Unit 2 B 3.7.3-2 Revision No. 61

CREV System B 3.7.3 BASES LCO c. Ductwork, valves, and dampers are OPERABLE, and air (continued) circulation can be maintained. Also, two control room supply fans must be OPERABLE to ensure single failure criteria can be met. In order for the CREV subsystems to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke. The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls. This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated. APPLICABILITY In MODES 1, 2, and 3, the CREV System must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA, since the DBA could lead to a fission product release. In MODES 4 and 5, the probability and consequences of a DBA are reduced because of the pressure and temperature limitations in these MODES. Therefore, maintaining the CREV System OPERABLE is not required in MODE 4 or 5, except for the following situations under which significant radioactive releases can be postulated:

a. During movement of irradiated fuel assemblies in the secondary containment;

b. During CORE ALTERATIONS; and

c. During operations with a potential for draining the reactor vessel (OPDRVs).

(continued) Brunswick Unit 2 B 3.7.3-3 Revision No. 61

CREV System B 3.7.3 BASES ACTIONS A.1 With one CREV subsystem inoperable, for reasons other than an inoperable CRE boundary, the inoperable CREV subsystem must be restored to OPERABLE status within 7 days. With the unit in this condition, the remaining OPERABLE CREV subsystem is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE subsystem could result in loss of the CREV System function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and that the remaining subsystem can provide the required capabilities. B.1, B.2, and B.3 If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (regulatory limit of 5 rem TEDE maximum), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days. During the period that the CRE boundary is considered to be inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verity that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within the analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary. (continued) Brunswick Unit 2 B 3.7.3-4 Revision No. 61

CREV System B 3.7.3 BASES ACTIONS C.1 and C.2 (continued) In MODE 1, 2, or 3, if any Required Action and required Completion Time of Condition A or B cannot be met or two CREV subsystems are inoperable for reasons other than Condition B, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. D.1, D.2.1, D.2.2, and D.2.3 The Required Actions of Condition D are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown. During movement of irradiated fuel assemblies in the secondary containment, during CORE ALTERATIONS, or during OPDRVs, if the inoperable CREV subsystem cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE CREV subsystem may be placed in the radiation/smoke protection mode. This action ensures that the remaining subsystem is OPERABLE, that no failures that would prevent automatic actuation will occur, and that any active failure will be readily detected. An alternative to Required Action D.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk. If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended. (continued) Brunswick Unit 2 B 3.7.3-5 Revision No. 61

CREV System B 3.7.3 BASES (continued) ACTIONS E.1, E.2, and E.3 (continued) The Required Actions of Condition E are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown. During movement of irradiated fuel assemblies in the secondary containment, during CORE ALTERATIONS, or during OPDRVs, with two CREV subsystems inoperable or with one or more CREV subsystems inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that present a potential for releasing radioactivity that might require isolation of the CRE. These actions place the unit in a condition that minimizes the accident risk. If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended. SURVEILLANCE SR 3.7.3.1 REQUIREMENTS This SR verifies that each CREV subsystem in a standby mode starts on demand and continues to operate. This SR includes initiating flow through the associated HEPA filter and charcoal adsorber bank. Standby systems should be checked periodically to ensure that they start and function properly. As the environmental and normal operating conditions of this system are not severe, testing each subsystem once every 31 days provides an adequate check on this system. Since the CREV subsystems do not have installed heaters, each subsystem need only be operated for 15 minutes to demonstrate the function of the subsystem. The 31 day Frequency is based on the known reliability of the equipment and the two subsystem redundancy available. (continued) Brunswick Unit 2 B 3.7.3-6 Revision No. 61

CREV System B 3.7.3 BASES SURVEILLANCE SR 3.7.3.2 REQUIREMENTS (continued) This SR verifies that the required CREV testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). It is noted that, per the basis provided by ESR 99-00055 (Ref. 5), system flow rate is determined using installed calibrated flow orifice plates. Specific test Frequencies and additional information are discussed in detail in Specification 5.5.7, "Ventilation Filter Testing Program (VFTP)." SR 3.7.3.3 This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program. The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem whole body or its equivalent to any part of the body and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered. Required Action B.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref. 6) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref 7). These compensatory measures may also be used as mitigating actions as required by Required Action B.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 8). Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status. (continued) Brunswick Unit 2 B 3.7.3-7 Revision No. 61

CREV System B 3.7.3 BASES SURVEILLANCE SR 3.7.3.4 REQUIREMENTS (continued) This SR verifies that on an actual or simulated initiation signal, each CREV subsystem starts and operates. This SR includes ensuring outside air flow is diverted to the HEPA filter and charcoal adsorber bank of each CREV subsystem. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.7.1 overlaps this SR to provide complete testing of the safety function. Operating experience has demonstrated that the components will usually pass the SR when performed at the 24 month Frequency. Therefore, the Frequency was found to be acceptable from a reliability standpoint. REFERENCES 1. UFSAR, Section 6.4.

2. UFSAR, Section 9.4.

3. UFSAR, Section 6.4.4.1.

4. 10 CFR 50.36(c)(2)(ii).

5. ESR 99-00055, SBGT and CBEAF Technical Specification Surveillance Flow Measurement.

6. Regulatory Guide 1.196

7. NEI 99-03, "Control Room Habitability Assessment," June 2001.

8. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." (ADAMS Accession No. ML040300694).

Brunswick Unit 2 B 3.7.3-8 Revision No. 61

Control Room AC System B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Control Room Air Conditioning (AC) System BASES BACKGROUND The Control Room AC portion of the Control Building Heating, Ventilation, and Air Conditioning System (hereinafter referred to as the Control Room AC System) provides temperature and humidity control for the control room during normal and accident conditions. The Control Room AC System consists of three 50% capacity subsystems that provide cooling of recirculated control room air and outside air. Each manually controlled subsystem consists of a heating coil, a cooling coil, a supply fan, a compressor-condenser unit, ductwork, dampers, and instrumentation and controls to provide for control room temperature control. The Control Room AC System is designed to provide a controlled environment under both normal and accident conditions. Two of the three subsystems provide the required temperature control to maintain a suitable control room environment for a sustained occupancy of 30 persons. The normal design conditions for the control room environment are 75°F and 50% relative humidity. The Control Room AC System operation in maintaining the control room temperature is discussed in the UFSAR, Section 6.4.2 (Ref. 1). APPLICABLE The design basis of the Control Room AC System is to maintain the SAFETY ANALYSES control room temperature for a 30 day continuous occupancy following a design basis event. The Control Room AC System components are arranged in redundant subsystems. During emergency operation, the Control Room AC System maintains a habitable environment and ensures the OPERABILITY of components in the control room. A single failure of an active component of the Control Room AC System, assuming a loss of offsite power, does not impair the ability of the system to perform its design function. (continued) Brunswick Unit 2 B 3.7.4-1 Revision No. 30

Control Room AC System B 3.7.4 BASES APPLICABLE Redundant detectors and controls are provided for control room SAFETY ANALYSES temperature control. The Control Room AC System is designed in (continued) accordance with Seismic Category I requirements. The Control Room AC System is capable of removing sensible and latent heat loads from the control room, including consideration of equipment heat loads and personnel occupancy requirements to ensure equipment OPERABILITY. The Control Room AC System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 2). LCO Three redundant subsystems of the Control Room AC System are required to be OPERABLE to ensure that at least two subsystems are available, assuming a single failure disables one subsystem. A failure of two or more control room AC subsystems could result in the equipment operating temperature exceeding limits. The Control Room AC System is considered OPERABLE when the individual components necessary to maintain the control room temperature are OPERABLE in all three subsystems. These components include the cooling coils, supply fans, compressor-condenser units, ductwork, dampers, and associated instrumentation and controls. APPLICABILITY In MODE 1, 2, or 3, the Control Room AC System must be OPERABLE to ensure that the control room temperature will not exceed equipment OPERABILITY limits following control room isolation. In MODES 4 and 5, the probability and consequences of a Design Basis Accident are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the Control Room AC System OPERABLE is not required in MODE 4 or 5, except for the following situations under which significant radioactive releases can be postulated:

a. During movement of irradiated fuel assemblies in the secondary containment;

b. During CORE ALTERATIONS; and

c. During operations with a potential for draining the reactor vessel (OPDRVs).

(continued) Brunswick Unit 2 B 3.7.4-2 Revision No. 30

Control Room AC System B 3.7.4 BASES (continued) ACTIONS A.1 With one control room AC subsystem inoperable, the inoperable control room AC subsystem must be restored to OPERABLE status within 30 days. With the unit in this condition, the remaining OPERABLE control room AC subsystems are adequate to perform the control room air conditioning function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystems could result in loss of the control room air conditioning function. The 30 day Completion Time is based on the low probability of an event occurring requiring control room isolation, the consideration that the remaining subsystems can provide the required protection, and the availability of alternate safety and nonsafety cooling methods. B.1 With two control room AC subsystems inoperable, the Control Room AC System may not be capable of performing the intended function. However, since the BNP control room is common to both Units 1 and 2, the risk associated with continued operation for a relatively short time could be less than that associated with an immediate controlled shutdown of both units. Therefore, additional time is allowed to restore one of the inoperable control room AC subsystems to OPERABLE status. The 72 hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining the Control Room AC System OPERABLE. This time period also ensures that the probability of an accident (requiring Control Room AC System OPERABILITY) occurring during periods when two control room AC subsystems are inoperable is minimal. C.1 and C.2 In MODE 1, 2, or 3, if Required Action A.1 or B.1 cannot be completed within the associated Completion Time, the unit must be placed in a MODE that minimizes risk. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. (continued) Brunswick Unit 2 B 3.7.4-3 Revision No. 30

Control Room AC System B 3.7.4 BASES ACTIONS D.1, D.2.1, D.2.2, and D.2.3 (continued) LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the Required Actions of Condition D are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown. During movement of irradiated fuel assemblies in the secondary containment, during CORE ALTERATIONS, or during OPDRVs, if Required Action A.1 or B.1 cannot be completed within the associated Completion Time, the OPERABLE control room AC subsystem or subsystems may be placed immediately in operation. This action ensures that the remaining subsystem(s) is OPERABLE, that no failures that would prevent actuation will occur, and that any active failure will be readily detected. An alternative to Required Action D.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes risk. If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, action must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Action must continue until the OPDRVs are suspended. E.1 If three control room AC subsystems are inoperable in MODE 1, 2, or 3, the Control Room AC System may not be capable of performing the intended function. Therefore, LCO 3.0.3 must be entered immediately. (continued) Brunswick Unit 2 B 3.7.4-4 Revision No. 30

Control Room AC System B 3.7.4 BASES ACTIONS F.1, F.2, and F.3 (continued) LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the Required Actions of Condition F are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not a sufficient reason to require a reactor shutdown. During movement of irradiated fuel assemblies in the secondary containment, during CORE ALTERATIONS, or during OPDRVs, with three control room AC subsystems inoperable, action must be taken immediately to suspend activities that present a potential for releasing radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes risk. If applicable, CORE ALTERATIONS and handling of irradiated fuel in the secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, action must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Action must continue until the OPDRVs are suspended. SURVEILLANCE SR 3.7.4.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to remove the control room heat load assumed in the safety analyses. The SR consists of a combination of testing and calculation. The 24 month Frequency is appropriate since significant degradation of the Control Room AC System is not expected over this time period. REFERENCES 1. UFSAR, Section 6.4.2.

2. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.7.4-5 Revision No. 30

Main Condenser Offgas B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Main Condenser Offgas BASES BACKGROUND During unit operation, steam from the low pressure turbine is exhausted directly into the main condenser. Air and noncondensible gases are collected in the main condenser, then exhausted through the steam jet air ejectors (SJAEs) to the Main Condenser Offgas System. The offgas from the main condenser normally includes radioactive gases. The Main Condenser Offgas System for the purposes of this specification consists of the components in the following flow path from the main condenser SJAEs to the plant stack. Offgas is discharged from the main condenser via the SJAEs and diluted with steam to keep hydrogen levels below explosive concentrations. The offgas is then passed through an Offgas Recombiner System where hydrogen and oxygen are catalytically recombined into water. After recombination, the offgas is routed to an offgas condenser to remove moisture. The offgas then passes through a 30 minute delay pipe before entering the Augmented Offgas Charcoal Adsorber System. The radioactivity of the offgas recombiner effluent is monitored downstream of the offgas condenser prior to entering the 30 minute delay pipe. The Augmented Offgas Charcoal Adsorber System provides a long delay period for radioisotope decay as the offgas passes through the system. Offgas exiting the Augmented Offgas Charcoal Adsorber System is routed to the plant stack for release to the environment. APPLICABLE The main condenser offgas gross gamma activity rate is an initial SAFETY ANALYSES condition of the Main Condenser Offgas System failure event, discussed in the UFSAR, Section 11.3 (Ref. 1). The analysis assumes a gross failure in the Main Condenser Offgas System that results in the rupture of the Main Condenser Offgas System pressure boundary. The gross gamma activity rate is controlled to ensure that, during the event, the calculated offsite doses will be well within the limits of 10 CFR 50.67 (Ref. 2). The main condenser offgas limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). (continued) Brunswick Unit 2 B 3.7.5-1 Revision No. 30

Main Condenser Offgas B 3.7.5 BASES (continued) LCO To ensure compliance with the assumptions of the Main Condenser Offgas System failure event (Ref. 1), the fission product release rate should be consistent with a noble gas release to the reactor coolant of 100 µCi/MWt-second after decay of 30 minutes. The LCO is established consistent with this requirement (2436 MWt x 100 µCi/MWt-second = 243,600 µCi/second) and is based on the original licensed RATED THERMAL POWER. APPLICABILITY The LCO is applicable when steam is being exhausted to the main condenser and the resulting noncondensibles are being processed via the Main Condenser Offgas System. This occurs during MODE 1, and during MODES 2 and 3 with any main steam line not isolated and the SJAE in operation. In MODES 4 and 5, main steam is not being exhausted to the main condenser and the requirements are not applicable. ACTIONS A.1 If the offgas radioactivity rate limit is exceeded, 72 hours is allowed to restore the gross gamma activity rate to within the limit. The 72 hour Completion Time is reasonable, based on engineering judgment, the time required to complete the Required Action, the large margins associated with permissible dose and exposure limits, and the low probability of a Main Condenser Offgas System failure. B.1, B.2, B.3.1, and B.3.2 If the gross gamma activity rate is not restored to within the limits in the associated Completion Time, all main steam lines or the SJAE must be isolated. This isolates the Main Condenser Offgas System from significant sources of radioactive steam. The main steam lines are considered isolated if at least one main steam isolation valve in each main steam line is closed, and at least one main steam line drain valve in each drain line is closed. The 12 hour Completion Time is reasonable, based on operating experience, to perform the actions from full power conditions in an orderly manner and without challenging unit systems. (continued) Brunswick Unit 2 B 3.7.5-2 Revision No. 30

Main Condenser Offgas B 3.7.5 BASES ACTIONS B.1, B.2, B.3.1, and B.3.2 (continued) An alternative to Required Actions B.1 and B.2 is to place the unit in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. SURVEILLANCE SR 3.7.5.1 REQUIREMENTS This SR, on a 31 day Frequency, requires an isotopic analysis of an offgas sample (taken at the discharge of the main condenser air ejector prior to dilution or discharge) to ensure that the required limits are satisfied. The noble gases to be sampled are Xe-133, Xe-135, Xe-138, Kr-85m, Kr-87, and Kr-88. If the measured rate of radioactivity increases significantly (by 50% after correcting for expected increases due to changes in THERMAL POWER), an isotopic analysis is also performed within 4 hours after the increase is indicated (by the condenser air ejector noble gas activity monitor), to ensure that the increase is not indicative of a sustained increase in the radioactivity rate. The 31 day Frequency is adequate in view of other instrumentation that continuously monitor the offgas, and is acceptable, based on operating experience. This SR is modified by a Note indicating that the SR is not required to be performed until 31 days after any main steam line is not isolated and the SJAE is in operation. Only in this condition can radioactive fission gases be in the Main Condenser Offgas System at significant rates. REFERENCES 1. UFSAR, Section 11.3.

2. 10 CFR 50.67.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.7.5-3 Revision No. 30

Main Turbine Bypass System B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Main Turbine Bypass System BASES BACKGROUND The Main Turbine Bypass System is designed to control steam pressure when reactor steam generation exceeds turbine requirements during unit startup, sudden load reduction, and cooldown. It allows excess steam flow from the reactor to the condenser without going through the turbine. The bypass capacity of the system is 69.6% of the Nuclear Steam Supply System rated steam flow. Sudden load reductions within the capacity of the steam bypass can be accommodated without reactor scram. The Main Turbine Bypass System consists of ten valves connected to the main steam lines between the main steam isolation valves and the turbine stop valves. The bypass valves are controlled by the pressure regulation function of the Turbine Electro Hydraulic Control System, as discussed in the UFSAR, Section 7.7.1.4 (Ref. 1). The bypass valves are normally closed, and the pressure regulator controls the turbine control valves that direct all steam flow to the turbine. If the Speed Control System or load limit restricts steam flow to the turbine, the pressure regulator controls the system pressure by opening the bypass valves. When the bypass valves open, the steam flows through connecting piping and bypass valve pressure reducers to the condenser. APPLICABLE The Main Turbine Bypass System is assumed to function during the SAFETY ANALYSES generator load rejection transient, the turbine trip transient, and the feedwater controller failure maximum demand transient, as described in the UFSAR, Section 15.2.1 (Ref. 2), Section 15.2.2 (Ref. 3), and Section 15.1.2 (Ref. 4). Opening the bypass valves during the pressurization event mitigates the increase in reactor vessel pressure, which affects the MCPR during the event. An inoperable Main Turbine Bypass System may result in APLHGR, MCPR, and LHGR penalties. The Main Turbine Bypass System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 5). (continued) Brunswick Unit 2 B 3.7.6-1 Revision No. 62

Main Turbine Bypass System B 3.7.6 BASES (continued) LCO The Main Turbine Bypass System is required to be OPERABLE to limit peak pressure in the main steam lines and maintain reactor pressure within acceptable limits during events that cause rapid pressurization, so that the Safety Limit MCPR is not exceeded. With the Main Turbine Bypass System inoperable, modifications to the APLHGR limits (LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)"), the MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), and the LHGR limits (LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)") may be applied to allow this LCO to be met. The APLHGR, MCPR, and LHGR limits for the inoperable Main Turbine Bypass System are specified in the COLR. An OPERABLE Main Turbine Bypass System requires the minimum number of bypass valves, specified in the COLR, to open in response to increasing main steam line pressure. This response is within the assumptions of the applicable analysis (Refs. 2, 3, and 4). APPLICABILITY The Main Turbine Bypass System is required to be OPERABLE at 23% RTP to ensure that the fuel cladding integrity Safety Limit and the cladding 1% plastic strain limit are not violated during the turbine generator load rejection transient. As discussed in the Bases for LCO 3.2.1, LCO 3.2.2, and LCO 3.2.3, sufficient margin to these limits exists at < 23% RTP. Therefore, these requirements are only necessary when operating at or above this power level. ACTIONS A.1 If the Main Turbine Bypass System is inoperable (three or more bypass valves as specified in the COLR inoperable), and the APLHGR, MCPR, and LHGR limits for an inoperable Main Turbine Bypass System, as specified in the COLR, are not applied, the assumptions of the design basis transient analysis may not be met. Under such circumstances, prompt action should be taken to restore the Main Turbine Bypass System to OPERABLE status or adjust the APLHGR, MCPR, and LHGR limits accordingly. The 4 hour Completion Time is reasonable, based on the time to complete the Required Action and the low probability of an event occurring during this period requiring the Main Turbine Bypass System. (continued) Brunswick Unit 2 B 3.7.6-2 Revision No. 62

Main Turbine Bypass System B 3.7.6 BASES ACTIONS B.1 (continued) If the Main Turbine Bypass System cannot be restored to OPERABLE status and the APLHGR, MCPR, and LHGR limits for an inoperable Main Turbine Bypass System are not applied, THERMAL POWER must be reduced to < 23% RTP. As discussed in the Applicability section, operation at < 23% RTP results in sufficient margin to the required limits, and the Main Turbine Bypass System is not required to protect fuel integrity during the applicable safety analyses transients. The 4 hour Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. SURVEILLANCE SR 3.7.6.1 REQUIREMENTS Cycling each main turbine bypass valve through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and will function when required. The 31 day Frequency is based on manufacturer's recommendations (Ref. 6), is consistent with the procedural controls governing valve operation, and ensures correct valve positions. Operating experience has shown that these components usually pass the SR when performed at the 31 day Frequency. Therefore, the Frequency is acceptable from a reliability standpoint. SR 3.7.6.2 The Main Turbine Bypass System is required to actuate automatically to perform its design function. This SR demonstrates that, with the required system initiation signals, the valves will actuate to their required position. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and because of the potential for an unplanned transient if the Surveillance were performed with the reactor at power. (continued) Brunswick Unit 2 B 3.7.6-3 Revision No. 62

Main Turbine Bypass System B 3.7.6 BASES SURVEILLANCE SR 3.7.6.3 REQUIREMENTS (continued) This SR ensures that the TURBINE BYPASS SYSTEM RESPONSE TIME is in compliance with the assumptions of the appropriate safety analysis. The response time limits are specified in a design calculation. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and because of the potential for an unplanned transient if the Surveillance were performed with the reactor at power. REFERENCES 1. UFSAR, Section 7.7.1.4.

2. UFSAR, Section 15.2.1.

3. UFSAR, Section 15.2.2.

4. UFSAR, Section 15.1.2.

5. 10 CFR 50.36(c)(2)(ii).

6. GE Service Information Letter No. 413, Main Steam Bypass Valve Testing, October 4, 1984.

Brunswick Unit 2 B 3.7.6-4 Revision No. 85

Spent Fuel Storage Pool Water Level B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Spent Fuel Storage Pool Water Level BASES BACKGROUND The minimum water level in the spent fuel storage pool meets the assumptions of iodine decontamination factors following a fuel handling accident. A general description of the spent fuel storage pool design is found in the UFSAR, Section 9.1.2 (Ref. 1). The assumptions of the fuel handling accident are found in the UFSAR, Section 15.7.1 (Ref. 2). APPLICABLE The water level above the irradiated fuel assemblies is an explicit SAFETY ANALYSES assumption of the fuel handling accident (Ref. 2). A fuel handling accident is evaluated to ensure that the radiological consequences (calculated control room operator dose and doses at the exclusion area and low population zone boundaries) are well below the 10 CFR 50.67 (Ref. 3) exposure guidelines. A fuel handling accident could release a fraction of the fission product inventory by breaching the fuel rod cladding as discussed in the Regulatory Guide 1.183 (Ref. 4). The fuel handling accident is evaluated for the dropping of an irradiated fuel assembly onto the reactor core. The consequences of a fuel handling accident over the spent fuel storage pool are no more severe than those of the fuel handling accident over the reactor core. The water level in the spent fuel storage pool provides for absorption of water soluble fission product gases and transport delays of soluble and insoluble gases that must pass through the water before being released to the secondary containment atmosphere. This absorption and transport delay reduces the potential radioactivity of the release during a fuel handling accident. The spent fuel storage pool water level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 5). (continued) Brunswick Unit 2 B 3.7.7-1 Revision No. 30

Spent Fuel Storage Pool Water Level B 3.7.7 BASES (continued) LCO The specified water level (19 feet 11 inches above the top of irradiated fuel assemblies seated in the High Density Fuel Storage System racks) preserves the assumptions of the fuel handling accident analysis (Ref. 2). As such, the water level is the minimum required for fuel movement within the spent fuel storage pool. This water level corresponds to 36 feet 11 3/4 inches spent fuel storage pool level. APPLICABILITY This LCO applies during movement of irradiated fuel assemblies in the spent fuel storage pool since the potential for a release of fission products exists. ACTIONS A.1 LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not a sufficient reason to require a reactor shutdown. When the initial conditions for an accident cannot be met, action must be taken to preclude the accident from occurring. If the spent fuel storage pool level is less than required, the movement of irradiated fuel assemblies in the spent fuel storage pool is suspended immediately. Suspension of this activity shall not preclude completion of movement of an irradiated fuel assembly to a safe position. This effectively precludes a spent fuel handling accident from occurring. SURVEILLANCE SR 3.7.7.1 REQUIREMENTS This SR verifies that sufficient water is available in the event of a fuel handling accident. The water level in the spent fuel storage pool must be checked periodically. The 7 day Frequency is acceptable considering that the water volume in the pool is normally stable, and the availability of spent fuel storage pool level indicators and associated alarms. (continued) Brunswick Unit 2 B 3.7.7-2 Revision No. 30

Spent Fuel Storage Pool Water Level B 3.7.7 BASES (continued) REFERENCES 1. UFSAR, Section 9.1.2.

2. UFSAR, Section 15.7.1.

3. 10 CFR 50.67.

4. Regulatory Guide 1.183, July 2000.

5. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.7.7-3 Revision No. 30

AC SourcesOperating B 3.8.1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC SourcesOperating BASES BACKGROUND The unit Class 1E AC Electrical Power Distribution System AC sources consist of the offsite power sources (preferred and alternate power sources), and the onsite standby power sources (diesel generators (DGs) 1, 2, 3, and 4. Per the UFSAR (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems. The Class 1E AC distribution system is divided into redundant load groups, so loss of any one group does not prevent the minimum safety functions from being performed. Each load group has access to two offsite power supplies (one preferred and one alternate) via a balance of plant (BOP) circuit path. This BOP circuit path consists of the BOP bus and the associated circuit path (master/slave breakers and interconnecting cables) to a 4.16 kV emergency bus. Each load group can also be connected to a single DG. Offsite power is supplied to the 230 kV switchyards from the transmission network by eight transmission lines. From the 230 kV switchyards, two qualified electrically and physically separated circuits provide AC power, through either a startup auxiliary transformer (SAT) or backfeeding via a unit auxiliary transformer (UAT), to 4.16 kV BOP buses. A single circuit path (master/slave breakers and interconnecting cables) from each BOP bus provides offsite power to its associated downstream 4.16 kV emergency bus. A detailed description of the offsite power network and circuits to the onsite Class 1E emergency buses is found in the UFSAR, Sections 8.2 and 8.3 (Ref. 2). A qualified offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from either 230 kV bus (bus A or B) to the onsite Class 1E emergency buses. The Unit 1 main generator provides the normal source of power to 4.16 kV emergency buses E1 and E2 via its respective UAT. The Unit 2 main generator provides the normal source of power to 4.16 kV emergency buses E3 and E4 via its respective UAT. In the event of a (continued) Brunswick Unit 2 B 3.8.1-1 Revision No. 30

AC SourcesOperating B 3.8.1 BASES BACKGROUND unit trip, an automatic transfer from the normal circuit (main generator (continued) output via the UAT) to the respective unit SAT occurs resulting in the SAT supplying power to two 4.16 kV emergency buses. As such, the Unit 1 SAT provides the preferred source of power to emergency buses E1 and E2 and the Unit 1 UAT (backfeed mode) is the alternate source of power to emergency buses E1 and E2. The Unit 2 SAT provides the preferred source of power to emergency buses E3 and E4 and the Unit 2 UAT (backfeed mode) is the alternate source of power to emergency buses E3 and E4. Each UAT can only be considered a qualified offsite source if it is capable of being powered from the 230 kV switchyard (Ref. 3). The SATs and UATs are sized to accommodate the load sequence starting of all emergency loads on receipt of an accident signal. The onsite standby power source for 4.16 kV emergency buses E1, E2, E3, and E4 consists of four DGs. Each DG is dedicated to its associated emergency bus. A DG starts automatically on a loss of coolant accident (LOCA) signal from either Unit 1 or Unit 2 or under emergency bus degraded voltage or undervoltage conditions. After the DG has started, it automatically ties to its respective bus after offsite power is tripped as a consequence of emergency bus undervoltage or degraded voltage, independent of or coincident with a LOCA signal (refer to LCO 3.3.8.1, "Loss of Power (LOP) Instrumentation"). The DGs also start and operate in the standby mode without tying to the emergency bus on a LOCA signal alone. Following the trip of offsite power, all loads are stripped from the emergency bus except the 480 V emergency bus. When the DG is tied to the emergency bus, select safety related loads are then sequentially connected to their respective emergency bus by individual timers associated with each auto-connected load following a permissive from a voltage relay monitoring each emergency bus. In the event of a loss of preferred power, the emergency electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a LOCA. (continued) Brunswick Unit 2 B 3.8.1-2 Revision No. 78

AC SourcesOperating B 3.8.1 BASES BACKGROUND Certain required plant loads are returned to service in a predetermined (continued) sequence in order to prevent overloading of the DGs in the process. The starting sequence of all automatically connected loads needed to recover the unit or maintain it in a safe condition is provided in UFSAR, Table 8-7 (Ref. 4). Ratings for the DGs satisfy the requirements of Safety Guide 9 (Ref. 5). Each DG has the following ratings:

a. 3500 kWcontinuous; and

b. 3850 kW2000 hours.

The capability is provided to connect a supplemental diesel generator (SUPP-DG) to supply power to any of the four 4.16 kV emergency buses via a BOP circuit path. This BOP circuit path consists of the BOP bus and the associated circuit path (master/slave breakers and interconnecting cables) to a 4.16 kV emergency bus. The SUPP-DG is commercial-grade and not designed to meet Class 1E requirements. The SUPP-DG is made available to support extended Completion Times in the event of an inoperable DG. The SUPP-DG is made available as a defense-in-depth alternate source of AC power to one emergency bus to mitigate a station blackout event. The SUPP-DG would remain disconnected from the Class 1E distribution system unless required during a station blackout. APPLICABLE The initial conditions of DBA and transient analyses in the UFSAR, SAFETY ANALYSES Chapter 6 (Ref. 6) and Chapter 15 (Ref. 7), assume ESF systems are OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, "Power Distribution Limits"; Section 3.5, "Emergency Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling (RCIC) System"; and Section 3.6, "Containment Systems." The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining the onsite or offsite AC sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite power; and

b. A worst case single failure.

AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 8). (continued) Brunswick Unit 2 B 3.8.1-3 Revision No. 83

AC SourcesOperating B 3.8.1 BASES (continued) LCO Two Unit 1 and two Unit 2 qualified circuits between the offsite transmission network and the onsite Class 1E Distribution System and four separate and independent DGs (1, 2, 3, and 4) ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated DBA. Qualified offsite circuits are those that are described in the UFSAR (Ref. 2), and are part of the licensing basis for the unit. Each offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the emergency buses. An OPERABLE qualified offsite circuit consists of the incoming breakers and disconnects from the respective 230 kV switchyard to and including the SAT or UAT, the respective circuit path to and including the BOP buses, and the circuit path to two 4.16 kV emergency buses including associated feeder (master/slave) breakers. Each DG must be capable of starting, accelerating to minimum acceptable frequency and voltage, and connecting to its respective emergency bus on detection of bus undervoltage. This sequence must be accomplished within 10.5 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the emergency buses. These capabilities are required to be met from a variety of initial conditions, such as DG in standby with the engine at ambient condition. Additional DG capabilities must be demonstrated to meet required Surveillances, e.g., capability of the DG to revert to ready-to-load status on an ECCS signal while operating in parallel test mode. Each DG is required to have an OPERABLE air start system. Additionally, proper sequencing of loads, including tripping of nonessential loads, is a required function for DG OPERABILITY. The AC sources must be separate and independent (to the extent possible) of other AC sources. For the DGs, the separation and independence are complete. For the offsite AC sources, the separation and independence are to the extent practical. An offsite circuit may be connected to more than one emergency bus, with manual transfer capability to the other offsite circuit available, and not violate separation criteria. If the preferred offsite circuit (i.e., the circuit path from a 230 kV bus through the SAT to the associated onsite Class 1E emergency buses) is not connected to an emergency bus, the circuit is required to have OPERABLE fast transfer capability to two emergency buses to support OPERABILITY of that circuit. (continued) Brunswick Unit 2 B 3.8.1-4 Revision No. 83

AC SourcesOperating B 3.8.1 BASES (continued) APPLICABILITY The AC sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

The AC power requirements for MODES 4 and 5 and other conditions in which AC sources are required are covered in LCO 3.8.2, "AC Sources Shutdown." ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance. A.1 The offsite circuits for two of the four 4.16 kV emergency buses utilize the opposite units SAT and UAT. Therefore, this Required Action provides a 45 day time period to perform maintenance that requires one of the opposite unit's offsite circuits to be inoperable. This is acceptable because performing this maintenance will increase the reliability of the offsite circuit. However, if a second Unit 1 or 2 offsite circuit becomes inoperable, Conditions C and E are entered. The 45 day Completion Time takes into account the capacity and capability of the remaining AC sources and a reasonable time for performance of maintenance. The Note to Condition A only allows the 45 day Completion Time to be used when the opposite unit is in MODE 4 or 5. When a Unit 1 offsite circuit becomes inoperable while Unit 1 is in MODE 1, 2, or 3, Condition C of Unit 2 Specification 3.8.1 must be entered and the associated Required Actions performed. (continued) Brunswick Unit 2 B 3.8.1-5 Revision No. 81

AC SourcesOperating B 3.8.1 BASES ACTIONS B.1 (continued) Required Action B.1 addresses actions to be taken in the event of inoperability of redundant required features concurrent with two offsite circuits inoperable due to one Unit 1 BOP circuit path to the downstream 4.16 kV emergency bus being inoperable and the DG associated with the downstream 4.16 kV emergency bus inoperable. When applying Required Action B.1, the Configuration Risk Management Program described in Technical Requirements Manual 5.5.14 is required to be implemented. Condition B is intended to be used for planned maintenance on the Unit 1 BOP buses and the associated 4.16 kV emergency bus (in order to perform maintenance on the 4.16 kV emergency bus, the associated DG must be rendered inoperable). Redundant required features failures consist of inoperable features that are associated with an emergency bus redundant to the emergency bus with inoperable offsite circuits and DG. Required Action B.1 reduces the vulnerability to a loss of function. An example of inoperable redundant required feature is as follows. If one Unit 2 core spray subsystem becomes inoperable while planned maintenance is being performed on a Unit 1 BOP bus and the associated emergency buses, the Unit 2 RHR subsystem associated with the inoperable Unit 1 emergency bus must immediately be declared inoperable since a core spray subsystem is a redundant required feature to an RHR subsystem for the purposes of core cooling. As a result, the applicable Conditions of Specification 3.5.1, "ECCSOperating," shall be entered and Required Actions performed. If at any time during the existence of this condition, an additional Unit 2 or Unit 1 offsite source or DG becomes inoperable, Condition I of Unit 2 Specification 3.8.1 must be entered and the associated Required Actions performed. The immediate Completion Time for Required Action B.1 is intended to ensure that all redundant required features are OPERABLE, or required features ACTIONS entered, prior to entering Condition B. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock". In this Required Action, the Completion Time only begins on discovery that both:

a. Two Unit 1 offsite circuits are inoperable due to one inoperable Unit 1 BOP circuit path to the downstream 4.16 kV emergency bus and the DG associated with the downstream 4.16 kV emergency bus is inoperable; and (continued)

Brunswick Unit 2 B 3.8.1-6 Revision No. 68

AC SourcesOperating B 3.8.1 BASES ACTIONS B.1 (continued)

b. A redundant required feature is inoperable.

If, at any time during the existence of this Condition, a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked. Condition B is modified by two notes. Note 1 only allows this Condition to be used when the opposite unit is in MODE 4 or 5. When two offsite circuits are inoperable, due to one Unit 1 BOP circuit path and the DG associated with the downstream 4.16 kV emergency bus inoperable, while Unit 1 is in MODE 1, 2, or 3, Condition I of Unit 2 Specification 3.8.1 must be entered and the associated Required Actions performed. Note 2 prevents Condition B from being entered coincident with Condition A (i.e., the SAT and UAT feeds to the operable BOP circuit path shall both be operable). The Unit 1 BOP buses 1C and 1D are supplied from the Unit 1 SAT and UAT. Inoperability of the Unit 1 SAT or UAT, as provided for in Condition A, would result in the loss of redundancy of offsite power to the operable BOP bus if Condition A and B were allowed to be entered coincidentally. Some maintenance activities may require isolating the SAT and/or UAT from the inoperable BOP circuit path (removing connectors in the non-segregated bus, for example). This is permissible because no additional equipment is rendered inoperable and there is no loss of redundancy to the operable BOP circuit. If at any time Condition A is entered coincident with Condition B, Condition I of Unit 2 Specification 3.8.1 must be entered and the associated Required Actions performed. B.2 The Unit 1 BOP buses 1C and 1D can each be supplied from the two Unit 1 offsite circuits (SAT and UAT). In turn, offsite power is supplied from each BOP bus to its downstream 4.16 kV emergency bus via a single circuit. Hence, an intentional outage of a BOP bus or the circuit path to its associated emergency bus (master/slave breakers and interconnecting cables) results in the loss of availability of both offsite circuits to the downstream emergency bus. The phrase "balance of plant circuit path to the downstream 4.16 kV emergency bus" as stated in Condition B refers to the BOP bus and its associated circuit path (master/slave breakers and interconnecting cables) to the downstream 4.16 kV emergency bus. (continued) Brunswick Unit 2 B 3.8.1-7 Revision No. 81

AC SourcesOperating B 3.8.1 BASES ACTIONS B.2 (continued) To ensure highly reliable power sources remain with one Unit 1 balance of plant circuit path to the downstream 4.16 kV emergency bus inoperable and the DG associated with the downstream 4.16 kV emergency bus inoperable, it is necessary to verify the availability of the remaining offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in the Required Action not met. However, if a second circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition E, for two or more offsite circuits inoperable, is entered. B.3 This Required Action provides a 7 day time period to perform planned maintenance on one of these BOP buses and the circuit path to its associated 4.16 kV emergency bus when Unit 1 is in MODE 4 or 5. During the planned maintenance of the BOP bus, the associated emergency bus and the associated DG, if a condition is discovered on these buses or the DG requiring corrective maintenance, this maintenance may be performed within the 7 day time period of Required Action B.3. (If Unit 1 is in MODE 1, 2, or 3, then the Unit 1 ACTIONS of Specification 3.8.1, "AC SourcesOperating," require entry into LCO 3.0.3 for this condition.) The 7 day Completion Time takes into account the capacity and capability of the remaining AC sources and a reasonable time frame for performance of planned maintenance. This is acceptable because maintenance on each BOP bus and the circuit path to its associated emergency bus will increase the reliability of the offsite circuits to the downstream 4.16 kV emergency buses. It should be noted that while in this condition each of the remaining three 4.16 kV emergency buses will have their standby emergency source and two sources of offsite power OPERABLE. If one or both sources of offsite power are lost to an additional 4.16 kV emergency bus then Condition E is entered. The second Completion Time for Required Action B.3 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet LCO 3.8.1.a or b. If Condition B is entered while, for (continued) Brunswick Unit 2 B 3.8.1-8 Revision No. 30

AC SourcesOperating B 3.8.1 BASES ACTIONS B.3 (continued) instance, an offsite circuit is inoperable and that circuit is subsequently restored OPERABLE, the LCO may already have been not met for up to 72 hours. This situation could lead to a total of 10 days from initial failure of the LCO to restoration of the BOP circuit path to the downstream 4.16 kV emergency bus and DG associated with the affected 4.16 kV emergency bus. At this time, a second offsite circuit could again become inoperable, the BOP circuit path to the downstream 4.16 kV emergency bus and DG associated with the affected 4.16 kV emergency bus restored OPERABLE, and an additional 72 hours (for a total of 13 days) allowed prior to complete restoration of the LCO. The 10 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet LCO 3.8.1.a or b. This limit is considered reasonable for situations in which Condition B and Condition C or D are entered concurrently. The "AND" connector between the 7 day and 10 day Completion Time means that both Completion Times apply simultaneously, and the more restrictive must be met. As in Required Action B.1, the second Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock". This exception results in establishing the "time zero" at the time that LCO 3.8.1.a or b was initially not met, instead of the time that Condition B was entered. C.1 To ensure a highly reliable power source remains with one offsite circuit inoperable, it is necessary to verify the availability of the remaining offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action not met. However, if a second circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition E, for two or more offsite circuits inoperable, is entered. (continued) Brunswick Unit 2 B 3.8.1-9 Revision No. 30

AC SourcesOperating B 3.8.1 BASES ACTIONS C.2 (continued) Required Action C.2, which only applies if one 4.16 kV emergency bus cannot be powered from an offsite source, is intended to provide assurance that an event with a coincident single failure of the associated DG does not result in a complete loss of safety function of critical systems. These features (e.g., system, subsystem, division, component, or device) are designed with redundant safety related 4.16 kV emergency buses. Redundant required feature failures consist of inoperable features associated with an emergency bus redundant to the emergency bus that has no offsite power. The Completion Time for Required Action C.2 is intended to allow time for the operator to evaluate and repair any discovered inoperabilities. This Completion Time also allows an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action the Completion Time only begins on discovery that both:

a. A 4.16 kV emergency bus has no offsite power supplying its loads; and

b. A redundant required feature on another emergency bus is inoperable.

If, at any time during the existence of this Condition (one offsite circuit inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time would begin to be tracked. Discovering no offsite power to one 4.16 kV emergency bus of the onsite Class 1E Power Distribution System coincident with one or more inoperable required support or supported features, or both, that are associated with any other emergency bus that has offsite power, results in starting the Completion Times for the Required Action. Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before the unit is subjected to transients associated with shutdown. (continued) Brunswick Unit 2 B 3.8.1-10 Revision No. 30

AC SourcesOperating B 3.8.1 BASES ACTIONS C.2 (continued) The remaining OPERABLE offsite circuits and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection may have been lost for the required feature's function; however, function is not lost. The 24 hour Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. C.3 According to Regulatory Guide 1.93 (Ref. 9), operation may continue in Condition C for a period that should not exceed 72 hours. With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this condition, however, the remaining OPERABLE offsite circuits and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System. The 72 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. The second Completion Time for Required Action C.3 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet LCO 3.8.1.a or b. If Condition C is entered while, for instance, a DG is inoperable, and that DG is subsequently returned OPERABLE, the LCO may already have been not met for up to 14 days. This situation could lead to a total of 17 days, since initial failure to meet the LCO, to restore the offsite circuit. At this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional 14 days (for a total of 31 days) allowed prior to complete restoration of the LCO. The 17 day Completion Time provides a limit on the time allowed (continued) Brunswick Unit 2 B 3.8.1-11 Revision No. 83

AC SourcesOperating B 3.8.1 BASES ACTIONS C.3 ( continued) in a specified condition after discovery of failure to meet LCO 3.8.1.a or b. This limit is considered reasonable for situations in which Conditions C and D are entered concurrently. The "AND" connector between the 72 hours and 17 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met. As in Required Action C.2, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This exception results in establishing the "time zero" at the time LCO 3.8.1.a or b was initially not met, instead of at the time that Condition C was entered. D.1 To ensure a highly reliable power source remains with one DG inoperable, it is necessary to verify the availability of the offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure to meet SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions must then be entered. D.2 In order to extend the Required Action D.5 Completion Time for an inoperable DG from 7 days to 14 days inoperable, it is necessary to verify the availability of the SUPP-DG within 2 hours on entry into TS 3.8.1 LCO and every 12 hours thereafter. Since Required Action D.2 only specifies "evaluate," discovering the SUPP-DG unavailable does not result in the Required Action being not met (i.e., the evaluation is performed). However, on discovery of an unavailable SUPP-DG, the Completion Time for Required Action D.5 starts the 7 day and/or 24 hour clock. SUPP-DG availability requires that:

1) The load test has been performed within 30 days of entry into the extended Completion Time. The Required Action evaluation is met with an administrative verification of this prior testing;

2) SUPP-DG fuel tank test is verified locally to be 24-hour supply; and

3) SUPP-DG supporting system parameters for starting and operating are verified to be within required limits for functional availability (e.g., battery state of charge, starting air system pressure).

The SUPP-DG is not used to extend the Completion Time for more than one inoperable DG at any one time. (continued) Brunswick Unit 2 B 3.8.1-12 Revision No. 83

AC SourcesOperating B 3.8.1 BASES ACTIONS D.3 (continued) Required Action D.3 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed to be powered from redundant safety related 4.16 kV emergency buses (i.e., single division systems are not included). Redundant required feature failures consist of inoperable features associated with an emergency bus redundant to the emergency bus that has an inoperable DG. The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action the Completion Time only begins on discovery that both:

a. An inoperable DG exists; and

b. A redundant required feature on another emergency bus is inoperable.

If, at any time during the existence of this Condition (one DG inoperable), a required redundant feature subsequently becomes inoperable, this Completion Time begins to be tracked. Discovering one DG inoperable coincident with one or more inoperable required support or supported features, or both, that are associated with the OPERABLE DGs results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown. The remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. (continued) Brunswick Unit 2 B 3.8.1-13 Revision No. 83

AC SourcesOperating B 3.8.1 BASES ACTIONS D.4.1 and D.4.2 (continued) Required Action D.4.1 provides an allowance to avoid unnecessary testing of OPERABLE DGs. If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DGs, SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on other DG(s), they are declared inoperable upon discovery, and Condition G or I of LCO 3.8.1 is entered, as applicable. Once the failure is repaired, and the common cause failure no longer exists, Required Action D.4.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s), performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of those DGs. In the event the inoperable DG is restored to OPERABLE status prior to completing either D.4.1 or D.4.2 (i.e., the inoperable DG has been restored to OPERABLE status but it has not yet been determined if the cause of the inoperability is common to the other OPERABLE DGs), the CP&L Corrective Action Program (CAP) will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer required under the 24 hour constraint imposed while in Condition D. According to Generic Letter 84-15 (Ref. 10), 24 hours is a reasonable time to confirm that the OPERABLE DGs are not affected by the same problem as the inoperable DG. D.5 The 4.16 kV emergency bus design is sufficient to allow operation to continue in Condition D for a period that should not exceed 14 days if the SUPP-DG is available. If the SUPP-DG is or becomes unavailable with an inoperable DG, then action is required to restore the SUPP-DG to available status or to restore the DG to operable status within 7 days from discovery of an unavailable SUPP-DG. However, if the SUPP-DG unavailability occurs sometime after 6 days of continuous DG inoperability, then the remaining time to restore the SUPP-DG to available status or to restore the DG to OPERABLE status is limited to 24 hours. The 7 day and 24 hour Completion Times allow for an exception to the normal "time zero" for beginning the allowed outage time "clock." The 7 day Completion Time only begins on discovery that both:

a. An inoperable DG exists; and

b. The SUPP-DG is unavailable.

The 24 hour Completion Time only begins on discovery that:

a. An inoperable DG exists for > 6 days; and

b. The SUPP-DG is unavailable.

(continued) Brunswick Unit 2 B 3.8.1-14 Revision No. 83

AC SourcesOperating B 3.8.1 BASES ACTIONS D.5 (continued) Therefore, when one required DG is inoperable due to either preplanned maintenance (preventive or corrective) or unplanned corrective maintenance work, the Completion Time can be extended from 7 days to 14 days if the SUPP-DG is verified available for backup operation. In Condition D, the remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. The 14 day Completion Time takes into account the capacity and capability of the remaining AC sources (including SUPP-DG), a reasonable time for repairs, and the low probability of a DBA occurring during this period. The fourth Completion Time for Required Action D.5 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet LCO 3.8.1.a or b. If Condition D is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently restored OPERABLE, the LCO may already have been not met for up to 72 hours. This situation could lead to a total of 17 days, since initial failure of the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours (for a total of 20 days) allowed prior to complete restoration of the LCO. The 17 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet LCO 3.8.1.a or b. This limit is considered reasonable for situations in which Conditions C and D are entered concurrently. The "AND" connector between the 14 day and 17 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive must be met. As in Required Action C.3, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This exception results in establishing the "time zero" at the time that LCO 3.8.1.a or b was initially not met, instead of the time that Condition D was entered. E.1 and E.2 Required Action E.1 addresses actions to be taken in the event of inoperability of redundant required features concurrent with inoperability of two or more offsite circuits. Required Action E.1 reduces the vulnerability to a loss of function. The Completion Time for taking these actions is reduced to 12 hours from that allowed with one 4.16 kV emergency bus without offsite power (Required Action C.2). The rationale for the reduction to 12 hours is that Regulatory Guide 1.93 (Ref. 9) allows a Completion Time of 24 hours for two offsite circuits inoperable, based upon the assumption that two complete safety divisions are OPERABLE. While this Action allows more than two circuits (continued) Brunswick Unit 2 B 3.8.1-15 Revision No. 83

AC SourcesOperating B 3.8.1 BASES ACTIONS E.1 and E.2 (continued) to be inoperable, Regulatory Guide 1.93 (Ref. 9) assumes only two circuits are required by the LCO, and a loss of those two circuits results in a total loss of offsite power to the Class 1E Electrical Power Distribution System. Thus, with the BNP electrical design, a loss of the four offsite circuits results in the same condition assumed in Regulatory Guide 1.93 (Ref. 9). When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours is appropriate. These features are designed with redundant safety related 4.16 kV emergency buses, (i.e., single division systems are not included in the list). Redundant required feature failures consist of any of these features that are inoperable because any inoperability is on an emergency bus redundant to an emergency bus with inoperable offsite circuits. The Completion Time for Required Action E.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. Two or more offsite circuits are inoperable; and

b. A redundant required feature is inoperable.

If, at any time during the existence of this Condition (any combination of two or more Unit 1 and 2 offsite circuits inoperable), a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked. According to Regulatory Guide 1.93 (Ref. 9), operation may continue in Condition E for a period that should not exceed 24 hours. This level of degradation means that the offsite electrical power system may not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources. (continued) Brunswick Unit 2 B 3.8.1-16 Revision No. 30

AC SourcesOperating B 3.8.1 BASES ACTIONS E.1 and E.2 (continued) Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable. However, two factors tend to decrease the severity of this degradation level:

a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and

b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With two or more of the offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour Completion Time provides a period of time to effect restoration of all but one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria. According to Regulatory Guide 1.93 (Ref. 9), with the available offsite AC sources two less than required by the LCO, operation may continue for 24 hours. If all offsite sources are restored within 24 hours, unrestricted operation may continue. If all but one offsite source is restored within 24 hours, power operation continues in accordance with Condition A or C, as applicable. F.1 and F.2 Pursuant to LCO 3.0.6, the Distribution SystemOperating ACTIONS would not be entered even if all AC sources to it were inoperable, resulting in de-energization. Therefore, the Required Actions of Condition F are modified by a Note to indicate that when Condition F is (continued) Brunswick Unit 2 B 3.8.1-17 Revision No. 30

AC SourcesOperating B 3.8.1 BASES ACTIONS F.1 and F.2 (continued) entered with no AC source to any 4.16 kV emergency bus, ACTIONS for LCO 3.8.7, "Distribution SystemsOperating," must be immediately entered. This allows Condition F to provide requirements for the loss of an offsite circuit and one DG without regard to whether an emergency bus is de-energized. LCO 3.8.7 provides the appropriate restrictions for a de-energized emergency bus. According to Regulatory Guide 1.93 (Ref. 9), operation may continue in Condition F for a period that should not exceed 12 hours. In Condition F, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition E (loss of two or more offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. G.1 With two or more DGs inoperable and an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for the majority of ESF equipment at this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown. (The immediate shutdown could cause grid instability, which could result in a total loss of AC power.) Since any inadvertent unit generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation. (continued) Brunswick Unit 2 B 3.8.1-18 Revision No. 30

AC SourcesOperating B 3.8.1 BASES ACTIONS G.1 (continued) According to Regulatory Guide 1.93 (Ref. 9), with two or more DGs inoperable, operation may continue for a period that should not exceed 2 hours. While this Action allows more than two DGs to be inoperable, Regulatory Guide 1.93 (Ref. 9) assumes only two DGs are required by the LCO, and a loss of those two DGs results in a total loss of onsite power to the Class 1E Electrical Power Distribution System. Thus, with the BNP electrical design, a loss of the four DGs results in the same condition assumed in Regulatory Guide 1.93 (Ref. 9). H.1 and H.2 If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. I.1 Condition I corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system may cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown. SURVEILLANCE The AC sources are designed to permit inspection and testing of all REQUIREMENTS important areas and features, especially those that have a standby function, in accordance with UFSAR Sections 8.2 and 8.3 (Ref. 2). Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions). The SRs for demonstrating the OPERABILITY of the DGs are consistent with the (continued) Brunswick Unit 2 B 3.8.1-19 Revision No. 30

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE recommendations of Safety Guide 9 (Ref. 5), Regulatory Guide 1.9 REQUIREMENTS (Ref. 11), and Regulatory Guide 1.137 (Ref. 12), as addressed in the (continued) UFSAR. Where the SRs discussed herein specify voltage and frequency tolerances, the following summary is applicable. The minimum steady state output voltage of 3750 V is derived from the recommendations found in Safety Guide 9 (Ref. 5) and bounds the minimum steady state output voltage criteria of 3698 V associated with the 4.16 kV emergency buses analyzed in the AC Auxiliary Electrical Distribution System Study. This value (3698 V) allows for voltage drop to the terminals of 4000 V motors whose minimum operating voltage is specified as 3600 V. It also allows for voltage drops to motors and other equipment down through the 480 V level where minimum operating voltage is also usually specified as 90% of name plate rating. The specified maximum steady state output voltage of 4300 V ensures the maximum operating voltage at the safety related 480 V substations is no more than the maximum rated steady state voltage criteria for the 480 V motor control centers. The maximum steady state output voltage was determined taking into consideration the voltage drop between the DGs and the 4.16 kV emergency buses and a 5% voltage boost at the 480 V substation transformers. This maximum steady state output voltage also ensures that for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors is no more than the maximum rated steady state operating voltage. The specified minimum and maximum frequencies of the DG are 58.8 Hz and 61.2 Hz, respectively. These values are equal to +/- 2% of the 60 Hz nominal frequency and are derived from the recommendations found in Safety Guide 9 (Ref. 5). SR 3.8.1.1 This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source and that appropriate independence of offsite circuits is maintained. The 7 day Frequency is adequate since breaker position is not likely to change without the operator being aware of it and because its status is displayed in the control room. (continued) Brunswick Unit 2 B 3.8.1-20 Revision No. 88

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.7 REQUIREMENTS (continued) These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and maintain the unit in a safe shutdown condition. To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs have been modified by a Note (Note 1 for SR 3.8.1.2 and SR 3.8.1.7) to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period. For the purposes of this testing, the DGs are started from standby conditions. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained. In order to reduce stress and wear on diesel engines, some manufacturers recommend a modified start in which the starting speed of DGs is limited, warmup is limited to this lower speed, and the DGs are gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of Note 2 of SR 3.8.1.2. SR 3.8.1.7 requires that, at a 184 day Frequency, the DG starts from standby conditions and achieves required voltage and frequency within 10 seconds. The minimum voltage and frequency stated in the SR are those necessary to ensure the DG can accept DBA loading while maintaining acceptable voltage and frequency levels. Stable operation at the nominal voltage and frequency values is also essential to establishing DG OPERABILITY, but a time constraint is not imposed. This is because a typical DG will experience a period of voltage and frequency oscillations prior to reaching steady state operation if these oscillations are not dampened by load application. This period may be extended beyond the 10 second acceptance criteria and could be cause for failing the SR. In lieu of a time constraint in the SR, BNP will monitor and trend the actual time to reach steady state operation as a means of ensuring there is no voltage regulator or governor degradation which could cause a DG to become inoperable. The 10 second start requirement supports and is conservative with respect to the assumptions in the design basis LOCA analysis of UFSAR, Section 6.3 (Ref. 6). The 10 second start requirement is not applicable to SR 3.8.1.2 (see Note 2 of SR 3.8.1.2), (continued) Brunswick Unit 2 B 3.8.1-21 Revision No. 30

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.7 (continued) REQUIREMENTS when a modified start procedure as described above is used. If a modified start is not used, the 10 second start requirement of SR 3.8.1.7 applies. To minimize testing of the DGs, Note 3 to SR 3.8.1.2 and Note 2 to SR 3.8.1.7 allow a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit. The 31 day Frequency for SR 3.8.1.2 is consistent with Regulatory Guide 1.9 (Ref. 11). The 184 day Frequency for SR 3.8.1.7 is a reduction in cold testing consistent with Generic Letter 84-15 (Ref. 10). These Frequencies provide adequate assurance of DG OPERABILITY, while minimizing degradation resulting from testing. SR 3.8.1.3 This Surveillance verifies that the DGs are capable of synchronizing and accepting a load approximately equivalent to the continuous rating of the DGs. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source. Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is the generator design limitation which if exceeded could lead to generator instability while in parallel with the offsite circuit. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in order to maintain DG OPERABILITY. The 31 day Frequency for this Surveillance is consistent with Regulatory Guide 1.9 (Ref. 11). (continued) Brunswick Unit 2 B 3.8.1-22 Revision No. 30

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 (continued) REQUIREMENTS Note 1 modifies this Surveillance to indicate that diesel engine runs for this Surveillance may include gradual loading so that mechanical stress and wear on the diesel engine are minimized. Note 2 modifies this Surveillance by stating that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients outside the range normally used during the performance of this Surveillance do not invalidate the test. Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance. To minimize testing of the DGs, Note 5 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit. SR 3.8.1.4 This SR provides verification that the level of fuel oil in the engine mounted tank is slightly below the level at which the backup fuel oil transfer pump automatically starts. The level is expressed as an equivalent volume in gallons, and is selected to ensure adequate fuel oil for approximately 30 minutes of DG operation at rated load. This SR may be satisfied by verifying the absence of the associated low level alarm. The 31 day Frequency is adequate to ensure that a sufficient supply of fuel oil is available, since low level alarms are provided and facility operators would be aware of any large uses of fuel oil during this period. (continued) Brunswick Unit 2 B 3.8.1-23 Revision No. 30

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.5 REQUIREMENTS (continued) Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the engine mounted tanks once every 31 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref. 12). This SR is for preventive maintenance. The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of this Surveillance. Removal of accumulated water may be accomplished by draining a portion of fuel oil from the engine mounted fuel oil tank to the day fuel oil storage tank and draining any accumulated water from the day fuel oil storage tank in accordance with SR 3.8.3.3. The draining evolution will continue until accumulated water is verified to be removed from the engine mounted fuel oil tank. SR 3.8.1.6 This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. It is required to support continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for fuel transfer systems are OPERABLE. (continued) Brunswick Unit 2 B 3.8.1-24 Revision No. 30

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6 (continued) REQUIREMENTS The Frequency for this SR is consistent with the Frequency for testing the DGs in SR 3.8.1.3. DG operation for SR 3.8.1.3 is normally long enough that fuel oil level in the engine mounted tank will be reduced to the point where the fuel oil transfer pump automatically starts to restore fuel oil level in the engine mounted tank. SR 3.8.1.8 Transfer of each 4.16 kV emergency bus power supply from the normal circuit to the preferred offsite circuit and from the preferred offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the offsite circuit distribution network to power the shutdown loads. In lieu of actually initiating an automatic circuit transfer, testing that adequately shows the capability of the transfer is acceptable. The automatic transfer testing may include any series of sequential, overlapping, or total steps so that the entire transfer sequence is verified. The 24 month Frequency of the Surveillance is based on engineering judgment taking into consideration the plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has demonstrated that these components will pass the SR when performed on the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. This SR is modified by three Notes. The reason for Note 1 is that, during operation with the reactor critical, performance of SR 3.8.1.8.a, verification of automatic transfer capability of the unit power supply from the normal circuit to the preferred offsite circuit, could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems. Note 1 is not applicable to SR 3.8.1.8.b, verification of manual transfer of the unit power supply from the preferred offsite circuit to the alternate offsite circuit, since this evolution does not cause perturbations of the electrical distribution systems. Due to the shared configuration of certain systems (required to mitigate DBAs and transients) between BNP Units 1 and 2, both units' offsite circuits are required to be OPERABLE to supply power (continued) Brunswick Unit 2 B 3.8.1-25 Revision No. 30

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.8 (continued) REQUIREMENTS to these systems when either one or both units are in MODE 1, 2, or 3. In order to reduce the consequences of a potential perturbation to the electrical distribution systems during the performance of this Surveillance, while at the same time avoiding the need for a shutdown of both units to perform this Surveillance, Note 1 only precludes satisfying this Surveillance Requirement for the Unit 2 offsite circuits when Unit 2 is in MODE 1 or 2. During the performance of this Surveillance with Unit 2 not in MODE 1 or 2 and with Unit 1 in MODE 1, 2, or 3; the applicable ACTIONS of the Unit 1 and Unit 2 Technical Specifications must be entered if a Unit 2 offsite circuit is rendered inoperable by the performance of this Surveillance. Credit may be taken for unplanned events that satisfy this SR. As stated in Note 2, automatic transfer capability to the SAT is not required to be met when the associated 4.16 kV emergency buses are powered from the preferred offsite circuit. This is acceptable since the automatic transfer capability function has been satisfied in this condition. To minimize testing, Note 3 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on a single unit. If an offsite circuit fails one of the Surveillances, the offsite circuit should be considered inoperable for both units. SR 3.8.1.9 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG capability to reject the largest single load without tripping. The largest single load for each DG is a core spray pump (1250 hp). This Surveillance may be accomplished by:

a. Tripping the DG output breaker with the DG carrying greater than or equal to its associated core spray pump while paralleled to offsite power, or while solely supplying the bus; or (continued)

Brunswick Unit 2 B 3.8.1-26 Revision No. 30

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 (continued) REQUIREMENTS

b. Tripping its associated core spray pump with the DG solely supplying the bus.

The load rejection test is acceptable if the increase in diesel speed does not exceed the overspeed trip setpoint. The 24 month Frequency is consistent with the recommendation of Regulatory Guide 1.9 (Ref. 11). This SR is modified by three Notes. The reason for Note 1 is that, during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems. Due to the shared configuration of certain systems (required to mitigate DBAs and transients) between BNP Units 1 and 2, all four DGs are required to be OPERABLE to supply power to these systems when either one or both units are in MODE 1, 2, or 3. In order to reduce the consequences of a potential perturbation to the electrical distribution systems during the performance of this Surveillance, while at the same time avoiding the need to shutdown both units to perform this Surveillance, Note 1 only precludes satisfying this Surveillance Requirement for DG 3 and DG 4 when Unit 2 is in MODE 1, 2, or 3. During the performance of this Surveillance with Unit 2 not in MODE 1, 2, or 3 and with Unit 1 in MODE 1, 2, or 3; the applicable ACTIONS of the Unit 1 and Unit 2 Technical Specifications must be entered if DG 3 or DG 4 is rendered inoperable by the performance of this Surveillance. Credit may be taken for unplanned events that satisfy this SR. In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, Note 2 requires that, if synchronized to offsite power, testing must be performed using a power factor 0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG would experience. To minimize testing of the DGs, Note 3 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit. (continued) Brunswick Unit 2 B 3.8.1-27 Revision No. 30

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 REQUIREMENTS (continued) Consistent with Regulatory Guide 1.9 (Ref. 11), paragraph C.2.2.12, this Surveillance demonstrates that DG non-critical protective functions (e.g., high jacket water temperature) are bypassed on an ECCS initiation test signal and critical protective functions (engine overspeed, generator differential overcurrent, low lubricating oil pressure, reverse power, loss of field, and phase overcurrent-voltage restrained) trip the DG to avert substantial damage to the DG unit. The non-critical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG. The 24 month Frequency is based on engineering judgment, takes into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has demonstrated that these components will pass the SR when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. The SR is modified by a Note. To minimize testing of the DGs, the Note allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit. SR 3.8.1.11 Brunswick Nuclear Plant performs a 60 minute run greater than or equal to the continuous rating (3500 kW) and less than or equal to the 2000-hour rating (3850 kW) to demonstrate diesel generator operation and to detect potential degradations and incipient failures. Post-accident DG loading is allowed up to the 2000-hour rating; however, it is impractical to require testing at this load but not to exceed it. A load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in order to maintain DG OPERABILITY. The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelube and warmup, discussed in the Bases for SR 3.8.1.2, and for gradual loading, discussed in the Bases for SR 3.8.1.3, are applicable to this SR. (continued) Brunswick Unit 2 B 3.8.1-28 Revision No. 46

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued) REQUIREMENTS In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible, testing must be performed using a power factor 0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG could experience. The 24 month Frequency is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 11), Table 1; takes into consideration plant conditions required to perform the Surveillance; and is intended to be consistent with expected fuel cycle lengths. This Surveillance has been modified by two Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit do not invalidate the test. To minimize testing of the DGs, Note 2 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit. SR 3.8.1.12 Consistent with Regulatory Guide 1.9 (Ref. 11), paragraph C.2.2.13, demonstration of the test mode override feature ensures that the DG availability under accident conditions is not compromised as the result of testing. Interlocks to the LOCA sensing circuits cause the DG to automatically reset to ready-to-load operation if an ECCS initiation (continued) Brunswick Unit 2 B 3.8.1-29 Revision No. 46

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 (continued) REQUIREMENTS signal is received during operation in the test mode. Ready-to-load operation is defined as the DG running at rated speed and voltage with the DG output breaker open. These provisions for automatic switchover are required by IEEE-308 (Ref. 13), paragraph 6.2.4(6). In lieu of actually returning the DG to ready-to-load status, testing that adequately shows the capability of the DG to perform this function is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire sequence is verified. The 24 month Frequency is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 11), Table 1; takes into consideration plant conditions required to perform the Surveillance; and is intended to be consistent with expected fuel cycle lengths. This SR is modified by a Note. To minimize testing of the DGs, the Note allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit. SR 3.8.1.13 Under accident conditions loads are sequentially connected to the bus by the automatic load sequence time delay relays. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs due to high motor starting currents. The 10% load sequence time interval tolerance ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated. Reference 4 provides a summary of the automatic loading of ESF buses. (continued) Brunswick Unit 2 B 3.8.1-30 Revision No. 30

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.13 (continued) REQUIREMENTS The Frequency of 24 months is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 11), Table 1; takes into consideration plant conditions required to perform the Surveillance; and is intended to be consistent with expected fuel cycle lengths. This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. Due to the shared configuration of certain systems (required to mitigate DBAs and transients) between BNP Units 1 and 2, all four DGs, and associated load sequence relays, are required to be OPERABLE to supply power to these systems when either one or both units are in MODE 1, 2, or 3. In order to reduce potential consequences associated with removing a required offsite circuit from service during the performance of this Surveillance, reduce consequences of a potential perturbation to the electrical distribution systems during the performance of this Surveillance, and reduce challenges to safety systems, while at the same time avoiding the need to shutdown both units to perform this Surveillance, the Note only precludes satisfying this Surveillance Requirement for the load sequence relays associated with DG 3 and DG 4 when Unit 2 is in MODE 1, 2, or 3. During the performance of this Surveillance with Unit 2 not in MODE 1, 2, or 3 and with Unit 1 in MODE 1, 2, or 3; the applicable ACTIONS of the Unit 1 and Unit 2 Technical Specifications must be entered if a required offsite circuit, DG 3, or DG 4 is rendered inoperable by the performance of this Surveillance. Credit may be taken for unplanned events that satisfy this SR. SR 3.8.1.14 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded. This Surveillance demonstrates DG operation during a loss of offsite power actuation test signal in conjunction with an ECCS initiation signal. This test verifies all actions encountered from the event, including shedding of the nonessential loads and energization of the emergency (continued) Brunswick Unit 2 B 3.8.1-31 Revision No. 30

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued) REQUIREMENTS buses and respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time. The 10.5 second time period, which is allowed for the DG to auto-start and connect to its respective emergency bus, is conservatively derived from requirements of the accident analysis for responding to a design basis large break LOCA. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, or systems are not capable of being operated at full flow, or RHR systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified. The Frequency of 24 months takes into consideration plant conditions required to perform the Surveillance and is intended to be consistent with an expected fuel cycle length. This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil being continuously circulated and temperature maintained consistent with procedural guidance. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety (continued) Brunswick Unit 2 B 3.8.1-32 Revision No. 30

AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued) REQUIREMENTS systems. Due to the shared configuration of certain systems (required to mitigate DBAs and transients) between BNP Units 1 and 2, all four DGs are required to be OPERABLE to supply power to these systems when either one or both units are in MODE 1, 2, or 3. In order to reduce the potential consequences associated with removing a required offsite circuit from service during the performance of this Surveillance, reduce consequences of a potential perturbation to the electrical distribution systems during the performance of this Surveillance, and reduce challenges to safety systems, while at the same time avoiding the need to shutdown both units to perform this Surveillance, Note 2 only precludes satisfying this Surveillance Requirement for DG 3 and DG 4 when Unit 2 is in MODE 1, 2, or 3. During the performance of this Surveillance with Unit 2 not in MODE 1, 2, or 3 and with Unit 1 in MODE 1, 2, or 3; the applicable ACTIONS of the Unit 1 and Unit 2 Technical Specifications must be entered if a required offsite circuit, DG 3, DG 4, or other supported Technical Specification equipment is rendered inoperable by the performance of this Surveillance. Credit may be taken for unplanned events that satisfy this SR. REFERENCES 1. UFSAR, Section 8.3.1.2.

2. UFSAR, Sections 8.2 and 8.3.

3. NRC Diagnostic Evaluation Team Report for Brunswick Steam Electric Plant dated August 2, 1989, from J. M. Taylor (NRC) to S. H. Smith, Jr. (CP&L).

4. UFSAR, Table 8-7.

5. Safety Guide 9.

6. UFSAR, Chapter 6.

7. UFSAR, Chapter 15.

8. 10 CFR 50.36(c)(2)(ii).

9. Regulatory Guide 1.93, December 1974.

10. Generic Letter 84-15.

(continued) Brunswick Unit 2 B 3.8.1-33 Revision No. 33

AC SourcesOperating B 3.8.1 BASES REFERENCES 11. Regulatory Guide 1.9, July 1993, Revision 3. (continued)

12. Regulatory Guide 1.137, January 1978.

13. IEEE Standard 308.

Brunswick Unit 2 B 3.8.1-34 Revision No. 30

AC SourcesShutdown B 3.8.2 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.2 AC SourcesShutdown BASES BACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1, "AC SourcesOperating." APPLICABLE The OPERABILITY of the minimum AC sources during MODES 4 SAFETY ANALYSES and 5, and during movement of irradiated fuel assemblies in the secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident.

In general, when the unit is shutdown the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, and 3 have no specific analyses in MODES 4 and 5. Worst case bounding events are deemed not credible in MODES 4 and 5 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and corresponding stresses result in the probabilities of occurrences significantly reduced or eliminated, and minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems. During MODES 1, 2, and 3, various deviations from the analysis assumptions and design requirements are allowed within the ACTIONS. This allowance is in recognition that certain testing and maintenance activities must be conducted, provided an acceptable level of risk is not (continued) Brunswick Unit 2 B 3.8.2-1 Revision No. 30

AC SourcesShutdown B 3.8.2 BASES APPLICABLE exceeded. During MODES 4 and 5, performance of a significant number SAFETY ANALYSES of required Testing and maintenance activities is also required. In (continued) MODES 4 and 5, the activities are generally planned and administratively controlled. Relaxations from typical MODES 1, 2, and 3 LCO requirements are acceptable during shutdown MODES, based on:

a. The fact that time in an outage is limited. This is a risk prudent goal as well as a utility economic consideration.

b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operation MODE analyses, or both.

c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.

d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODES 1, 2, and 3 OPERABILITY requirements) with systems assumed to function during an event.

In the event of an accident during shutdown, this LCO ensures the capability of supporting systems necessary for avoiding immediate difficulty, assuming a loss of all offsite power. The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 1). LCO One Unit 2 offsite circuit capable of supplying the onsite Class 1E power distribution subsystem(s) of LCO 3.8.8, "Distribution Systems Shutdown," ensures that all required Unit 2 loads are powered from offsite power. Two OPERABLE DGs, associated with distribution subsystem(s) required OPERABLE by LCO 3.8.8, ensures that a diverse power source is available for providing electrical power support assuming a loss of the offsite circuit(s). In addition, some Unit 1 equipment may be required by Unit 2 (e.g., Control Room Emergency Ventilation (CREV) System components). Therefore, one Unit 1 qualified circuit between the offsite (continued) Brunswick Unit 2 B 3.8.2-2 Revision No. 30

AC SourcesShutdown B 3.8.2 BASES LCO transmission network and the onsite Class 1E AC electrical power (continued) distribution subsystem(s), needed to support the Unit 1 equipment required to be OPERABLE, must also be OPERABLE. Together, OPERABILITY of the required offsite circuit(s) and DGs ensures the availability of sufficient AC sources to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents and reactor vessel draindown). The qualified offsite circuit(s) must be capable of maintaining rated frequency and voltage while connected to the respective emergency bus(es), and of accepting required loads during an accident. Qualified offsite circuits are those that are described in the UFSAR and are part of the licensing basis for the unit. The Unit 2 qualified offsite circuit consists of the incoming breaker and disconnect to and including the associated startup auxiliary transformer (SAT) or unit auxiliary transformer (UAT), the respective circuit path to and including the balance of plant bus(es), and the circuit path to associated 4.16 kV emergency bus(es) required by LCO 3.8.8. The Unit 1 qualified offsite circuit consists of the incoming breaker and disconnect to and including the associated SAT or UAT, the respective circuit path to and including the balance of plant bus(es), and the circuit path to associated 4.16 kV emergency bus(es) required by LCO 3.7.3, LCO 3.7.4, and LCO 3.8.5. The required DGs must be capable of starting, accelerating to minimum acceptable frequency and voltage, and connecting to its respective 4.16 kV emergency bus on detection of bus undervoltage. This sequence must be accomplished within 10.5 seconds. Each required DG is required to have an OPERABLE air start system. Additionally, each DG must be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the 4.16 kV emergency buses. These capabilities are required to be met from a variety of initial conditions such as DG in standby with engine at ambient conditions. Additional DG capabilities must be demonstrated to meet required Surveillances, e.g., capability of the DG to revert to standby status on an ECCS signal while operating in parallel test mode. Proper sequencing of loads, including tripping of (continued) Brunswick Unit 2 B 3.8.2-3 Revision No. 84

AC SourcesShutdown B 3.8.2 BASES LCO nonessential loads, is required function for DG OPERABILITY. The (continued) necessary portions of the Nuclear Service Water System are also required to provide appropriate cooling to each required DG. It is acceptable for 4.16 kV emergency buses to be cross tied during shutdown conditions, permitting a single offsite power circuit to supply all required buses provided both units are shutdown. APPLICABILITY The AC sources are required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment to provide assurance that:

a. Systems providing adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core in case of an inadvertent draindown of the reactor vessel;

b. Systems needed to mitigate a fuel handling accident are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

AC power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.1. ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in Mode 1, 2, or 3, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, or 3, would require the unit to be shutdown, but would not require immediate suspension of movement of irradiated fuel assemblies. The Note to the ACTIONS, "LCO 3.0.3 is not applicable," ensures that the actions for (continued) Brunswick Unit 2 B 3.8.2-4 Revision No. 84

AC SourcesShutdown B 3.8.2 BASES ACTIONS immediate suspension of irradiated fuel assembly movement are not (continued) postponed due to entry into LCO 3.0.3. A.1 and B.1 With one or more required offsite circuits inoperable, or with one DG inoperable, the remaining required AC sources may be capable of supporting sufficient required features (e.g., system, subsystem, division, component, or device) to allow continuation of CORE ALTERATIONS, fuel movement, and operations with a potential for draining the reactor vessel. For example, if two 4.16 kV emergency buses are required per LCO 3.8.8, one emergency bus with offsite power available may be capable of supplying sufficient required features. By the allowance of the option to declare required features inoperable that are not powered from offsite power (Required Action A.1) or capable of being powered by the required DG (Required Action B.1), appropriate restrictions can be implemented in accordance with the affected required feature(s) LCOs' ACTIONS. Required features remaining powered from the qualified offsite power circuit, even if the circuit is inoperable to other required features, are not declared inoperable by this Required Action. A.2.1, A.2.2, A.2.3, A.2.4, B.2.1, B.2.2, B.2.3, B.2.4, C.1, C.2, C.3, and C.4 With an offsite circuit not available to all required 4.16 kV emergency buses or one required DG inoperable, the option still exists to declare all required features inoperable (per Required Actions A.1 and B.1). Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. With two required DGs inoperable, the minimum required diversity of AC power sources is not available. It is, therefore, required to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies in the secondary containment, and activities that could result in inadvertent draining of the reactor vessel. Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC sources and to (continued) Brunswick Unit 2 B 3.8.2-5 Revision No. 30

AC SourcesShutdown B 3.8.2 BASES ACTIONS A.2.1, A.2.2, A.2.3, A.2.4, B.2.1, B.2.2, B.2.3, B.2.4, C.1, C.2, C.3, and C.4 (continued) continue this action until restoration is accomplished in order to provide the necessary AC power to the plant safety systems. The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power. Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore, the Required Actions of Condition A have been modified by a Note to indicate that when Condition A is entered with no AC power to any required 4.16 kV emergency bus, ACTIONS for LCO 3.8.8 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite circuit whether or not a required bus is de-energized. LCO 3.8.8 provides the appropriate restrictions for the situation involving a de-energized bus. SURVEILLANCE SR 3.8.2.1 REQUIREMENTS SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the required AC sources in other than MODES 1, 2, and 3 to be met. SR 3.8.1.8 is not required to be met since only one offsite circuit is required to be OPERABLE. SR 3.8.1.12 is not required to be met because the required OPERABLE DG(s) is not required to undergo periods of being synchronized to the offsite circuit. Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR. This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DG(s) from being paralleled with the offsite power network or otherwise rendered inoperable during the performance of SRs, and to preclude de-energizing a required 4.16 kV emergency bus (continued) Brunswick Unit 2 B 3.8.2-6 Revision No. 30

AC SourcesShutdown B 3.8.2 BASES SURVEILLANCE SR 3.8.2.1 (continued) REQUIREMENTS or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit(s) and the DGs. It is the intent that these SRs must still be capable of being met, but actual performance is not required during periods when the DGs and offsite circuit(s) are required to be OPERABLE unless Unit 1 Specification 3.8.1, "AC SourcesOperating," requires performance of these SRs. When Unit 1 Specification 3.8.1 requires performance of these SRs, AC sources availability is not limited due to the Unit 1 requirements for AC source OPERABILITY. Therefore, a single event, in this condition, is not expected to compromise both the required offsite circuit(s) and the DG(s). REFERENCES 1. 10 CFR 50.36(c)(2)(ii). Brunswick Unit 2 B 3.8.2-7 Revision No. 30

Diesel Fuel Oil B 3.8.3 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil BASES BACKGROUND Each diesel generator (DG) is provided with storage tanks having a fuel oil capacity sufficient to operate that DG for a period of approximately 7 days while the DG is operating at rated load as discussed in UFSAR, Section 8.3.1.1.6.2.8 (Ref. 1). The fuel consumption rate is calculated using the assumption that four DGs are available. The diesel generator fuel oil capacity in the combination of the fuel oil volumes of the Seismic Class I day fuel oil storage tanks (one tank for each diesel generator) and the Seismic Class I engine mounted fuel tanks (one tank attached to each diesel generator) provide approximately four days of diesel generator operation at rated load. The main fuel oil storage tank provides approximately three additional days of diesel generator operation at rated load to each of the day fuel oil storage tanks. The main fuel oil storage tank is seismically designed but not seismically qualified. Following the postulated loss of the main fuel oil storage tank, the onsite fuel oil capacity in seismically qualified storage tanks is sufficient to operate the DGs for longer than the time to replenish the onsite supply from outside sources as discussed in Reference 1. Fuel oil is transferred from the day fuel oil storage tank to the engine mounted fuel tank by either of two transfer pumps associated with each day fuel oil storage tank. Fuel oil is gravity fed from the main fuel oil storage tank to the day fuel oil storage tanks through manual or automatic valves. However, level in the day fuel oil storage tanks is currently maintained through the use of the manual valves. Redundancy of pumps and piping, and the normally isolated gravity feed lines from the main fuel oil storage tank to the day fuel oil storage tanks, precludes the failure of one pump, or the rupture of any pipe, valve, or tank to result in the loss of more than one DG. All outside tanks, pumps, and piping (other than the main fuel oil storage tank and a portion of the associated piping) are located underground. (continued) Brunswick Unit 2 B 3.8.3-1 Revision No. 30

Diesel Fuel Oil B 3.8.3 BASES BACKGROUND For proper operation of the standby DGs, it is necessary to ensure the (continued) proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses the recommended fuel oil practices as modified by Reference 3. The fuel oil properties governed by SRs of this Specification are the water content, the kinematic viscosity, and impurity level. APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY ANALYSES analyses in UFSAR, Chapter 6 (Ref. 4), and Chapter 15 (Ref. 5), assume Engineered Safety Feature (ESF) systems are OPERABLE. The DGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that reactor fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, "Power Distribution Limits"; Section 3.5, "Emergency Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling (RCIC) System"; and Section 3.6, "Containment Systems." Since diesel fuel oil supports the operation of the standby AC power sources, it satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 6). LCO Stored diesel fuel oil is required to have sufficient supply for approximately 7 days of operation at rated load. It is also required to meet specific standards for quality. These requirements, in conjunction with an ability to obtain replacement supplies within approximately 7 days, support the availability of DGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational occurrence (AOO) or a postulated DBA with loss of offsite power. DG engine mounted tank fuel oil requirements, as well as transfer capability from the day fuel oil storage tank to the engine mounted tank, are addressed in LCO 3.8.1, "AC SourcesOperating," and LCO 3.8.2, "AC Sources Shutdown." (continued) Brunswick Unit 2 B 3.8.3-2 Revision No. 30

Diesel Fuel Oil B 3.8.3 BASES (continued) APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AOO or a postulated DBA. Because stored diesel fuel oil supports LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil, is required to be within limits when the associated DG is required to be OPERABLE. ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each DG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable DG subsystem. Complying with the Required Actions for one inoperable DG subsystem may allow for continued operation, and subsequent inoperable DG subsystem(s) governed by separate Condition entry and application of associated Required Actions. A.1 and B.1 With one or more required DGs with fuel oil level in the associated day fuel oil storage tanks < 22,650 gallons per required DG and 17,000 gallons per required DG and the fuel oil level in the main fuel oil storage tank 20,850 gallons per required DG, the approximate 7 day fuel oil supply for a required DG is not available. However, Condition A is restricted to fuel oil level reductions that maintain at least an approximate 6 day supply (at least an approximate 3 day supply is available in the required day fuel oil storage tanks and an approximate 3 day supply is available in the main fuel oil storage tank). With one or more required DGs with fuel oil level in the main fuel oil storage tank < 20,850 gallons per required DG and 13,900 gallons per required DG and the fuel oil level in the required day fuel oil storage tank(s) 22,650 gallons per required DG, the approximate 7 day fuel oil supply for a required DG is not available. However, Condition B is restricted to fuel oil level reductions that maintain at least an approximate 6 day supply (at least an approximate 2 day supply is available in the main fuel oil storage tank and an approximate 4 day supply is available in the required day fuel oil storage tanks(s)). (continued) Brunswick Unit 2 B 3.8.3-3 Revision No. 30

Diesel Fuel Oil B 3.8.3 BASES ACTIONS A.1 and B.1 (continued) These circumstances may be caused by events such as:

a. Full load operation required for an inadvertent start while at minimum required level; or

b. Feed and bleed operations that may be necessitated by increasing particulate levels or any number of other oil quality degradations.

These restrictions (Required Actions A.1 and B.1) allow sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of the fuel oil to the tank. A period of 48 hours is considered sufficient to complete restoration of the required level prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity ( approximately 6 days), the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period. C.1 This Condition is entered as a result of a failure to meet the acceptance criterion for particulates. Normally, trending of particulate levels allows sufficient time to correct high particulate levels prior to reaching the limit of acceptability. Poor sample procedures (bottom sampling), contaminated sampling equipment, and errors in laboratory analysis can produce failures that do not follow a trend. Since the presence of particulates does not mean failure of the fuel oil to burn properly in the diesel engine, since particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and since proper engine performance has been recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated DG inoperable. The 7 day Completion Time allows for further evaluation, resampling, and re-analysis of the DG fuel oil. (continued) Brunswick Unit 2 B 3.8.3-4 Revision No. 30

Diesel Fuel Oil B 3.8.3 BASES ACTIONS D.1 (continued) With a Required Action and associated Completion Time of Condition A, B, or C not met, or the stored diesel fuel oil not within limits for reasons other than addressed by Conditions A, B, or C, the associated DG may be incapable of performing its intended function and must be immediately declared inoperable. SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the storage tanks to support each DG's operation for approximately 7 days at rated load. The approximate 7 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location. For the purposes of this SR, the verification of the main fuel oil storage tank fuel oil volume is performed on a per DG basis. This per DG volume is obtained using the following equation: M VOL U VOL NDG

                            ; where MVOL           =      measured fuel oil volume of the main fuel oil storage tank, UVOL           =      unusable fuel oil volume of the main fuel oil storage tank, and NDG            =      number of DGs required to be OPERABLE.

The results from this equation must be 20,850 gallons in order to satisfy the acceptance criteria of SR 3.8.3.1.b. The 31 day Frequency is adequate to ensure that a sufficient supply of fuel oil is available, since low level alarms are provided and unit operators would be aware of any large uses of fuel oil during this period. (continued) Brunswick Unit 2 B 3.8.3-5 Revision No. 49

Diesel Fuel Oil B 3.8.3 BASES SURVEILLANCE SR 3.8.3.2 REQUIREMENTS Once per 92 days, the stored fuel oil is sampled in accordance with ASTM D4057-06, (Ref. 7) and analyzed to establish that the viscosity limits specified in Table 1 of ASTM D975-06b (Ref. 7) are met for stored fuel oil. The 92 day period is acceptable because fuel oil viscosity, even if it was not within stated limits, would not have an immediate effect on DG operation. This Surveillance, in combination with the fuel oil delivery certificate of analysis or equivalent, ensures the availability of high quality fuel oil for the DGs. Fuel oil degradation during long term storage shows up as an increase in particulate, mostly due to oxidation. The presence of particulate does not mean that the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure. Particulate concentrations should be determined in accordance with ASTM D6217-98(2003)e1 (Ref. 7), except that the filters specified in ASTM D6217-98(2003)e1 (Sections 4.1, 7.6, and 7.7) may have a nominal pore size up to 3 microns. This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing. For the BNP design, the total volume of stored fuel oil is contained in more than two interconnected tanks. Therefore, each tank must be considered and tested separately. The Frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between Frequency intervals. The acceptability of new diesel fuel is verified by testing of the fuel oil. New fuel oil is sampled in accordance with ASTM D4507-06 (Ref. 7). The tests listed in Table 1.6 of Reference 3 (Specific or API Gravity, Water and Sediment, and Viscosity) are a means of determining whether fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. Failure to meet any of the limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO since the fuel oil is not added to the storage tanks. Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-06b (Ref. 7) are met for new fuel oil when tested in (continued) Brunswick Unit 2 B 3.8.3-6 Revision No. 74

Diesel Fuel Oil B 3.8.3 BASES SURVEILLANCE SR 3.8.3.2 (continued) REQUIREMENTS accordance with ASTM D975-06b (Ref. 7). The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within limits, would not have an immediate effect on DG operations. This Surveillance ensures the availability of high quality fuel oil for the DGs. SR 3.8.3.3 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel storage tanks once every 31 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is established by Regulatory Guide 1.137 (Ref. 2). This SR is for preventive maintenance. The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during performance of the Surveillance. REFERENCES 1. UFSAR, Section 8.3.1.1.6.2.8.

2. Regulatory Guide 1.137, January 1978.

3. UFSAR, Section 1.8.

4. UFSAR, Chapter 6.

5. UFSAR, Chapter 15.

6. 10 CFR 50.36(c)(2)(ii).

7. ASTM Standards: D4057-06; D975-06b; and D6217-98(2003)e1.

Brunswick Unit 2 B 3.8.3-7 Revision No. 74

DC SourcesOperating B 3.8.4 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.4 DC SourcesOperating BASES BACKGROUND The DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment. Also, these DC subsystems provide a source of uninterruptible power to AC vital buses. As required by design bases in UFSAR Section 8.3.2.1.1 (Ref. 1), the DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure. The DC electrical power system also conforms to the recommendations of Safety Guide 6 (Ref. 2). The DC power sources provide both motive and control power to selected safety related equipment, as well as power for circuit breaker control, relay operation, plant annunciation, and emergency lighting. There are two independent divisions per unit, designated Division I and Division II. Each division consists of a 250 VDC battery center tapped to form two 125 VDC batteries. Each 125 VDC battery has an associated full capacity battery charger. The chargers are supplied from the same AC load groups for which the associated DC subsystem supplies the control power. During normal operation, the DC loads are powered from the battery chargers with the batteries floating on the system. In case of loss of normal power to the battery charger, the DC loads are automatically powered from the station batteries. The DC power distribution system is described in more detail in Bases for LCO 3.8.7, "Distribution SystemOperating," and LCO 3.8.8, "Distribution SystemShutdown." Each battery has adequate storage capacity to meet the duty cycles discussed in UFSAR Section 8.3.2 (Ref. 10). (continued) Brunswick Unit 2 B 3.8.4-1 Revision No. 82

DC SourcesOperating B 3.8.4 BASES BACKGROUND Each DC battery subsystem (division) is separately housed in a battery (continued) room with its associated chargers and main DC distribution switchboard. This arrangement provides complete separation and isolation of the redundant DC subsystems to ensure that a single failure in one subsystem does not cause a failure in a redundant subsystem. The batteries for DC electrical power subsystems are sized to produce required capacity at 80% of nameplate rating, corresponding to warranted capacity at end of life cycles and the 100% design demand. The minimum design voltage limit is 105/210 V. Each battery charger of DC electrical power subsystem has ample power output capacity for the steady state operation of connected loads required during normal operation, while at the same time maintaining its battery bank fully charged. Each station service battery charger has sufficient capacity to restore the battery from the design minimum charge to its fully charged state in approximately 8 hours while supplying normal steady state loads (Ref. 3). A description of the Unit 1 DC power sources is provided in the Bases for Unit 1 LCO 3.8.4, "DC SourcesOperating." APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY ANALYSES analyses in the UFSAR, Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume that Engineered Safety Feature (ESF) systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the diesel generators (DGs), emergency auxiliaries, and control and switching during all MODES of operation. The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining DC sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite AC power; and

b. A worst case single failure.

The DC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 6). (continued) Brunswick Unit 2 B 3.8.4-2 Revision No. 30

DC SourcesOperating B 3.8.4 BASES (continued) LCO The Unit 2 Division I and Division II DC electrical power subsystems, with each DC subsystem consisting of two 125 V batteries (Batteries 2A-1 and 2A-2 for Division I and Batteries 2B-1 and 2B-2 for Division II), two battery chargers (one per battery) and the corresponding control equipment and interconnecting cabling supplying power to the associated bus are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. In addition, DC control power for operation of two of the four 4.16 kV emergency buses and two of the four 480 V emergency buses, as well as control power for two of the four DGs, is provided by the Unit 1 DC electrical power subsystems. Therefore, Unit 1 Division I and Division II DC electrical power subsystems are also required to be OPERABLE. Unit 1 DC electrical power subsystem OPERABILITY requirements are the same as those required for a Unit 2 DC electrical power subsystem. Loss of any DC electrical power subsystem does not prevent the minimum safety function from being performed (Ref. 1). APPLICABILITY The DC electrical power sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure safe unit operation and to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.

The DC electrical power requirements for MODES 4 and 5 and other conditions in which the DC electrical power sources are required are addressed in LCO 3.8.5, "DC Sources Shutdown." ACTIONS A.1 Pursuant to LCO 3.0.6, the Distribution SystemsOperating ACTIONS would not be entered even if the DC electrical power subsystem inoperability resulted in de-energization of an AC electrical power distribution subsystem or a DC electrical power distribution subsystem. (continued) Brunswick Unit 2 B 3.8.4-3 Revision No. 30

DC SourcesOperating B 3.8.4 BASES ACTIONS A.1 (continued) Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A results in de-energization of an AC electrical power distribution subsystem or a DC electrical power distribution subsystem, Actions of LCO 3.8.7 must be immediately entered. This allows Condition A to provide requirements for the loss of a DC electrical power subsystem without regard to whether a distribution subsystem is de-energized. LCO 3.8.7 provides the appropriate restriction for a de-energized distribution subsystem. Condition A represents one division with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is therefore imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected division. If one of the required DC electrical power subsystems is inoperable (e.g., inoperable battery, inoperable battery charger(s), or inoperable battery charger and associated inoperable battery), the remaining DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst case single failure could, however, result in the loss of minimum necessary DC electrical subsystems to mitigate a worst case accident, continued power operation should not exceed 7 days. The Completion time is based on the capacity and capability of the remaining DC Sources, including the enhanced reliability afforded by the capability to manually transfer DC loads to the opposite unit's DC electrical power distribution subsystems. B.1 and B.2 If the DC electrical power subsystem cannot be restored to OPERABLE status within the required Completion Time or if two or more DC electrical power subsystems are inoperable, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on (continued) Brunswick Unit 2 B 3.8.4-4 Revision No. 30

DC SourcesOperating B 3.8.4 BASES ACTIONS B.1 and B.2 (continued) operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. The Completion Time to bring the unit to MODE 4 is consistent with the time required in Regulatory Guide 1.93 (Ref. 7). SURVEILLANCE SR 3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the charging system and the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state. The voltage requirements are based on the nominal design voltage of the battery. The 7 day Frequency is conservative when compared with manufacturer recommendations and IEEE-450 (Ref. 8). SR 3.8.4.2 Visual inspection to detect corrosion of the battery cells and connections, or measurement of the resistance of each inter-cell and inter-rack connection, provides an indication of physical damage or abnormal deterioration that could potentially degrade battery performance. The connection resistance limits are 1.2 times the established benchmark resistance values for the connections or 5µohms above the established benchmark resistance values for the connections, whichever is higher. These connection resistance acceptance criteria were derived from IEEE-450 (Ref. 8) and IEEE-484 (Ref. 9), respectively. The Frequency for these inspections, which can detect conditions that can cause power losses due to resistance heating, is 92 days. This Frequency is consistent with manufacturers recommendations. (continued) Brunswick Unit 2 B 3.8.4-5 Revision No. 30

DC SourcesOperating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.3 REQUIREMENTS (continued) Visual inspection of the battery cells, cell plates, and battery racks provides an indication of physical damage or abnormal deterioration that could potentially degrade battery performance. The presence of physical damage or deterioration does not necessarily represent a failure of this SR, provided an evaluation determines that the physical damage or deterioration does not affect the OPERABILITY of the battery (its ability to perform its design function). The 18 month Frequency for the Surveillance is based on engineering judgement. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. SR 3.8.4.4 Visual inspection of inter-cell and inter-rack connections provides an indication of physical damage or abnormal deterioration that could indicate degraded battery condition. The anti-corrosion material is used to help ensure good electrical connections and to reduce terminal deterioration. The visual inspection for corrosion is not intended to require removal of and inspection under each terminal connection. The removal of visible corrosion is a preventive maintenance SR. The presence of visible corrosion does not necessarily represent a failure of this SR, provided visible corrosion is removed during performance of this Surveillance. The 18 month Frequency for the Surveillance is based on engineering judgement. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. SR 3.8.4.5 Battery charger capability requirements are derived from the design capacity of the chargers. According to Reference 3, the battery charger supply is required to be based on the largest combined demands of the (continued) Brunswick Unit 2 B 3.8.4-6 Revision No. 30

DC SourcesOperating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.5 (continued) REQUIREMENTS various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, under any load condition. The minimum required amperes and duration ensures that these requirements can be satisfied. The Frequency is acceptable, given battery charger reliability and the other administrative controls existing to ensure adequate charger performance during these 24 month intervals. In addition, this Frequency is intended to be consistent with expected fuel cycle lengths. SR 3.8.4.6 A battery service test is a special test of the battery's capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length corresponds to the design duty cycle requirements as specified in Reference 10. The Frequency of 24 months is acceptable, given unit conditions required to perform the test and the other requirements existing to ensure adequate battery performance during these 24 month intervals. In addition, this Frequency is intended to be consistent with expected fuel cycle lengths. This SR is modified by three Notes. Note 1 allows the performance of a modified performance discharge test in lieu of a service test once per 60 months. This substitution is acceptable because a modified performance discharge test represents a more severe test of battery capacity than SR 3.8.4.6. The reason for Note 2 is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. Due to the shared configuration of certain systems (required to mitigate DBAs and transients) between BNP Units 1 and 2, both Unit 1 and Unit 2 DC electrical power subsystems are required to supply power to these systems when either one or both units are in MODE 1, 2, or 3. In order to reduce the potential consequences associated with removing a required DC electrical power subsystem from service during the performance of (continued) Brunswick Unit 2 B 3.8.4-7 Revision No. 30

DC SourcesOperating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.6 (continued) REQUIREMENTS this Surveillance, reduce consequences of a potential perturbation to the electrical distribution systems during the performance of this Surveillance, and reduce challenges to safety systems, while at the same time avoiding the need to shutdown both units to perform this Surveillance, Note 2 only precludes satisfying this Surveillance for the Unit 2 DC electrical power subsystems when Unit 2 is in MODE 1 or 2. During the performance of this Surveillance with Unit 2 not in MODE 1 or 2 and with Unit 1 in MODE 1, 2, or 3; the applicable ACTIONS of the Unit 1 and Unit 2 Technical Specifications must be entered if a required DC electrical power subsystem or other supported Technical Specification equipment is rendered inoperable by the performance of this Surveillance. Credit may be taken for unplanned events that satisfy the Surveillance. To minimize testing, Note 3 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the test can be met by performing the test on a single unit. If a DC electrical power subsystem fails the Surveillance, the DC electrical power subsystem should be considered inoperable for both units. SR 3.8.4.7 A battery performance discharge test is a test of constant current capacity of a battery, normally done in the as found condition, after having been in service, to detect any change in the capacity determined by the acceptance test. The test is intended to determine overall battery degradation due to age and usage. A battery modified performance discharge test is a simulated duty cycle consisting of just two rates; the one minute rate published for the battery or the largest current load of the duty cycle, followed by the test rate employed for the performance discharge test, both of which envelope the duty cycle of the service test. Since the ampere-hours removed by a rated one minute discharge represents a very small portion of the battery capacity, the test rate can be changed to that for the performance test without compromising the results of the performance discharge test. (continued) Brunswick Unit 2 B 3.8.4-8 Revision No. 30

DC SourcesOperating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.7 (continued) REQUIREMENTS The battery terminal voltage for the modified performance discharge test should remain above the minimum battery terminal voltage specified in the battery performance discharge test for the duration of time equal to that of the performance discharge test. A modified discharge test is a test of the battery capacity and its ability to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will often confirm the battery's ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for a performance discharge test. Either the battery performance discharge test or the modified performance discharge test is acceptable for satisfying SR 3.8.4.7; however, only the modified performance discharge test may be used to satisfy SR 3.8.4.7 while satisfying the requirements of SR 3.8.4.6 at the same time. The acceptance criteria for this Surveillance is consistent with IEEE-450 (Ref. 8) and IEEE-485 (Ref. 11). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements. The Frequency for this test is normally 60 months. If the battery shows degradation, or if the battery has reached 85% of its expected life and capacity is < 100% of the manufacturer's rating, the Surveillance Frequency is reduced to 12 months. However, if the battery shows no degradation but has reached 85% of its expected life, the Surveillance Frequency is only reduced to 24 months for batteries that retain capacity 100% of the manufacturer's rating. Degradation is indicated, according to IEEE-450 (Ref. 8), when the battery capacity drops by more than 10% relative to its capacity on the previous performance test or when it is 10% below the manufacturer's rating. The 60 month Frequency is consistent with the recommendations in IEEE-450 (Ref. 8). The 12 month and 24 month Frequencies are derived from the recommendations in IEEE-450 (Ref. 8). (continued) Brunswick Unit 2 B 3.8.4-9 Revision No. 30

DC SourcesOperating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.7 (continued) REQUIREMENTS This SR is modified by two Notes. The reason for Note 1 is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. Due to the shared configuration of certain systems (required to mitigate DBAs and transients) between BNP Units 1 and 2, both Unit 1 and Unit 2 DC electrical power subsystems are required to supply power to these systems when either one or both units are in MODE 1, 2, or 3. In order to reduce the potential consequences associated with removing a required DC electrical power subsystem from service during the performance of this Surveillance, reduce consequences of a potential perturbation to the electrical distribution systems during the performance of this Surveillance, and reduce challenges to safety systems, while at the same time avoiding the need to shutdown both units to perform this Surveillance, Note 1 only precludes satisfying this Surveillance for the Unit 2 DC electrical power subsystems when Unit 2 is in MODE 1 or 2. During the performance of this Surveillance with Unit 2 not in MODE 1 or 2 and with Unit 1 in MODE 1, 2, or 3; the applicable ACTIONS of the Unit 1 and Unit 2 Technical Specifications must be entered if a required DC electrical power subsystem or other supported Technical Specification equipment is rendered inoperable by the performance of this Surveillance. Credit may be taken for unplanned events that satisfy the Surveillance. To minimize testing, Note 2 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the test can be met by performing the test on a single unit. If a DC electrical power subsystem fails the Surveillance, the DC electrical power subsystem should be considered inoperable for both units. REFERENCES 1. UFSAR, Section 8.3.2.1.1.

2. Safety Guide 6.

3. UFSAR, Section 8.3.2.1.2.

4. UFSAR, Chapter 6.

5. UFSAR, Chapter 15.

(continued) Brunswick Unit 2 B 3.8.4-10 Revision No. 30

DC SourcesOperating B 3.8.4 BASES REFERENCES 6. 10 CFR 50.36(c)(2)(ii). (continued)

7. Regulatory Guide 1.93, December 1974.

8. IEEE Standard 450, 1987.

9. IEEE Standard 484, 1996.

10. UFSAR, Section 8.3.2.

11. IEEE Standard 485, 1983.

Brunswick Unit 2 B 3.8.4-11 Revision No. 30

DC SourcesShutdown B 3.8.5 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.5 DC SourcesShutdown BASES BACKGROUND A description of the DC sources is provided in the Bases for LCO 3.8.4, "DC SourcesOperating." APPLICABLE The initial conditions of Design Basis Accident and transient analyses SAFETY ANALYSES in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume that Engineered Safety Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the diesel generators (DGs), emergency auxiliaries, and control and switching during all MODES of operation and during movement of irradiated fuel assemblies in the secondary containment. The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY. The OPERABILITY of the minimum DC electrical power sources during MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident.

In general, when the unit is shutdown, the Technical Specification requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required. The rationale for this is based on the fact that many Design Basis (continued) Brunswick Unit 2 B 3.8.5-1 Revision No. 30

DC SourcesShutdown B 3.8.5 BASES APPLICABLE Accidents (DBAs) that are analyzed in MODES 1, 2, and 3 have no SAFETY ANALYSES specific analyses in MODES 4 and 5. Worst case bounding events are (continued) deemed not credible in MODES 4 and 5 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems. The shutdown Technical Specification requirements are designed to ensure that the unit has the capability to mitigate the consequences of certain postulated accidents. Worst case DBAs, which are analyzed for operating MODES, are not as significant a concern during shutdown MODES due to lower energies involved. The Technical Specifications, therefore, require a lesser complement of electrical equipment to be available during shutdown than is required during operating MODES. More recent work completed on the potential risks associated with shutdown, however, have found significant risk associated with certain shutdown evolutions. As a result, in addition to the requirements established in the Technical Specifications, the industry has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," as an industry initiative to manage shutdown and associated electrical support to maintain risk at an acceptable low level. This may require the availability of additional equipment beyond that required by the shutdown Technical Specifications. The DC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). LCO The required Unit 2 DC electrical power subsystem consisting of two 125 V batteries in series, two battery chargers (one per battery), and the corresponding control equipment and interconnecting cabling supplying power to the associated bus, needed to support one DC distribution subsystem is required to be OPERABLE. This requirement ensures the availability of sufficient DC electrical power sources to operate the unit in (continued) Brunswick Unit 2 B 3.8.5-2 Revision No. 30

DC SourcesShutdown B 3.8.5 BASES LCO a safe manner and to mitigate the consequences of postulated events (continued) during shutdown (e.g., fuel handling accidents and inadvertent reactor vessel draindown). APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment provide assurance that:

a. Required features to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core in case of an inadvertent draindown of the reactor vessel;

b. Required features needed to mitigate a fuel handling accident are available;

c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The DC electrical power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.4. ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, or 3, would require the unit to be shutdown, but would not require immediate suspension of movement of irradiated fuel assemblies. The Note to the ACTIONS, "LCO 3.0.3 is not applicable," ensures that the actions for immediate suspension of irradiated fuel assembly movement are not postponed due to entry into LCO 3.0.3. (continued) Brunswick Unit 2 B 3.8.5-3 Revision No. 30

DC SourcesShutdown B 3.8.5 BASES ACTIONS A.1, A.2.1, A.2.2, A.2.3, and A.2.4 (continued) By allowance of the option to declare required features inoperable with associated DC electrical power subsystem(s) inoperable, appropriate restrictions are implemented in accordance with the affected system LCOs' ACTIONS. However, in many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies in the secondary containment, and any activities that could result in inadvertent draining of the reactor vessel). Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystems and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the plant safety systems. The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystems should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power. SURVEILLANCE SR 3.8.5.1 REQUIREMENTS SR 3.8.5.1 requires certain Surveillances required by LCO 3.8.4 to be met. Therefore, see the corresponding Bases for LCO 3.8.4 for a discussion of each SR. This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC sources from being discharged below their capability to provide the required power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that these SRs must still be capable of being met, but actual performance is not required unless Unit 1 Specification 3.8.4, "DC SourcesOperating," requires performance of these SRs. (continued) Brunswick Unit 2 B 3.8.5-4 Revision No. 30

DC SourcesShutdown B 3.8.5 BASES SURVEILLANCE SR 3.8.5.1 (continued) REQUIREMENTS When Unit 1 Specification 3.8.4 requires performance of these SRs, DC source availability is not limited, due to the Unit 1 requirements for DC source OPERABILITY. Therefore, in this condition, other DC sources would be available to supply the required loads. REFERENCES 1. UFSAR, Chapter 6.

2. UFSAR, Chapter 15.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.8.5-5 Revision No. 30

Battery Cell Parameters B 3.8.6 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.6 Battery Cell Parameters BASES BACKGROUND This LCO delineates the limits on electrolyte temperature, level, float voltage, and specific gravity for the DC electrical power subsystems batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC Sources Operating," and LCO 3.8.5, "DC SourcesShutdown." APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY ANALYSES analyses in UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE. The DC electrical power subsystems provide normal and emergency DC electrical power for the diesel generators (DGs), emergency auxiliaries, and control and switching during all MODES of operation. The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit as discussed in the Bases for LCO 3.8.4 and LCO 3.8.5. Since battery cell parameters support the operation of the DC electrical power subsystems, they satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). LCO Battery cell parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA. Electrolyte limits are conservatively established, allowing continued DC electrical system function even with Category A and B limits not met. APPLICABILITY The battery cell parameters are required solely for the support of the associated DC electrical power subsystem. Therefore, these cell parameters are only required when the associated DC electrical power subsystem is required to be OPERABLE. Refer to the Applicability discussions in Bases for LCO 3.8.4 and LCO 3.8.5. (continued) Brunswick Unit 2 B 3.8.6-1 Revision No. 30

Battery Cell Parameters B 3.8.6 BASES (continued) ACTIONS The ACTIONS Table is modified by a Note indicating that a separate Condition entry is allowed for each battery. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each battery with battery cell parameters not within limits. Complying with the Required Actions may allow for continued operation, and subsequent batteries with battery cell parameters not within limits are governed by subsequent Condition entry and application of associated Required Actions. A.1, A.2, and A.3 With parameters of one or more cells in one or more batteries not within limits (i.e., Category A limits not met or Category B limits not met, or Category A and B limits not met) but within the Category C limits specified in Table 3.8.6-1, the battery is degraded but there is still sufficient capacity to perform the intended function. Therefore, the affected battery is not required to be considered inoperable solely as a result of Category A or B limits not met, and continued operation is permitted for a limited period. The pilot cell(s) electrolyte level and float voltage are required to be verified to meet the Category C limits within 1 hour (Required Action A.1). This check provides a quick indication of the status of the remainder of the battery cells. One hour provides time to inspect the electrolyte level and to confirm the float voltage of the pilot cell(s). One hour is considered a reasonable amount of time to perform the required verification. Verification that the Category C limits are met (Required Action A.2) provides assurance that during the time needed to restore the parameters to the Category A and B limits, the battery is still capable of performing its intended function. A period of 24 hours is allowed to complete the initial verification because specific gravity measurements must be obtained for each connected cell. Taking into consideration both the time required to perform the required verification and the assurance that the battery cell parameters are not severely degraded, this time is considered reasonable. The verification is repeated at 7 day intervals until the (continued) Brunswick Unit 2 B 3.8.6-2 Revision No. 30

Battery Cell Parameters B 3.8.6 BASES ACTIONS A.1, A.2, and A.3 (continued) parameters are restored to Category A and B limits. This periodic verification is consistent with the normal Frequency of pilot cell Surveillances. Continued operation prior to declaring the affected batteries inoperable is permitted for 31 days before battery cell parameters must be restored to within Category A and B limits. Taking into consideration that, while battery capacity is degraded, sufficient capacity exists to perform the intended function and to allow time to fully restore the battery cell parameters to normal limits, this time is acceptable for operation prior to declaring the DC batteries inoperable. B.1 When any battery parameter is outside the Category C limit for any connected cell, sufficient capacity to supply the maximum expected load requirement is not ensured and the corresponding DC electrical power subsystem must be declared inoperable. Additionally, other potentially extreme conditions, such as any Required Action of Condition A and associated Completion Time not met or average electrolyte temperature of representative cells < 60°F, also are cause for immediately declaring the associated DC electrical power subsystem inoperable. SURVEILLANCE SR 3.8.6.1 REQUIREMENTS This SR verifies that Category A battery cell parameters are consistent with IEEE-450 (Ref. 4), which recommends regular battery inspections (at least one per month) including voltage, specific gravity, and electrolyte temperature of pilot cells. SR 3.8.6.2 The quarterly inspection of specific gravity and voltage is consistent with IEEE-450 (Ref. 4). (continued) Brunswick Unit 2 B 3.8.6-3 Revision No. 30

Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE SR 3.8.6.3 REQUIREMENTS (continued) This Surveillance verification that the average temperature of representative cells is within limits is consistent with a recommendation of IEEE-450 (Ref. 4) that states that the temperature of electrolytes in representative cells should be determined on a quarterly basis. Lower than normal temperatures act to inhibit or reduce battery capacity. This SR ensures that the operating temperatures remain within an acceptable operating range. This limit is based on manufacturer's recommendations and the battery sizing calculations. Table 3.8.6-1 This Table delineates the limits on electrolyte level, float voltage, and specific gravity for three different categories. The meaning of each category is discussed below. Category A defines the normal parameter limit for each designed pilot cell in each battery. The cells selected as pilot cells are those whose temperature, voltage, and electrolyte specific gravity approximate the state of charge of the entire battery. The Category A limits specified for electrolyte level are based on manufacturer's recommendations and are consistent with the guidance in IEEE-450 (Ref. 4), with the extra 1/4 inch allowance above the high water level indication for operating margin to account for temperature and charge effects. In addition to this allowance, Footnote (a) to Table 3.8.6-1 permits the electrolyte level to be temporarily above the specified maximum level during and following equalizing charge (i.e., for up to 3 days following the completion of an equalize charge), provided it is not overflowing. These limits ensure that the plates suffer no physical damage, and that adequate electron transfer capability is maintained in the event of transient conditions. IEEE-450 (Ref. 4) recommends that electrolyte level readings should be made only after the battery has been at float charge for at least 72 hours. (continued) Brunswick Unit 2 B 3.8.6-4 Revision No. 30

Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE Table 3.8.6-1 (continued) REQUIREMENTS The Category A limit specified for float voltage is 2.13 V per cell. This value is based on the manufacturer's recommendations and on the recommendation of IEEE-450 (Ref. 4), which states that prolonged operation of cells below 2.13 V can reduce the life expectancy of cells. The Category A limit specified for specific gravity for each pilot cell is 1.200 (0.015 below the manufacturer's fully charged nominal specific gravity or a battery charging current that had stabilized at a low value). This value is characteristic of a charged cell with adequate capacity. According to IEEE-450 (Ref. 4), the specific gravity readings are based on a temperature of 77°F (25°C). The specific gravity readings are corrected for actual electrolyte temperature and level. For each 3°F (1.67°C) above 77°F (25°C), 1 point (0.001) is added to the reading; 1 point is subtracted for each 3°F below 77°F. The specific gravity of the electrolyte in a cell increases with a loss of water due to electrolysis or evaporation. Level correction will be in accordance with manufacturer's recommendations. Category B defines the normal parameter limits for each connected cell. The term "connected cell" excludes any battery cell that may be jumpered out. The Category B limits specified for electrolyte level and float voltage are the same as those specified for Category A and have been discussed above. The Category B limit specified for specific gravity for each connected cell is 1.195 (0.020 below the manufacturer's fully charged, nominal specific gravity) with the average of all connected cells 1.205 (0.010 below the manufacturer's fully charged, nominal specific gravity). These values are based on manufacturer's recommendations. The minimum specific gravity value required for each cell ensures that a cell with a marginal or unacceptable specific gravity is not masked by averaging cells having higher specific gravities. Category C defines the limits for each connected cell. These values, although reduced, provide assurance that sufficient capacity exists to perform the intended function and maintain a margin of safety. When any (continued) Brunswick Unit 2 B 3.8.6-5 Revision No. 30

Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE Table 3.8.6-1 (continued) REQUIREMENTS battery parameter is outside the Category C limits, the assurance of sufficient capacity described above no longer exists, and the battery must be declared inoperable. The Category C limit specified for electrolyte level (above the top of the plates and not overflowing) ensures that the plates suffer no physical damage and maintain adequate electron transfer capability. The Category C limit for voltage is based on IEEE-450, Appendix C (Ref. 4), which states that a cell voltage of 2.07 V or below, under float conditions and not caused by elevated temperature of the cell, indicates internal cell problems and may require cell replacement. The Category C limit on average specific gravity 1.195, is based on manufacturer's recommendations (0.020 below the manufacturer's recommended fully charged, nominal specific gravity). In addition to that limit, it is required that the specific gravity for each connected cell must be no less than 0.020 below the average of all connected cells. This limit ensures that a cell with a marginal or unacceptable specific gravity is not masked by averaging with cells having higher specific gravities. The footnotes to Table 3.8.6-1 that apply to specific gravity are applicable to Category A, B, and C specific gravity. Footnote (b) requires the above mentioned correction for electrolyte level and temperature, with the exception that level correction is not required when battery charging current, while on float charge, is < 2 amps. This current provides, in general, an indication of acceptable overall battery condition. Because of specific gravity gradients that are produced during the recharging process, delays of several days may occur while waiting for the specific gravity to stabilize. A stabilized charging current is an acceptable alternative to specific gravity measurement for determining the state of charge of the designated pilot cell. This phenomenon is discussed in IEEE-450 (Ref. 4). Footnote (c) allows the float charge current to be used as an alternate to specific gravity for up to 7 days (continued) Brunswick Unit 2 B 3.8.6-6 Revision No. 30

Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE Table 3.8.6-1 (continued) REQUIREMENTS following a battery recharge. Within 7 days, each connected cell's specific gravity must be measured to confirm the state of charge. Following a minor battery recharge (such as equalizing charge that does not follow a deep discharge) specific gravity gradients are not significant, and confirming measurements may be made in less than 7 days. REFERENCES 1. UFSAR, Chapter 6.

2. UFSAR, Chapter 15.

3. 10 CFR 50.36(c)(2)(ii).

4. IEEE Standard 450, 1987.

Brunswick Unit 2 B 3.8.6-7 Revision No. 30

Distribution SystemsOperating B 3.8.7 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.7 Distribution SystemsOperating BASES BACKGROUND The onsite Class 1E AC and DC electrical power distribution system is divided into redundant and independent AC and DC electrical power distribution subsystems. The Class 1E AC electrical distribution system is divided into four load groups. Each load group consists of a primary emergency bus, its downstream secondary emergency bus, 120 VAC vital bus, and transformers and interconnecting cables. The buses associated with each of the four load groups are defined as follows: Load group E1 consists of 4.16 kV bus E1, 480 V bus E5, and 120 VAC vital bus 1E5. Load group E2 consists of 4.16 kV bus E2, 480 V bus E6, and 120 VAC vital bus 1E6. Load group E3 consists of 4.16 kV bus E3, 480 V bus E7, and 120 VAC vital bus 2E7. Load group E4 consists of 4.16 kV bus E4, 480 V bus E8, and 120 VAC vital bus 2E8. The E1 and E2 load groups are supplied from Unit 1 balance of plant (BOP) buses and primarily serve Unit 1 loads. The E3 and E4 load groups are supplied from Unit 2 BOP buses and primarily serve Unit 2 loads. In some instances loads associated with one unit are actually supplied from the opposite unit's load group buses. Each primary emergency bus (4.16 kV emergency bus) has access to two offsite sources of power via a common circuit path from its associated upstream BOP bus (master/slave breakers and interconnecting cables). In addition, each 4.16 kV emergency bus can be provided power from an onsite diesel generator (DG) source. The upstream BOP bus associated with each 4.16 kV emergency bus is normally connected to the main generator output via the unit auxiliary transformer. During a loss of the normal power source to the 4.16 kV BOP bus, the preferred source supply breaker attempts to close. If all offsite sources are unavailable, (continued) Brunswick Unit 2 B 3.8.7-1 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES BACKGROUND the affected 4.16 kV emergency bus is isolated from its associated (Continued) upstream 4.16 kV BOP bus and the onsite emergency DG will supply power to the 4.16 kV emergency bus. Control power for each 4.16 kV emergency bus is supplied from a Class 1E battery with manual transfer capability to another Class 1E battery. Additional descriptions of this system may be found in the Bases for Specification 3.8.1, "AC Sources-Operating," and the Bases for Specification 3.8.4, "DC Sources-Operating". The secondary plant distribution system includes 480 VAC emergency buses E5, E6, E7, and E8 and associated motor control centers (MCCs), transformers, and interconnecting cables. Secondary emergency buses E5, E6, E7, and E8 are supplied from primary emergency buses E1, E2, E3, and E4, respectively. Control power for each 480 VAC emergency bus is supplied from a Class 1E battery with manual transfer capability to another Class 1E battery. Additional descriptions of this system may be found in the Bases for Specification 3.8.4, "DC Sources-Operating". The 120 VAC vital buses 1E5, 1E6, 2E7, and 2E8 are arranged in four load groups and are powered from secondary emergency buses E5, E6, E7, and E8, respectively. There are two independent 125/250 VDC electrical power distribution subsystems. The list of required distribution buses is presented in Table B 3.8.7-1. APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY ANALYSES analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature (ESF) systems are OPERABLE. The AC and DC electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, "Power Distribution Limits"; Section 3.5, "Emergency Core Cooling System (ECCS) and Reactor Core Isolation Cooling (RCIC) System"; and Section 3.6, "Containment Systems." (continued) Brunswick Unit 2 B 3.8.7-2 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES APPLICABLE The OPERABILITY of the AC and DC electrical power distribution SAFETY ANALYSES subsystems is consistent with the initial assumptions of the accident (continued) analyses and is based upon meeting the design basis of the unit. This includes maintaining distribution systems OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite power; and

b. A worst case single failure.

The AC and DC electrical power distribution system satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). LCO The required electrical power distribution subsystems listed in Table B 3.8.7-1 ensure the availability of AC and DC electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. The Unit 2 AC and DC electrical power distribution subsystems are required to be OPERABLE. In addition, since some components required by Unit 2 receive power through Unit 1 DC electrical power distribution subsystems (e.g., control power for two of the four 4.16 kV emergency buses, two of the four 480 VAC emergency buses, and for two of the DGs, and two of four engineered safeguard system (ESS) panels), the Unit 1 DC electrical power distribution subsystems needed to support the required equipment must also be OPERABLE. As stated in Table B 3.8.7-1, each division of the AC and DC electrical power distribution systems is a subsystem. Maintaining the Division I and II AC and DC electrical power distribution subsystems OPERABLE ensures that the redundancy incorporated into the design of ESF is not defeated. Therefore, a single failure within any system or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor. The AC electrical power distribution subsystems require the associated buses and electrical circuits to be energized to their proper voltages. The DC electrical power distribution subsystems require the associated buses to be energized to their proper voltage from either the associated batteries or chargers. (continued) Brunswick Unit 2 B 3.8.7-3 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES LCO Based on the number of safety significant electrical loads associated with (continued) each bus listed in Table B 3.8.7-1, if one or more of the buses becomes inoperable, entry into the appropriate ACTIONS of LCO 3.8.7 is required. Other buses, such as MCCs and distribution panels, which help comprise the AC and DC distribution systems are not listed in Table B 3.8.7-1. The loss of electrical loads associated with these buses may not result in a complete loss of a redundant safety function necessary to shut down the reactor and maintain it in a safe condition. Therefore, should one or more of these buses become inoperable due to a failure not affecting the OPERABILITY of a bus listed in Table B 3.8.7-1 (e.g., a breaker supplying a single MCC fails open), the individual loads on the bus must be declared inoperable, and the appropriate Conditions and Required Actions of the LCOs governing the individual loads would be entered. However, if one or more of these buses is inoperable due to a failure also affecting the OPERABILITY of a bus listed in Table B 3.8.7-1 (e.g., loss of a 4.16kV emergency bus, which results in de-energization of all buses powered from the 4.16 kV emergency bus), then although the individual loads are still considered inoperable, the Conditions and Required Actions of the LCO for the individual loads are not required to be entered, since LCO 3.0.6 allows this exception (i.e., the loads are inoperable due to the inoperability of a support system governed by a Technical Specification; the 4.16 kV emergency bus). In addition, tie breakers and transfer switches between redundant safety related AC and DC power distribution subsystems, if they exist, must be open. This includes control power transfer switches associated with the 4.16 kV and 480 V emergency buses and transfer switches associated with the ESS and DG panels. The requirement for tie breakers to be open between redundant buses and divisions is necessary to ensure independence of the redundant buses and divisions. Independence of the redundant buses and divisions is required to ensure that single-failure criteria are satisfied. This prevents any electrical malfunction in any power distribution subsystem from propagating to the redundant subsystem, which could cause the failure of a redundant subsystem and a loss of essential safety function(s). Except as noted below, if any tie breakers are closed or transfer switches aligned to the alternate supply, (continued) Brunswick Unit 2 B 3.8.7-4 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES (continued) LCO the affected redundant electrical power distribution subsystems are (continued) considered inoperable. This applies to the onsite, safety related, redundant electrical power distribution subsystems. It does not, however, preclude redundant Class 1E 4.16 kV emergency buses from being powered from the same offsite circuit. An exception to the requirement to maintain the cross-tie breakers open between the 4.16 kV emergency buses applies during breaker setup and/or Appendix R and Station Blackout testing of cross-tie breakers and their associated control circuitry. During these evolutions it is permissible to close one of the two series cross-tie breakers between the 4.16 kV buses if the remaining series cross-tie breaker has been racked-out and removed from its cubicle and control power for the closed breaker is maintained at all times while the breaker is closed; under these conditions independence of the redundant buses and divisions is maintained such that single-failure criteria are satisfied. APPLICABILITY The electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

Electrical power distribution subsystem requirements for MODES 4 and 5 and other conditions in which AC and DC electrical power distribution subsystems are required are covered in the Bases for LCO 3.8.8, "Distribution SystemsShutdown." ACTIONS A.1 With one AC electrical power distribution subsystem inoperable due to either inoperable load group E1 bus(es), or inoperable load group E2 bus(es), the remaining AC electrical power distribution load groups are capable of supporting the minimum safety functions necessary to shut (continued) Brunswick Unit 2 B 3.8.7-5 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES ACTIONS A.1 (continued) down the operating reactor and maintain both reactors in a safe condition, assuming no single failure in the remaining AC electrical power distribution load groups, when Unit 1 is in MODE 4 or 5. (If Unit 1 is in MODE 1, 2, or 3, then the Unit 1 ACTIONS of Specification 3.8.7, "Distribution SystemsOperating," require restoration of the associated AC electrical power distribution subsystem within 8 hours of the inoperability.) The overall reliability is reduced in Condition A, because a single failure in a remaining load group could result in the minimum required ESF functions not being supported. As a result, Required Action A.1 limits the time period to perform planned maintenance on a Unit 1 load group to 7 days. This is acceptable based on the following:

a. The other unit's load group buses are not as critical to the operating unit (fewer operating unit loads) as the operating unit's load group buses.

b. Performing maintenance on these components will increase the reliability of the Class 1E AC Electrical Power Distribution System.

c. The 7 day Completion Time provides a reasonable time frame for performance of planned maintenance.

During the planned maintenance of the load group buses, if a condition is discovered on these buses requiring corrective maintenance, this maintenance may be performed within the 7 day Completion Time of Required Action A.1. The Class 1E AC Electrical Power Distribution System is divided into four load groups. Each load group consists of a primary emergency bus, its downstream secondary emergency bus, 120 VAC vital bus, and transformers and interconnecting cables. The buses associated with each of the four load groups are defined as follows: (continued) Brunswick Unit 2 B 3.8.7-6 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES ACTIONS A.1 (continued) Load group E1 consists of 4.16 kV bus E1, 480 V bus E5, and 120 VAC vital bus 1E5. Load group E2 consists of 4.16 kV bus E2, 480 V bus E6, and 120 VAC vital bus 1E6. Load group E3 consists of 4.16 kV bus E3, 480 V bus E7, and 120 VAC vital bus 2E7. Load group E4 consists of 4.16 kV bus E4, 480 V bus E8, and 120 VAC vital bus 2E8. The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition A is entered while, for instance, an AC bus in a load group in a different division is inoperable and subsequently returned OPERABLE, this LCO may already have been not met for up to 8 hours. This situation could lead to a total duration of 176 hours (since initial failure to meet the LCO) to restore the AC Electrical Power Distribution System. At this time an AC bus in a load group in a different division could again become inoperable, and the load group removed under Condition A could be restored OPERABLE. This could continue indefinitely. This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock". This results in establishing the "time zero" at the time this LCO was initially not met, instead of at the time Condition A was entered. The 176 hour Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely. If while in Condition A, emergency buses associated with another load group become inoperable (e.g., buses in load groups E1 and E2 are concurrently inoperable), Condition B and F must be entered, as appropriate. (continued) Brunswick Unit 2 B 3.8.7-7 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES ACTIONS B.1 (continued) With one or more required AC buses or distribution panels in one division inoperable for reasons other than Condition A, the remaining AC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining AC electrical power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the required AC buses, and distribution panels must be restored to OPERABLE status within 8 hours. The Condition B worst scenario is one division without AC power (i.e., no offsite power to the division and the associated DG inoperable). In this Condition, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operators' attention be focused on minimizing the potential for loss of power to the remaining division by stabilizing the unit and restoring power to the affected division. The 8 hour time limit before requiring a unit shutdown in this Condition is acceptable because of:

a. The potential for decreased safety if the unit operators' attention is diverted from the evaluations and actions necessary to restore power to the affected division to the actions associated with taking the unit to shutdown within this time limit.

b. The low potential for an event in conjunction with a single failure of a redundant component in the division with AC power. (The redundant component is verified OPERABLE in accordance with Specification 5.5.11, "Safety Function Determination Program (SFDP).")

The second Completion Time for Required Action B.1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, a DC bus is inoperable and subsequently returned OPERABLE, this LCO (continued) Brunswick Unit 2 B 3.8.7-8 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES ACTIONS B.1 (continued) may already have been not met for up to 7 days. This situation could lead to a total duration of 176 hours, since initial failure to meet the LCO, to restore the AC electrical power distribution system. At this time a DC bus could again become inoperable, and the AC electrical power distribution system could be restored OPERABLE. This could continue indefinitely. This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This results in establishing the "time zero" at the time this LCO was initially not met, instead of at the time Condition B was entered. The 176 hour Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely. C.1, C.2, C.3 and C.4 Condition C applies to the 125 VDC buses listed in Table B 3.8.7-1 which can be supplied from either a normal or an alternate DC source. These buses are listed below:

a. 125 VDC Control Power Buses for 4.16 kV Switchgear E1, E2, E3, and E4;

b. 125 VDC Control Power Buses for 480 V Switchgear E5, E6, E7, and E8;

c. 125 VDC ESS Logic Cabinets H58, H59, H60, and H61; and

d. 125 VDC DG Panels DG-1, DG-2, DG-3, and DG-4.

Condition A permits the de-energization of the E1 load group bus(es) or the E2 load group bus(es) for planned maintenance when Unit 1 is in MODE 4 or 5. During a 4.16 kV or 480 V bus outage it is desirable to clear both the normal and alternate sources of DC control power to the bus for personnel safety. The de-energized AC bus is inoperable and not capable of supplying its loads regardless of the availability of DC control power. Hence, entry into Condition C as a result of performing maintenance under Condition A is not necessary; Condition D would apply. (continued) Brunswick Unit 2 B 3.8.7-9 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES ACTIONS C.1, C.2, C.3 and C.4 (continued) With one or more DC electrical power distribution subsystems inoperable due to loss of normal DC source, the remaining DC electrical power distribution subsystem(s) are capable of supporting the minimum safety functions necessary to shutdown the reactor and maintain it in a safe shutdown condition, provided safety function is not lost and assuming no single failure. However, the overall reliability is reduced because a single failure in the DC electrical power distribution system could result in a loss of two of four AC electrical load groups and the minimum required ESF functions not being supported. Therefore, action must be immediately initiated to transfer the DC electrical power distribution system to its alternate source and the affected supported equipment immediately declared inoperable. Upon completion of the transfer of the affected supported equipment's DC electrical power distribution subsystem to its OPERABLE alternate DC source, the affected supported equipment may be declared OPERABLE again. The ESS logic cabinets transfer automatically upon loss of the normal source. For an ESS logic cabinet, verification that the automatic transfer has occurred and alternate power is available to the ESS logic cabinet will satisfy Required Action C.2. By allowance of the option to declare affected supported equipment inoperable with associated DC electrical power distribution subsystems inoperable due to loss of normal DC source, more conservative restrictions are implemented in accordance with the affected system LCOs' ACTIONS. When any control power transfer switch associated with the 4.16 kV and 480 V emergency buses or any transfer switch associated with the ESS and DG panels is transferred to the alternate source, a single failure in the DC system could render two of four AC electrical load groups inoperable. Therefore, to prevent indefinite operation in this degraded condition, power from the normal DC source must be restored in 7 days. The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. Required Actions C.1 and C.2 should be completed as quickly as possible. The 7 day Completion Time of Required Action C.4 is considered to be acceptable due to the low potential for an event in conjunction with a single failure of a redundant (continued) Brunswick Unit 2 B 3.8.7-10 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES ACTIONS C.1, C.2, C.3 and C.4 (continued) component and is consistent with the allowed Completion Time for an inoperable DC electrical power subsystem specified in Specification 3.8.4, "DC SourcesOperating." The second Completion Time for Required Action C.4 establishes a limit on the maximum time allowed for any combination of required electrical power distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition C is entered while, for instance, an AC bus is inoperable and subsequently restored OPERABLE, the LCO may already have been not met for up to 8 hours. This situation could lead to a total duration of 176 hours, since initial failure to meet the LCO, to restore the DC electrical power distribution system. At this time, an AC bus could again become inoperable, and the DC electrical power distribution system could be restored OPERABLE. This could continue indefinitely. This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This allowance results in establishing the "time zero" at the time the LCO was initially not met, instead of at the time Condition C was entered. The 176 hour Completion Time is an acceptable limitation on this potential of failing to meet the LCO indefinitely. D.1 With one DC electrical power distribution subsystem inoperable for reasons other than Condition C, the remaining DC electrical power distribution subsystem is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution subsystem could result in the minimum required ESF functions not being supported. Therefore, the required DC electrical power distribution subsystem must be restored to OPERABLE status within 7 days by powering the bus from the associated batteries or chargers. (continued) Brunswick Unit 2 B 3.8.7-11 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES ACTIONS D.1 (continued) Condition D represents one division without adequate DC power, potentially with both the battery(s) significantly degraded and the associated charger(s) nonfunctioning. In this situation the plant is significantly more vulnerable to a complete loss of all DC power. It is, therefore, imperative that the operator's attention focus on stabilizing the plant, minimizing the potential for loss of power to the remaining divisions, and restoring power to the affected division. The 7 day Completion Time is consistent with the allowed Completion Time for an inoperable DC electrical power subsystem specified in Specification 3.8.4, "DC SourcesOperating". Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 7 days, is acceptable because of:

a. The potential for decreased safety when requiring a change in plant conditions (i.e., requiring a shutdown) while not allowing stable operations to continue;

b. The potential for decreased safety when requiring entry into numerous applicable Conditions and Required Actions for components without DC power, while not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected division;

c. The low potential for an event in conjunction with a single failure of a redundant component.

The second Completion Time for Required Action D.1 establishes a limit on the maximum time allowed for any combination of required electrical power distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition D is entered while, for instance, an AC bus is inoperable and subsequently restored OPERABLE, the LCO may already have been not met for up to 8 hours. This situation could lead to a total duration of 176 hours, since initial failure to meet the LCO, to restore the DC electrical power (continued) Brunswick Unit 2 B 3.8.7-12 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES ACTIONS D.1 (continued) distribution system. At this time, an AC bus could again become inoperable, and the DC electrical power distribution system could be restored OPERABLE. This could continue indefinitely. This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This allowance results in establishing the "time zero" at the time the LCO was initially not met, instead of at the time Condition D was entered. The 176 hour Completion Time is an acceptable limitation on this potential of failing to meet the LCO indefinitely. E.1 and E.2 If the inoperable electrical power distribution subsystem(s) cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. F.1 Condition F corresponds to a level of degradation in the electrical power distribution system that causes a required safety function to be lost. When more than one AC or DC electrical power distribution subsystem is lost, and this results in the loss of a required function, the plant is in a condition outside the accident analysis. Therefore, no additional time is justified for continued operation. LCO 3.0.3 must be entered immediately to commence a controlled shutdown. (continued) Brunswick Unit 2 B 3.8.7-13 Revision No. 30

Distribution SystemsOperating B 3.8.7 BASES (continued) SURVEILLANCE SR 3.8.7.1 REQUIREMENTS This Surveillance verifies that the AC and DC electrical power distribution systems are functioning properly, with the correct circuit breaker alignment. This includes verifying that distribution bus tie breakers are open and control power transfer switches associated with the 4.16 kV and 480 V emergency buses and transfer switches associated with the ESS and DG panels are aligned to their normal DC sources. The correct breaker alignment ensures the appropriate separation and independence of the electrical buses are maintained, and power is available to each required bus. The verification of energization of the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. This may be performed by verification of absence of low voltage alarms or by verifying a load powered from the bus is operating. The 7 day Frequency takes into account the redundant capability of the AC and DC electrical power distribution subsystems, and other indications available in the control room that alert the operator to subsystem malfunctions. SR 3.8.7.2 This Surveillance verifies that no combination of more than two power conversion modules (consisting of either two lighting inverters or one lighting inverter and one plant uninterruptible power supply unit) are aligned to Division II (bus B). Two power conversion modules aligned to Division II (bus B) was an initial assumption in the DC battery load study. Limiting two power conversion modules to be aligned to Division II ensures the associated batteries will supply DC power to safety related equipment during a design basis event. The 7 day Frequency takes into account the redundant capability of the DC electrical power distribution subsystems and indications available in the control room to alert the operator of power conversion module misalignment. REFERENCES 1. UFSAR, Chapter 6.

2. UFSAR, Chapter 15.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.8.7-14 Revision No. 30

Distribution SystemsOperating B 3.8.7 Table B 3.8.7-1 (page 1 of 1) AC and DC Electrical Power Distribution Systems TYPE VOLTAGE DIVISION I(a) DIVISION II(a) AC emergency 4160 V Emergency Buses Emergency Buses buses E1, E3 E2, E4 480 V Emergency Buses Emergency Buses E5, E7 E6, E8 AC vital buses 120 V Distribution Distribution Panels Panels 1E5, 2E7 1E6, 2E8 DC buses 250 V Switchboard 2A Switchboard 2B 125 V ESS logic ESS logic Cabinets Cabinets H58, H60 H59, H61 125 V DG Panels DG Panels DG-1, DG-3 DG-2, DG-4 DC control 125 V 4.16 kV Switchgear 4.16 kV Switchgear power buses E1, E3 E2, E4 125 V 480 V 480 V Switchgear Switchgear E5, E7 E6, E8 (a) Each division of the AC and DC electrical power distribution systems is a subsystem. Brunswick Unit 2 B 3.8.7-15 Revision No. 30

Distribution SystemsShutdown B 3.8.8 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.8 Distribution SystemsShutdown BASES BACKGROUND A description of the AC and DC electrical power distribution system is provided in the Bases for LCO 3.8.7, "Distribution SystemsOperating." APPLICABLE The initial conditions of Design Basis Accident and transient analyses SAFETY ANALYSES in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature (ESF) systems are OPERABLE. The AC and DC electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. The OPERABILITY of the AC and DC electrical power distribution system is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY. The OPERABILITY of the minimum AC and DC electrical power sources and associated power distribution subsystems during MODES 4 and 5, and during movement of irradiated fuel assemblies in the secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate power is provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident.

The AC and DC electrical power distribution systems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3). (continued) Brunswick Unit 2 B 3.8.8-1 Revision No. 30

Distribution SystemsShutdown B 3.8.8 BASES (continued) LCO Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific plant condition. Implicit in those requirements is the required OPERABILITY of necessary support features. This LCO explicitly requires energization of the portions of the electrical distribution system necessary to support OPERABILITY of Technical Specifications required systems, equipment, and componentsboth specifically addressed by their own LCO, and implicitly required by the definition of OPERABILITY. In addition, DC control power for operation of two of the four 4.16 kV emergency buses and two of the four 480 V emergency buses, as well as control power for two of the four diesel generators, is provided by the Unit 1 DC electrical power subsystems. Therefore, the Unit 1 DC electrical power distribution subsystems needed to support required components are also required to be OPERABLE. In addition, it is acceptable for required buses to be cross-tied during shutdown conditions, permitting a single source to supply multiple redundant buses, provided the source is capable of maintaining proper frequency (if required) and voltage. Maintaining these portions of the distribution system energized ensures the availability of sufficient power to operate the plant in a safe manner to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents and inadvertent reactor vessel draindown). APPLICABILITY The AC and DC electrical power distribution subsystems required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core in case of an inadvertent draindown of the reactor vessel;

b. Systems needed to mitigate a fuel handling accident are available; (continued)

Brunswick Unit 2 B 3.8.8-2 Revision No. 30

Distribution SystemsShutdown B 3.8.8 BASES APPLICABILITY c. Systems necessary to mitigate the effects of events that can lead (continued) to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The AC and DC electrical power distribution subsystem requirements for MODES 1, 2, and 3 are covered in LCO 3.8.7. ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, or 3, would require the unit to be shutdown, but would not require immediate suspension of movement of irradiated fuel assemblies. The Note to the ACTIONS, "LCO 3.0.3 is not applicable," ensures that the actions for immediate suspension of irradiated fuel assembly movement are not postponed due to entry into LCO 3.0.3. A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5 Although redundant required features may require redundant divisions of electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem division may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, fuel movement, and operations with a potential for draining the reactor vessel. By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions are implemented in accordance with the affected distribution subsystem LCO's Required Actions. In many instances this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made, (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies in the secondary containment, and any activities that could result in inadvertent draining of the reactor vessel). (continued) Brunswick Unit 2 B 3.8.8-3 Revision No. 30

Distribution SystemsShutdown B 3.8.8 BASES ACTIONS A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5 (continued) Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the plant safety systems. Notwithstanding performance of the above conservative Required Actions, a required residual heat removal-shutdown cooling (RHR-SDC) subsystem may be inoperable. In this case, Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the RHR-SDC ACTIONS would not be entered. Therefore, Required Action A.2.5 is provided to direct declaring RHR-SDC inoperable and not in operation, which results in taking the appropriate RHR-SDC ACTIONS. The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the plant safety systems may be without power. SURVEILLANCE SR 3.8.8.1 REQUIREMENTS This Surveillance verifies that the AC and DC electrical power distribution subsystems are functioning properly, with the correct breaker alignment. The correct breaker alignment ensures power is available to each required bus. The verification of energization of the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. This may be performed by verification of the absence of low voltage alarms or by verifying a load powered from the bus is operating. The 7 day Frequency takes into account the redundant capability of the electrical power distribution subsystems, as well as other indications available in the control room that alert the operator to subsystem malfunctions. (continued) Brunswick Unit 2 B 3.8.8-4 Revision No. 30

Distribution SystemsShutdown B 3.8.8 BASES (continued) REFERENCES 1. UFSAR, Chapter 6.

2. UFSAR, Chapter 15.

3. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.8.8-5 Revision No. 30

Refueling Equipment Interlocks B 3.9.1 B 3.9 REFUELING OPERATIONS B 3.9.1 Refueling Equipment Interlocks BASES BACKGROUND Refueling equipment interlocks restrict the operation of the refueling equipment or the withdrawal of control rods to reinforce unit procedures that prevent the reactor from achieving criticality during refueling. The refueling interlock circuitry senses the conditions of the refueling equipment and the control rods. Depending on the sensed conditions, interlocks are actuated to prevent the operation of the refueling equipment or the withdrawal of control rods. The UFSAR requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods, when fully inserted, serve as the system capable of maintaining the reactor subcritical in cold conditions during all fuel movement activities and accidents. Instrumentation is provided to sense the position of the refuel platform, the loading of the refuel platform fuel grapple, and the full insertion of all control rods. Additionally, inputs are provided for the loading of the refuel platform frame-mounted hoist, the loading of the refuel platform monorail hoist, and the fuel grapple not in the full-up position. With the reactor mode switch in the shutdown or refueling position, the indicated conditions are combined in logic circuits to determine if all restrictions on refueling equipment operations and control rod insertion are satisfied. A control rod not at its full-in position interrupts power to the refueling equipment to prevent operating the equipment over the reactor core when loaded with a fuel assembly or when the fuel grapple is not in the full-up position. Conversely, the refueling equipment located over the core with either the refueling equipment loaded with fuel or the fuel grapple not in the full-up position inserts a control rod withdrawal block in the Reactor Manual Control System to prevent withdrawing a control rod. (continued) Brunswick Unit 2 B 3.9.1-1 Revision No. 30

Refueling Equipment Interlocks B 3.9.1 BASES BACKGROUND The refuel platform has two mechanical switches that open before the (continued) platform or any of its hoists are physically located over the reactor vessel. All refueling hoists have switches that open when the hoists are loaded with fuel. The hoist switches open at a load lighter than the weight of a single fuel assembly. The refueling interlocks use these indications to prevent operation of the refueling equipment with fuel loaded over the core whenever any control rod is withdrawn, or to prevent control rod withdrawal whenever fuel loaded refueling equipment is over the core (Ref. 2). APPLICABLE The refueling interlocks are explicitly assumed in the UFSAR analyses for SAFETY ANALYSES the control rod removal error during refueling (Ref. 3) and the fuel assembly insertion error during refueling (Ref. 4). These analyses evaluate the consequences of control rod withdrawal during refueling and also fuel assembly insertion with a control rod withdrawn. A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment. Criticality and, therefore, subsequent prompt reactivity excursions are prevented during the insertion of fuel, provided all control rods are fully inserted during the fuel insertion. The refueling interlocks accomplish this by preventing loading of fuel into the core with any control rod withdrawn or by preventing withdrawal of a rod from the core during fuel loading. The refuel platform location switches activate at a point outside of the reactor core such that, with a fuel assembly loaded and a control rod withdrawn, the fuel is not over the core. Refueling equipment interlocks satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 5). LCO To prevent criticality during refueling, the refueling interlocks associated with the refuel position of the reactor mode switch ensure that fuel assemblies are not loaded into the core with any control rod withdrawn. (continued) Brunswick Unit 2 B 3.9.1-2 Revision No. 30

Refueling Equipment Interlocks B 3.9.1 BASES LCO To prevent these conditions from developing, the all-rods-in, the refuel (continued) platform position, the refuel platform fuel grapple fuel loaded, the refuel platform frame-mounted hoist fuel loaded, the refuel platform monorail hoist fuel loaded, and the fuel grapple position inputs are required to be OPERABLE. These inputs are combined in logic circuits, which provide refueling equipment or control rod blocks to prevent operations that could result in criticality during refueling operations. APPLICABILITY In MODE 5, a prompt reactivity excursion could cause fuel damage and subsequent release of radioactive material to the environment. The refueling equipment interlocks protect against prompt reactivity excursions during MODE 5. The interlocks are required to be OPERABLE during in-vessel fuel movement with refueling equipment associated with the interlocks when the reactor mode switch is in the refuel position. The interlocks are not required when the reactor mode switch is in the shutdown position since a control rod block (LCO 3.3.2.1, "Control Rod Block Instrumentation") ensures control rod withdrawals cannot occur simultaneously during in-vessel fuel movements. In MODES 1, 2, 3, and 4, the reactor pressure vessel head is on, and CORE ALTERATIONS are not possible. Therefore, the refueling interlocks are not required to be OPERABLE in these MODES. ACTIONS A.1 With one or more of the required refueling equipment interlocks inoperable (does not include the one-rod-out interlock addressed in LCO 3.9.2, "Refuel Position One-Rod-Out Interlock"), the unit must be placed in a condition in which the LCO does not apply. In-vessel fuel movement with the affected refueling equipment must be immediately suspended. This action ensures that operations are not performed with equipment that would potentially not be blocked from unacceptable operations (e.g., loading fuel into a cell with a control rod withdrawn). Suspension of in-vessel fuel movement shall not preclude completion of movement of a component to a safe position. (continued) Brunswick Unit 2 B 3.9.1-3 Revision No. 30

Refueling Equipment Interlocks B 3.9.1 BASES (continued) SURVEILLANCE SR 3.9.1.1 REQUIREMENTS Performance of a CHANNEL FUNCTIONAL TEST demonstrates each required refueling equipment interlock will function properly when a simulated or actual signal indicative of a required condition is injected into the logic. The CHANNEL FUNCTIONAL TEST may be performed by any series of sequential, overlapping, or total channel steps so that the entire channel is tested. The 7 day Frequency is based on engineering judgment and is considered adequate in view of other indications of refueling interlocks and their associated input status that are available to unit operations personnel. REFERENCES 1. UFSAR, Section 3.1.2.3.7.

2. UFSAR, Section 7.6.1.2.

3. UFSAR, Section 15.4.5.1.

4. UFSAR, Section 15.4.5.2.

5. 10 CFR 50.36(c)(2)(ii)

Brunswick Unit 2 B 3.9.1-4 Revision No. 30

Refuel Position One-Rod-Out Interlock B 3.9.2 B 3.9 REFUELING OPERATIONS B 3.9.2 Refuel Position One-Rod-Out Interlock BASES BACKGROUND The refuel position one-rod-out interlock restricts the movement of control rods to reinforce unit procedures that prevent the reactor from becoming critical during refueling operations. During refueling operations, no more than one control rod is permitted to be withdrawn. The UFSAR requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods serve as the system capable of maintaining the reactor subcritical in cold conditions. The refuel position one-rod-out interlock prevents the selection of a second control rod for movement when any other control rod is not fully inserted (Ref. 2). It is a logic circuit that has redundant channels. It uses the all rods-in signal (from the control rod full-in position indicators discussed in LCO 3.9.4, "Control Rod Position Indication") and a rod selection signal (from the Reactor Manual Control System). This Specification ensures that, in the event of a Design Basis Accident, the performance of the refuel position one-rod-out interlock meets the assumptions used in the safety analysis of Reference 3. APPLICABLE The refueling position one-rod-out interlock is explicitly assumed in the SAFETY ANALYSES UFSAR analysis for the control rod removal error during refueling (Ref. 3). This analysis evaluates the consequences of control rod withdrawal during refueling. A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment. The refuel position one-rod-out interlock and adequate SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") prevent criticality by preventing withdrawal of more than one control rod. With one control rod withdrawn, (continued) Brunswick Unit 2 B 3.9.2-1 Revision No. 30

Refuel Position One-Rod-Out Interlock B 3.9.2 BASES APPLICABLE the core will remain subcritical, thereby preventing any prompt critical SAFETY ANALYSES excursion. (continued) The refuel position one-rod-out interlock satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). LCO To prevent criticality during MODE 5, the refuel position one-rod-out interlock ensures no more than one control rod may be withdrawn. Both channels of the refuel position one-rod-out interlock are required to be OPERABLE and the reactor mode switch must be locked in the refuel position to support the OPERABILITY of these channels. APPLICABILITY In MODE 5, with the reactor mode switch in the refuel position and any control rod withdrawn, the OPERABLE refuel position one-rod-out interlock provides protection against prompt reactivity excursions. In MODES 1, 2, 3, and 4, the refuel position one-rod-out interlock is not required to be OPERABLE and is bypassed. In MODES 1 and 2, the Reactor Protection System (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation") and the control rods (LCO 3.1.3, "Control Rod OPERABILITY") provide mitigation of potential reactivity excursions. In MODES 3 and 4, with the reactor mode switch in the shutdown position, a control rod block (LCO 3.3.2.1, "Control Rod Block Instrumentation") ensures all control rods are inserted, thereby preventing criticality during shutdown conditions. ACTIONS A.1 and A.2 With one or both channels of the refueling position one-rod-out interlock inoperable, the refueling interlocks may not be capable of preventing more than one control rod from being withdrawn. This condition may lead to criticality. Control rod withdrawal must be immediately suspended, and action must be immediately initiated to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Action must continue until (continued) Brunswick Unit 2 B 3.9.2-2 Revision No. 30

Refuel Position One-Rod-Out Interlock B 3.9.2 BASES ACTIONS A.1 and A.2 (continued) all such control rods are fully inserted. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and, therefore, do not have to be inserted. SURVEILLANCE SR 3.9.2.1 REQUIREMENTS Proper functioning of the refueling position one-rod-out interlock requires the reactor mode switch to be in Refuel. During control rod withdrawal in MODE 5, improper positioning of the reactor mode switch could, in some instances, allow improper bypassing of required interlocks. Therefore, this Surveillance imposes an additional level of assurance that the refueling position one-rod-out interlock will be OPERABLE when required. By "locking" the reactor mode switch in the proper position (i.e., removing the reactor mode switch key from the console while the reactor mode switch is positioned in refuel), an additional administrative control is in place to preclude operator errors from resulting in unanalyzed operation. The Frequency of 12 hours is sufficient in view of other administrative controls utilized during refueling operations to ensure safe operation. SR 3.9.2.2 Performance of a CHANNEL FUNCTIONAL TEST on each channel demonstrates the associated refuel position one-rod-out interlock will function properly when a simulated or actual signal indicative of a required condition is injected into the logic. The CHANNEL FUNCTIONAL TEST may be performed by any series of sequential, overlapping, or total channel steps so that the entire channel is tested. The 7 day Frequency is considered adequate because of demonstrated circuit reliability, procedural controls on control rod withdrawals, and visual and audible indications available in the control room to alert the operator to control rods not fully inserted. To perform the required testing, the applicable condition must be entered (i.e., a control rod (continued) Brunswick Unit 2 B 3.9.2-3 Revision No. 30

Refuel Position One-Rod-Out Interlock B 3.9.2 BASES SURVEILLANCE SR 3.9.2.2 (continued) REQUIREMENTS must be withdrawn from its full-in position). Therefore, SR 3.9.2.2 has been modified by a Note that states the CHANNEL FUNCTIONAL TEST is not required to be performed until 1 hour after any control rod is withdrawn. REFERENCES 1. UFSAR, Section 3.1.2.3.7.

2. UFSAR, Section 7.6.1.2.

3. UFSAR, Section 15.4.5.1.

4. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.9.2-4 Revision No. 30

Control Rod Position B 3.9.3 B 3.9 REFUELING OPERATIONS B 3.9.3 Control Rod Position BASES BACKGROUND Control rods provide the capability to maintain the reactor subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the Control Rod Drive System. During refueling, movement of control rods is limited by the refueling interlocks (LCO 3.9.1, "Refueling Equipment Interlocks" and LCO 3.9.2, "Refuel Position One-Rod-Out Interlock") or the control rod block with the reactor mode switch in the shutdown position (LCO 3.3.2.1, "Control Rod Block Instrumentation"). The UFSAR requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods serve as the system capable of maintaining the reactor subcritical in cold conditions. The refueling interlocks allow a single control rod to be withdrawn at any time unless fuel is being loaded into the core. To preclude loading fuel assemblies into the core with a control rod withdrawn, all control rods must be fully inserted. This prevents the reactor from achieving criticality during refueling operations. APPLICABLE Prevention and mitigation of prompt reactivity excursions during refueling SAFETY ANALYSES are provided by the refueling interlocks (LCO 3.9.1 and LCO 3.9.2), the SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"), the intermediate range monitor neutron flux scram (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), and the control rod block instrumentation (LCO 3.3.2.1). The safety analysis for the control rod removal error during refueling in the UFSAR (Ref. 2) assumes the functioning of the refueling interlocks and adequate SDM. The analysis for the fuel assembly insertion error (Ref. 3) assumes all control rods are fully inserted. Thus, prior to fuel (continued) Brunswick Unit 2 B 3.9.3-1 Revision No. 30

Control Rod Position B 3.9.3 BASES APPLICABLE reload, all control rods must be fully inserted to minimize the probability SAFETY ANALYSES of an inadvertent criticality. (continued) Control rod position satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). LCO All control rods must be fully inserted during applicable refueling conditions to minimize the probability of an inadvertent criticality during refueling. APPLICABILITY During MODE 5, loading fuel into core cells with control rods withdrawn may result in inadvertent criticality. Therefore, the control rods must be inserted before loading fuel into a core cell. All control rods must be inserted before loading fuel to ensure that a fuel loading error does not result in loading fuel into a core cell with the control rod withdrawn. In MODES 1, 2, 3, and 4, the reactor pressure vessel head is on, and no fuel loading activities are possible. Therefore, this Specification is not applicable in these MODES. ACTIONS A.1 With all control rods not fully inserted during the applicable conditions, an inadvertent criticality could occur that is not analyzed in the UFSAR. All fuel loading operations must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position. SURVEILLANCE SR 3.9.3.1 REQUIREMENTS During refueling, to ensure that the reactor remains subcritical, all control rods must be fully inserted prior to and during fuel loading. Periodic checks of the control rod position ensure this condition is maintained. (continued) Brunswick Unit 2 B 3.9.3-2 Revision No. 30

Control Rod Position B 3.9.3 BASES SURVEILLANCE SR 3.9.3.1 (continued) REQUIREMENTS The 12 hour Frequency takes into consideration the procedural controls on control rod movement during refueling as well as the redundant functions of the refueling interlocks. REFERENCES 1. UFSAR, Section 3.1.2.3.7.

2. UFSAR, Section 15.4.5.1.

3. UFSAR, Section 15.4.5.2.

4. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.9.3-3 Revision No. 30

Control Rod Position Indication B 3.9.4 B 3.9 REFUELING OPERATIONS B 3.9.4 Control Rod Position Indication BASES BACKGROUND The full-in position indication channel for each control rod provides necessary information to the refueling interlocks to prevent inadvertent criticalities during refueling operations. During refueling, the refueling interlocks (LCO 3.9.1, "Refueling Equipment Interlocks" and LCO 3.9.2, "Refuel Position One-Rod-Out Interlock") use the full-in position indication channel to limit the operation of the refueling equipment and the movement of the control rods. The absence of the full-in position channel signal for any control rod removes the all-rods-in permissive for the refueling equipment interlocks and prevents fuel loading into the core. Also, this condition causes the refuel position one-rod-out interlock to not allow the withdrawal of any other control rod. The UFSAR requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods serve as the system capable of maintaining the reactor subcritical in cold conditions. APPLICABLE Prevention and mitigation of prompt reactivity excursions during refueling SAFETY ANALYSES are provided by the refueling interlocks (LCO 3.9.1 and LCO 3.9.2), the SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"), the intermediate range monitor neutron flux scram (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), and the control rod block instrumentation (LCO 3.3.2.1, "Control Rod Block Instrumentation"). The safety analysis for the control rod removal error during refueling (Ref. 2) assumes the functioning of the refueling interlocks and adequate SDM. The analysis for the fuel assembly insertion error (Ref. 3) assumes all control rods are fully inserted. The full-in position indication channel is required to be OPERABLE so that the refueling interlocks can ensure that fuel cannot be loaded into the core with any control rod withdrawn and that no more than one control rod can be withdrawn at a time. (continued) Brunswick Unit 2 B 3.9.4-1 Revision No. 30

Control Rod Position Indication B 3.9.4 BASES APPLICABLE Control rod position indication satisfies Criterion 3 of SAFETY ANALYSES 10 CFR 50.36(c)(2)(ii) (Ref. 4). (continued) LCO Each control rod full-in position indication channel must be OPERABLE to provide the required input to the refueling interlocks. A channel is OPERABLE if it provides correct position indication to the refueling interlock logic. APPLICABILITY During MODE 5, the control rods must have OPERABLE full-in position indication channels to ensure the applicable refueling interlocks will be OPERABLE. In MODES 1 and 2, requirements for control rod position are specified in LCO 3.1.3, "Control Rod OPERABILITY." In MODES 3 and 4, with the reactor mode switch in the shutdown position, a control rod block (LCO 3.3.2.1) ensures all control rods are inserted, thereby preventing criticality during shutdown conditions. ACTIONS A Note has been provided to modify the ACTIONS related to control rod position indication channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable control rod position indication channels provide appropriate compensatory measures for separate inoperable channels. As such, this Note has been provided, which allows separate Condition entry for each inoperable required control rod position indication channel. (continued) Brunswick Unit 2 B 3.9.4-2 Revision No. 30

Control Rod Position Indication B 3.9.4 BASES ACTIONS A.1.1, A.1.2, A.1.3, A.2.1 and A.2.2 (continued) With one or more required full-in position indication channels inoperable, compensating actions must be taken to protect against potential reactivity excursions from fuel assembly insertions or control rod withdrawals. This may be accomplished by immediately suspending in-vessel fuel movement and control rod withdrawal, and immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Actions must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and, therefore, do not have to be inserted. Suspension of in-vessel fuel movements and control rod withdrawal shall not preclude moving a component to a safe position. Alternatively, actions must be immediately initiated to fully insert the control rod(s) associated with the inoperable full-in position indicator(s) and disarm (electrically or hydraulically) the drive(s) to ensure that the control rod is not withdrawn. Actions must continue until all associated control rods are fully inserted and drives are disarmed. Under these conditions (control rod fully inserted and disarmed), an inoperable full-in channel may be bypassed to allow refueling operations to proceed. An alternate method must be used to ensure the control rod is fully inserted (e.g., use the "00" notch position indication). SURVEILLANCE SR 3.9.4.1 REQUIREMENTS The full-in position indication channels provide input to the one-rod-out interlock and other refueling interlocks that require an all-rods-in permissive. The interlocks are actuated when the full-in position indication for any control rod is not present, since this indicates that all rods are not fully inserted. Therefore, testing of the full-in position indication channels is performed to ensure that when a control rod is withdrawn, the full-in position indication is not present. The full-in position indication channel is considered inoperable even with the control rod (continued) Brunswick Unit 2 B 3.9.4-3 Revision No. 30

Control Rod Position Indication B 3.9.4 BASES SURVEILLANCE SR 3.9.4.1 (continued) REQUIREMENTS fully inserted, if it would continue to indicate full-in with the control rod withdrawn. Performing the SR each time a control rod is withdrawn from the full-in position is considered adequate because of the procedural controls on control rod withdrawals and the visual and audible indications available in the control room to alert the operator to control rods not fully inserted. REFERENCES 1. UFSAR, Section 3.1.2.3.7.

2. UFSAR, Section 15.4.5.1.

3. UFSAR, Section 15.4.5.2.

4. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.9.4-4 Revision No. 30

Control Rod OPERABILITYRefueling B 3.9.5 B 3.9 REFUELING OPERATIONS B 3.9.5 Control Rod OPERABILITYRefueling BASES BACKGROUND Control rods are components of the Control Rod Drive (CRD) System, the primary reactivity control system for the reactor. In conjunction with the Reactor Protection System, the CRD System provides the means for the reliable control of reactivity changes during refueling operation. In addition, the control rods provide the capability to maintain the reactor subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the CRD System. The UFSAR requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The CRD System is the system capable of maintaining the reactor subcritical in cold conditions. APPLICABLE Prevention and mitigation of prompt reactivity excursions during refueling SAFETY ANALYSES are provided by refueling interlocks (LCO 3.9.1, "Refueling Equipment Interlocks," and LCO 3.9.2, "Refuel Position One-Rod-Out Interlock"), the SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"), the intermediate range monitor neutron flux scram (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), and the control rod block instrumentation (LCO 3.3.2.1, "Control Rod Block Instrumentation"). The safety analyses for the control rod removal error during refueling (Ref. 2) and the fuel assembly insertion error (Ref. 3) evaluate the consequences of control rod withdrawal during refueling and also fuel assembly insertion with a control rod withdrawn. A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment. Control rod scram provides protection should a prompt reactivity excursion occur. Control rod OPERABILITY during refueling satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). (continued) Brunswick Unit 2 B 3.9.5-1 Revision No. 30

Control Rod OPERABILITYRefueling B 3.9.5 BASES (continued) LCO Each withdrawn control rod must be OPERABLE. The withdrawn control rod is considered OPERABLE if the scram accumulator pressure is 940 psig and the control rod is capable of being automatically inserted upon receipt of a scram signal. Inserted control rods have already completed their reactivity control function, and therefore are not required to be OPERABLE. APPLICABILITY During MODE 5, withdrawn control rods must be OPERABLE to ensure that during a scram condition the control rods will insert and provide the required negative reactivity to maintain the reactor subcritical. For MODES 1 and 2, control rod requirements are found in LCO 3.1.3, "Control Rod OPERABILITY," LCO 3.1.4, "Control Rod Scram Times," and LCO 3.1.5, "Control Rod Scram Accumulators." During MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod OPERABILITY during these conditions. ACTIONS A.1 With one or more withdrawn control rods inoperable, action must be immediately initiated to fully insert the inoperable control rod(s). Inserting the control rod(s) ensures the shutdown and scram capabilities are not adversely affected. Actions must continue until the inoperable control rod(s) is fully inserted. SURVEILLANCE SR 3.9.5.1 and SR 3.9.5.2 REQUIREMENTS During MODE 5, the OPERABILITY of control rods is primarily required to ensure a withdrawn control rod will automatically insert if a signal requiring a reactor shutdown occurs. Because no explicit analysis exists for automatic shutdown during refueling, the shutdown function is satisfied if the withdrawn control rod is capable of automatic insertion (continued) Brunswick Unit 2 B 3.9.5-2 Revision No. 30

Control Rod OPERABILITYRefueling B 3.9.5 BASES SURVEILLANCE SR 3.9.5.1 and SR 3.9.5.2 (continued) REQUIREMENTS and the associated CRD scram accumulator pressure is 940 psig. SR 3.9.5.2 may be performed by verification of absence of the common scram accumulator low pressure alarm. The 7 day Frequency takes into consideration equipment reliability, procedural controls over the scram accumulators, and control room alarms and indicating lights that indicate low accumulator charge pressures. SR 3.9.5.1 is modified by a Note that allows 7 days after withdrawal of the control rod to perform the Surveillance. This acknowledges that the control rod must first be withdrawn before performance of the Surveillance, and therefore avoids potential conflicts with SR 3.0.3. REFERENCES 1. UFSAR, Section 3.1.2.3.7.

2. UFSAR, Section 15.4.5.1.

3. UFSAR, Section 15.4.5.2.

4. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.9.5-3 Revision No. 30

RPV Water Level B 3.9.6 B 3.9 REFUELING OPERATIONS B 3.9.6 Reactor Pressure Vessel (RPV) Water Level BASES BACKGROUND The movement of fuel assemblies or handling of control rods within the RPV requires a minimum water level of 23 ft above the top of irradiated fuel assemblies seated within the RPV. During refueling, this maintains a sufficient water level in the reactor vessel. Sufficient water is necessary to retain iodine fission product activity in the water in the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite doses from the accident to well below the 10 CFR 50.67 exposure guidelines (Ref. 3). APPLICABLE During movement of fuel assemblies or handling of control rods, the SAFETY ANALYSES water level in the RPV is an initial condition design parameter in the analysis of a fuel handling accident in containment postulated by Regulatory Guide 1.183 (Ref. 1). A minimum water level of 23 ft allows a decontamination factor of 200 to be used in the accident analysis for iodine (Ref. 1). This relates to the assumption that 99.5% of the total iodine released from the pellet to cladding gap of all the damaged fuel assembly rods is retained by the water. Analysis of the fuel handling accident inside containment is described in Reference 2. With a minimum water level of 23 ft and a minimum decay time of 24 hours prior to fuel handling, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water and that offsite doses are maintained well below the allowable limits of Reference 3. RPV water level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii) (Ref. 4). (continued) Brunswick Unit 2 B 3.9.6-1 Revision No. 30

RPV Water Level B 3.9.6 BASES (continued) LCO A minimum water level of 23 ft above the top of irradiated fuel assemblies seated within the RPV is required to ensure that the radiological consequences of a postulated fuel handling accident are within acceptable limits. APPLICABILITY LCO 3.9.6 is applicable when moving fuel assemblies or handling control rods (i.e., movement with other than the normal control rod drive) within the RPV. The LCO minimizes the possibility of a fuel handling accident in containment that is beyond the assumptions of the safety analysis. If irradiated fuel is not present within the RPV, there can be no significant radioactivity release as a result of a postulated fuel handling accident. Requirements to preclude fuel handling accidents in the spent fuel storage pool are covered by LCO 3.7.7, "Spent Fuel Storage Pool Water Level." ACTIONS A.1 If the water level is < 23 ft above the top of irradiated fuel assemblies seated within the RPV, all operations involving movement of fuel assemblies and handling of control rods within the RPV shall be suspended immediately to ensure that a fuel handling accident cannot occur. The suspension of fuel movement and control rod handling shall not preclude completion of movement of a component to a safe position. SURVEILLANCE SR 3.9.6.1 REQUIREMENTS Verification of a minimum water level of 23 ft above the top of irradiated fuel assemblies seated within the RPV ensures that the design basis for the postulated fuel handling accident analysis during refueling operations is met. Water at the required level limits the consequences of damaged fuel rods, which are postulated to result from a fuel handling accident in containment (Ref. 2). The Frequency of 24 hours is based on engineering judgment and is considered adequate in view of the large volume of water and the normal procedural controls on valve positions, which make significant unplanned level changes unlikely. (continued) Brunswick Unit 2 B 3.9.6-2 Revision No. 30

RPV Water Level B 3.9.6 BASES (continued) REFERENCES 1. Regulatory Guide 1.183, July 2000

2. UFSAR, Section 15.7.1.

3. 10 CFR 50.67.

4. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.9.6-3 Revision No. 30

RHRHigh Water Level B 3.9.7 B 3.9 REFUELING OPERATIONS B 3.9.7 Residual Heat Removal (RHR)High Water Level BASES BACKGROUND The purpose of the RHR System in MODE 5 is to remove decay heat and sensible heat from the reactor coolant. The RHR System has two loops with each loop consisting of two motor driven pumps, a heat exchanger, and associated piping and valves. There are two RHR shutdown cooling subsystems per RHR System loop. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after it has been cooled by circulation through the respective heat exchangers, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the RHR Service Water System. The RHR shutdown cooling mode is manually controlled and any one of the four RHR shutdown cooling subsystems can provide the required decay heat removal function. In addition to the RHR shutdown cooling subsystems, the volume of water above the reactor pressure vessel (RPV) flange provides a heat sink for decay heat removal. APPLICABLE With the unit in MODE 5, the RHR shutdown cooling subsystems are not SAFETY ANALYSES required to mitigate any events or accidents evaluated in the safety analyses. The RHR shutdown cooling subsystems are required for removing decay heat to maintain the temperature of the reactor coolant. The RHR shutdown cooling subsystems satisfy Criterion 4 of 10 CFR 50.36(c)(2)(ii) (Ref. 1). LCO Only one RHR shutdown cooling subsystem is required to be OPERABLE and in operation in MODE 5 with irradiated fuel in the RPV and the water level 21 feet 10 inches above the RPV flange. A water level of 21 feet 10 inches above the RPV flange corresponds to 115 feet 7 7/16 inches plant elevation. A spent fuel storage pool level of 37 feet 1 inch when the spent fuel storage pool gates are removed is slightly more conservative (continued) Brunswick Unit 2 B 3.9.7-1 Revision No. 30

RHRHigh Water Level B 3.9.7 BASES LCO with respect to the corresponding specified water level above the reactor (continued) pressure vessel flange. Only one subsystem is required because the volume of water above the RPV flange provides backup decay heat removal capability. An OPERABLE RHR shutdown cooling subsystem consists of an RHR pump, a heat exchanger, one RHR Service Water Pump capable of providing cooling to the heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path. In MODE 5, the RHR cross tie valve is not required to be closed; thus, the valve may be opened to allow pumps in one RHR loop to discharge through the opposite RHR and recirculation loops to make a complete subsystem. Additionally, each RHR shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. Operation (either continuous or intermittent) of one subsystem can maintain and reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. A Note is provided to allow a 2 hour exception to shutdown the operating subsystem every 8 hours. APPLICABILITY One RHR shutdown cooling subsystem must be OPERABLE and in operation in MODE 5, with irradiated fuel in the reactor pressure vessel and with the water level 21 feet 10 inches above the top of the RPV flange, to provide decay heat removal. RHR shutdown cooling subsystem requirements in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS). RHR shutdown cooling subsystem requirements in MODE 5 with irradiated fuel in the RPV and with the water level < 21 feet 10 inches above the RPV flange are given in LCO 3.9.8, "Residual Heat Removal (RHR)Low Water Level." ACTIONS A.1 With no RHR shutdown cooling subsystem OPERABLE, an alternate method of decay heat removal must be established within 1 hour. In this condition, the volume of water above the RPV flange provides adequate capability to remove decay heat from the reactor core. However, the overall reliability is reduced because loss of water level could result in (continued) Brunswick Unit 2 B 3.9.7-2 Revision No. 30

RHRHigh Water Level B 3.9.7 BASES ACTIONS A.1 (continued) reduced decay heat removal capability. The 1 hour Completion Time is based on decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of the alternate method must be reconfirmed every 24 hours thereafter. This will ensure continued heat removal capability. Alternate decay heat removal methods are available to the operators for review and preplanning in the unit operating procedures. The required cooling capacity of the alternate method should be ensured by verifying (by calculation or demonstration) its capability to maintain or reduce temperature. Alternate methods are described in plant procedures. The method used to remove the decay heat should be the most prudent choice based on unit conditions. B.1, B.2, B.3, and B.4 If no RHR shutdown cooling subsystem is OPERABLE and an alternate method of decay heat removal is not available in accordance with Required Action A.1, actions shall be taken immediately to suspend operations involving an increase in reactor decay heat load by suspending loading of irradiated fuel assemblies into the RPV. Additional actions are required to minimize any potential fission product release to the environment. This includes ensuring secondary containment is OPERABLE; one standby gas treatment subsystem is OPERABLE; and secondary containment isolation capability is available in each associated penetration flow path not isolated that is assumed to be isolated to mitigate radioactive releases (i.e., one secondary containment isolation damper and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability. These administrative controls consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated). This may be performed as an administrative check, by (continued) Brunswick Unit 2 B 3.9.7-3 Revision No. 30

RHRHigh Water Level B 3.9.7 BASES ACTIONS B.1, B.2, B.3, and B.4 (continued) examining logs or other information to determine whether the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, a Surveillance may need to be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE. C.1 and C.2 If no RHR shutdown cooling subsystem is in operation, an alternate method of coolant circulation is required to be established within 1 hour. The Completion Time is modified such that the 1 hour is applicable separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of reactor coolant circulation must be reconfirmed every 12 hours thereafter. This will ensure reactor coolant circulation is maintained. During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem), the reactor coolant temperature must be periodically monitored to ensure proper functioning of the alternate method. The once per hour Completion Time is deemed appropriate. SURVEILLANCE SR 3.9.7.1 REQUIREMENTS This Surveillance demonstrates that the required RHR shutdown cooling subsystem is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Frequency of 12 hours is sufficient in view of other visual and audible indications available to the operator for monitoring the RHR shutdown cooling subsystem in the control room. REFERENCES 1. 10 CFR 50.36(c)(2)(ii). Brunswick Unit 2 B 3.9.7-4 Revision No. 30

RHRLow Water Level B 3.9.8 B 3.9 REFUELING OPERATIONS B 3.9.8 Residual Heat Removal (RHR)Low Water Level BASES BACKGROUND The purpose of the RHR System in MODE 5 is to remove decay heat and sensible heat from the reactor coolant. The RHR System has two loops with each loop consisting of two motor driven pumps, a heat exchanger, and associated piping and valves. There are two RHR shutdown cooling subsystems per RHR System loop. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after it has been cooled by circulation through the respective heat exchangers, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the RHR Service Water System. The RHR shutdown cooling mode is manually controlled and any one of the four RHR shutdown cooling subsystems can provide the required decay heat removal function. APPLICABLE With the unit in MODE 5, the RHR shutdown cooling subsystems are not SAFETY ANALYSES required to mitigate any events or accidents evaluated in the safety analyses. The RHR shutdown cooling subsystems are required for removing decay heat to maintain the temperature of the reactor coolant. The RHR shutdown cooling subsystems satisfy Criterion 4 of 10 CFR 50.36(c)(2)(ii) (Ref. 1). LCO In MODE 5 with irradiated fuel in the reactor pressure vessel (RPV) and the water level < 21 feet 10 inches above the RPV flange both RHR shutdown cooling subsystems must be OPERABLE. A water level of 21 feet 10 inches above the RPV flange corresponds to 115 feet 7 7/16 inches plant elevation. A spent fuel storage pool level of 37 feet 1 inch when the spent fuel storage pool gates are removed is slightly more conservative with respect to the corresponding specified water level above the RPV flange. An OPERABLE RHR shutdown cooling subsystem consists of an RHR pump, a heat exchanger, one RHR Service Water pump capable of providing cooling to the heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path. To meet the LCO, both RHR (continued) Brunswick Unit 2 B 3.9.8-1 Revision No. 30

RHRLow Water Level B 3.9.8 BASES LCO pumps in one loop or one RHR pump in each of the two loops must be (continued) OPERABLE. If the LCO is met using two RHR pumps in one loop, then two RHR Service Water pumps must be capable of providing cooling to the associated heat exchanger. In MODE 5, the RHR cross tie valve is not required to be closed; thus, the valve may be opened to allow pumps in one RHR loop to discharge through the opposite RHR and recirculation loops to make a complete subsystem. Additionally, each RHR shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. Operation (either continuous or intermittent) of one subsystem can maintain and reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. A Note is provided to allow a 2 hour exception to shutdown the operating subsystem every 8 hours. APPLICABILITY Two RHR shutdown cooling subsystems are required to be OPERABLE, and one must be in operation in MODE 5, with irradiated fuel in the RPV and with the water level < 21 feet 10 inches above the top of the RPV flange, to provide decay heat removal. RHR shutdown cooling subsystem requirements in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS). RHR shutdown cooling subsystem requirements in MODE 5 with irradiated fuel in the RPV and with the water level 21 feet 10 inches above the RPV flange are given in LCO 3.9.7, "Residual Heat Removal (RHR)High Water Level." ACTIONS A.1 With one of the two required RHR shutdown cooling subsystems inoperable, the remaining subsystem is capable of providing the required decay heat removal. However, the overall reliability is reduced. Therefore, an alternate method of decay heat removal must be provided. With both required RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability. This re-establishes backup decay heat removal capabilities, (continued) Brunswick Unit 2 B 3.9.8-2 Revision No. 30

RHRLow Water Level B 3.9.8 BASES ACTIONS A.1 (continued) similar to the requirements of the LCO. The 1 hour Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of this alternate method(s) must be reconfirmed every 24 hours thereafter. This will ensure continued heat removal capability. Alternate decay heat removal methods are available to the operators for review and preplanning in the unit operating procedures. The required cooling capacity of the alternate methods(s) should be ensured by verifying (by calculation or demonstration) their capacity to maintain or reduce temperature. Alternate methods are described in plant procedures. The method used to remove decay heat should be the most prudent choice based on unit conditions. B.1, B.2, and B.3 With the required decay heat removal subsystem(s) inoperable and the required alternate method(s) of decay heat removal not available in accordance with Required Action A.1, additional actions are required to minimize any potential fission product release to the environment. This includes ensuring secondary containment is OPERABLE; one standby gas treatment subsystem is OPERABLE; and secondary containment isolation capability is available in each associated penetration flow path not isolated that is assumed to be isolated to mitigate radioactive releases (i.e., one secondary containment isolation damper and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability. These administrative controls consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated). This may be performed as an administrative check, by examining logs or other information to determine whether the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. (continued) Brunswick Unit 2 B 3.9.8-3 Revision No. 30

RHRLow Water Level B 3.9.8 BASES ACTIONS B.1, B.2, and B.3 (continued) If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the surveillance may need to be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE. C.1 and C.2 If no RHR shutdown cooling subsystem is in operation, an alternate method of coolant circulation is required to be established within 1 hour. The Completion Time is modified such that the 1 hour is applicable separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of reactor coolant circulation must be reconfirmed every 12 hours thereafter. This will ensure reactor coolant circulation is maintained. During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem), the reactor coolant temperature must be periodically monitored to ensure proper functioning of the alternate method. The once per hour Completion Time is deemed appropriate. SURVEILLANCE SR 3.9.8.1 REQUIREMENTS This Surveillance demonstrates that one RHR shutdown cooling subsystem is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Frequency of 12 hours is sufficient in view of other visual and audible indications available to the operator for monitoring the RHR shutdown cooling subsystems in the control room. REFERENCES 1. 10 CFR 50.36(c)(2)(ii). Brunswick Unit 2 B 3.9.8-4 Revision No. 30

Inservice Leak and Hydrostatic Testing Operation B 3.10.1 B 3.10 SPECIAL OPERATIONS B 3.10.1 Inservice Leak and Hydrostatic Testing Operation BASES BACKGROUND The purpose of this Special Operations LCO is to allow certain reactor coolant pressure tests to be performed in MODE 4 when the metallurgical characteristics of the reactor pressure vessel (RPV) or plant temperature control capabilities during these tests require the pressure testing at temperatures > 212°F (normally corresponding to MODE 3) or to allow completing these reactor coolant pressure tests when the initial conditions do not require temperatures > 212°F. Furthermore, the purpose is to allow continued performance of control rod scram time testing required by SR 3.1.4.1 or SR 3.1.4.4 if reactor coolant temperatures exceed 212°F when the control rod scram time testing is initiated in conjunction with an inservice leak or hydrostatic test. These control rod scram time tests would be performed in accordance with LCO 3.10.4, Single Control Rod Withdrawal - Cold Shutdown," during MODE 4 operation. Inservice hydrostatic testing and system leakage pressure tests required by Section XI of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (Ref. 1) are performed prior to the reactor going critical after a refueling outage. Recirculation pump operation, decay heat, and a water solid RPV are used to achieve the necessary temperatures and pressures required for these tests. The minimum temperatures (at the required pressures) allowed for these tests are determined from the RPV pressure and temperature (P/T) limits required by LCO 3.4.9, "Reactor Coolant System (RCS) Pressure and Temperature (P/T) Limits." These limits are conservatively based on the fracture toughness of the reactor vessel, taking into account anticipated vessel neutron fluence. With increased reactor vessel fluence over time, the minimum allowable vessel temperature increases for a given pressure. Periodic updates to the RCS P/T limit curves are performed as necessary, based upon the results of analyses of irradiated surveillance specimens removed from the vessel. Hydrostatic and leak testing may eventually be required with minimum reactor coolant temperatures > 212°F. However, even with required minimum reactor coolant temperatures < 212°F, maintaining RCS temperatures within a small band during the test can be impractical. Removal of heat addition from recirculation pump operation and reactor core decay heat is coarsely controlled by control rod drive hydraulic system flow and reactor water cleanup system non-regenerative heat exchanger operation. Test conditions are focused on maintaining a steady state pressure, and tightly limited temperature control poses an unnecessary burden on the operator and may not be achievable in certain instances. (continued) Brunswick Unit 2 B 3.10.1-1 Revision No. 59

Inservice Leak and Hydrostatic Testing Operation B 3.10.1 BASES BACKGROUND The RCS hydrostatic and/or RCS system leakage tests require increasing (continued) reactor pressure to approximately 1050 psig. Scram time testing required by SR 3.1.4.1 and SR 3.1.4.4 requires reactor pressures 800 psig. Other testing may be performed in conjunction with the allowances for inservice leak or hydrostatic tests and control rod scram time tests. APPLICABLE Allowing the reactor to be considered in MODE 4 when the reactor SAFETY ANALYSES coolant temperature is > 212°F during, or as a consequence of, hydrostatic or leak testing, or as a consequence of control rod scram time testing initiated in conjunction with an inservice leak or hydrostatic test, effectively provides an exception to MODE 3 requirements, including OPERABILITY of primary containment and the full complement of redundant Emergency Core Cooling Systems. Since the tests are performed water solid, at low decay heat values, and near MODE 4 conditions, the stored energy in the reactor core will be very low. Under these conditions, the potential for failed fuel and a subsequent increase in coolant activity above the LCO 3.4.6, "RCS Specific Activity," limits are minimized. In addition, the secondary containment will be OPERABLE, in accordance with this Special Operations LCO, and will be capable of handling any airborne radioactivity or steam leaks that could occur during the performance of hydrostatic or leak testing. The required pressure testing conditions provide adequate assurance that the consequences of a steam leak will be conservatively bounded by the consequences of the postulated main steam line break outside of primary containment described in References 2 and 3. Therefore, these requirements will conservatively limit radiation releases to the environment. In the event of a large primary system leak, the reactor vessel would rapidly depressurize, allowing the low pressure core cooling systems to operate. The capability of the low pressure coolant injection and core spray subsystems, as required in MODE 4 by LCO 3.5.2, "ECCS Shutdown," would be more than adequate to keep the core flooded under this low decay heat load condition. Small system leaks would be detected by leakage inspections before significant inventory loss occurred. For the purposes of this test, the protection provided by normally required MODE 4 applicable LCOs, in addition to the secondary containment requirements required to be met by this Special Operations LCO, will ensure acceptable consequences during normal hydrostatic test conditions and during postulated accident conditions. (continued) Brunswick Unit 2 B 3.10.1-2 Revision No. 59

Inservice Leak and Hydrostatic Testing Operation B 3.10.1 BASES APPLICABLE As described in LCO 3.0.7, compliance with Special Operations LCOs is SAFETY ANALYSES optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) (Ref. 4) apply. (continued) Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases. LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation at reactor coolant temperatures > 212°F can be in accordance with Table 1.1-1 for MODE 3 operation without meeting this Special Operations LCO or its ACTIONS. This option may be required due to P/T limits, however, which require testing at temperatures > 212°F, while performance of inservice leak and hydrostatic testing results in the inoperability of subsystems required when > 212°F (i.e., MODE 3). Additionally, even with required minimum reactor coolant temperatures

                < 212°F, RCS temperatures may drift above 212°F during the performance of inservice leak and hydrostatic testing or during subsequent control rod scram time testing, which is typically performed in conjunction with inservice leak and hydrostatic testing. While this Special Operations LCO is provided for inservice leak and hydrostatic testing, and for scram time testing initiated in conjunction with an inservice leak or hydrostatic test, parallel performance of other tests and inspections is not precluded.

If it is desired to perform these tests while complying with this Special Operations LCO, then the MODE 4 applicable LCOs and specified MODE 3 LCOs must be met. This Special Operations LCO allows changing Table 1.1-1 temperature limits for MODE 4 to "NA" and suspending the requirements of LCO 3.4.8, "Residual Heat Removal (RHR) Shutdown Cooling SystemCold Shutdown." The additional requirements for secondary containment LCOs to be met will provide sufficient protection for operations at reactor coolant temperatures

                > 212°F for the purpose of performing an inservice leak or hydrostatic test and for control rod scram time testing initiated in conjunction with an inservice leak or hydrostatic test.

This LCO allows primary containment to be open for frequent unobstructed access to perform inspections, and for outage activities on various systems to continue consistent with the MODE 4 applicable requirements. (continued) Brunswick Unit 2 B 3.10.1-3 Revision No. 59

Inservice Leak and Hydrostatic Testing Operation B 3.10.1 BASES APPLICABILITY The MODE 4 requirements may only be modified for the performance of, or as a consequence of, inservice leak or hydrostatic tests, or as a consequence of control rod scram time testing initiated in conjunction with an inservice leak or hydrostatic test, so that these operations can be considered as in MODE 4, even though the reactor coolant temperature is

                > 212°F. The additional requirement for secondary containment OPERABILITY according to the imposed MODE 3 requirements provides conservatism in the response of the unit to any event that may occur.

Operations in all other MODES are unaffected by this LCO. ACTIONS A Note has been provided to modify the ACTIONS related to inservice leak and hydrostatic testing operation. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for each requirement of the LCO not met provide appropriate compensatory measures for separate requirements that are not met. As such, a Note has been provided that allows separate Condition entry for each requirement of the LCO. A.1 If a MODE 3 LCO specified in LCO 3.10.1 is not met, the ACTIONS applicable to the affected LCO are entered immediately and complied with. Required Action A.1 has been modified by a Note that clarifies the intent of another LCO's Required Action to be in MODE 4 includes reducing the average reactor coolant temperature to 212°F. A.2.1 and A.2.2 Required Action A.2.1 and Required Action A.2.2 are alternate Required Actions that can be taken instead of Required Action A.1 to restore compliance with the normal MODE 4 requirements, and thereby exit this Special Operation LCO's Applicability. Activities that could further increase reactor coolant temperature or pressure are suspended immediately, in accordance with Required Action A.2.1, and the reactor coolant temperature is reduced to establish normal MODE 4 requirements. The allowed Completion Time of 24 hours for Required (continued) Brunswick Unit 2 B 3.10.1-4 Revision No. 59

Inservice Leak and Hydrostatic Testing Operation B 3.10.1 BASES ACTIONS A.2.1 and A.2.2 (continued) Action A.2.2 is based on engineering judgment and provides sufficient time to reduce the average reactor coolant temperature from the highest expected value to 212°F with normal cooldown procedures. The Completion Time is also consistent with the time provided in LCO 3.0.3 to reach MODE 4 from MODE 3. SURVEILLANCE SR 3.10.1.1 REQUIREMENTS The LCOs made applicable are required to have their Surveillances met to establish that this LCO is being met. A discussion of the applicable SRs is provided in their respective Bases. REFERENCES 1. American Society of Mechanical Engineers, Boiler and Pressure Vessel Code, Section XI.

2. UFSAR, Section 15.6.3.

3. NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, September 1995.

4. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.10.1-5 Revision No. 59

Reactor Mode Switch Interlock Testing B 3.10.2 B 3.10 SPECIAL OPERATIONS B 3.10.2 Reactor Mode Switch Interlock Testing BASES BACKGROUND The purpose of this Special Operations LCO is to permit operation of the reactor mode switch from one position to another to confirm certain aspects of associated interlocks during periodic tests and calibrations in MODES 3, 4, and 5. The reactor mode switch is a conveniently located, multiposition, keylock switch provided to select the necessary scram functions for various plant conditions (Ref. 1). The reactor mode switch selects the appropriate trip relays for scram functions and provides appropriate bypasses. The mode switch positions and related scram interlock functions are summarized as follows:

a. ShutdownInitiates a reactor scram; bypasses main steam line isolation scram;

b. RefuelSelects Neutron Monitoring System (NMS) scram function for low neutron flux level operation (but does not disable the average power range monitor scram); bypasses main steam line isolation scram;

c. Startup/Hot StandbySelects NMS scram function for low neutron flux level operation (intermediate range monitors and average power range monitors); bypasses main steam line isolation scram; and

d. RunSelects NMS scram function for power range operation.

The reactor mode switch also provides interlocks for such functions as control rod blocks, scram discharge volume trip bypass, refueling interlocks, and main steam isolation valve isolations. APPLICABLE The acceptance criterion for reactor mode switch interlock testing is to SAFETY ANALYSES prevent fuel failure by precluding reactivity excursions or core criticality. The interlock functions of the shutdown and refuel positions normally maintained for the reactor mode switch in MODES 3, 4, and 5 are provided to preclude reactivity excursions that could potentially result in fuel failure. Interlock testing that requires moving the reactor mode switch (continued) Brunswick Unit 2 B 3.10.2-1 Revision No. 30

Reactor Mode Switch Interlock Testing B 3.10.2 BASES APPLICABLE to other positions (run, startup/hot standby, or refuel) while in MODE 3, 4, SAFETY ANALYSES or 5, requires administratively maintaining all control rods inserted and no (continued) CORE ALTERATIONS in progress. With all control rods inserted in core cells containing one or more fuel assemblies, and no CORE ALTERATIONS in progress, there are no credible mechanisms for unacceptable reactivity excursions during the planned interlock testing. For postulated accidents, such as control rod removal error during refueling or loading of fuel with a control rod withdrawn, the accident analysis demonstrates that fuel failure will not occur (Refs. 2 and 3). The withdrawal of the single most reactive control rod will not result in criticality when adequate SDM is maintained. Also, loading fuel assemblies into the core with a single control rod withdrawn will not result in criticality, thereby preventing fuel failure. As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) (Ref. 4) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases. LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. MODES 3, 4, and 5 operations not specified in Table 1.1-1 can be performed in accordance with other Special Operations LCOs (i.e., LCO 3.10.1, "Inservice Leak and Hydrostatic Testing Operation," LCO 3.10.3, "Single Control Rod WithdrawalHot Shutdown," LCO 3.10.4, "Single Control Rod WithdrawalCold Shutdown," and LCO 3.10.8, "SDM TestRefueling") without meeting this LCO or its ACTIONS. If any testing is performed that involves the reactor mode switch interlocks and requires repositioning beyond that specified in Table 1.1-1 for the current MODE of operation, the testing can be performed, provided all interlock functions potentially defeated are administratively controlled. In MODES 3, 4, and 5 with the reactor mode switch in shutdown as specified in Table 1.1-1, all control rods are fully inserted and a control rod block is initiated. Therefore, all control rods in core cells that contain one or more fuel assemblies must be verified (continued) Brunswick Unit 2 B 3.10.2-2 Revision No. 30

Reactor Mode Switch Interlock Testing B 3.10.2 BASES LCO fully inserted while in MODES 3, 4, and 5, with the reactor mode switch (continued) in other than the shutdown position. The additional LCO requirement to preclude CORE ALTERATIONS is appropriate for MODE 5 operations, as discussed below, and is inherently met in MODES 3 and 4 by the definition of CORE ALTERATIONS, which cannot be performed with the vessel head in place. In MODE 5, with the reactor mode switch in the refuel position, only one control rod can be withdrawn under the refuel position one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock"). The refueling equipment interlocks (LCO 3.9.1, "Refueling Equipment Interlocks") appropriately control other CORE ALTERATIONS. Due to the increased potential for error in controlling these multiple interlocks, and the limited duration of tests involving the reactor mode switch position, conservative controls are required, consistent with MODES 3 and 4. The additional controls of administratively not permitting CORE ALTERATIONS will adequately ensure that the reactor does not become critical during these tests. APPLICABILITY Any required periodic interlock testing involving the reactor mode switch, while in MODES 1 and 2, can be performed without the need for Special Operations exceptions. Mode switch manipulations in these MODES would likely result in unit trips. In MODES 3, 4, and 5, this Special Operations LCO is only permitted to be used to allow reactor mode switch interlock testing that cannot conveniently be performed without this allowance or testing that must be performed prior to entering another MODE. Such interlock testing may consist of required Surveillances, or may be the result of maintenance, repair, or troubleshooting activities. In MODES 3, 4, and 5, the interlock functions provided by the reactor mode switch in shutdown (i.e., all control rods inserted and incapable of withdrawal) and refueling (i.e., refueling interlocks to prevent inadvertent criticality during CORE ALTERATIONS) positions can be administratively controlled adequately during the performance of certain tests. (continued) Brunswick Unit 2 B 3.10.2-3 Revision No. 30

Reactor Mode Switch Interlock Testing B 3.10.2 BASES (continued) ACTIONS A.1, A.2, A.3.1, and A.3.2 These Required Actions are provided to restore compliance with the Technical Specifications overridden by this Special Operations LCO. Restoring compliance will also result in exiting the Applicability of this Special Operations LCO. All CORE ALTERATIONS, except control rod insertion, if in progress, are immediately suspended in accordance with Required Action A.1, and all insertable control rods in core cells that contain one or more fuel assemblies are fully inserted within 1 hour, in accordance with Required Action A.2. This will preclude potential mechanisms that could lead to criticality. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and, therefore, do not have to be inserted. Suspension of CORE ALTERATIONS shall not preclude the completion of movement of a component to a safe condition. Placing the reactor mode switch in the shutdown position will ensure that all inserted control rods remain inserted and result in operating in accordance with Table 1.1-1. Alternatively, if in MODE 5, the reactor mode switch may be placed in the refuel position, which will also result in operating in accordance with Table 1.1-1. A Note is added to Required Action A.3.2 to indicate that this Required Action is not applicable in MODES 3 and 4, since only the shutdown position is allowed in these MODES. The allowed Completion Time of 1 hour for Required Action A.2, Required Action A.3.1, and Required Action A.3.2 provides sufficient time to normally insert the control rods and place the reactor mode switch in the required position, based on operating experience, and is acceptable given that all operations that could increase core reactivity have been suspended. SURVEILLANCE SR 3.10.2.1 and SR 3.10.2.2 REQUIREMENTS Meeting the requirements of this Special Operations LCO maintains operation consistent with or conservative to operating with the reactor mode switch in the shutdown position (or the refuel position for MODE 5). The functions of the reactor mode switch interlocks that are not in effect, due to the testing in progress, are adequately compensated for by the Special Operations LCO requirements. (continued) Brunswick Unit 2 B 3.10.2-4 Revision No. 30

Reactor Mode Switch Interlock Testing B 3.10.2 BASES SURVEILLANCE SR 3.10.2.1 and SR 3.10.2.2 (continued) REQUIREMENTS The administrative controls are to be periodically verified to ensure that the operational requirements continue to be met. In addition, the all rods fully inserted Surveillance (SR 3.10.2.1) must be verified by a second licensed operator (Reactor Operator or Senior Reactor Operator) or other technically qualified member of the unit technical staff. A member of the technical staff is considered to be qualified if he has completed applicable qualification requirements in accordance with required plant training and qualification procedures. The Surveillances performed at the 12 hour and 24 hour Frequencies are intended to provide appropriate assurance that each operating shift is aware of and verifies compliance with these Special Operations LCO requirements. REFERENCES 1. UFSAR, Section 7.2.1.1.2.13.

2. UFSAR, Section 15.4.5.1.

3. UFSAR, Section 15.4.5.2.

4. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.10.2-5 Revision No. 30

Single Control Rod WithdrawalHot Shutdown B 3.10.3 B 3.10 SPECIAL OPERATIONS B 3.10.3 Single Control Rod WithdrawalHot Shutdown BASES BACKGROUND The purpose of this MODE 3 Special Operations LCO is to permit the withdrawal of a single control rod for testing while in hot shutdown, by imposing certain restrictions. In MODE 3, the reactor mode switch is in the shutdown position, and all control rods are inserted and blocked from withdrawal. Many systems and functions are not required in these conditions, due to the other installed interlocks that are actuated when the reactor mode switch is in the shutdown position. However, circumstances may arise while in MODE 3 that present the need to withdraw a single control rod for various tests (e.g., friction tests, scram timing, and coupling integrity checks). These single control rod withdrawals are normally accomplished by selecting the refuel position for the reactor mode switch. This Special Operations LCO provides the appropriate additional controls to allow a single control rod withdrawal in MODE 3. APPLICABLE With the reactor mode switch in the refuel position, the analyses for SAFETY ANALYSES control rod withdrawal during refueling are applicable and, provided the assumptions of these analyses are satisfied in MODE 3, these analyses will bound the consequences of an accident. Explicit safety analyses in the UFSAR (Ref. 1) demonstrate that the functioning of the refueling interlocks and adequate SDM will preclude unacceptable reactivity excursions. Refueling interlocks restrict the movement of control rods to reinforce operational procedures that prevent the reactor from becoming critical. These interlocks prevent the withdrawal of more than one control rod. Under these conditions, since only one control rod can be withdrawn, the core will always be shut down even with the highest worth control rod withdrawn if adequate SDM exists. The control rod scram function provides backup protection to normal refueling procedures and the refueling interlocks, which prevent inadvertent criticalities during refueling. (continued) Brunswick Unit 2 B 3.10.3-1 Revision No. 30

Single Control Rod WithdrawalHot Shutdown B 3.10.3 BASES APPLICABLE Alternate backup protection can be obtained by ensuring that a five by SAFETY ANALYSES five array of control rods, centered on the withdrawn control rod, are (continued) inserted and incapable of withdrawal. As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) (Ref. 2) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases. LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 3 with the reactor mode switch in the refuel position can be performed in accordance with other Special Operations LCOs (i.e., LCO 3.10.2, "Reactor Mode Switch Interlock Testing," without meeting this Special Operations LCO or its ACTIONS. However, if a single control rod withdrawal is desired in MODE 3, controls consistent with those required during refueling must be implemented and this Special Operations LCO applied. "Withdrawal" in this application includes the actual withdrawal of the control rod as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod. The refueling interlocks of LCO 3.9.2, "Refuel Position One-Rod-Out Interlock," required by this Special Operations LCO, will ensure that only one control rod can be withdrawn. To back up the refueling interlocks (LCO 3.9.2), the ability to scram the withdrawn control rod in the event of an inadvertent criticality is provided by this Special Operations LCO's requirements in Item d.1. Alternately, provided a sufficient number of control rods in the vicinity of the withdrawn control rod are known to be inserted and incapable of withdrawal (Item d.2), the possibility of criticality on withdrawal of this control rod is sufficiently precluded, so as not to require the scram capability of the withdrawn control rod. Also, once this alternate (Item d.2) is completed, the SDM requirement to account for both the withdrawn-untrippable control rod and the highest worth control rod may (continued) Brunswick Unit 2 B 3.10.3-2 Revision No. 30

Single Control Rod WithdrawalHot Shutdown B 3.10.3 BASES LCO be changed to allow the withdrawn-untrippable control rod to be the single (continued) highest worth control rod. APPLICABILITY Control rod withdrawals are adequately controlled in MODES 1, 2, and 5 by existing LCOs. In MODES 3 and 4, control rod withdrawal is only allowed if performed in accordance with this Special Operations LCO or Special Operations LCO 3.10.4, and if limited to one control rod. This allowance is only provided with the reactor mode switch in the refuel position. For these conditions, the one-rod-out interlock (LCO 3.9.2), control rod position indication (LCO 3.9.4, "Control Rod Position Indication"), full insertion requirements for all other control rods and scram functions (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," and LCO 3.9.5, "Control Rod OPERABILITY Refueling"), or the added administrative controls in Item d.2 of this Special Operations LCO, minimize potential reactivity excursions. ACTIONS A Note has been provided to modify the ACTIONS related to a single control rod withdrawal while in MODE 3. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for each requirement of the LCO not met provide appropriate compensatory measures for separate requirements that are not met. As such, a Note has been provided that allows separate Condition entry for each requirement of the LCO. A.1 If one or more of the requirements specified in this Special Operations LCO are not met, the ACTIONS applicable to the stated requirements of the affected LCOs are immediately entered as directed by Required Action A.1. Required Action A.1 has been modified by a Note that clarifies the intent of any other LCO's Required Action, to insert all control (continued) Brunswick Unit 2 B 3.10.3-3 Revision No. 30

Single Control Rod WithdrawalHot Shutdown B 3.10.3 BASES ACTIONS A.1 (continued) rods. This Required Action includes exiting this Special Operations Applicability by returning the reactor mode switch to the shutdown position. A second Note has been added, which clarifies that this Required Action is only applicable if the requirements not met are for an affected LCO. A.2.1 and A.2.2 Required Actions A.2.1 and A.2.2 are alternate Required Actions that can be taken instead of Required Action A.1 to restore compliance with the normal MODE 3 requirements, thereby exiting this Special Operations LCO's Applicability. Actions must be initiated immediately to insert all insertable control rods. Actions must continue until all such control rods are fully inserted. Placing the reactor mode switch in the shutdown position will ensure all inserted rods remain inserted and restore operation in accordance with Table 1.1-1. The allowed Completion Time of 1 hour to place the reactor mode switch in the shutdown position provides sufficient time to normally insert the control rods. SURVEILLANCE SR 3.10.3.1, SR 3.10.3.2, and SR 3.10.3.3 REQUIREMENTS The other LCOs made applicable in this Special Operations LCO are required to have their Surveillances met to establish that this Special Operations LCO is being met. If the local array of control rods is inserted and disarmed while the scram function for the withdrawn rod is not available, periodic verification in accordance with SR 3.10.3.2 is required to preclude the possibility of criticality. SR 3.10.3.2 has been modified by a Note, which clarifies that this SR is not required to be met if SR 3.10.3.1 is satisfied for LCO 3.10.3.d.1 requirements, since SR 3.10.3.2 demonstrates that the alternative LCO 3.10.3.d.2 requirements are satisfied. Also, SR 3.10.3.3 verifies that all control rods other than the control rod being withdrawn are fully inserted. The 24 hour Frequency is acceptable because of the administrative controls on control rod (continued) Brunswick Unit 2 B 3.10.3-4 Revision No. 30

Single Control Rod WithdrawalHot Shutdown B 3.10.3 BASES SURVEILLANCE SR 3.10.3.1, SR 3.10.3.2, and SR 3.10.3.3 (continued) REQUIREMENTS withdrawal, the protection afforded by the LCOs involved, and hardwire interlocks that preclude additional control rod withdrawals. REFERENCES 1. UFSAR, Section 15.4.5.1.

2. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.10.3-5 Revision No. 30

Single Control Rod WithdrawalCold Shutdown B 3.10.4 B 3.10 SPECIAL OPERATIONS B 3.10.4 Single Control Rod WithdrawalCold Shutdown BASES BACKGROUND The purpose of this MODE 4 Special Operations LCO is to permit the withdrawal of a single control rod for testing or maintenance, while in cold shutdown, by imposing certain restrictions. In MODE 4, the reactor mode switch is in the shutdown position, and all control rods are inserted and blocked from withdrawal. Many systems and functions are not required in these conditions, due to the installed interlocks associated with the reactor mode switch in the shutdown position. Circumstances may arise while in MODE 4, however, that present the need to withdraw a single control rod for various tests (e.g., friction tests, scram time testing, and coupling integrity checks). Certain situations may also require the removal of the associated control rod drive (CRD). These single control rod withdrawals and possible subsequent removals are normally accomplished by selecting the refuel position for the reactor mode switch. APPLICABLE With the reactor mode switch in the refuel position, the analyses for SAFETY ANALYSES control rod withdrawal during refueling are applicable and, provided the assumptions of these analyses are satisfied in MODE 4, these analyses will bound the consequences of an accident. Explicit safety analyses in the UFSAR (Ref. 1) demonstrate that the functioning of the refueling interlocks and adequate SDM will preclude unacceptable reactivity excursions. Refueling interlocks restrict the movement of control rods to reinforce operational procedures that prevent the reactor from becoming critical. These interlocks prevent the withdrawal of more than one control rod. Under these conditions, since only one control rod can be withdrawn, the core will always be shut down even with the highest worth control rod withdrawn if adequate SDM exists. The control rod scram function provides backup protection in the event normal refueling procedures and the refueling interlocks fail to prevent inadvertent criticalities during refueling. Alternate backup protection can be obtained by ensuring that a five by five array of control rods, centered (continued) Brunswick Unit 2 B 3.10.4-1 Revision No. 30

Single Control Rod WithdrawalCold Shutdown B 3.10.4 BASES APPLICABLE on the withdrawn control rod, are inserted and incapable of withdrawal. SAFETY ANALYSES This alternate backup protection is required when removing a CRD (continued) because this removal renders the withdrawn control rod incapable of being scrammed. As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) (Ref. 2) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases. LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 4 with the reactor mode switch in the refuel position can be performed in accordance with other LCOs (i.e., Special Operations LCO 3.10.2, "Reactor Mode Switch Interlock Testing") without meeting this Special Operations LCO or its ACTIONS. If a single control rod withdrawal is desired in MODE 4, controls consistent with those required during refueling must be implemented and this Special Operations LCO applied. "Withdrawal" in this application includes the actual withdrawal of the control rod as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod. The refueling interlocks of LCO 3.9.2, "Refuel Position One-Rod-Out Interlock," required by this Special Operations LCO will ensure that only one control rod can be withdrawn. At the time CRD removal begins, the disconnection of the position indication probe will cause LCO 3.9.4, "Control Rod Position Indication," and therefore, LCO 3.9.2 to fail to be met. Therefore, prior to commencing CRD removal, a control rod withdrawal block is required to be inserted to ensure that no additional control rods can be withdrawn and that compliance with this Special Operations LCO is maintained. To back up the refueling interlocks (LCO 3.9.2) or the control rod withdrawal block, the ability to scram the withdrawn control rod in the event of an inadvertent criticality is provided by the Special Operations LCO requirements in Item c.1. Alternatively, when the scram function is (continued) Brunswick Unit 2 B 3.10.4-2 Revision No. 30

Single Control Rod WithdrawalCold Shutdown B 3.10.4 BASES LCO not OPERABLE, or when the CRD is to be removed, a sufficient number (continued) of rods in the vicinity of the withdrawn control rod are required to be inserted and made incapable of withdrawal (Item c.2). This precludes the possibility of criticality upon withdrawal of this control rod. Also, once this alternate (Item c.2) is completed, the SDM requirement to account for both the withdrawn-untrippable control rod and the highest worth control rod may be changed to allow the withdrawn-untrippable control rod to be the single highest worth control rod. APPLICABILITY Control rod withdrawals are adequately controlled in MODES 1, 2, and 5 by existing LCOs. In MODES 3 and 4, control rod withdrawal is only allowed if performed in accordance with Special Operations LCO 3.10.3, or this Special Operations LCO, and if limited to one control rod. This allowance is only provided with the reactor mode switch in the refuel position. During these conditions, the full insertion requirements for all other control rods, the one-rod-out interlock (LCO 3.9.2), control rod position indication (LCO 3.9.4), and scram functions (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," and LCO 3.9.5, "Control Rod OPERABILITYRefueling"), or the added administrative controls in Item b.2 and Item c.2 of this Special Operations LCO, provide mitigation of potential reactivity excursions. ACTIONS A Note has been provided to modify the ACTIONS related to a single control rod withdrawal while in MODE 4. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for each requirement of the LCO not met provide appropriate compensatory measures for separate requirements that are not met. As such, a Note has been provided that allows separate Condition entry for each requirement of the LCO. (continued) Brunswick Unit 2 B 3.10.4-3 Revision No. 30

Single Control Rod WithdrawalCold Shutdown B 3.10.4 BASES ACTIONS A.1, A.2.1, and A.2.2 (continued) If one or more of the requirements of this Special Operations LCO are not met with the affected control rod insertable, these Required Actions restore operation consistent with normal MODE 4 conditions (i.e., all rods inserted) or with the exceptions allowed in this Special Operations LCO. Required Action A.1 has been modified by a Note that clarifies the intent of any other LCO's Required Action to insert all control rods. This Required Action includes exiting this Special Operations Applicability by returning the reactor mode switch to the shutdown position. A second Note has been added to Required Action A.1 to clarify that this Required Action is only applicable if the requirements not met are for an affected LCO. Required Actions A.2.1 and A.2.2 are specified, based on the assumption that the control rod is being withdrawn. If the control rod is still insertable, actions must be immediately initiated to fully insert all insertable control rods and within 1 hour place the reactor mode switch in the shutdown position. Actions must continue until all such control rods are fully inserted. The allowed Completion Time of 1 hour for placing the reactor mode switch in the shutdown position provides sufficient time to normally insert the control rods. B.1, B.2.1, and B.2.2 If one or more of the requirements of this Special Operations LCO are not met with the affected control rod not insertable, withdrawal of the control rod and removal of the associated CRD must be immediately suspended. If the CRD has been removed, such that the control rod is not insertable, the Required Actions require the most expeditious action be taken to either initiate action to restore the CRD and insert its control rod, or initiate action to restore compliance with this Special Operations LCO. (continued) Brunswick Unit 2 B 3.10.4-4 Revision No. 30

Single Control Rod WithdrawalCold Shutdown B 3.10.4 BASES (continued) SURVEILLANCE SR 3.10.4.1, SR 3.10.4.2, SR 3.10.4.3, and SR 3.10.4.4 REQUIREMENTS The other LCOs made applicable by this Special Operations LCO are required to have their associated surveillances met to establish that this Special Operations LCO is being met. If the local array of control rods is inserted and electrically disarmed while the scram function for the withdrawn rod is not available, periodic verification is required to ensure that the possibility of criticality remains precluded. Verification that all the other control rods are fully inserted is required to meet the SDM requirements. Verification that a control rod withdrawal block has been inserted ensures that no other control rods can be inadvertently withdrawn under conditions when position indication instrumentation is inoperable for the affected control rod. The 24 hour Frequency is acceptable because of the administrative controls on control rod withdrawals, the protection afforded by the LCOs involved, and hardwire interlocks to preclude an additional control rod withdrawal. SR 3.10.4.2 and SR 3.10.4.4 have been modified by Notes, which clarify that these SRs are not required to be met if the alternative requirements demonstrated by SR 3.10.4.1 are satisfied. REFERENCES 1. UFSAR, Section 15.4.5.

2. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.10.4-5 Revision No. 30

Single CRD RemovalRefueling B 3.10.5 B 3.10 SPECIAL OPERATIONS B 3.10.5 Single Control Rod Drive (CRD) RemovalRefueling BASES BACKGROUND The purpose of this MODE 5 Special Operations LCO is to permit the removal of a single CRD during refueling operations by imposing certain administrative controls. Refueling interlocks restrict the movement of control rods and the operation of the refueling equipment to reinforce operational procedures that prevent the reactor from becoming critical during refueling operations. During refueling operations, no more than one control rod is permitted to be withdrawn from a core cell containing one or more fuel assemblies. The refueling interlocks use the "full-in" position indicators to determine the position of all control rods. If the "full-in" position signal is not present for every control rod, then the all rods in permissive for the refueling equipment interlocks is not present and fuel loading is prevented. Also, the refuel position one-rod-out interlock will not allow the withdrawal of a second control rod. The control rod scram function provides backup protection in the event normal refueling procedures, and the refueling interlocks described above fail to prevent inadvertent criticalities during refueling. The requirement for this function to be OPERABLE precludes the possibility of removing the CRD once a control rod is withdrawn from a core cell containing one or more fuel assemblies. This Special Operations LCO provides controls sufficient to ensure the possibility of an inadvertent criticality is precluded, while allowing a single CRD to be removed from a core cell containing one or more fuel assemblies. The removal of the CRD involves disconnecting the position indication probe, which may cause noncompliance with LCO 3.9.4, "Control Rod Position Indication," and, therefore, LCO 3.9.1, "Refueling Equipment Interlocks," and LCO 3.9.2, "Refueling Position One-Rod-Out Interlock." The CRD removal also requires isolation of the CRD from the CRD Hydraulic System, thereby causing inoperability of the control rod (LCO 3.9.5, "Control Rod OPERABILITYRefueling"). (continued) Brunswick Unit 2 B 3.10.5-1 Revision No. 30

Single CRD RemovalRefueling B 3.10.5 BASES (continued) APPLICABLE With the reactor mode switch in the refuel position, the analyses for SAFETY ANALYSES control rod withdrawal during refueling are applicable and, provided the assumptions of these analyses are satisfied, these analyses will bound the consequences of accidents. Explicit safety analyses in the UFSAR (Ref. 1) demonstrate that proper operation of the refueling interlocks and adequate SDM will preclude unacceptable reactivity excursions. Refueling interlocks restrict the movement of control rods and the operation of the refueling equipment to reinforce operational procedures that prevent the reactor from becoming critical. These interlocks prevent the withdrawal of more than one control rod. Under these conditions, since only one control rod can be withdrawn, the core will always be shut down even with the highest worth control rod withdrawn if adequate SDM exists. By requiring all other control rods to be inserted and a control rod withdrawal block initiated, the function of the inoperable one-rod-out interlock (LCO 3.9.2) is adequately maintained. This Special Operations LCO requirement that no other CORE ALTERATIONS are in progress adequately compensates for the inoperable all rods in permissive for the refueling equipment interlocks (LCO 3.9.1). The control rod scram function provides backup protection to normal refueling procedures and the refueling interlocks, which prevent inadvertent criticalities during refueling. Since the scram function and refueling interlocks may be suspended, alternate backup protection required by this Special Operations LCO is obtained by ensuring that a five by five array of control rods, centered on the withdrawn control rod, are inserted and are incapable of being withdrawn, and all other control rods are inserted and incapable of being withdrawn (by insertion of a control rod block). As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) (Ref. 2) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases. (continued) Brunswick Unit 2 B 3.10.5-2 Revision No. 30

Single CRD RemovalRefueling B 3.10.5 BASES (continued) LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 5 with any of the following LCOs, LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," LCO 3.3.8.2, "Reactor Protection System (RPS) Electric Power Monitoring," LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, or LCO 3.9.5 not met, can be performed in accordance with the Required Actions of these LCOs without meeting this Special Operations LCO or its ACTIONS. However, if a single CRD removal from a core cell containing one or more fuel assemblies is desired in MODE 5, controls consistent with those required by LCO 3.3.1.1, LCO 3.3.8.2, LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 must be implemented, and this Special Operations LCO applied. By requiring all other control rods to be inserted and a control rod withdrawal block initiated, the function of the inoperable one-rod-out interlock (LCO 3.9.2) is adequately maintained. A control rod withdrawal block may be initiated by deselecting all selected control rods. This Special Operations LCO requirement that no other CORE ALTERATIONS are in progress adequately compensates for the inoperable all rods in permissive for the refueling equipment interlocks (LCO 3.9.1). Ensuring that the five by five array of control rods, centered on the withdrawn control rod, are inserted and incapable of withdrawal adequately satisfies the backup protection that LCO 3.3.1.1 and LCO 3.9.2 would have otherwise provided. Also, once these requirements (Items a, b, and c) are completed, the SDM requirement to account for both the withdrawn-untrippable control rod and the highest worth control rod may be changed to allow the withdrawn-untrippable control rod to be the single highest worth control rod. APPLICABILITY Operation in MODE 5 is controlled by existing LCOs. The allowance to comply with this Special Operations LCO in lieu of the ACTIONS of LCO 3.3.1.1, LCO 3.3.8.2, LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 is appropriately controlled with the additional administrative controls required by this Special Operations LCO, which reduce the potential for reactivity excursions. (continued) Brunswick Unit 2 B 3.10.5-3 Revision No. 30

Single CRD RemovalRefueling B 3.10.5 BASES (continued) ACTIONS A.1, A.2.1, and A.2.2 If one or more of the requirements of this Special Operations LCO are not met, the immediate implementation of these Required Actions restores operation consistent with the normal requirements for failure to meet LCO 3.3.1.1, LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 (i.e., all control rods inserted) or with the allowances of this Special Operations LCO. The Completion Times for Required Action A.1, Required Action A.2.1, and Required Action A.2.2 are intended to require that these Required Actions be implemented in a very short time and carried through in an expeditious manner to either initiate action to restore the CRD and insert its control rod, or initiate action to restore compliance with this Special Operations LCO. Actions must continue until either Required Action A.2.1 or Required Action A.2.2 is satisfied. SURVEILLANCE SR 3.10.5.1, SR 3.10.5.2, SR 3.10.5.3, SR 3.10.5.4, and SR 3.10.5.5 REQUIREMENTS Verification that all the control rods, other than the control rod withdrawn for the removal of the associated CRD, are fully inserted is required to ensure the SDM is within limits. Verification that the local five by five array of control rods, other than the control rod withdrawn for removal of the associated CRD, is inserted and electrically disarmed, while the scram function for the withdrawn rod is not available, is required to ensure that the possibility of criticality remains precluded. Verification that a control rod withdrawal block has been inserted ensures that no other control rods can be inadvertently withdrawn under conditions when position indication instrumentation is inoperable for the withdrawn control rod. The Surveillance for LCO 3.1.1, which is made applicable by this Special Operations LCO, is required in order to establish that this Special Operations LCO is being met. Verification that no other CORE ALTERATIONS are being made is required to ensure the assumptions of the safety analysis are satisfied. Periodic verification of the administrative controls established by this Special Operations LCO is prudent to preclude the possibility of an inadvertent criticality. The 24 hour Frequency is acceptable, given the administrative controls on control rod removal and hardwire interlock to block an additional control rod withdrawal. (continued) Brunswick Unit 2 B 3.10.5-4 Revision No. 30

Single CRD RemovalRefueling B 3.10.5 BASES (continued) REFERENCES 1. UFSAR, Section 15.4.5.

2. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.10.5-5 Revision No. 30

Multiple Control Rod WithdrawalRefueling B 3.10.6 B 3.10 SPECIAL OPERATIONS B 3.10.6 Multiple Control Rod WithdrawalRefueling BASES BACKGROUND The purpose of this MODE 5 Special Operations LCO is to permit multiple control rod withdrawal during refueling by imposing certain administrative controls. Refueling interlocks restrict the movement of control rods and the operation of the refueling equipment to reinforce operational procedures that prevent the reactor from becoming critical during refueling operations. During refueling operations, no more than one control rod is permitted to be withdrawn from a core cell containing one or more fuel assemblies. When all four fuel assemblies are removed from a cell, the control rod may be withdrawn with no restrictions. Any number of control rods may be withdrawn and removed from the reactor vessel if their cells contain no fuel. The refueling interlocks use the "full-in" position indicators to determine the position of all control rods. If the "full-in" position signal is not present for every control rod, then the all rods in permissive for the refueling equipment interlocks is not present and fuel loading is prevented. Also, the refuel position one-rod-out interlock will not allow the withdrawal of a second control rod. To allow more than one control rod to be withdrawn during refueling, these interlocks must be defeated. This Special Operations LCO establishes the necessary administrative controls to allow bypassing the "full-in" position indicators. APPLICABLE Explicit safety analyses in the UFSAR (Ref. 1) demonstrate that the SAFETY ANALYSES functioning of the refueling interlocks and adequate SDM will prevent unacceptable reactivity excursions during refueling. To allow multiple control rod withdrawals, control rod removals, associated control rod drive (CRD) removal, or any combination of these, the "full-in" position indication is allowed to be bypassed for each withdrawn control rod if all fuel has been removed from the cell. With no fuel assemblies in the core (continued) Brunswick Unit 2 B 3.10.6-1 Revision No. 30

Multiple Control Rod WithdrawalRefueling B 3.10.6 BASES APPLICABLE cell, the associated control rod has no reactivity control function and is not SAFETY ANALYSES required to remain inserted. Prior to reloading fuel into the cell, however, (continued) the associated control rod must be inserted to ensure that an inadvertent criticality does not occur, as evaluated in the Reference 1 analysis. As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) (Ref. 2) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases. LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 5 with either LCO 3.9.3, "Control Rod Position," LCO 3.9.4, "Control Rod Position Indication," or LCO 3.9.5, "Control Rod OPERABILITYRefueling," not met, can be performed in accordance with the Required Actions of these LCOs without meeting this Special Operations LCO or its ACTIONS. If multiple control rod withdrawal or removal, or CRD removal is desired, all four fuel assemblies are required to be removed from the associated cells. Prior to entering this LCO, any fuel remaining in a cell whose CRD was previously removed under the provisions of another LCO must be removed.

                "Withdrawal" in this application includes the actual withdrawal of the control rod as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod.

When fuel is loaded into the core with multiple control rods withdrawn, special spiral reload sequences are used to ensure that reactivity additions are minimized. Spiral reloading encompasses reloading a cell (four fuel locations immediately adjacent to a control rod) on the edge of a continuous fueled region (the cell can be loaded in any sequence). Otherwise, all control rods must be fully inserted before loading fuel. APPLICABILITY Operation in MODE 5 is controlled by existing LCOs. The exceptions from other LCO requirements (e.g., the ACTIONS of LCO 3.9.3, LCO 3.9.4, or LCO 3.9.5) allowed by this Special Operations LCO are (continued) Brunswick Unit 2 B 3.10.6-2 Revision No. 30

Multiple Control Rod WithdrawalRefueling B 3.10.6 BASES APPLICABILITY appropriately controlled by requiring all fuel to be removed from cells (continued) whose "full-in" indicators are allowed to be bypassed. ACTIONS A.1, A.2, A.3.1, and A.3.2 If one or more of the requirements of this Special Operations LCO are not met, the immediate implementation of these Required Actions restores operation consistent with the normal requirements for refueling (i.e., all control rods inserted in core cells containing one or more fuel assemblies) or with the exceptions granted by this Special Operations LCO. The Completion Times for Required Action A.1, Required Action A.2, Required Action A.3.1, and Required Action A.3.2 are intended to require that these Required Actions be implemented in a very short time and carried through in an expeditious manner to either initiate action to restore the affected CRDs and insert their control rods, or initiate action to restore compliance with this Special Operations LCO. SURVEILLANCE SR 3.10.6.1, SR 3.10.6.2, and SR 3.10.6.3 REQUIREMENTS Periodic verification of the administrative controls established by this Special Operations LCO is prudent to preclude the possibility of an inadvertent criticality. The 24 hour Frequency is acceptable, given the administrative controls on fuel assembly and control rod removal, and takes into account other indications of control rod status available in the control room. REFERENCES 1. UFSAR, Section 15.4.5.

2. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.10.6-3 Revision No. 30

Control Rod TestingOperating B 3.10.7 B 3.10 SPECIAL OPERATIONS B 3.10.7 Control Rod TestingOperating BASES BACKGROUND The purpose of this Special Operations LCO is to permit control rod testing, while in MODES 1 and 2, by imposing certain administrative controls. Control rod patterns during startup conditions are controlled by the operator and the rod worth minimizer (RWM) (LCO 3.3.2.1, "Control Rod Block Instrumentation"), such that only the specified control rod sequences and relative positions required by LCO 3.1.6, "Rod Pattern Control," are allowed over the operating range from all control rods inserted to the low power setpoint (LPSP) of the RWM. The sequences effectively limit the potential amount and rate of reactivity increase that could occur during a control rod drop accident (CRDA). During these conditions, control rod testing is sometimes required that may result in control rod patterns not in compliance with the prescribed sequences of LCO 3.1.6. These tests include SDM demonstrations, control rod scram time testing, and control rod friction testing. This Special Operations LCO provides the necessary exemption to the requirements of LCO 3.1.6 and provides additional administrative controls to allow the deviations in such tests from the prescribed sequences in LCO 3.1.6. APPLICABLE The analytical methods and assumptions used in evaluating the CRDA SAFETY ANALYSES are summarized in Reference 1. CRDA analyses assume the reactor operator follows prescribed withdrawal sequences. These sequences define the potential initial conditions for the CRDA analyses. The RWM provides backup to operator control of the withdrawal sequences to ensure the initial conditions of the CRDA analyses are not violated. For special sequences developed for control rod testing, the initial control rod patterns assumed in the safety analysis of Reference 1 may not be preserved. Therefore special CRDA analyses are required to demonstrate that these special sequences will not result in unacceptable consequences, should a CRDA occur during the testing. These analyses, performed in accordance with an NRC approved methodology, are dependent on the specific test being performed. (continued) Brunswick Unit 2 B 3.10.7-1 Revision No. 30

Control Rod TestingOperating B 3.10.7 BASES APPLICABLE As described in LCO 3.0.7, compliance with Special Operations LCOs is SAFETY ANALYSES optional, and therefore, no criteria of10 CFR 50.36(c)(2)(ii) (Ref. 2) apply. (continued) Operations Special LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases. LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Control rod testing may be performed in compliance with the prescribed sequences of LCO 3.1.6, and during these tests, no exceptions to the requirements of LCO 3.1.6 are necessary. For testing performed with a sequence not in compliance with LCO 3.1.6, the requirements of LCO 3.1.6 may be suspended, provided additional administrative controls are placed on the test to ensure that the assumptions of the special safety analysis for the test sequence are satisfied. Assurances that the test sequence is followed can be provided by either programming the test sequence into the RWM, with conformance verified as specified in SR 3.3.2.1.8 and allowing the RWM to monitor control rod withdrawal and provide appropriate control rod blocks if necessary, or by verifying conformance to the approved test sequence by a second licensed operator or other qualified member of the technical staff. These controls are consistent with those normally applied to operation in the startup range as defined in the SRs and ACTIONS of LCO 3.3.2.1, "Control Rod Block Instrumentation." APPLICABILITY Control rod testing, while in MODES 1 and 2, with THERMAL POWER greater than 8.75% RTP, is adequately controlled by the existing LCOs on power distribution limits and control rod block instrumentation. Control rod movement during these conditions is not restricted to prescribed sequences and can be performed within the constraints of LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)," LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)," and LCO 3.3.2.1. With THERMAL POWER less than or equal to 8.75% RTP, the provisions of this Special Operations LCO are necessary to perform special tests that are not in conformance with the prescribed sequences of LCO 3.1.6. (continued) Brunswick Unit 2 B 3.10.7-2 Revision No. 65

Control Rod TestingOperating B 3.10.7 BASES APPLICABILITY While in MODES 3 and 4, control rod withdrawal is only allowed if (continued) performed in accordance with Special Operations LCO 3.10.3, "Single Control Rod WithdrawalHot Shutdown," or Special Operations LCO 3.10.4, "Single Control Rod WithdrawalCold Shutdown," which provide adequate controls to ensure that the assumptions of the safety analyses of References 1 and 2 are satisfied. During these Special Operations and while in MODE 5, the one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock,") and scram functions (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," and LCO 3.9.5, "Control Rod OPERABILITYRefueling"), or the added administrative controls prescribed in the applicable Special Operations LCOs, provide mitigation of potential reactive excursions. ACTIONS A.1 With the requirements of the LCO not met (e.g., the control rod pattern is not in compliance with the special test sequence, the sequence is improperly loaded in the RWM) the testing is required to be immediately suspended. Upon suspension of the special test, the provisions of LCO 3.1.6 are no longer excepted, and appropriate actions are to be taken to restore the control rod sequence to the prescribed sequence of LCO 3.1.6, or to shut down the reactor, if required by LCO 3.1.6. SURVEILLANCE SR 3.10.7.1 REQUIREMENTS With the special test sequence not programmed into the RWM, a second licensed operator or other qualified member of the technical staff is required to verify conformance with the approved sequence for the test. A member of the technical staff is considered to be qualified if he has completed applicable qualification requirements in accordance with required plant training and qualification procedures. This verification must be performed during control rod movement to prevent deviations from the specified sequence. A Note is added to indicate that this Surveillance does not need to be met if SR 3.10.7.2 is satisfied. (continued) Brunswick Unit 2 B 3.10.7-3 Revision No. 30

Control Rod TestingOperating B 3.10.7 BASES SURVEILLANCE SR 3.10.7.2 REQUIREMENTS (continued) When the RWM provides conformance to the special test sequence, the test sequence must be verified to be correctly loaded into the RWM prior to control rod movement. This Surveillance demonstrates compliance with SR 3.3.2.1.8, thereby demonstrating that the RWM is OPERABLE. A Note has been added to indicate that this Surveillance does not need to be met if SR 3.10.7.1 is satisfied. REFERENCES 1. UFSAR, Section 15.4.6.

2. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.10.7-4 Revision No. 30

SDM TestRefueling B 3.10.8 B 3.10 SPECIAL OPERATIONS B 3.10.8 SHUTDOWN MARGIN (SDM) TestRefueling BASES BACKGROUND The purpose of this MODE 5 Special Operations LCO is to permit SDM testing to be performed for those plant configurations in which the reactor pressure vessel (RPV) head is either not in place or the head bolts are not fully tensioned. LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," requires that adequate SDM be demonstrated following fuel movements or control rod replacement within the RPV. The demonstration must be performed prior to or within 4 hours after criticality is reached. This SDM test may be performed prior to or during the first startup following the refueling. Performing the SDM test prior to startup requires the test to be performed while in MODE 5, with the vessel head bolts less than fully tensioned (and possibly with the vessel head removed). While in MODE 5, the reactor mode switch is required to be in the shutdown or refuel position, where the applicable control rod blocks ensure that the reactor will not become critical. The SDM test requires the reactor mode switch to be in the startup/hot standby position, since more than one control rod will be withdrawn for the purpose of demonstrating adequate SDM. This Special Operations LCO provides the appropriate additional controls to allow withdrawing more than one control rod from a core cell containing one or more fuel assemblies when the reactor vessel head bolts are less than fully tensioned. APPLICABLE Prevention and mitigation of unacceptable reactivity excursions during SAFETY ANALYSES control rod withdrawal, with the reactor mode switch in the startup/hot standby position while in MODE 5, is provided by the intermediate range monitor (IRM) neutron flux scram (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), and control rod block instrumentation (LCO 3.3.2.1, "Control Rod Block Instrumentation"). The limiting reactivity excursion during startup conditions while in MODE 5 is the control rod drop accident (CRDA). (continued) Brunswick Unit 2 B 3.10.8-1 Revision No. 30

SDM TestRefueling B 3.10.8 BASES APPLICABLE CRDA analyses assume that the reactor operator follows prescribed SAFETY ANALYSES withdrawal sequences. For SDM tests performed within these defined (continued) sequences, the analyses of Reference 1 are applicable. However, for some sequences developed for the SDM testing, the control rod patterns assumed in the safety analysis of Reference 1 may not be met. Therefore, special CRDA analyses, performed in accordance with an NRC approved methodology, are required to demonstrate the SDM test sequence will not result in unacceptable consequences should a CRDA occur during the testing. For the purpose of this test, the protection provided by the normally required MODE 5 applicable LCOs, in addition to the requirements of this LCO, will maintain normal test operations as well as postulated accidents within the bounds of the appropriate safety analyses (Ref. 1). In addition to the added requirements for the RWM, APRM, and control rod coupling, the notch out mode is specified for out of sequence withdrawals. Requiring the notch out mode limits withdrawal steps to a single notch, which limits inserted reactivity, and allows adequate monitoring of changes in neutron flux, which may occur during the test. As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) (Ref. 2) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases. LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. SDM tests may be performed while in MODE 2, in accordance with Table 1.1-1, without meeting this Special Operations LCO or its ACTIONS. For SDM tests performed while in MODE 5, additional requirements must be met to ensure that adequate protection against potential reactivity excursions is available. To provide additional scram protection, beyond the normally required IRMs, the APRMs are also required to be OPERABLE (LCO 3.3.1.1, Functions 2.a, 2.d, and 2.e) as though the reactor were in MODE 2. Because multiple control rods will be withdrawn and the reactor will potentially become critical, the approved control rod withdrawal sequence must be enforced by the RWM (LCO 3.3.2.1, Function 2, MODE 2), or must be verified by a second licensed operator or other qualified member of the technical staff. To (continued) Brunswick Unit 2 B 3.10.8-2 Revision No. 30

SDM TestRefueling B 3.10.8 BASES LCO provide additional protection against an inadvertent criticality, control rod (continued) withdrawals that do not conform to the banked position withdrawal sequence specified in LCO 3.1.6, "Rod Pattern Control," (i.e., out of sequence control rod withdrawals) must be made in the individual notched withdrawal mode to minimize the potential reactivity insertion associated with each movement. Coupling integrity of withdrawn control rods is required to minimize the probability of a CRDA and ensure proper functioning of the withdrawn control rods, if they are required to scram. Because the reactor vessel head may be removed during these tests, no other CORE ALTERATIONS may be in progress. Furthermore, since the control rod scram function with the RCS at atmospheric pressure relies solely on the CRD accumulator, it is essential that the CRD charging water header remain pressurized. This Special Operations LCO then allows changing the Table 1.1-1 reactor mode switch position requirements to include the startup/hot standby position, such that the SDM tests may be performed while in MODE 5. APPLICABILITY These SDM test Special Operations requirements are only applicable if the SDM tests are to be performed while in MODE 5 with the reactor vessel head removed or the head bolts not fully tensioned. Additional requirements during these tests to enforce control rod withdrawal sequences and restrict other CORE ALTERATIONS provide protection against potential reactivity excursions. Operations in all other MODES are unaffected by this LCO. ACTIONS A.1 With one or more control rods discovered uncoupled during this Special Operation, a controlled insertion of each uncoupled control rod is required; either to attempt recoupling, or to preclude a control rod drop. This controlled insertion is preferred since, if the control rod fails to follow the drive as it is withdrawn (i.e., is "stuck" in an inserted position), placing the reactor mode switch in the shutdown position per Required Action B.1 could cause substantial secondary damage. If recoupling is not accomplished, operation may continue, provided the control rods are fully inserted within 3 hours and disarmed (electrically or hydraulically) within 4 hours. Inserting a control rod ensures the shutdown and scram capabilities are not adversely affected. The control rod is disarmed to (continued) Brunswick Unit 2 B 3.10.8-3 Revision No. 30

SDM TestRefueling B 3.10.8 BASES ACTIONS A.1 (continued) prevent inadvertent withdrawal during subsequent operations. The control rods can be hydraulically disarmed by closing the drive water and exhaust water isolation valves. Electrically the control rods can be disarmed by disconnecting power from all four directional control valve solenoids. Required Action A.1 is modified by a Note that allows the inoperable control rods to be bypassed or the RWM to be bypassed if required to allow insertion of the inoperable control rods and continued operation. LCO 3.3.2.1, "Control Rod Block Instrumentation," Actions provide additional requirements when the RWM is bypassed to ensure compliance with the CRDA analysis. The allowed Completion Times are reasonable, considering the small number of allowed inoperable control rods, and provide time to insert and disarm the control rods in an orderly manner and without challenging plant systems. Condition A is modified by a Note allowing separate Condition entry for each uncoupled control rod. This is acceptable since the Required Actions for this Condition provide appropriate compensatory actions for each uncoupled control rod. Complying with the Required Actions may allow for continued operation. Subsequent uncoupled control rods are governed by subsequent entry into the Condition and application of the Required Actions. B.1 With one or more of the requirements of this LCO not met for reasons other than an uncoupled control rod, the testing should be immediately stopped by placing the reactor mode switch in the shutdown or refuel position. This results in a condition that is consistent with the requirements for MODE 5 where the provisions of this Special Operations LCO are no longer required. SURVEILLANCE SR 3.10.8.1, SR 3.10.8.2, and SR 3.10.8.3 REQUIREMENTS LCO 3.3.1.1, Functions 2.a, 2.d, and 2.e, made applicable in this Special Operations LCO, are required to have applicable Surveillances met to establish that this Special Operations LCO is being met (SR 3.10.8.1). (continued) Brunswick Unit 2 B 3.10.8-4 Revision No. 30

SDM TestRefueling B 3.10.8 BASES SURVEILLANCE SR 3.10.8.1, SR 3.10.8.2, and SR 3.10.8.3 (continued) REQUIREMENTS However, the control rod withdrawal sequences during the SDM tests may be enforced by the RWM (LCO 3.3.2.1, Function 2, MODE 2 requirements) or by a second licensed operator or other qualified member of the technical staff. As noted, either the applicable SRs for the RWM (LCO 3.3.2.1) must be satisfied according to the applicable Frequencies (SR 3.10.8.2), or the proper movement of control rods must be verified (SR 3.10.8.3). This latter verification (i.e., SR 3.10.8.3) must be performed during control rod movement to prevent deviations from the specified sequence. These surveillances provide adequate assurance that the specified test sequence is being followed. SR 3.10.8.4 Periodic verification of the administrative controls established by this LCO will ensure that the reactor is operated within the bounds of the safety analysis. The 12 hour Frequency is intended to provide appropriate assurance that each operating shift is aware of and verifies compliance with these Special Operations LCO requirements. SR 3.10.8.5 Coupling verification is performed to ensure the control rod is connected to the control rod drive mechanism and will perform its intended function when necessary. The verification is required to be performed any time a control rod is withdrawn to the "full-out" notch position, or prior to declaring the control rod OPERABLE after work on the control rod or CRD System that could affect coupling. This Frequency is acceptable, considering the low probability that a control rod will become uncoupled when it is not being moved as well as operating experience related to uncoupling events. SR 3.10.8.6 CRD charging water header pressure verification is performed to ensure the motive force is available to scram the control rods in the event of a scram signal. Since the reactor is depressurized in MODE 5, there is (continued) Brunswick Unit 2 B 3.10.8-5 Revision No. 30

SDM TestRefueling B 3.10.8 BASES SURVEILLANCE SR 3.10.8.6 (continued) REQUIREMENTS insufficient reactor pressure to scram the control rods. Verification of charging water header pressure ensures that if a scram were required, capability for rapid control rod insertion would exist. The minimum pressure of 940 psig is well below the expected pressure of approximately 1400 psig while still ensuring sufficient pressure for rapid control rod insertion. The 7 day Frequency has been shown to be acceptable through operating experience and takes into account indications available in the control room. REFERENCES 1. UFSAR, Section 15.4.6.

2. 10 CFR 50.36(c)(2)(ii).

Brunswick Unit 2 B 3.10.8-6 Revision No. 30]]