ML21047A433: Difference between revisions

From kanterella
Jump to navigation Jump to search
(StriderTol Bot change)
(StriderTol Bot change)
Line 17: Line 17:


=Text=
=Text=
{{#Wiki_filter:Serial No. 21-031 Attachment 2 MPS3 TECHNICAL SPECIFICATION BASES PAGES MILLSTONE POWER STATION UNIT 3 DOMINION ENERGY NUCLEAR CONNECTICUT, INC.
{{#Wiki_filter:}}
 
I October 25, 1990 3/4.0 APPLICABILITY BASES 3/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS 3/4.0 APPLICABILITY Specification 3.0.1 through 3.0.4 establish the general requirements applicable to Limiting Conditions for Operation. These requirements are based on the requirements for Limiting Conditions for Operation stated in the Code of Federal Regulations, 10 CFR 50.36(c)(2):
"Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specification until the condition can be met."
Specification 3. 0 .1 establishes the Applicability statement within each individual specification as the requirement for when (i.e., in which OPERATIONAL MODES or other specified conditions) conformance to the Limiting Conditions for Operation is required for safe operation of the facility. The ACTION requirements establish those remedial measures that must be taken within specified time limits when the requirements of a Limiting Condition for Operation are not met.
There are two basic types of ACTION requirements. The first specifies the remedial measures that permit continued operation of the facility which is not further restricted by the time limits of the ACTION requirements. In this case, conformance to the ACTION requirements provides an acceptable level of safety for unlimited continued operation as long as the ACTION requirements continue to be met. The second type of ACTION requirement specifies a time limit in which conformance to the conditions of the Limiting Condition for Operation must be met. This time limit is the allowable outage time to restore an inoperable system or component to OPERABLE status of for restoring parameters within specified limits. If these actions are not completed within the allowable outage time limits, a shutdown is required to place the facility in a MODE or condition in which the specification no longer applies. It is not intended that the shutdown ACTION requirements be used as an operational convenience which permits (routine) voluntary removal of a system(s) or component(s) from service in lieu of other alternatives that would not result in redundant systems or components being inoperable.
The specified time limits of the ACTION requirements are applicable from the point in time it is identified that a Limiting Condition for Operation is not met. The time limits of the ACTION requirements are also applicable when a system or component is removed from service for surveillance testing or investigation of operational problems. Individual specifications may include a specified time limit for the completion of a Surveillance Requirement when equipment is removed from service. In this case, the allowable outage time limits of the ACTION requirements are applicable when this limit expires if the surveillance has not been completed.
When a shutdown is required to MILLSTONE - UNIT 3                          B 3/4 0-1                            AMENDMENT NO. 57
 
October 25, 1990 3/4.0  APPLICABILITY BASES comply with ACTION requirements, the plant may have entered a MODE in which a new specification becomes applicable. In this case, the time limits of the ACTION requirements would apply from the point in time that the new specification becomes applicable if the requirements of the Limiting Condition for Operation are not met.
Specification 3.0.2 establishes that noncompliance with a specification exists when the requirements of the Limiting Condition for Operation are not met and the associated ACTION requirements have not been implemented within the specified time interval. The purpose of this specification is to clarify that (1) implementation of the ACTION requirements within the specified time interval constitutes compliance with a specification and (2) completion of the remedial measures of the ACTION requirements is not required when compliance with a Limiting Condition of Operation is restored within the time interval specified in the associated ACTION requirements.
Specification 3 .0 .3 establishes the shutdown ACTION requirements that must be implemented when a Limiting Condition for Operation is not met and the condition is not specifically addressed by the associated ACTION requirements. The purpose of this specification is to delineate the time limits for placing the unit in a safe shutdown MODE when plant operation cannot be maintained within the limits for safe operation defined by the Limiting Conditions for Operation and its ACTION requirements. It is not intended to be used as an operational convenience which permits (routine) voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable. This time permits the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the cooldown capabilities of the facility assuming only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the primary coolant system and the potential for a plant upset that could challenge safety systems under conditions for which this specification applies.
If remedial measures permitting limited continued operation of the facility under the provisions of the ACTION requirements are completed, the shutdown may be terminated. The time limits of the ACTION requirements are applicable from the point in time it is identified that a Limiting Condition for Operation is not met. Therefore, the shutdown may be terminated if the ACTION requirements have been met or the time limits of the ACTION requirements have not expired, thus providing an allowance for the completion of the required actions. The time limits of Specification 3.0.3 allow 37 hours for the plant to be in COLD SHUTDOWN MODE when a shutdown is required during the POWER MODE of operation. If the plant is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE of operation applies. However, if a lower MODE of operation is reached in less time than allowed, the total allowable time to reach COLD SHUTDOWN, or other applicable MILLSTONE - UNIT 3                          B 3/4 0-2                          AMENDMENT NO. 57
 
April17,2000 3/4.0    APPLICABILITY BASES MODE, is not reduced. For example, if HOT STANDBY is reached in 2 hours, the time allowed to reach HOT SHUTDOWN is the next 11 hours because the total time to reach HOT SHUTDOWN is not reduced from the allowable limit of 13 hours. Therefore, if remedial measures are completed that would permit a return to POWER operation, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed.
The same principle applies with regard to the allowable outage time limits of the ACTION requirements, if compliance with the ACTION requirements for one specification results in entry into a MODE or condition of operation for another specification in which the requirements of the Limiting Condition for Operation are not met. If the new specification becomes applicable in less time than specified, the difference may be added to the allowable outage time limits of the second specification. However, the allowable outage time limits of ACTION requirements for a higher MODE of operation may not be used to extend the allowable outage time that is applicable when a Limiting Condition for Operation is not met in a lower MODE of operation.
The shutdown requirements of Specification 3.0.3 do not apply in MODES 5 and 6, because the ACTION requirements of individual specifications define the remedial measures to be taken.
Specification 3.0.4 establishes limitations on MODE changes when a Limiting Condition for Operation is not met. It precludes placing the facility in a high MODE of operation when the requirements for a Limiting Condition for Operation are not met and continued noncompliance to these conditions would result in a shutdown to comply with the ACTION requirements if a change in MODES were permitted. The purpose of this specification is to ensure that facility operation is not initiated or that higher MODES of operation are not entered when corrective action is being taken to obtain compliance with a specification by restoring equipment to OPERABLE status or parameters to specified limits. Compliance with ACTION requirements that permit continued operation of the facility for an unlimited period of time provides an acceptable level of safety for continued operation without regard to the status of the plant before or after a MODE change. Therefore, in this case, entry into an OPERATIONAL MODE or other specified condition may be made in accordance with the provisions of the ACTION requirements.
The provisions of this specification should not, however, be interpreted as endorsing the failure to exercise good practice in restoring systems or components to OPERABLE status before plant startup.
When a shutdown is required to comply with ACTION requirements, the provision of Specification 3.0.4 do not apply because they would delay placing the facility in a lower MODE of operation.
Specification 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to Specifications 3.0.1 and 3.0.2 (e.g., to not comply with the applicable RequiredAction(s)) to allow the performance of required testing to demonstrate either:
: a. The OPERABILITY of the equipment being returned to service; or
: b. The OPERABILITY of other equipment.
MILLSTONE - UNIT 3                          B 3/4 0-3                          Amendment No. /1-, 179
 
April 17, 2000 3/4.0 APPLICABILITY BASES The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the required testing to demonstrate OPERABILITY. This Specification does not provide time to perform any other preventative or corrective maintenance.
An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the required testing.
An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of required testing on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of required testing on another channel in the same trip system.
Specifications 4.0.1 through 4.0.5 establish the general requirements applicable to Surveillance Requirements. These requirements are based on the Surveillance Requirements stated in the Code of Federal Regulations, 10 CPR 50.36(c)(3):
MILLSTONE - UNIT 3                        B 3/4 0-3a                          AmendmentNo . .§-'.7-, 179
 
November 15, 2002 3/4.0 APPLICABILITY BASES "Surveillance requirements are requirements relating to test, calibration, or inspection to ensure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions of operation will be met."
Specification 4.0.1 establishes the requirement that surveillances must be met during the OPERATIONAL MODES or other conditions for which the requirements of the Limiting Conditions for Operation apply unless otherwise stated in an individual Surveillance Requirement. The purpose of this specification is to ensure that surveillances are performed to verify the OPERABILITY of systems and components and that parameters are within specified limits to ensure safe operation of the facility when the plant is in a MODE or other specified condition for which the associated Limiting Conditions for Operation are applicable. Failure to meet a Surveillance within the specified surveillance interval, in accordance with Specification 4.0.2, constitutes a failure to meet a Limiting Condition for Operation.
Systems and components are assumed to be OPERABLE when the associated Surveillance Requirements have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when either:
: a.      The systems or components are known to be inoperable, although still meeting the Surveillance Requirements or
: b.      The requirements of the Surveillance(s) are known to be not met between required Surveillance performances.
Surveillance requirements do not have to be performed when the facility is in an OPERATIONAL MODE or other specified conditions for which the requirements of the associated Limiting Condition for Operation do not apply unless otherwise specified. The Surveillance Requirements associated with a Special Test Exception are only applicable when the Special Test Exception is used as an allowable exception to the requirements of a specification.
Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given Surveillance Requirement. In this case, the unplanned event may be credited as fulfilling the performance of the Surveillance Requirement. This allowance includes those Surveillance Requirement(s) whose performance is normally precluded in a given MODE or other specified condition.
Surveillance Requirements, including Surveillances invoked by ACTION requirements, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with Specification 4.0.2, prior to returning equipment to OPERABLE status.
Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with Specification 4.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed.
MILLSTONE - UNIT 3                          B 3/4 0-4                    AmendmentNo.~.~,213
 
LBDCR No. 04-MP3-015 February 24, 2005 3/4.0 APPLICABILITY BASES Some examples of this process are:
: a.      Auxiliary feedwater (AFW) pump turbine maintenance during refueling that requires testing at steam pressure > 800 psi. However, if other appropriate testing is satisfactorily completed, the AFW System can be considered OPERABLE. This allows startup and other necessary testing to proceed until the plant reaches the steam pressure required to perform the testing.
: b.      High pressure safety injection (HPSI) maintenance during shutdown that requires system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with HPSI considered OPERABLE.
This allows operation to reach the specified pressure to complete the necessary post maintenance testing.
Specification 4.0.2 This specification establishes the limit for which the specified time interval for surveillance requirements may be extended. It permits an allowable extension of the normal surveillance interval to facilitate surveillance scheduling and consideration of plant operating conditions that may not be suitable for conducting the surveillance; e.g., transient conditions or other ongoing surveillance or maintenance activities. It also provides flexibility to accommodate the length of a fuel cycle for surveillances that are performed at each refueling outage and are specified typically with an 18-month surveillance interval. It is not intended that this provision be used repeatedly as a convenience to extend surveillance intervals beyond that specified for surveillances that are not performed during refueling outage. The limitation of 4.0.2 is based on engineering judgment and the recognition that the most probable result of any particular surveillance being performed is the verification of conformance with the surveillance requirements. This provision is sufficient to ensure that the reliability ensured through surveillance activities is not significantly degraded beyond that obtained from the specified surveillance interval.
Specification 4.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified surveillance interval. A delay period ofup to 24 hours or up to the limit of the specified surveillance interval, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with Specification 4.0.2, and not at the time that the specified surveillance interval was not met.
This delay period provides adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with ACTION requirements or other remedial measures that might preclude completion of the Surveillance.
The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.
MILLSTONE - UNIT 3                          B 3/4 0-5            Amendment No . .s::7-, ~. ~. U-3-,
Acknowledged by NRC letter dated 08/25/05
 
LBDCR No. 04-MP3-015 February 24, 2005 3/4.0  APPLICABILITY BASES When a Surveillance with a surveillance interval based not on time intervals, but upon specified unit conditions, operating situations, or requirements ofregulations, (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, Specification 4.0.3 allows for the full delay period ofup to the specified surveillance interval to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.
Specification 4.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by ACTION requirements.
Failure to comply with specified surveillance intervals for the Surveillance Requirements is expected to be an infrequent occurrence. Use of the delay period established by Specification 4.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals. While up to 24 hours or the limit of the specified surveillance interval is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the licensee's Corrective Action Program.
If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the entry into the ACTION requirements for the applicable Limiting Condition for Operation begins immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and entry into the ACTION requirements for the applicable Limiting Conditions for Operation begins immediately upon the failure of the Surveillance.
Completion of the Surveillance within the delay period allowed by this Specification, or within the Allowed Outage Time of the applicable ACTIONS, restores compliance with Specification 4.0.1.
MILLSTONE - UNIT 3                          B 3/4 0-5a                            Amendment No. m-,
Acknowledged by NRC letter dated 08/25/05
 
LBDCR No. 07-MP3-009 June 19, 2007 3/4.0 APPLICABILITY BASES Specification 4.0.4 establishes the requirement that all applicable surveillances must be met before entry into an OPERATIONAL MODE or other condition of operation specified in the Applicability statement. The purpose of this specification is to ensure that system and component OPERABILITY requirements or parameter limits are met before entry into a MODE or condition for which these systems and components ensure safe operation of the facility. This provision applies to changes in OPERATIONAL MODES or other specified conditions associated with plant shutdown as well as startup.
Under the provisions of this specification, the applicable Surveillance Requirements must be performed within the specified surveillance interval to ensure that the Limiting Conditions for Operation are met during initial plant startup or following a plant outage.
When a shutdown is required to comply with ACTION requirements, the provisions of Specification 4.0.4 do not apply because this would delay placing the facility in a lower MODE of operation.
Specification 4.0.5 establishes the requirement that inservice testing of ASME Code Class 1, 2, and 3 pumps and valves shall be performed in accordance with a periodically updated version of the ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OM Code) and applicable Addenda as required by 10CFR50.55a(f). These requirements apply except when relief has been provided in writing by the Commission.
This specification includes a clarification of the frequencies for performing the inservice testing activities required by the ASME OM Code and applicable Addenda. This clarification is provided to ensure consistency in surveillance intervals throughout the Technical Specifications and to remove any ambiguities relative to the frequencies for performing the required inservice testing activities.
Under the terms of this specification, the more restrictive requirements of the Technical Specifications take precedence over the ASME OM Code and applicable Addenda. The requirements of Specification 4.0.4 to perform surveillance activities before entry into an OPERATIONAL MODE or other specified condition takes precedence over the ASME OM Code provision which allows pumps and valves to be tested up to one week after return to normal operation.
MILLSTONE - UNIT 3                          B 3/4 0-6                          Amendment No. -¥1, 2--1-3-,
 
LBDCR 06-MP3-013 April 5, 2006 3/4.1 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1 BORATION CONTROL 3/4.1.1.1 AND 3/4.1.1.2 SHUTDOWN MARGIN A sufficient SHUTDOWN MARGIN ensures that: (1) the reactor can be made subcritical from all operating conditions, (2) the reactivity transients associated with postulated accident conditions are controllable within acceptable limits, and (3) the reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.
SHUTDOWN MARGIN requirements vary throughout core life as a function of fuel depletion, RCS boron concentration, and RCS T avg* In MODES 1 and 2, the most restrictive condition occurs at EOL with T avg at no load operating temperature, and is associated with a postulated steam line break accident and resulting uncontrolled RCS cooldown. In the analysis of this accident, a minimum SHUTDOWN MARGIN as defined in Specification 3/4.1.1.1.1 is required to control the reactivity transient. Accordingly, the SHUTDOWN MARGIN requirement is based upon this limiting condition and is consistent with FSAR safety analysis assumptions.
In MODES 3, 4 and 5, the most restrictive condition occurs at BOL, associated with a boron dilution accident. In the analysis of this accident, a minimum SHUTDOWN MARGIN as defined in Specification 3/4.1.1.1.2 is required to allow the operator 15 minutes from the initiation of the Shutdown Margin Monitor alarm to total loss of SHUTDOWN MARGIN. Accordingly, the SHUTDOWN MARGIN requirement is based upon this limiting requirement and is consistent with the accident analysis assumption.
The locking closed of the required valves in MODE 5 (with the loops not filled) will preclude the possibility of uncontrolled boron dilution of the Reactor Coolant System by preventing flow ofunborated water to the RCS.
3/4.1.1.3 MODERATOR TEMPERATURE COEFFICIENT The limitations on moderator temperature coefficient (MTC) are provided to ensure that the value of this coefficient remains within the limiting condition assumed in the FSAR accident and transient analyses.
The MTC values of this specification are applicable to a specific set of plant conditions; accordingly, verification of MTC values at conditions other than those explicitly stated will require extrapolation to those conditions in order to permit an accurate comparison.
The most negative MTC, value equivalent to the most positive moderator density coefficient (MDC), was obtained by incrementally correcting the MDC used in the FSAR analyses to nominal operating conditions.
MILLSTONE - UNIT 3                          B 3/4 1-1                  Amendment No. W,-6G, 99, -!-1-'.7-,
Acknowledged by NRC Letter dated 12/19/06
 
August 27, 2001 REACTIVITY CONTROL SYSTEMS BASES MODERATOR TEMPERATURE COEFFICIENT (Continued)
These corrections involved: (1) a conversion of the MDC used in the FSAR safety analyses to its equivalent MTC, based on the rate of change of moderator density with temperature at RATED THERMAL POWER conditions, and (2) subtracting from this value the largest differences in MTC observed between EOL, all rods withdrawn, RATED THERMAL POWER conditions, and those most adverse conditions of moderator temperature and pressure, rod insertion, axial power skewing, and xenon concentration that can occur in normal operation and lead to a significantly more negative EOL MTC at RATED THERMAL POWER. These corrections transformed the MDC value used in the FSAR safety analyses into the limiting End of Cycle Life (EOL) MTC value. The 300 ppm surveillance limit MTC value represents a conservative MTC value at a core condition of 300 ppm equilibrium boron concentration, and is obtained by making corrections for burnup and soluble boron to the limiting EOL MTC value.
The Surveillance Requirements for measurement of the MTC at the beginning and near the end of the fuel cycle are adequate to confirm that the MTC remains within its limits since this coefficient changes slowly due principally to the reduction in RCS boron concentration associated with fuel burnup.
3/4.1.1.4 MINIMUM TEMPERATURE FOR CRITICALITY This specification ensures that the reactor will not be made critical with the Reactor Coolant System average temperature less than 551. This limitation is required to ensure: (1) the moderator temperature coefficient is within it analyzed temperature range, (2) the trip instrumentation is within its normal operating range, (3) the P-12 interlock is above its setpoint, (4) the pressurizer is capable of being in an OPERABLE status with a steam bubble, and (5) the reactor vessel is above its minimum RTNDT temperature.
3/4.1.2 DELETED MILLSTONE - UNIT 3                          B 3/4 1-2            AmendmentNo.W,-:SG,H-1-, 197
 
LBDCR 07-MP3-037 July 12, 2007 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.3 MOVABLE CONTROL ASSEMBLIES The specifications of this section ensure that: (1) acceptable power distribution limits are maintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effects of rod misalignment on associated accident analyses are limited. OPERABILITY of the control rod position indicators is required to determine control rod positions and thereby ensure compliance with the control rod alignment and insertion limits. Verification that the Digital Rod Position Indicator agrees with the demanded position within +/-12 steps at 24, 48, 120, and fully withdrawn position for the Control Banks and 18, 210, and fully withdrawn position for the Shutdown Banks provides assurances that the Digital Rod Position Indicator is operating correctly over the full range of indication. Since the Digital Rod Position Indication System does not indicate the actual shutdown rod position between 18 steps and 210 steps, only points in the indicated ranges are picked for verification of agreement with demanded position.
The ACTION statements which permit limited variations from the basic requirements are accompanied by additional restrictions which ensure that the original design criteria are met.
Misalignment of a rod requires measurement of peaking factors and a restriction in THERMAL POWER. These restrictions provide assurance of fuel rod integrity during continued operation. In addition, those safety analyses affected by a misaligned rod are reevaluated to confirm that the results remain valid during future operation.
The maximum rod drop time restriction is consistent with the assumed rod drop time used in the safety analyses. Measurement with T avg greater than or equal to 500°F and with all reactor coolant pumps operating ensures that the measured drop times will be representative of insertion times experienced during a Reactor trip at operating conditions.
The required rod drop time of::;; 2.7 seconds specified in Technical Specification 3.1.3.4 is used in the FSAR accident analysis. A rod drop time was calculated to validate the Technical Specification limit. This calculation accounted for all uncertainties, including a plant specific seismic allowance of 0.50 seconds. Since the seismic allowance should be removed when verifying the actual rod drop time, the acceptance criteria for surveillance testing is 2.20 seconds (Reference 4).
Measuring rod drop times prior to reactor criticality, after reactor vessel head removal and installation, ensures that the reactor internals and rod drive mechanism will not interfere with rod motion or rod drop time, and that no degradation in these systems has occurred that would adversely affect rod motion or drop time. Any time the OPERABILITY of the control rods has been affected by a repair, maintenance, modification, or replacement activity, post maintenance testing in accordance with SR 4. 0.1 is required to demonstrate OPERABILITY.
MILLSTONE - UNIT 3                          B 3/4 1-3            Amendment No. H, eG, , H-3-, -l-S-1-,
                                                                                                -l-64,-+/--9-1-,
 
LBDCR 12-MP3-010 September 20, 2012 REACTIVITY CONTROL SYSTEMS BASES MOVABLE CONTROLASSEMBLIES (Continued)
Control rod positions and OPERABILITY of the rod position indicators are required to be verified at the frequency specified in the Surveillance Frequency Control Program with more frequent verifications required if an automatic monitoring channel is inoperable. These verification frequencies are adequate for assuring that the applicable LCOs are satisfied.
The Digital Rod Position Indication (DRPI) System is defined as follows:
* Rod position indication as displayed on DRPI display panel (MB4), or
* Rod position indication as displayed by the Plant Process Computer System.
With the above definition, LCO 3.1.3.2, "ACTION a." is not applicable with either DRPI display panel or the plant process computer points OPERABLE.
The plant process computer may be utilized to satisfy DRPI System requirements which meets LCO 3 .1.3 .2, in requiring diversity for determining digital rod position indication.
Technical Specification SR 4.1.3.2.1 determines each digital rod position indicator to be OPERABLE by verifying the Demand Position Indication System and the DRPI System agree within 12 steps at the frequency specified in the Surveillance Frequency Control Program, except during the time when the rod position deviation monitor is inoperable, then compare the Demand Position Indication System and the DRPI System at least once each 4 hours.
The Rod Deviation Monitor is generated only from the DRPI panel at MB4. Therefore, when rod position indication as displayed by the plant process computer is the only available indication, then perform SURVEILLANCE REQUIREMENTS every 4 hours.
MILLSTONE - UNIT 3                          B 3/4 1-4                                Amendment No. 6G
 
LBDCR 12-MP3-010 September 20, 2012 REACTIVITY CONTROL SYSTEMS BASES MOVABLE CONTROLASSEMBLIES (Continued)
Additional surveillance is required to ensure the plant process computer indications are in agreement with those displayed on the DRPI. This additional SURVEILLANCE REQUIREMENT is as follows:
Each rod position indication as displayed by the plant process computer shall be determined to be OPERABLE by verifying the rod position indication as displayed on the DRPI display panel agrees with the rod position indication as displayed by the plant process computer at the frequency specified in the Surveillance Frequency Control Program.
The rod position indication, as displayed by DRPI display panel (MB4), is a non-QA system, calibrated on a refueling interval, and used to implement TIS 3.1.3.2. Because the plant process computer receives field data from the same source as the DRPI System (MB4), and is also calibrated on a refueling interval, it fully meets all requirements specified in T/S 3.1. 3 .2 for rod position. Additionally, the plant process computer provides the same type and level of accuracy as the DRPI System (MB4). The plant process computer does not provide any alarm or rod position deviation monitoring as does DRPI display panel (MB4).
For Specification 3 .1.3 .1 ACTIONS b. and c., it is incumbent upon the plant to verify the trippability of the inoperable control rod(s). Trippability is defined in Attachment C to a {{letter dated|date=December 21, 1984|text=letter dated December 21, 1984}}, from E. P. Rahe (Westinghouse) to C. 0. Thomas (NRC). This may be by verification of a control system failure, usually electrical in nature, or that the failure is associated with the control rod stepping mechanism. In the event the plant is unable to verify the rod(s) trippability, it must be assumed to be untrippable and thus falls under the requirements of ACTION a. Assuming a controlled shutdown from 100% RATED THERMAL POWER, this allows approximately 4 hours for this verification.
For LCO 3.1.3.6 the control bank insertion limits are specified in the CORE OPERATING LIMITS REPORT (COLR). These insertion limits are the initial assumptions in safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions, assumptions of available SHUTDOWN MARGIN, and initial reactivity insertion rate.
The applicable I&C calibration procedure (Reference 1.) being current indicates the associated circuitry is OPERABLE.
There are conditions when the Lo-Lo and Lo alarms of the RIL Monitor are limited below the RIL specified in the COLR. The RIL Monitor remains OPERABLE because the lead control rod bank still has the Lo and Lo-Lo alarms greater than or equal to the RIL.
MILLSTONE - UNIT 3                          B 3/4 1-5                                  AmendmentNo.6G
 
LBDCR 14-MP3-005 May 8, 2014 REACTIVITY CONTROL SYSTEMS BASES MOVABLE CONTROLASSEMBLIES (Continued)
When rods are at the top of the core, the Lo-Lo alarm is limited below the RIL to prevent spurious alarms. The RIL is equal to the Lo-Lo alarm until the adjustable upper limit setpoint on the RIL Monitor is reached, then the alarm remains at the adjustable upper limit setpoint. When the RIL is in the region above the adjustable upper limit setpoint, the Lo-Lo alarm is below the RIL.
 
==References:==
: 1. SP 3451N23, Rod Insertion Limits Calibration.
: 2. Letter NS-OPLS-OPL-1-91-226, (Westinghouse Letter NEU-91-563), dated April 24, 1991.
: 3. Millstone Unit 3 Technical Requirements Manual,Appendix 8.1, "CORE OPERATING LIMITS REPORT".
: 4. Westinghouse Letter NEU-07-62, "MPS3 - SPUP RCCA Drop Time," dated June 4, 2007.
: 5. Westinghouse Letter 98NEU-G-0060, "Millstone Unit 3 - Robust Fuel Assembly (Design Report) and Generic SECL," dated October 2, 1998.
MILLSTONE - UNIT 3                        B 3/4 1-6                              Amendment No.
 
LBDCR 04-MP3-015 February 24, 2005 3/4.2 POWER DISTRIBUTION LIMITS BASES The specifications of this section provide assurance of fuel integrity during Condition I (Normal Operation) and II (Incidents of Moderate Frequency) events by: (1) maintaining the minimum DNBR in the core greater than or equal to the design limit during normal operation and in short-term transients, and (2) limiting the fission gas release, fuel pellet temperature, and cladding mechanical properties to within assumed design criteria. In addition, limiting the peak linear power density during Condition I events provides assurance that the initial conditions assumed for the LOCA analyses are met and the ECCS acceptance criteria limit of 2200°F is not exceeded.
The definitions of certain hot channel and peaking factors as used in these specifications are as follows:
FQ(Z)            Heat Flux Hot Channel Factor, is defined as the maximum local heat flux on the surface of a fuel rod at core elevation Z divided by the average fuel rod heat flux, allowing for manufacturing tolerances on fuel pellets and rods; and Nuclear Enthalpy Rise Hot Channel Factor, is defined as the ratio of the integral of linear power along the rod with the highest integrated power to the average rod power.
3/4.2.1 AXIAL FLUX DIFFERENCE The limits on AXIAL FLUX DIFFERENCE (AFD) assure that the FQ(Z) upper bound envelope of the FQ limit specified in the CORE OPERATING LIMITS REPORT (COLR) times the normalized axial peaking factor is not exceeded during either normal operation or in the event of xenon redistribution following power changes.
Target flux difference is determined at equilibrium xenon conditions. The full-length rods may be positioned within the core in accordance with their respective insertion limits and should be inserted near their normal position for steady-state operation at high power levels. The value of the target flux difference obtained under these conditions divided by the fraction of RATED THERMAL POWER is the target flux difference at RATED THERMAL POWER for the associated core burnup conditions. Target flux differences for other THERMAL POWER levels are obtained by multiplying the RATED THERMAL POWER value by the appropriate fractional THERMAL POWER level. The periodic updating of the target flux difference value is necessary to reflect core burnup considerations.
MILLSTONE - UNIT 3                          B 3/4 2-1                            Amendment No. §G, 6G, Acknowledged by NRC letter dated 08/25/05
 
LBDCR 15-MP3-005 April 21, 2015 POWER DISTRIBUTION LIMITS BASES AXIAL FLUX DIFFERENCE (Continued)
The computer determines the I-minute average of each of the OPERABLE excore detector outputs and provides an alarm message immediately if the AFD for at least 2 of 4 or 2 of 3 OPERABLE excore channels are outside the allowed delta-I power operating space (as specified in the COLR). These alarms are active when power is greater than 50% of RATED THERMAL POWER.
MILLSTONE - UNIT 3                    B 3/4 2-2                            Amendment No . .§{), 6G, Aeknmvledged by NRG letter dated 08/25/05
 
LBDCR 15-MP3-005 April 21, 2015 POWER DISTRIBUTION LIMITS BASES 3/4.2.2 AND 3/4.2.3 HEAT FLUX HOT CHANNEL FACTOR AND RCS FLOW RATE AND NUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR The limits on heat flux hot channel factor, RCS flow rate, and nuclear enthalpy rise hot channel factor ensure that: (1) the design limits on peak local power density and minimum DNBR are not exceeded and (2) in the event of a LOCA the peak fuel clad temperature will not exceed the 2200°F ECCS acceptance criteria limit.
Each of these is measurable but will normally only be determined periodically as specified in Specifications 4.2.2 and 4.2.3. This periodic surveillance is sufficient to ensure that the limits are maintained provided:
: a. Control rods in a single group move together with no individual rod insertion differing by more than +/-12 steps, indicated, from the group demand position;
: b. Control rod groups are sequenced with overlapping groups as described in Specification 3.1.3.6;
: c. The control rod insertion limits of Specifications 3.1.3.5 and 3.1.3.6 are maintained; and
: d. The axial power distribution, expressed in terms of AXIAL FLUX DIFFERENCE, is maintained within the limits.
FNMI will be maintained within its limits provided Conditions a. through d. above are maintained. The relaxation of FNMI as a function of THERMAL POWER allows changes in the radial power shape for all permissible rod insertion limits.
The FNMI as calculated in Specification 3.2.3.1 is used in the various accident analyses where FNMI influences parameters other than DNBR, e.g., peak clad temperature, and thus is the maximum "as measured" value allowed.
The RCS total flow rate and FNMI are specified in the CORE OPERATING LIMITS REPORT (COLR) to provide operating and analysis :flexibility from cycle to cycle. However, the minimum RCS flow rate, that is based on 10% steam generator tube plugging, is retained in the Technical Specifications.
MILLSTONE - UNIT 3                          B 3/4 2-3                      Amendment No. -s<:l, W, ~ .
 
LBDCR 15-MP3-005 April 21, 2015 POWER DISTRIBUTION LIMITS BASES 3/4.2.2 and 3/4.2.3 HEAT FLUX HOT CHANNEL FACTOR and RCS FLOW RATE AND NUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR (Continued)
Margin is maintained between the safety analysis limit DNBR and the design limit DNBR. This margin is more than sufficient to offset the effect of rod bow and any other DNB penalties that may occur. The remaining margin is available for plant design flexibility.
When an F Q measurement is taken, an allowance for both experimental error and manufacturing tolerance must be made. An allowance of 5% is appropriate for a full core map taken with the incore detector flux mapping system and a 3% allowance is appropriate for manufacturing tolerance.
The heat flux hot channel factor, FQ(Z), is measured periodically in accordance with the Surveillance Frequency Control Program using the incore detector system. These measurements are generally taken with the core at or near steady state conditions. Using the measured three dimensional power distributions, it is possible to derive FQM(z), a computed value ofFQ(Z).
FQ(Z), as approximated by FQM(z), shall be limited by the following relationships:
F RTP Q
FQM(z):s:;            K(Z) for P > 0.5 p
F RTP Q
FQM(z)::;;              K(Z) for P::;; 0.5 0.5 FQRTP = the FQ limit at RATED THERMAL POWER (RTP) provided in the CORE OPERATING LIMITS REPORT (COLR).
Where.. p -_    THERMAL IOWER RATED1HERMALPOWER'        an d
K(Z) = the normalized FQ(Z) as a function of core height specified in the COLR.
Evaluation of the steady state FQ(Z) limit is performed in Specification 4.2.2.1.2.b.
To account for possible variations in the value ofFQ(Z) that are present during non-equilibrium situations, the steady state limit of F Q(Z) is adjusted by an elevation dependent factor that accounts for the calculated worst case transient conditions. The elevation dependent factors for normal operation are specified in the COLR per Specification 6.9 .1.6. Core monitoring and control under non-equilibrium conditions are accomplished by operating the core within the limits of the appropriate LCOs, including the limits on AFD, QPTR, and control rod insertion.
MILLSTONE - UNIT 3                          B 3/4 2-4                    AmendmentNo.H,6G,HG,U+
 
LBDCR 19-MP3-003 March 21, 2019 POWER DISTRIBUTION LIMITS BASES 3/4.2.2 and 3/4.2.3 HEAT FLUX HOT CHANNEL FACTOR and RCS FLOW RATE AND NUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR (Continued)
FQM(z) shall be evaluated to determine if the non-equilibrium limits described by the following relationships are satisfied:
Where:          F QM(z) is the measured F Q(Z) increased by the allowances for manufacturing tolerances and measurement uncertainty.
FQRTP is the FQ limit at RTP provided in the COLR, K(Z) is the normalized FQ(Z) as a function of core height provided in the COLR, N(Z) is the cycle-dependent function that accounts for power distribution transients encountered during normal operation. The N(Z) function is specified in the COLR; and P is the fraction of RATED THERMAL POWER defined as p_      THERMAL IDWER RATED THERMAL POWER Evaluation of the non-equilibrium F Q(Z) limit is performed per Specification 4.2.2.1.2.c.
MILLSTONE - UNIT 3                        B 3/4 2-4a                            Amendment No.
 
LBDCR 19-MP3-003 March 21, 2019 POWER DISTRIBUTION LIMITS BASES 3/4.2.2 and 3/4.2.3 HEAT FLUX HOT CHANNEL FACTOR and RCS FLOW RATE AND NUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR (Continued)
To account for possible increases in the value of F Q(Z) between required 31 EFPD surveillances, the FQM(z) is adjusted by an appropriate factor, typically 2%, that bounds the maximum expected increase in F Q(Z) over the interval. The appropriate factor, which may be defined as a function of burnup, is specified in the COLR per Specification 6.9.1.6. Specification 4.2.2.1.2.e allows for two options to conservatively account for compliance with the non-equilibrium FQ(Z) between the required 31 EFPD surveillance interval for FQ(Z):
: 1) Increase FQM(z) by the appropriate factor specified in the COLR and verify that FQM(z) satisfies Specification 4.2.2.1.2.c, or
: 2) Verify that FQM(z) satisfies Specification 4.2.2.1.2.c and perform the subsequent FQ(Z) surveillance at least once within 7 EFPD. The 7 EFPD surveillance interval may be discontinued when Option 1 above satisfies Specification 4.2.2.1.2.c.
Where it is necessary to calculate the percent that FQ(Z) exceeds the non-equilibrium limits, it shall be calculated as the maximum percent over the core height (Z) for the appropriate core planes, that FQ(Z) exceeds its limit by the following expression:
MILLSTONE - UNIT 3                        B 3/4 2-4b                              Amendment No.
 
LBDCR 15-MP3-005 April 21, 2015 POWER DISTRIBUTION LIMITS BASES 3/4.2.2 and 3/4.2.3 HEAT FLUX HOT CHANNEL FACTOR and RCS FLOW RATE AND NUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR (Continued)
The core plane regions applicable to an FQ(Z) evaluation exclude the following measured in percent of core height:
: a. Lower core region, from 0% to 8% inclusive,
: b. Upper core region, from 92% to 100% inclusive, The THERMAL POWER specified in the ACTION 3.2.2.1.b.(1) is normally the RATED THERMAL POWER. For example, ifFQM(z) exceeds its limit, then THERMAL POWER must be reduced to less than or equal to the percentage of RATED THERMAL POWER specified in the COLR.
When RCS flow rate and FNMI are measured, no additional allowances are necessary prior to comparison with the limits of the Limiting Condition for Operation. Measurement errors for RCS total flow rate and for FNMI have been taken into account in determination of the design DNBR value.
The measurement error for RCS total flow rate is based upon performing a precision heat balance and using the result to calibrate the RCS flow rate indicators. To perform the precision heat balance, the instrumentation used for determination of steam pressure, feedwater pressure, feedwater temperature, and feedwater venturi LlP in the calorimetric calculations shall be calibrated in accordance with the Surveillance Frequency Control Program. Potential fouling of the feedwater venturi which might not be detected could bias the result from the precision heat balance in a non-conservative manner. Any fouling which might bias the RCS flow rate measurement can be detected by monitoring and trending various plant performance parameters.
If detected, action shall be taken before performing subsequent precision heat balance measurements, i.e., either the effect of the fouling shall be quantified and compensated for in the RCS flow rate measurement or the venturi shall be cleaned to eliminate the fouling.
MILLSTONE - UNIT 3                          B 3/4 2-4c                            Amendment No.
 
REVERSE OF PAGE B 3/4 2-4c INTENTIONALLY LEFT BLANK
 
LBDCR 12-MP3-010 September 20, 2012 POWER DISTRIBUTION LIMITS BASES HEAT FLUX HOT CHANNEL FACTOR and RCS FLOW RATE AND NUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR (Continued)
The periodic surveillance of indicated RCS flow in accordance with the Surveillance Frequency Control Program is sufficient to detect only flow degradation which could lead to operation outside the acceptable region of operation defined in Specifications 3 .2.3 .1.
3/4.2.4 QUADRANT POWER TILT RATIO The QUADRANT POWER TILT RATIO limit assures that the radial power distribution satisfies the design values used in the power capability analysis. Radial power distribution measurements are made during STARTUP testing and periodically during POWER OPERATION.
The limit of 1.02, at which corrective action is required, provides DNB and linear heat generation rate protection with x-y plane power tilts. A limiting tilt of 1.025 can be tolerated before the margin for uncertainty in FQ is depleted. A limit of 1.02 was selected to provide an allowance for the uncertainty associated with the indicated power tilt.
The 2-hour time allowance for operation with a tilt condition greater than 1.02 but less than 1.09 is provided to allow identification and correction of a dropped or misaligned control rod. In the event such action does not correct the tilt, the margin for uncertainty on F Q is reinstated by reducing the maximum allowed power by 3% for each percent of tilt in excess of 1.
For purposes of monitoring QUADRANT POWER TILT RATIO when one excore detector is inoperable, the moveable incore detectors are used to confirm that the normalized symmetric power distribution is consistent with the QUADRANT POWER TILT RATIO. The incore detector monitoring is done with a full incore flux map or two sets of four symmetric thimbles. The two sets of four symmetric thimbles is a unique set of eight detector locations.
These locations are C-8, E-5, E-11, H-3, H-13, L-5, L-11, N-8.
3/4.2.5 DNB PARAMETERS The limits on the DNB-related parameters assure that each of the parameters are maintained within the normal steady-state envelope of operation assumed in the transient and accident analyses. The limits are consistent with the initial FSAR assumptions and have been analytically demonstrated adequate to maintain a minimum DNBR greater than the design limit
' throughout each analyzed transient. The indicated T avg values MILLSTONE - UNIT 3                          B 3/4 2-5                    AmendmentNo.~,~,6G,:2.-l-1 Acknovlledged by NRG letter dated 08/25/05
 
LBDCR 12-MP3-010 September 20, 2012 POWER DISTRIBUTION LIMITS BASES DNB PARAMETERS (Continued) and the indicated pressurizer pressure values are specified in the CORE OPERATING LIMITS REPORT. The calculated values of the DNB related parameters will be an average of the indicated values for the OPERABLE channels.
The periodic surveillance of these parameters through instrument readout in accordance with the Surveillance Frequency Control Program is sufficient to ensure that the parameters are restored within their limits following load changes and other expected transient operation. Measurement uncertainties have been accounted for in determining the parameter limits.
MILLSTONE - UNIT 3                        B 3/4 2-6                    AmendmentNo.~,6G,:iH
 
LBDCR 12-MP3-010 September 20, 2012 3/4.3 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION The OPERABILITY of the Reactor Trip System and the Engineered Safety Features Actuation System instrumentation and interlocks ensures that: (1) the associated action and/or Reactor trip will be initiated when the parameter monitored by each channel or combination thereofreaches its setpoint, (2) the specified coincidence logic is maintained, (3) sufficient redundancy is maintained to permit a channel to be out of service for testing or maintenance, and (4) sufficient system functional capability is available from diverse parameters.
The OPERABILITY of these systems is required to provide the overall reliability, redundancy, and diversity assumed available in the facility design for the protection and mitigation of accident and transient conditions. The integrated operation of each of these systems is consistent with the assumptions used in the safety analyses. The Surveillance Requirements specified for these systems ensure that the overall system functional capability is maintained comparable to the original design standards. The periodic surveillance tests performed are sufficient to demonstrate this capability. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
The Engineered Safety Features Actuation System Nominal Trip Setpoints specified in Table 3.3-4 are the nominal values of which the bistables are set for each functional unit. The Allowable Values (Nominal Trip Setpoints +/- the calibration tolerance) are considered the Limiting Safety System Settings as identified in 10CFRS0.36 and have been selected to mitigate the consequences of accidents. A Setpoint is considered to be consistent with the nominal value when the measured "as left" Setpoint is within the administratively controlled(+/-) calibration tolerance identified in plant procedures (which specifies the difference between the Allowable Value and Nominal Trip Setpoint). Additionally, the Nominal Trip Setpoints may be adjusted in the conservative direction provided the calibration tolerance remains unchanged.
Measurement and Test Equipment accuracy is administratively controlled by plant procedures and is included in the plant uncertainty calculations as defined in WCAP-10991.
OPERABILITY determinations are based on the use of Measurement and Test Equipment that conforms with the accuracy used in the plant uncertainty calculation.
The Allowable Value specified in Table 3 .3-4 defines the limit beyond which a channel is inoperable. If the process rack bistable setting is measured within the "as left" calibration tolerance, which specifies the difference between the Allowable Value and Nominal Trip Setpoint, then the channel is considered to be OPERABLE.
MILLSTONE - UNIT 3                          B 3/4 3-1                              Amendment No. +&sect;.9.
 
LBDCR l 8-MP3-005 March 15, 2018 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)
The methodology, as defined in WCAP-10991 to derive the Nominal Trip Setpoints, is based upon combining all of the uncertainties in the channels. Inherent in the determination of the Nominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and other instrumentation utilized in these channels should be capable of operating within the allowances of these uncertainty magnitudes. Occasional drift in excess of the allowance may be determined to be acceptable based on the other device performance characteristics. Device drift in excess of the allowance that is more than occasional, may be indicative of more serious problems and would warrant further investigation.
The above Bases does not apply to the Control Building Inlet Ventilation radiation monitors ESF Table (Item 7E). For these radiation monitors the allowable values are essentially nominal values.
Due to the uncertainties involved in radiological parameters, the methodologies ofWCAP-10991 were not applied. Actual trip setpoints will be reestablished below the allowable value based on calibration accuracies and good practices.
The OPERABILITY requirements for Table 3.3-3, Functional Units 7.a, "Control Building Isolation, Manual Actuation," and 7.e, "Control Building Isolation, Control Building Inlet Ventilation Radiation," are defined by table notation"*". These functional units are required to be OPERABLE at all times during plant operation in MODES 1, 2, 3, and 4. These functional units are also required to be OPERABLE during movement of recently irradiated fuel assemblies, as specified by table notation "*". The Control Building Isolation Manual Actuation and Control Building Inlet Ventilation Radiation are required to be OPERABLE during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 350 hours*). Table notation "*" of Table 4.3-2 has the same applicability.
Required ACTION 18.a of Table 3.3-3 applies when one Control Building Inlet Ventilation Radiation monitor is inoperable. If one Control Building Inlet Ventilation Radiation monitor is inoperable, 7 days are permitted to restore it to OPERABLE status. The 7 day Allowed Outage Time (AOT) is the same as is allowed if one train of the mechanical portion of the Control Room Emergency Ventilation System (CREVS) is inoperable. If the Control Building Inlet Ventilation Radiation monitor cannot be restored to OPERABLE status within 7 days, the associated CREVS train (same train as inoperable radiation monitor) must be placed in the emergency mode of operation (i.e., filtered pressurization whereby outside air is diverted through the filters to the Control Room Envelope to maintain a positive pressure). This accomplishes the actuation instrumentation function and places the unit in a conservative mode of operation. The associated CREVS train is specified to ensure the CREVS function is performed even in the presence of a single failure.
* During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a critical reactor core within the previous 525 hours.
MILLSTONE - UNIT 3                          B 3/4 3-2    Amendment No. 3-,--9+, -l-S9, m, -l-&-1, 219,230
 
LBDCR 18-MP3-005 March 15, 2018 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)
This ACTION is modified by a Note(+) to allow operation of the non-affected CREVS train, instead of the affected CREVS train, to perform required Technical Specifications 3 .3 .2 and 3. 7. 7 surveillance testing. This allowance is necessary since only one train of the CREVS is run at a time. Without this allowance, the required surveillance testing of the non-affected train could lapse resulting in the train becoming inoperable.
Required ACTION 18.b of Table 3.3-3 applies when both Control Building Inlet Ventilation Radiation monitors are inoperable. Since both Control Building Inlet Ventilation Radiation monitors are inoperable, immediate action is required to place one CREVS train in the emergency mode of operation. This accomplishes the actuation instrumentation function and places the unit in a conservative mode of operation. The applicable ACTIONS of Technical Specification 3. 7. 7 must also be entered for one of the CREVS trains made inoperable by the inoperable actuation instrumentation. This ensures appropriate limits (7 days) are placed on plant operation with both Control Building Inlet Ventilation Radiation monitor channels inoperable. The 7 day AOT is based on the low probability of a DBA occurring during this time period.
With both Control Building Inlet Ventilation Radiation monitors inoperable, either CREVS train can be declared inoperable. If during this 7 day time period, the remaining operable CREVS train becomes inoperable, it is acceptable to consider that to be the inoperable CREVS train for compliance with ACTION 18.b instead of the previously declared inoperable CREVS train (declared inoperable only because both Control Building Inlet Ventilation Radiation monitors are inoperable). However, the total time plant operation is allowed to continue with both Control Building Inlet Ventilation Radiation monitors inoperable cannot exceed 7 days.
The verification of response time provides assurance that the reactor trip and the engineered safety features actuation associated with each channel is completed within the time limit assumed in the safety analysis. No credit is taken in the analysis for those channels with response times indicated as not applicable (i.e., N.A.). The surveillance frequency is controlled under the Surveillance Frequency Control Program.
Required ACTION 4. of Table 3.3-1 is modified by a Note to indicate that normal plant control operations that individually add limited positive reactivity (e.g., temperature or boron fluctuations associated with RCS inventory management or temperature control) are not precluded by this ACTION provided they are accounted for in the calculated SDM. The proposed change permits operations introducing positive reactivity additions but prohibits the temperature change or overall boron concentration from decreasing below that required to maintain the specified SDM or required boron concentration.
MILLSTONE - UNIT 3                          B 3/4 3-2a              Amendment No. 3-, 93-, 98-, ~
 
LBDCR 18-MP3-005 March 15, 2018 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)
Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace, onsite, or offsite (e.g. vendor) test measurements, or (3) utilizing vendor engineering specifications. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be demonstrated by test. Detector response times may be measured by the in-situ online noise analysis-response time degradation method described in the Westinghouse Topical Report, "The Use of Process Noise Measurements to Determine Response Characteristics of Protection Sensors in U.S. Plants," dated August 1983.
WCAP-14036, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.
The allocations for sensor, signal conditioning and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.
The Engineered Safety Features Actuation System senses selected plant parameters and determines whether or not predetermined limits are being exceeded. If they are, the signals are combined into logic matrices sensitive to combinations indicative of various accidents, events, and transients. Once the required logic combination is completed, the system sends actuation signals to those Engineered Safety Features components whose aggregate function best serves the requirements of the condition. As an example, the following actions may be initiated by the Engineered Safety Features Actuation System to mitigate the consequences of a steam line break or loss-of-coolant accident: (1) Safety Injection pumps start and automatic valves position, (2)
Reactor trip, (3) feed-water isolation, (4) startup of the emergency diesel generators, (5) quench spray pumps start and automatic valves position, (6) containment isolation, (7) steam line isolation, (8) Turbine trip, (9) auxiliary feedwater pumps start, (10) service water pumps start and automatic valves position, and (11) Control Room isolates.
MILLSTONE - UNIT 3                          B 3/4 3-2b              AmendmentNo.~,93-,-l-98-,:2,1-9
 
LBDCR 18-MP3-005 March 15, 2018 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)
For slave relays, or any auxiliary relays in ESFAS circuits that are of the type Potter & Brumfield MDR series relays, the SLAVE RELAY TEST is performed at an "R" frequency (at least once every 18 months) provided the relays meet the reliability assessment criteria presented in WCAP-13878, "Reliability Assessment of Potter and Brumfield MDR series relays," and WCAP-13900, "Extension of Slave Relay Surveillance Test Intervals." The reliability assessments performed as part of the aforementioned WCAPs are relay specific and apply only to Potter and Brumfield MDR series relays. Note that for normally energized applications, the relays may have to be replaced periodically in accordance with the guidance given in WCAP-13 878 for MDRrelays.
REACTOR TRIP BREAK.ER This trip function applies to the reactor trip breakers (RTBs) exclusive of individual trip mechanisms. The LCO requires two OPERABLE trains of trip breakers. A trip breaker train consists of all trip breakers associated with a single RTS logic train that are racked in, closed, and capable of supplying power to the control rod drive (CRD) system. Thus, the train may consist of the main breaker, bypass breaker, or main breaker and bypass breaker, depending upon the system configuration. Two OPERABLE trains ensure no single random failure can disable the RTS trip capability.
These trip functions must be OPERABLE in MODE 1 or 2 when the reactor is critical. In MODE 3, 4, or 5, these RTS trip functions must be OPERABLE when the RTBs or associated bypass breakers are closed, and the CRD system is capable of rod withdrawal.
BYPASSED CHANNEL* -Technical Specifications 3.3.1 and 3.3.2 often allow the bypassing of instrument channels in the case of an inoperable instrument or for surveillance testing.
A BYPASSED CHANNEL shall be a channel which is:
* Required to be in its accident or tripped condition, but is not presently in its accident or tripped condition using a method described below; or
* Prevented from tripping.
MILLSTONE - UNIT 3                          B 3/4 3-2c                                Amendment No.~,
Aekn:ovAedged by NRG letter dated 08/25/05
 
REVERSE OF PAGE B 3/4 3-2c INTENTIONALLY LEFT BLANK
 
March 17, 2004 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)
A channel may be bypassed by:
* Insertion of a simulated signal to the bistable; or
* Failing the transmitter or input device to the bypassed condition; or
* Returning a channel to service in a untripped condition; or
* An equivalent method, as determined by Engineering and I&C
*Bypass switches exist only for NIS source range, NIS intermediate range, and containment pressure Hi-3.
TRIPPED CHANNEL - Technical Specifications 3 .3 .1 and 3 .3 .2 often require the tripping of instrument channels in the case of an inoperable instrument or for surveillance testing.
A TRIPPED CHANNEL shall be a channel which is in its required accident or tripped condition.
A channel may be placed in trip by:
* The Bistable Trip Switches; or
* Insertion of a simulated signal to the bistable; or
(
* Failing the transmitter or input device to the tripped condition; or
* An equivalent method, as determined by Engineering and I&C The Engineered Safety Features Actuation System interlocks perform the following functions:
P-4            Reactor tripped - Actuates Turbine trip, closes main feedwater valves on Tavg below Setpoint, prevents the opening of the main feedwater valves which were closed by a Safety Injection or High Steam Generator Water Level signal, allows Safety Injection block so that components can be reset or tripped.
Reactor not tripped - prevents manual block of Safety Injection.
MILLSTONE - UNIT 3                          B 3/4 3-3                Amendment No. Ht, -l-64, 219
 
LBDCR 10-MP3-003 February 23, 2010 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)
P-11        On increasing pressurizer pressure, P-11 automatically reinstates Safety Injection actuation on low pressurizer pressure and low steam line pressure. On decreasing pressure, P-11 allows the manual block of Safety Injection actuation on low pressurizer pressure and low steam line pressure.
P-12        On increasing reactor coolant loop temperature, P-12 automatically provides an arming signal to the Steam Dump System. On decreasing reactor coolant loop temperature, P-12 automatically removes the arming signal from the Steam Dump System.
P-14        On increasing steam generator water level, P-14 automatically trips all feedwater isolation valves, main feed pumps and main turbine, and inhibits feedwater control valve modulation.
P-19        Upon decreasing Reactor Coolant System pressure, permits the cold leg injection valves to automatically open upon receipt of a Safety Injection signal.
3/4.3.3 MONITORING INSTRUMENTATION 3/4.3.3. l RADIATION MONITORING FOR PLANT OPERATIONS The OPERABILITY of the radiation monitoring instrumentation for plant operations ensures that: (1) the associated action will be initiated when the radiation level monitored by each channel or combination thereofreaches its Setpoint, (2) the specified coincidence logic is maintained, and (3) sufficient redundancy is maintained to permit a channel to be out-of-service for testing or maintenance. The radiation monitors for plant operations senses radiation levels in selected plant systems and locations and determines whether or not predetermined limits are being exceeded. If they are, the signals are combined into logic matrices sensitive to combinations indicative of various accidents and abnormal conditions. Once the required logic combination is completed, the system sends actuation signals to initiate alarms.
The Fuel Storage Pool Area Monitor is required to be OPERABLE during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 350 hours*).
* During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a critical reactor core within the previous 525 hours.
MILLSTONE - UNIT 3                          B 3/4 3-4                          AmendmentNo.-l-%,U9
 
LBDCR No. 08-MP3-014 October 21, 2008 INSTRUMENTATION BASES 3/4.3.3.2 DELETED 3/4.3.3.3 DELETED 3/4.3.3.4 DELETED 3/4.3.3.5 REMOTE SHUTDOWN INSTRUMENTATION The OPERABILITY of the Remote Shutdown Instrumentation ensures that sufficient capability is available to permit safe shutdown of the facility from locations outside of the control room. This capability is required in the event control room habitability is lost and is consistent with General Design Criterion 19 of 10 CFR Part 50.
Calibration of the Intermediate Range Neutron Amps channel from Table 4.3-6 applies to the signal that originates from the output of the isolation amplifier within the intermediate range neutron flux processor drawers in the control room and terminates at the displays within the Auxiliary Shutdown Panel.
The OPERABILITY of the Remote Shutdown Instrumentation ensures that a fire will not preclude achieving safe shutdown. The remote shutdown monitoring instrumentation, control, and power circuits and transfer switches necessary to eliminate effects of the fire and allow operation of instrumentation, control and power circuits required to achieve and maintain a safe shutdown condition are independent of areas where a fire could damage systems normally used to shut down the reactor. This capability is consistent with General Design Criterion 3 and Appendix R to 10 CFR Part 50.
3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION The OPERABILITY of the accident monitoring instrumentation ensures that sufficient information is available on selected plant parameters to monitor and assess these variables following an accident. The instrumentation included in this specification are those instruments provided to monitor key variables, designated as Category I instruments following the guidance for classification contained in Regulatory Guide 1.97, Revision 2, "Instrumentation for Light-Water-Cooled Nuclear Power Plants To Assess Plant and Environs Conditions During and Following an Accident."
MILLSTONE - UNIT 3                          B 3/4 3-5              Amendment No. J, %, -84, ~ , ~ ,
 
LBDCRNo. 04-MP3-015 February 24, 2005 INSTRUMENTATION BASES 3/4.3 .3 .6 ACCIDENT MONITORING INSTRUMENTATION (Continued)
ACTION Statement "a":
The use of one main control board indicator and one computer point, total of two indicators per steam generator, meets the requirements for the total number of channels for Auxiliary Feedwater flow rate. The two channels used to satisfy this Technical Specification for each steam generator are as follows:
Steam            Instrument            (MB5)          Instrument          (Com12uter)
~enerator S/G 1            FWA*FI51Al            (Orange)        FWA-F33A3          (Purple)
S/G2            FWA*FI33Bl              (Purple)        FWA-F51B3          (Orange)
S/G3            FWA*FI33Cl              (Purple)        FWA-F51C3          (Orange)
S/G4            FWA*FI51Dl              (Orange)        FWA-F33D3          (Purple)
The SPDS computer point for auxiliary feedwater flow will be lost 30 minutes following an LOP when the power supply for the plant computer is lost. However, this design configuration
- one continuous main control board indicator and one indication via the SPDS/plant computer, total of two per steam generator - was submitted to the NRC via "Response to question 420.6" dated January 13, 1984, Bl1002. NRC review and approval was obtained with the acceptance of MP3, SSER 4 Appendix L, "Conformance to Regulatory Guide 1.97," Revision 2. (dated November 1985).
LCO 3.3.3.6, Table 3.3-10, Item (17), requires 2 OPERABLE reactor vessel water level (heated junction thermocouples - HJTC) channels. An OPERABLE reactor vessel water level channel shall be defined as:
: 1. Four or more total sensors operating.
: 2. At least one of two operating sensors in the upper head.
: 3. At least three of six operating sensors in the upper plenum.
MILLSTONE - UNIT 3                          B 3/4 3-5a            Amendment No. 3, %, 84, ~ . 2-1-9, Acknowledged by NRC letter dated 08/25/05
 
LBDCR 05-MP3-028 November 30, 2005 INSTRUMENTATION BASES 3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continued)
A channel is OPERABLE if four or more sensors, half or more in the upper head region and half or more in the upper plenum region, are OPERABLE.
In the event more than four sensors in a Reactor Vessel Level channel are inoperable, repairs may only be possible during the next refueling outage. This is because the sensors are accessible only after the missile shield and reactor vessel head are removed. It is not feasible to repair a channel except during a refueling outage when the missile shield and reactor vessel head are removed to refuel the core. If only one channel is inoperable, it should be restored to OPERABLE status in a refueling outage as soon as reasonably possible. If both channels are inoperable, at least one channel shall be restored to OPERABLE status in the nearest refueling outage.
The Reactor Coolant System Subcooling Margin Monitor, Core Exit Thermocouples, and Reactor Vessel Water Level instruments are processed by two separate trains of ICC (Inadequate Core Cooling) and HJTC (Heated Junction Thermocouple) processors. The preferred indication for these parameters is the Safety Parameter Display System (SPDS) via the non-qualified PPC (Plant Process Computer) but qualified indication is provided in the instrument rack room. When the PPC data links cease to transmit data, the processors must be reset in order to restore the flow of data to the PPC. During reset, the qualified indication in the instrument rack room is lost. These instruments are OPERABLE during this reset since the indication is only briefly interrupted while the processors reset and the indication is promptly restored. The sensors are not removed from service during this reset. The train should be considered inoperable only if the qualified indication fails to be restored following reset. Except for the non-qualified PPC display, the instruments operate as required.
3/4.3.3.7 DELETED 3/4.3.3.8 DELETED 3/4.3.3.9 DELETED 3/4.3.3.10 DELETED 3/4.3.4 DELETED MILLSTONE - UNIT 3                    B 3/4 3-6                      Amendment No. +8-8, 93-,~,
Acknowledged by NRC Letter dated 04/12/06
 
REVERSE OF PAGE B 3/4 3-6 INTENTIONALLY LEFT BLANK
 
LBDCR No. 04-MP3-015 February 24, 2005 INSTRUMENTATION BASES 3/4.3.5 SHUTDOWN MARGIN MONITOR The Shutdown Margin Monitors provide an alarm that a Boron Dilution Event may be in progress. The minimum count rate of Specification 3/4.3.5 and the SHUTDOWN MARGIN requirements specified in the CORE OPERATING LIMITS REPORT for MODE 3, MODE 4 and MODE 5 ensure that at least 15 minutes are available for operator action from the time of the Shutdown Margin Monitor alarm to total loss of SHUTDOWN MARGIN. By berating an additional 150 ppm above the SHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT for MODE 3 or 350 ppm above the SHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT for MODE 4, MODE 5 with RCS loops filled, or MODE 5 with RCS loops not filled, lower values of minimum count rate are accepted.
Shutdown Margin Monitors
 
==Background:==
 
The purpose of the Shutdown Margin Monitors (SMM) is to annunciate an increase in core subcritical multiplication allowing the operator at least 15 minutes response time to mitigate the consequences of the inadvertent addition ofunborated primary grade water (boron dilution event) into the Reactor Coolant System (RCS) when the reactor is shut down (MODES 3, 4, and 5).
The SMMs utilizes two channels of source range instrumentation (GM detectors). Each channel provides a signal to its applicable train of SMM. The SMM channel uses the last 600 or more counts to calculate the count rate and updates the measurement after 30 new counts or 1 second, whichever is longer. Each channel has 20 registers that hold the counts (20 registers X 30 count=
600 counts) for averaging the rate. As the count rate decreases, the longer it takes to fill the registers (fill the 30 count minimum). As the instrument's measured count rate decreases, the delay time in the instrument's response increases. This delay time leads to the requirement of a minimum count rate for OPERABILITY During the dilution event, count rate will increase to a level above the normal steady state count rate. When this new count rate level increases above the instrument's setpoint, the channel will alarm alerting the operator of the event.
Applicable Safety Analysis The SMM senses abnormal increases in the source range count per second and alarms the operator of an inadvertent dilution event. This alarm will occur at least 15 minutes prior to the reactor achieving criticality. This 15 minute window allows adequate operator response time to terminate the dilution, FSAR Section 15.4.6.
LCO 3.3.5 provides the requirements for OPERABILITY of the instrumentation of the SMMs that are used to mitigate the boron dilution event. Two trains are required to be OPERABLE to provide protection against single failure.
MILLSTONE - UNIT 3                          B 3/4 3-7                        Amendment No. -l-64, ~ ,
Acknowledged by NRC letter dated 08/25/05
 
LBDCR No. 04-MP3-015 February 24, 2005 BASES (continued)
Applicability The SMM must be OPERABLE in MODES 3, 4, and 5 because the safety analysis identifies this system as the primary means to alert the operator and mitigate the event. The SMMs are allowed to be blocked during start up activities in MODE 3 in accordance with approved plant procedures.
The alarm is blocked to allow the SMM channels to be used to monitor the 1/M approach to criticality.
The SMM are not required to be OPERABLE in MODES 1 and 2 as other RPS is credited with accident mitigation, over temperature delta temperature and power range neutron flux high (low setpoint of 25 percent RTP) respectively. The SMMs are not required to be OPERABLE in MODE 6 as the dilution event is precluded by administrative controls over all dilution flow paths Technical Specification (4.1.1.2.2).
ACTIONS Channel inoperability of the SMMs can be caused by failure of the channel's electronics, failure of the channel to pass its calibration procedure, or by the channel's count rate falling below the minimum count rate for OPERABILITY. This can occur when the count rate is so low that the channel's delay time is in excess of that assumed in the safety analysis. In any of the above conditions, the channel must be declared inoperable and the appropriate ACTION statement entered. If the SMMs are declared inoperable due to low count rates, an RCS heatup will cause the SMM channel count rate to increase to above the minimum count rate for OPERABILITY.
Allowing the plant to increase modes will actually return the SMMs to OPERABLE status. Once the SMM channels are above the minimum count rate for OPERABILITY, the channels can be declared OPERABLE and the LCO ACTION statements can be exited.
LCO 3.3.5, ACTION a. - With one train of SMM inoperable, ACTION a. requires the inoperable train to be returned to OPERABLE status within 48 hours. In this condition, the remaining SMM train is adequate to provide protection. If the above required ACTION cannot be met, alternate compensatory actions must be performed to provide adequate protection from the boron dilution event. All operations involving positive reactivity changes associated with RCS dilutions and rod withdrawal must be suspended, and all dilution flowpaths must be closed and secured in position (locked closed per Technical Specification 4.1.1.2.2) within the following 4 hours.
LCO 3 .3 .5, ACTION b. -With both trains of SMM inoperable, alternate protection must be provided:
: 1.        Positive reactivity operations via dilutions and rod withdrawal are suspended. The intent of this ACTION is to stop any planned dilutions of the RCS. The SMMs are not intended to monitor core reactivity during RCS temperature changes. The alarm setpoint is routinely reset during the plant heatup due to the increasing count rate. During cooldowns as the count rate decreases, baseline count rates are continually lowered automatically by the SMMs. The Millstone Unit No. 3 boron dilution analysis assumes steady state RCS temperature conditions.
MILLSTONE - UNIT 3                          B 3/4 3-8                                Amendment No. -:1.-64, Acknowledged by NRC letter dated 08/25/05
 
LBDCR 12-MP3-010 September 20, 2012 INSTRUMENTATION 3/4.3.5 SHUTDOWN MARGIN MONITOR BASES (continued)
Required ACTION b. is modified by a Note which permits plant temperature changes provided the temperature change is accounted for in the calculated SDM. Introduction of temperature changes, including temperature increases when a positive MTC exists, must be evaluated to ensure they do not result in a loss of required SDM.
: 2.      All dilution flowpaths are isolated and placed under administrative control (locked closed). This action provides redundant protection and defense in depth (safety overlap) to the SMMs. In this configuration, a boron dilution event (BDE) cannot occur. This is the basis for not having to analyze for BDE in MODE 6. Since the BDE cannot occur with the dilution flow paths isolated, the SMMs are not required to be OPERABLE as the event cannot occur and OPERABLE SMMs provide no benefit.
: 3.      Increase the SHUTDOWN MARGIN surveillance frequency from the frequency specified in the Surveillance Frequency Control Program to every 12 hours. This action in combination with the above, provide defense in depth and overlap to the loss of the SMMs.
Surveillance Requirements The SMMs are subject to an ANALOG CHANNEL OPERATIONAL TEST to ensure each train of SMM is fully operational. This test shall include verification that the SMMs are set per the CORE OPERATING LIMITS REPORT. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
MILLSTONE - UNIT 3                          B 3/4 3-9                        AmendmentNo.-1-64,~
 
REVERSE OF PAGE B 3/4 3-9 INTENTIONALLY LEFT BLANK
 
LBDCR No. 06-MP3-005 May 25, 2006 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 REACTOR COOLANT LOOPS AND COOLANT CIRCULATION The purpose of Specification 3 .4.1.1 is to require adequate forced flow rate for con~ heat removal in MODES I and 2 during all normal operations and anticipated transients. Flow is represented by the number of reactor coolant pumps in operation for removal of heat by the steam generators. To meet safety analysis acceptance criteria for DNB, four reactor coolant pumps are required at rated power. An OPERABLE reactor coolant loop consists of an OPERABLE reactor coolant pump in operation providing forced flow for heat transport and an OPERABLE steam generator. With less than the required reactor coolant loops in operation this specification requires that the plant be in at least HOT STANDBY within 6 hours.
In MODE 3, three reactor coolant loops, and in MODE 4, two reactor coolant loops provide sufficient heat removal capability for removing core decay heat even in the event of a bank withdrawal accident; however, in MODE 3 a single reactor coolant loop provides sufficient heat removal capacity if a bank withdrawal accident can be prevented, i.e., the Control Rod Drive System is not capable of rod withdrawal.
In MODE 4, if a bank withdrawal accident can be prevented, a single reactor coolant loop or RHR loop provides sufficient heat removal capability for removing decay heat; but single failure considerations require that at least two loops (any combination ofRHR or RCS) be OPERABLE.
In MODE 5, with reactor coolant loops filled, a single RHR loop provides sufficient heat removal capability for removing decay heat; but single failure considerations require that at least two RHR loops or at least one RHR loop and two steam generators be OPERABLE.
In MODE 5 with reactor coolant loops not filled, a single RHR loop provides sufficient heat removal capability for removing decay heat; but single failure considerations, and the unavailability of the steam generators as a heat removing component, require that at least two RHR loops be OPERABLE.
In MODE 5, during a planned heatup to MODE 4 with all RHR loops removed from operation, an RCS loop, OPERABLE and in operation, meets the requirements of an OPERABLE and operating RHR loop to circulate reactor coolant. During the heatup there is no requirement for heat removal capability so the OPERABLE and operating RCS loop meets all of the required functions for the heatup condition. Since failure of the RCS loop, which is OPERABLE and operating, could also cause the associated steam generator to be inoperable, the associated steam generator cannot be used as one of the steam generators used to meet the requirement of LCO 3.4.1.4.1.b.
MILLSTONE - UNIT 3                          B 3/4 4-1        Amendment No. 6G, '::/-G, 99, &sect;-1, 91-, ~ ,
 
LBDCR No. 14-MP3-0ll January 8, 2015 3/4.4 REACTOR COOLANT SYSTEM BASES (Continued)
During any mode where RHR is required for decay heat removal, management of gas voids is important to RHR System OPERABILITY. RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the required RHR loop(s) and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
The operation of one reactor coolant pump (RCP) or one RHR pump provides adequate flow to ensure mixing, prevent stratification and produce gradual reactivity changes during boron concentration reductions in the Reactor Coolant System. The reactivity change rate associated with boron reduction will, therefore, be within the capability of operator recognition and control.
The RHR System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criterion for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
Accumulated gas should be eliminated or brought within the acceptance criteria limits.
Selection of RHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
Surveillance Requirements 4.4.1.3.4, 4.4.1.4.1.4, and 4.4.1.4.2.3 are performed for RHR System locations susceptible to gas accumulation and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval. The operating RHR pump and associated piping are exempted from this surveillance requirement, in that the operating train is self venting/flushing.
MILLSTONE - UNIT 3                            B 3/44-la AmendmentNo.6G,=7-G,99,W,-l-9-1,~,~.
Aeknov-Aedged by NRG letter dated 08/25/05
 
LBDCR No. 14-MP3-011 January 8, 2015 314.4 REACTOR COOLANT SYSTEM BASES The monitoring frequency of the locations that are susceptible to gas accumulation takes into consideration the gradual nature of gas accumulation in the RHR System piping and the procedural controls governing system operation. The frequency is controlled by the Surveillance Frequency Control Program. The surveillance frequency may vary by each location's susceptibility to gas accumulation.
SR 4.4.1.3.4 is not required to be performed until 12 hours after entering MODE 4. In a rapid shutdown, there may be insufficient time to verify all susceptible locations prior to entering MODE4.
The restrictions on starting the first RCP in MODE 4 below the cold overpressure protection enable temperature (226&deg;F), and in MODE 5 are provided to prevent RCS pressure transients. These transients, energy additions due to the differential temperature between the steam generator secondary side and the RCS, can result in pressure excursions which could challenge the PIT limits. The RCS will be protected against overpressure transients and will not exceed the reactor vessel isothermal beltline PIT limit by restricting RCP starts based on the differential water temperature between the secondary side of each steam generator and the RCS cold legs. The restrictions on starting the first RCP only apply to RCPs in RCS loops that are not isolated. The restoration of isolated RCS loops is normally accomplished with all RCPs secured.
If an isolated RCS loop is to be restored when an RCP is operating, the appropriate temperature differential limit between the secondary side of the isolated loop steam generator and the in service RCS cold legs is applicable, and shall be met prior to opening the loop isolation valves.
The temperature differential limit between the secondary side of the steam generators and the RCS cold legs is based on the equipment providing cold overpressure protection as required by Technical Specification 3 .4.9 .3. If the pressurizer PORVs are providing cold overpressure protection, the steam generator secondary to RCS cold leg water temperature differential is limited to a maximum of 50&deg;F. If any RHR relief valve is providing cold overpressure protection and RCS cold leg temperature is above 150&deg;F, the steam generator secondary water temperature must be at or below RCS cold leg water temperature. If any RHR relief valve is providing cold overpressure protection and RCS cold leg temperature is at or below l 50&deg;F, the steam generator secondary to RCS cold leg water temperature differential is limited to a maximum of 50&deg;F.
Specification 3.4.1.5 The reactor coolant loops are equipped with loop stop valves that permit any loop to be isolated from the reactor vessel. One valve is installed on each hot leg and one on each cold leg.
The loop stop valves are used to perform maintenance on an isolated loop. Operation in MODES 1-4 with a RCS loop stop valve closed is not permitted except for the mitigation of emergency or abnormal events. If a loop stop valve is closed for any reason, the required ACTIONS of this specification must be completed. To ensure that inadvertent closure of a loop stop valve does not occur, the valves must be open with power to the valve operators removed in MODES 1, 2, 3 and 4.
MILLSTONE - UNIT 3                          B 314 4-1 b Amendment No. W, =7-G, 99, &sect;-1, -l-91, ~ , ~
 
LBDCR No. 14-MP3-0ll January 8, 2015 3/4.4 REACTOR COOLANT SYSTEM BASES (Continued)
The safety analyses performed for the reactor at power assume that all reactor coolant loops are initially in operation and the loop stop valves are open. This LCO places controls on the loop stop valves to ensure that the valves are not inadvertently closed in MODES 1, 2, 3 and 4.
The inadvertent closure of a loop stop valve when the Reactor Coolant Pumps (RCPs) are operating will result in a partial loss of forced reactor coolant flow. If the reactor is at rated power at the time of the event, the effect of the partial loss of forced coolant flow is a rapid increase in the coolant temperature which could result in DNB with subsequent fuel damage if the reactor is not tripped by the Low Flow reactor trip. If the reactor is shutdown and a RCS loop is in operation removing decay heat, closure of the loop stop valve associated with the operating loop could also result in increasing coolant temperature and the possibility of fuel damage.
The loop stop valves have motor operators. If power is inadvertently restored to one or more loop stop valve operators, the potential exists for accidental ,closure of the affected loop stop valve(s) and the partial loss of forced reactor coolant flow. With power applied to a valve operator, only the interlocks prevent the valve from being operated. Although operating procedures and interlocks make the occurrence of this event unlikely, the prudent action is to remove power from the loop stop valve operators. The time period of 30 minutes to remove power from the loop stop valve operators is sufficient considering the complexity of the task.
Should a loop stop valve be closed in MODES 1 through 4, the affected valve must be maintained closed and the plant placed in MODE 5. Once in MODE 5, the isolated loop may be started in a controlled manner in accordance with LCO 3 .4.1.6, "Reactor Coolant System Isolated Loop Startup." Opening the closed loop stop valve in MODES 1 through 4 could result in colder water or water at a lower boron concentration being mixed with the operating RCS loops resulting in positive reactivity insertion. The time period provided in ACTION 3 .4.1.5 .b allows time for borating the operating loops to a shutdown boration level such that the plant can be brought to MODE 3 within 6 hours and MODE 5 within 30 hours. The allowed ACTION times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
Surveillance Requirement 4.4.1.5 is performed to ensure that the RCS loop stop valves are open, with power removed from the loop stop valve operators. The primary function of this Surveillance is to ensure that power is removed from the valve operators, since Surveillance Requirement 4.4.1.1 requires verification that all loops are operating and circulating reactor coolant, thereby ensuring that the loop stop valves are open. The frequency specified in the Surveillance Frequency Control Program ensures that the required flow is available. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
MILLSTONE - UNIT 3                          B 3/4 4-lc                              Amendment No. 2-H, Acknowledged by NRG Letter dated 04/12/06
 
LBDCR No. 14-MP3-0ll January 8, 2015 3/4.4 REACTOR COOLANT SYSTEM BASES (Continued)
Specification 3.4.1.6 The requirement to maintain the isolated loop stop valves shut with power removed ensures that no reactivity addition to the core could occur due to the startup of an isolated loop.
Verification of the boron concentration in an isolated loop prior to opening the first stop valve provides a reassurance of the adequacy of the boron concentration in the isolated loop.
Specifications 3.4.1.4.1 and 3.4.1.4.2 RCS Loops Filled/Not Filled:
In MODE 5, any RHR train with only one cold leg injection path is sufficient to provide adequate core cooling and prevent stratification of boron in the Reactor Coolant System.
The definition of OPERABILITY states that the system or subsystem must be capable of performing its specified function(s). The reason for the operation of one reactor coolant pump (RCP) or one RHR pump is to:
* Provide sufficient decay heat removal capability
* Provide adequate flow to ensure mixing to:
* Prevent stratification
* Produce gradual reactivity changes due to boron concentration changes in the RCS The definition of "Reactor coolant loops filled" includes a loop that is filled, swept, and vented, and capable of supporting natural circulation heat transfer. This allows the non-operating RHR loop to be removed from service while filling and unisolating loops as long as steam generators on the OPERABLE reactor coolant loops are available to support decay heat removal.
Any loop being unisolated is not OPERABLE until the loop has been swept and vented. The process of sweep and vent will make the previously OPERABLE loops inoperable and the requirements ofLCO 3.4.1.4.2, "Reactor Coolant System, COLD SHUTDOWN - Loops Not Filled," are applicable. When the RCS has been filled, swept and vented using an approved procedure, all unisolated loops may be declared OPERABLE.
The definition of "Reactor coolant loops filled" also includes a loop that has been vacuum filled and capable of supporting natural circulation heat transfer. Any isolated loop that has been vacuum filled is OPERABLE as soon as the loop is unisolated.
One cold leg injection isolation valve on an RHR train may be closed without considering the train to be inoperable, as long as the following conditions exist:
MILLSTONE - UNIT 3                          B 3/4 4-ld                              Amendment No. iH,
 
LBDCR No. 14-MP3-0ll January 8, 2015 3/4.4 REACTOR COOLANT SYSTEM BASES (Continued)
* CCP temperature is at or below 95&deg;F
* Initial RHR temperature is below 184 &deg;F
* The single RHR cold leg injection flow path is not utilized until a minimum of 48 hours after reactor shutdown
* CCP flow is at least 6,600 gpm
* RHR flow is at least 2,000 gpm In the above system lineup, total flow to the core is decreased compared to the flow when two cold legs are in service. This is acceptable due to the substantial margin between the flow required for cooling and the flow available, even through a slightly restricted RHR train.
The review concerning boron stratification with the utilization of the single injection point line, indicates there will not be a significant change in the flow rate or distribution through the core, so there is not an increased concern due to stratification.
Flow velocity, which is high, is not a concern from a flow erosion or pipe loading standpoint. There are no loads imposed on the piping system which would exceed those experienced in a seismic event. The temperature of the fluid is low and is not significant from a flow erosion standpoint.
The boron dilution accident analysis, for Millstone Unit 3 in MODE 5, assumes a full RHR System flow of approximately 4,000 gpm. Westinghouse analysis, Reference (1), for RHR flows down to 1,000 gpm, determined adequate mixing results. As the configuration will result in a RHR flow rate only slightly less then 4,000 gpm there is no concern in regards to a boron dilution accident.
The basis for the requirement of two RCS loops OPERABLE is to provide natural circulation heat sink in the event the operating RHR loop is lost. If the RHR loop were lost, with two loops filled and two loops air bound, natural circulation would be established in the two filled loops.
Natural circulation would not be established in the air bound loops. Since there would be no circulation in the air bound loops, there would be no mechanism for the air in those loops to be carried to the vessel, and subsequently into the filled loops rendering them inoperable for heat sink requirements.
The LCO is met as long as at least two reactor coolant loops are OPERABLE and the following conditions are satisfied:
* One RHR loop is OPERABLE and in operation, with exceptions as allowed in Technical Specifications; and MILLSTONE - UNIT 3                          B 3/4 4-le                              Amendment No. m, A.cknmvledged by NRG Letter dated 04/12/06
 
LBDCR No. 14-MP3-0ll January 8, 2015 3/4.4 REACTOR COOLANT SYSTEM BASES (continued)
Either of the following:
* An additional RHR loop OPERABLE, with exceptions as allowed in Technical Specifications; or
* The secondary side water level of at least two steam generators shall be greater than 17% (These are assumed to be on OPERABLE reactor coolant loops)
When the reactor coolant loops are swept, the mechanism exists for air to be carried into previously OPERABLE loops. All previously OPERABLE loops are declared inoperable and an additional RHR loop is required OPERABLE as specified by LCO 3.4.1.4.2 for loops not filled.
When the RCS has been filled, swept, and vented using an approved procedure, all unisolated loops may be declared OPERABLE.
ISOLATED LOOP STARTUP The below requirements are for unisolating a loop with all four loops isolated while decay heat is being removed by RHR and to clarify prerequisites to meet T/S requirements for unisolating a loop at any time.
With no RCS loops operating, the two RHR loops referenced in Specification 3.4.1.4.2 are the operating loops. Starting in MODE 4 as referenced in Specification 3.4.1.3, the RHR.loops are allowed to be used in place of an operating RCS loop. Specification 3 .4.1.4.2 requires two RHR loops OPERABLE and at least one in operation. Ensuring the isolated cold leg temperature is within 20&deg;F of the highest RHR outlet temperature for the operating RHR loops within 30 minutes prior to opening the cold leg stop valve is a conservative approach since the major concern is a positive reactivity addition.
SR 4.4.1.6.1: When in MODE 5 with all RCS loops isolated, the two RHR loops referenced in LCO 3.4.1.4.2 shall be considered the OPERABLE RCS loops. The isolated loop cold leg temperature shall be determined to be within 20&deg;F of the highest RHR outlet temperature for the operating RHR loops within 30 minutes prior to opening the cold leg stop valve.
Surveillance requirement 4.4.1. 6.2 is met when the following actions occur within 2 hours prior to opening the cold leg or hot leg stop valve:
* An RCS boron sample has been taken and analyzed to determine current boron concentration
* The SHUTDOWN MARGIN has been determined using OP 3209B, "Shutdown Margin" using the current boron concentration determined above
* For the isolated loop being restored, the power to both loop stop valves has been restored MILLSTONE - UNIT 3                          B 3/4 4-lf                        AmendmentNo.~,:23G
 
LBDCR No. 14-MP3-0ll January 8, 2015 3/4.4 REACTOR COOLANT SYSTEM BASES (continued)
Surveillance 4.4.1.6.2 indicates that the reactor shall be determined subcritical by at least the amount required by Specifications 3 .1.1.1.2 or 3.1.1.2 for MODE 5 or Specification 3 .9 .1.1 for MODE 6 within 2 hours of opening the cold leg or hot leg stop valve.
The SHUTDOWN MARGIN requirement in Specification 3.1.1.1.2 is specified in the CORE OPERATING LIMITS REPORT for MODE 5 with RCS loops filled. Specification 3.1.1.1.2 cannot be used to determine the required SHUTDOWN MARGIN for MODE 5 loops isolated condition.
Specification 3 .1.1.2 requires the SHUTDOWN MARGIN to be greater than or equal to the limits specified in the CORE OPERATING LIMITS REPORT for MODE 5 with RCS loops not filled provided CVCS is aligned to preclude boron dilution. This specification is for loops not filled and therefore is applicable to an all loops isolated condition.
Specification 3 .9 .1.1 requires 3/4ff of O.95 or less, or a boron concentration of greater than or equal to the limit specified in the COLR in MODE 6.
Specification 3 .1.1.1.2 or 3 .1.1.2 for MODE 5, both require boron concentration to be determined at the frequency specified in the Surveillance Frequency Control Program.
SR 4.1.1.1.2.1.b.2 and 4.1.1.2.1.b.l satisfy the requirements of Specifications 3.1.1.1.2 and 3.1.1.2 respectfully. Specification 3.9.1.1 for MODE 6 requires boron concentration to be determined at the frequency specified in the Surveillance Frequency Control Program. S.R. 4.9.1.1.2 satisfy the requirements of Specification 3. 9.1.1.
Per Specifications 3.4.1.2, ACTION c.; 3.4.1.3, ACTION c.; 3.4.1.4.1, ACTIONb.; and 3.4.1.4.2, ACTIONb., suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3 .1.1.1.2 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however, coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.
 
==References:==
: 1. Letter NEU-94-623, dated July 13, 1994; Mixing Evaluation for Boron Dilution Accident in Modes 4 and 5, Westinghouse HR-59782.
: 2. Memo No. MP3-E-93-821, dated October 7, 1993.
MILLSTONE - UNIT 3                            B 3/4 4-lg                                  Amendment No.
 
LBDCR No. 07-MP3-009 June 19, 2007 REACTOR COOLANT SYSTEM BASES 3/4.4.2 SAFETY VALVES The pressurizer Code safety valves operate to prevent the RCS from being pressurized above its Safety Limit of2750 psia. Each safety valve is designed to relieve 420,000 lbs per hour of saturated steam at the valve Setpoint. The relief capacity of a single safety valve is adequate to relieve any overpressure condition which could occur during shutdown. If any pressurizer Code safety valve is inoperable, and cannot be restored to OPERABLE status, the ACTION statement requires the plant to be shut down and cooled down such that Technical Specification 3.4.9.3 will become applicable and require cold overpressure protection to be placed in service.
During operation, all pressurizer Code safety valves must be OPERABLE to prevent the RCS from being pressurized above its Safety Limit of2750 psia. The combined relief capacity of all of these valves is greater than the maximum surge rate resulting from a complete loss-of-load assuming no Reactor trip until the first Reactor Trip System Trip Setpoint is reached (i.e., no credit is taken for a direct Reactor trip on the loss-of-load) and also assuming no operation of the power-operated relief valves or steam dump valves.
Demonstration of the safety valves' lift settings will occur only during shutdown and will be performed in accordance with the provisions of the ASME Code for Operation and Maintenance of Nuclear Power Plants.
3/4.4.3 PRESSURIZER The pressurizer provides a point in the RCS when liquid and vapor are maintained in equilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in the remainder of the RCS. Key functions include maintaining required primary system pressure during steady state operation and limiting the pressure changes caused by reactor coolant thermal expansion and contraction during load transients.
MODES 1AND2 The requirement for the pressurizer to be OPERABLE, with pressurizer level maintained at programmed level within +/- 6% of full scale is consistent with the accident analysis in Chapter 15 of the FSAR. The accident analysis assumes that pressurizer level is being maintained at the programmed level by the automatic control system, and when in manual control, similar limits are established. The programmed level ensures the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpressure and pressurizer overfill transients. A pressurizer level control error based upon automatic level control has been taken into account for those transients where pressurizer overfill is a concern (e.g., loss offeedwater, feedwater line break, and inadvertent ECCS actuation at power). When in manual control, the goal is to maintain pressurizer level at the program level value. The +/- 6% of full scale acceptance criterion in the Technical Specification establishes a band for operation to accommodate variations between level measurements. This value is bounded by the margin applied to the pressurizer overfill events.
MILLSTONE - UNIT 3                          B 3/4 4-2                        Amendment No. MG, 9-1,
 
LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.3 PRESSURJZER (continued)
The periodic surveillances require that pressurizer level be maintained at programmed level within+/- 6% of full scale. The surveillance is performed by observing the indicated level.
The surveillance frequency is controlled under the Surveillance Frequency Control Program.
During transitory conditions, i.e., power changes, the operators will maintain programmed level, and deviations greater than 6% will be corrected within 2 hours. Two hours has been selected for pressurizer level restoration after a transient to avoid an unnecessary downpower with pressurizer level outside the operating band. Normally, alarms are also available for early detection of abnormal level indications.
Electrical immersion heaters, located in the lower section of the pressurizer vessel, keep the water in the pressurizer at saturation temperature and maintain a constant operating pressure.
A minimum required available capacity of pressurizer heaters ensures that the RCS pressure can be maintained. The capability to maintain and control system pressure is important for maintaining subcooled conditions in the RCS and ensuring the capability to remove core decay heat by either forced or natural circulation of the reactor coolant. Unless adequate heater capacity is available, the hot high-pressure condition cannot be maintained indefinitely and still provide the required subcooling margin in the primary system. Inability to control the system pressure and maintain sub cooling under conditions of natural circulation flow in the primary system could lead to a loss of single-phase natural circulation and decreased capability to remove core decay heat.
The LCO requires two groups of OPERABLE pressurizer heaters, each with a capacity of at least 175 kW. The heaters are capable of being powered from either the offsite power source or the emergency power supply. The minimum heater capacity required is sufficient to maintain the RCS near normal operating pressure when accounting for heat losses through the pressurizer insulation. By maintaining the pressure near the operating conditions, a wide margin to subcooling can be obtained in the loops. The requirement for two groups of pressurizer heaters, each having a capacity of 175 kW, is met by verifying the capacity of the pressurizer heater groups A and B. Since the pressurizer heater groups A and B are supplied from the emergency 480V electrical buses, there is reasonable assurance that these heaters can be energized during a loss of offsite power to maintain natural circulation at HOT STANDBY. Providing an emergency (Class IE) power source for the required pressurizer heaters meets the requirement ofNUREG-0737, "A Clarification ofTMIAction Plan Requirements," 11.E.3.1, "Emergency Power Requirements for Pressurizer Heaters."
If one required group of pressurizer heaters is inoperable, restoration is required within 72 hours. The Completion Time of 72 hours is reasonable considering that a demand caused by loss of offsite power would be unlikely in this time period. Pressure control may be maintained during this time using normal station powered heaters.
MODE3 The requirement for the pressurizer to be OPERABLE, with a level less than or equal to 89%, ensures that a steam bubble exists. The 89% level preserves the steam space for pressure control. The 89% level has been established to ensure the capability to establish and maintain pressure control for MODE 3 and to ensure a bubble is present in the pressurizer. Initial pressurizer level is not significant for those events analyzed for MODE 3 in Chapter 15 of the FSAR.
MILLSTONE - UNIT 3                          B 3/4 4-2a                    AmendmentNo.MG,;!-1-0
 
LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.3 PRESSURIZER (cont'd.)
The periodic surveillance requires that during MODE 3 operation, pressurizer level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The surveillance is performed by observing the indicated level. The surveillance frequency is controlled under the Surveillance Frequency Control Program. Alarms are also available for early detection of abnormal level indications.
The basis for the pressurizer heater requirements is identical to MODES 1 and 2.
3/4.4.4 RELIEF VALVES The power-operated relief valves (PORVs) and steam bubble function to relieve RCS pressure during all design transients up to and including the design step load decrease with steam dump. Operation of the PORVs minimizes the undesirable opening of the spring-loaded pressurizer Code safety valves. Each PORV has a remotely operated block valve to provide a positive shutoff capability should a relief valve become inoperable. Requiring the PORVs to be OPERABLE ensures that the capability for depressurization during safety grade cold shutdown is met.
ACTION statements a, b, and c distinguishes the inoperability of the power operated relief valves (PORV). Specifically, a PORV may be designated inoperable but it may be able to automatically and manually open and close and therefore, able to perform its function. PORV inoperability may be due to seat leakage which does not prevent automatic or manual use and does not create the possibility for a small-break LOCA. For these reasons, the block valve may be closed but the action requires power to be maintained to the valve. This allows quick access to the PORV for pressure control. On the other hand if a PORV is inoperable and not capable of being automatically and manually cycled, it must be either restored or isolated by closing the associated block valve and removing power.
Note: PORV position indication does not affect the ability of the PORV to perform any of its safety functions. Therefore, the failure of PORV position indication does not cause the PORV to be inoperable. However, failed position indication of these valves must be restored "as soon as practicable" as required by Technical Specification 6.8.4.e.3.
Automatic operation of the PORVs is created to allow more time for operators to terminate an Inadvertent ECCS Actuation at Power. The PORVs and associated piping have been demonstrated to be qualified for water relief. Operation of the PORVs will prevent water relief from the pressurizer safety valves for which qualification for water relief has not been demonstrated. If the PORVs are capable of automatic operation but have been declared inoperable, closure of the PORV block valve is acceptable since the Emergency Operating Procedures provide guidance to assure that the PORVs would be available to mitigate the event. OPERABILITY and setpoint controls for the safety grade PORV opening logic are maintained in the Technical Requirements Manual.
MILLSTONE - UNIT 3                          B 3/4 4-2b                        Amendment No. -MG, 6 LBDCR No. 14-MP3-014 September 18, 2014 REACTOR COOLANT SYSTEM BASES RELIEF VALVES (Continued)
The prime importance for the capability to close the block valve is to isolate a stuck-open PORV.
Therefore, if the block valve(s) cannot be restored to OPERABLE status within 1 hour, the remedial action is to place the PORV in manual control (i.e., the control switch in the "CLOSE" position) to preclude its automatic opening for an overpressure event and to avoid the potential of a stuck-open PORV at a time that the block valve is inoperable. The time allowed to restore the block valve(s) to OPERABLE status is based upon the remedial action time limits for inoperable PORV per ACTION requirements b. and c. ACTION statement d. does not specify closure of the block valves because such action would not likely be possible when the block valve is inoperable.
For the same reasons, reference is not made to ACTION statements b. and c. for the required remedial actions.
SURVEILLANCE REQUIREMENT 4.4.4.2 verifies that a block valve(s) can be opened or closed if necessary. This SURVEILLANCE REQUIREMENT is not required to be performed with the block valve(s) closed in accordance with the ACTIONS ofTS 3.4.4. Opening the block valve(s) in this condition increases the risk of an unisolable leak from the RCS since the PORV(s) is already inoperable.
MILLSTONE - UNIT 3                          B 3/4 4-2c                    Amendment No. 8-, -l-6G, -l-6-l-,
Acknowledged by NRC letter dated 08/28/15
 
LBDCR No. 12-MP3-007 June 26, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY The LCO requires that steam generator (SG) tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the plugging criteria be plugged in accordance with the Steam Generator Program.
During a SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed from service by plugging. If a tube was determined to satisfy the plugging criteria but was not plugged, the tube may still have tube integrity.
In the context of this Specification, a SG tube is defined as the entire length of the tube, including the tube wall between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.
A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performance criteria are defined in Specification 6.8.4.g, "Steam Generator Program," and describe acceptable SG tube performance. The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.
The structural integrity performance criterion provides a margin of safety against tube burst or collapse under normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Tube burst is defined as, "The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area increased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero." The structural integrity performance criterion provides guidance on assessing loads that have a significant effect on burst or collapse. In that context, the term "significant" is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established." For tube integrity evaluations, except for circumferential degradation, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primary or secondary loads will be evaluated on a case-by-case basis. The division between primary and secondary classifications will be based on detailed analysis and/or testing.
MILLSTONE - UNIT 3                          B 3/4 4-3                                    Amendment No.
 
LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)
Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all ASME Code, Section III, Service Level A (normal operating conditions) and Service Level B (upset or abnormal conditions) transients included in the design specification.
This includes safety factors and applicable design basis loads based on ASME Code, Section III, Subsection NB (Ref. 4) and Draft Regulatory Guide 1.121 (Reference 5).
The accident induced leakage performance criterion ensures that the primary to secondary LEAKAGE caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions. The accident analysis assumes that accident induced leakage does not exceed 1 gallon per minute or is assumed to increase to 1 gallon per minute for all steam generators. The accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the accident in addition to primary to secondary LEAKAGE induced during the accident.
The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational LEAKAGE is contained in RCS LCO 3.4.6.2, "Operational Leakage," and limits primary to secondary LEAKAGE through any one SG to 150 gallons per day. This limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, and the above assumption is conservative.
APPLICABILITY Steam generator tube integrity is challenged when the pressure differential across the tubes is large. Large differential pressures across SG tubes can only be experienced during MODES 1, 2, 3, and 4.
RCS conditions are far less challenging during MODES 5 and 6 than during MODES 1, 2, 3, and
: 4. During MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.
ACTIONS The ACTIONS are modified by a NOTE clarifying that the Conditions may be entered independently for each SG tube. This is acceptable because the Required Actions provide appropriate compensatory actions for each affected SG tube. Complying with the Required Actions may allow for continued operation, and subsequent affected SG tubes are governed by subsequent Condition entry and application of associated Required Actions.
MILLSTONE - UNIT 3                          B 3/4 4-3a                              Amendment No.
 
LBDCR No. 12-MP3-007 June 26, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) a.land a.2 ACTION a. applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube plugging criteria but were not plugged in accordance with the Steam Generator Program as required by SR 4.4.5.2. An evaluation of SG tube integrity of the affected tube(s) must be made. Steam generator tube integrity is based on meeting the SG performance criteria described in the Steam Generator Program. The SG plugging criteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the time the situation is discovered and the estimated growth of the degradation prior to the next SG tube inspection. If it is determined that tube integrity is not being maintained, ACTION b. applies.
A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with a SG tube that may not have tube integrity.
If the evaluation determines that the affected tube(s) have tube integrity, Required ACTION a.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection interval continues to be supported by an operational assessment that reflects the affected tube(s). However, the affected tube(s) must be plugged prior to entering MODE 4 following the next refueling outage or SG inspection. This Completion Time is acceptable since operation until the next inspection is supported by the operational assessment.
b.1 and b.2 If the ACTIONS and associated Completion Times of ACTION a. are not met or if SG tube integrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems.
MILLSTONE - UNIT 3                          B 3/4 4-3b                            Amendment No.
 
LBDCR No. 12-MP3-007 June 26, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)
SURVEILLANCE REQUIREMENTS TS 4.4.5.1 During shutdown periods the SGs are inspected as required by this SR and the Steam Generator Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices.
During SG inspections a condition monitoring assessment of the SG tubes is performed. The condition monitoring assessment determines the "as found" condition of the SG tubes. The purpose of the condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.
The Steam Generator Program determines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube plugging criteria. Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing and potential degradation locations. The Steam Generator Program also specifies the inspection methods to be used to find potential degradation. Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, and inspection locations.
The Steam Generator Program defines the Frequency of TS 4.4.5 .1. The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Reference 6).
The Steam Generator Program uses information on existing degradations and growth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 6.8.4.g contains prescriptive requirements concerning inspection intervals to provide added assurance that the SG performance criteria will be met between scheduled inspections. If crack indications are found in any SG tube, the maximum inspection interval for all affected and potentially affected SGs is restricted by Specification 6.8.4.g until subsequent inspections support extending the inspection interval.
TS 4.4.5.2 During a SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed from service by plugging. The tube plugging criteria delineated in Specification 6.8.4.g are intended to ensure that tubes accepted for continued service satisfy the SG performance criteria with allowance for error in the flaw size measurement and for future flaw growth. In addition, the tube plugging criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s). Reference 1 provides guidance for performing operational MILLSTONE - UNIT 3                          B 3/4 4-3c                              Amendment No.
 
LBDCR No. 12-MP3-007 June 26, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) assessments to verify that the tubes remaining in service will continue to meet the SG performance criteria.
The Frequency of prior to entering MODE 4 following a SG inspection ensures that the Surveillance has been completed and all tubes meeting the plugging criteria are plugged prior to subjecting the SG tubes to significant primary to secondary pressure differential.
BACKGROUND SG tubes are small diameter, thin walled tubes that carry primary coolant through the primary to secondary heat exchangers. The SG tubes have a number of important safety functions. Steam generator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary system's pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO 3.4.1.1, "STARTUP and POWER OPERATION," LCO 3.4.1.2, "HOT STANDBY,"
LCO 3.4.1.3, "HOT SHUTDOWN," and LCO 3.4.1.4.1, "COLD SHUTDOWN - Loops Filled."
SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements.
SG tubing is subject to a variety of degradation mechanisms. Steam generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively. The SG performance criteria are used to manage SG tube degradation.
Specification 6.8.4.g., "Steam Generator (SG) Program," requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 6.8.4.g., tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 6.8.4.g. Meeting the SG performance criteria provides reasonable assurance of maintaining tube integrity at normal and accident conditions.
The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Reference 1).
MILLSTONE - UNIT 3                          B 3/4 4-3d                            Amendment No.
 
LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)
APPLICABLE SAFETY ANALYSES The steam generator tube rupture (SGTR) accident is the limiting design basis event for SG tubes and avoiding an SGTR is the basis for this Specification. The analysis of a SGTR event assumes a bounding primary to secondary LEAKAGE rate greater than the operational LEAKAGE rate limits in RCS LCO 3.4.6.2, "Operational LEAKAGE," plus the leakage rate associated with a double-ended rupture of a single tube. The accident analysis for a SGTR assumes the contaminated secondary fluid is released to the atmosphere via safety valves or atmospheric dump valves.
The analysis for design basis accidents and transients other than a SGTR assume the SG tubes retain their structural integrity (i.e., they are assumed not to rupture.) In these analyses, the steam discharge to the atmosphere is based on the total primary to secondary LEAKAGE from all SGs of 1 gallon per minute or is assumed to increase to 1 gallon per minute as a result of accident induced conditions. For accidents that do not involve fuel damage, the primary coolant activity level of DOSE EQUNALENT I-131 is assumed to be equal to the RCS LCO 3.4.8, "Specific Activity" limits. For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of GDC 19 (Reference 2), 10 CFR 50.67 (Reference 3) or the NRC approved licensing basis (e.g., a small fraction of these limits).
Steam Generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
REFERENCES
: 1.      NEI 97-06, "Steam Generator Program Guidelines."
: 2.      10 CFR 50 Appendix A, GDC 19.
: 3.      10 CFR 50.67.
: 4.      ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.
: 5.      Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam Generator Tubes," August 1976.
: 6.      EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines."
MILLSTONE - UNIT 3                            B 3/4 4-3e                              Amendment No.
 
LBDCRNo. 07-MP3-032 August 8, 2007 REACTOR COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.1 LEAKAGE DETECTION SYSTEMS The RCS Leakage Detection Systems required by this specification are provided to monitor and detect leakage from the reactor coolant pressure boundary. These Detection Systems are consistent with the recommendations of Regulatory Guide 1.45, "Reactor Coolant Pressure Boundary Leakage Detection Systems," May 1973.
ACTION c provides a 72 hour allowed outage time (AOT) when both the containment atmosphere particulate radioactivity monitor and the containment drain sump monitoring system, are inoperable. The 72 hour AOT is appropriate since additional actions will be taken during this limited time period to ensure RCS leakage, in excess of the UNIDENTIFIED LEAKAGE TS limit of 1 gpm (TS 3 .4.6.2), will be readily detectable. This will provide reasonable assurance that any significant reactor coolant pressure boundary degradation is detected soon after occurrence to minimize the potential for propagation to a gross failure. This is consistent with the requirements of General Design Criteria (GDC) 30 and also Criterion 1 of 10 CFR 50.36(d)(2)(ii) which requires installed instrumentation to detect, and indicate in the control room, a s1gn1ficant abnormal degradation of the reactor coolant pressure boundary. The RCS water inventory balance calculation determines the magnitude of RCS UNIDENTIFIED LEAKAGE by use of instrumentation readily available to the control room operators. However, the proposed additional actions will not restore the continuous monitoring capability normally provided by the inoperable equipment.
The RCS water inventory balance is capable of identifying a one gpm RCS leak rate. The containment grab samples will also indicate an increase in RCS leak rate which would then be quantified by the RCS water inventory balance. Since these additional actions are sufficient to ensure RCS LEAKAGE is within TS limits, it is appropriate to provide a limited time period to restore at least one of the TS-required LEAKAGE monitoring systems.
LCO 3.4.6.1.b. Containment Sump Drain Monitoring System The intent of LCO 3.4.6.1.b is to have a system able to monitor and detect leakage from the reactor coolant pressure boundary (RCPB). Any of the following three methods may be used to meet LCO 3.4.6.1.b:
A.      3DAS-Pl0, Unidentified Leakage Sump Pump, and associated local and main board annunciation.
B.      3DAS-Pl0, Unidentified Leakage Sump Pump, and computer point 3DAS-L39 andCVLKR2.
C.      3DAS-P2A or 3DAS-P2B, Containment Drains Sump Pump, and computer points 3DAS-L22 and CVLKR2 or CVLKR3I.
To meet Regulatory Guide 1.45 recommendations, the Containment Drain Sump Monitoring System must meet the following five criteria:
: 1.      Must monitor changes in sump water level, changes in flow rate or changes in the operating frequency of pumps.
: 2.      Be able to detect an UNIDENTIFIED LEAKAGE rate of 1 gpm in less than one hour.
MILLSTONE - UNIT 3                          B 3/4 4-4                                    Amendment No.
 
LBDCR No. 07-MP3-032 August 8, 2007 REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued)
: 3. Remain OPERABLE following an Operating Basis Earthquake (OBE).
: 4. Provide indication and alarm in the Control Room.
: 5. Procedures for converting various indications to a common leakage equivalent must be available to the Operators.
The three Containment Drain Sump Monitoring Systems identified above meet these five requirements as follows:
A. 3DAS-Pl0, Unidentified Leakage Sump Pump, and associated main board annunciation.
: 1. Sump level is monitored at two locations by the starting and stopping of 3DAS-P 10, Unidentified Leakage Sump Pump. Flow is measured as a function of time between pump starts/stops and the known sump levels at which these occur.
: 2. Two timer relays in the control circuitry of 3DAS-P10 are set to identify a 1 gpm leak rate within 1 hour.
: 3. This monitoring system is not seismic Category I, but is expected to remain OPERABLE during an QBE. If the monitoring system is not OPERABLE following a seismic event, the appropriate ACTION according to Technical Specifications will be taken. This position has been reviewed by the NRC and documented as acceptable in the Safety Evaluation Report.
: 4. If the control circuitry of 3DAS-Pl O identifies a 1 gpm leak rate within 1 hour, Liquid Radwaste Panel Annunciator LWS 4-5, CTMT UNIDENT LEAKAGE TROUBLE, and Main Board Annunciator MBl B 4-3, RAD LIQUID WASTE SYS TROUBLE, will alarm. These control circuits and alarms operate independently from the plant process computer.
If the computer is inoperable, these control circuits and alarms meet the Technical Specification requirements for the Containment Drain Sump Monitoring System.
: 5. To convert the unidentified leakage sump pump run times to a leakage rate, use the following formula:
(3DAS-P10 run times in minutes - [number of 3DAS-P10 starts x.5 minutes]) x 20 gpm Elapsed monitored Time in minutes B.      3DAS-Pl0, Unidentified Leakage Sump Pump. and computer points 3DAS-L39 and CVLKR2.
: 1. Sump level is monitored by 3DAS-LI39, the Unidentified Leakage Sump Level indicator. This level indicator provides an input to computer point 3DAS-L39.
MILLSTONE - UNIT 3                        B 3/4 4-4a                                Amendment No.
 
LBDCR No. 11-MP3-004 March 22, 2011 REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued)
: 2. The plant process computer calculates a leakage rate every 30 seconds when 3DASP10 indicates stop. This leakage rate is displayed via computer point CVLKR2. When pump Pl0 does run, the leakage rate calculation is stopped and resumes 10 minutes after pump P 10 stops. If it cannot provide a value of the leakage rate within any 54 minute interval, CVDASPlONC (UNDNT LKG RT NOT CALC) alarms which alerts the Operator that UNIDENTIFIED LEAKAGE cannot be determined.
: 3. This monitoring system is not seismic Category I, but is expected to remain OPERABLE during an OBE. If the monitoring system is not OPERABLE following a seismic event, the appropriate ACTION according to Technical Specifications will be taken.
: 4. A priority computer alarm ( CVLKR2) is generated if the calculated leakage rate is greater than a value specified on the Priority Alarm Point Log. This alarm value should be set to alert the Operators to a possible RCS leak rate in excess of the Technical Specification maximum allowed UNIDENTIFIED LEAKAGE. The alarm value may be set at one gallon per minute or less above the rate of IDENTIFIED LEAKAGE, from the reactor coolant or auxiliary systems, into the unidentified leakage sump. The rate of IDENTIFIED LEAKAGE maybe determined by either measurement or analysis. If the Priority Alarm Point Log is adjusted, the high leakage rate alarm will be bounded by the IDENTIFIED LEAKAGE rate and the low leakage rate alarm will be set to notify the operator that a decrease in leakage may require the high leakage rate alarm to be reset. The priority alarm setpoint shall be no greater than 2 gallons per minute. This ensures that the IDENTIFIED LEAKAGE will not mask a small increase in UNIDENTIFIED LEAKAGE that is of concern. The 2 gallons per minute limit is also within the identified leakage sump level monitoring system alarm operating range which has a maximum setpoint of2.3 gallons per minute.
To convert unidentified leakage sump level changes to leakage rate, use the following formula:
Note: Wait 10 minutes after 3DAS-Pl0 stops before taking level readings.
1.08315 gallons        X      % change in level from 3DAS-L39 1%                    time between level readings in minutes C.      3DAS-P2A or 3DAS-P2B. Containment Drains Sump Pump. and computer points 3DAS-L22 and CVLKR2 or CVLKR3I.
: 1. Sump level is monitored by 3DAS-LI22, the Containment Drains Sump Level Indicator. This level indicator provides an input to computer point 3DAS-L22.
This method can be used to monitor UNIDENTIFIED LEAKAGE when Pump P 10 and its associated equipment is inoperable provided Pump P 10 is out of service and 3DAS-L139 indicates that the unidentified leakage sump is overflowing to the containment drains sump (approximately 40% level on 3DAS-LI39).
MILLSTONE - UNIT 3                      B 3/4 4-4b                                  Amendment No.
 
LBDCR No. 07-MP3-032 August 8, 2007 REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued)
In this case, CVLKR2 and CVLKR3I monitor flow rate by comparing level indications on the containment drains sump when Pumps PlO, P2A, P2B and Pl are not running.
: 2.      The plant process computer calculates a leakage rate every 30 seconds when 3DAS-P10, 3DAS-Pl, 3DAS-P2Aand 3DAS-P2B indicate stop. This leakage rate is displayed via computer points CVLKR3I and CVLKR2 when 3DAS-P10 is off and when the unidentified leakage sump is overflowing to the containment drains sump. When one of these pumps does run, the leakage rate calculation is stopped and resumes 10 minutes after all pumps stop. If it cannot provide value of the leakage rate within any 54 minute interval, two computer point alarms (CVDASP2NC, UNDNT LKG RT NOT CALC and CVDASP2NC, SMP 3 LKG RT NT CALC) are generated which alerts the Operator that UNIDENTIFIED LEAKAGE cannot be determined.
: 3.      This monitoring system is not seismic Category I, but is expected to remain OPERABLE during an OBE. If the monitoring system is not OPERABLE following a seismic event, the appropriate ACTION according to Technical Specifications will be taken.
: 4.      Two priority computer alarms (CVLKR2 and CVLKR3I) are generated if the calculated leakage rate is greater than a value specified on the Priority Alarm Point Log. This alarm value should be set to alert the Operators to a possible RCS leak rate in excess of the Technical Specification maximum allowed UNIDENTIFIED LEAKAGE. The alarm value may be set at one gallon per minute or less above the rate of IDENTIFIED LEAKAGE, from the reactor coolant or auxiliary systems, into the containment drains sump. The rate of IDENTIFIED LEAKAGE may be determined by either measurement or by analysis. If the Priority Alarm Point Log is adjusted, the high leakage rate alarm will be bounded by the IDENTIFIED LEAKAGE rate and the low leakage rate alarm will be set to notify the operator that a decrease in leakage may require the high leakage rate alarm to be reset. The priority alarm setpoint shall be no greater than 2 gallons per minute. This ensures that the IDENTIFIED LEAKAGE will not mask a small increase in UNIDENTIFIED LEAKAGE that is of concern. The 2 gallons per minute limit is also within the containment drains sump level monitoring system alarm operating range which has a maximum setpoint of 2.5 gallons per minute.
: 5.      To convert containment drains sump run times to a leakage rate, refer to procedure SP3670.1 for guidance on the conversion method.
3/4.4.6.2 OPERATIONAL LEAKAGE LCO RCS operational LEAKAGE shall be limited to:
: a. PRESSURE BOUNDARY LEAKAGE No PRESSURE BOUNDARY LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further MILLSTONE - UNIT 3                          B 3/4 4-4c                                    Amendment No.
 
LBDCR No. 07-MP3-032 August 8, 2007 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) deterioration, resulting in higher LEAKAGE. Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE.
: b. UNIDENTIFIED LEAKAGE One gallon per minute (gpm) of UNIDENTIFIED LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect within a reasonable time Qeriod. Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.
: c. Primary to Secondary LEAKAGE through Any One Steam Generator (SG)
The limit of 150 gallons per day per SG is based on the operational LEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines (Reference 4).
The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states, "The RCS operational primary to secondary LEAKAGE through any one SG shall be limited to 150 gallons per day.' The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational LEAKAGE rate criterion in conjunction with the implementation of tlie Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.
: d. IDENTIFIED LEAKAGE Up to 10 gpm of IDENTIFIED LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of UNIDENTIFIED LEAKAGE and is well within the capability of the RCS makeup system. IDENTIFIED LEAKAGE includes LEAKAGE to the containment from specilically known and located sources, but does not include PRESSURE BOUNDARY LEAKAGE or controlled reactor coolant pump (RCP) seal leakoff (CONTROLLED LEAKAGE). Violation of this LCO could result m continued degradation of a component or system.
: e. CONTROLLED LEAKAGE The CONTROLLED LEAKAGE limitation restricts operation when the total flow supplied to the reactor coolant pump seals exceeds 40 gpm with the modulating valve in the supply line fully open at a nominal RCS pressure of2250 psia. This limitation ensures that in the event of a LOCA, the safety injection flow will not be less than assumed in the safety analyses.
A limit of 40 gpm is placed on CONTROLLED LEAKAGE.
: f. RCS Pressure Isolation Valve LEAKAGE The specified allowable leakage from any RCS pressure isolation valve is sufficiently low to ensure early detection of possible in-series valve failure. It is aIJparent that when pressure isolation is providecl by two in-series valves and when failure of one valve in the pair can go undetected for a suostantial length of time, verification of valve integrity is required. Since these valves are important in preventing overpressurization and rupture of the ECCS low pressure piping which could result in a LOCA, these valves should be tested periodically to ensure low probability of gross failure.
MILLSTONE - UNIT 3                          B 3/4 4-4d                              Amendment No.~,
 
LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)
APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.
In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.
LCO 3.4.6.2.f, RCS Pressure Isolation Valve (PIV) Leakage, measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leak tight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.
ACTIONS
~
UNIDENTIFIED LEAKAGE, IDENTIFIED LEAKAGE or RCS pressure isolation valve LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours. This Completion Time allows time to verify leakage rates and either identify UNIDENTIFIED LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.
a., b., c.
If any PRESSURE BOUNDARY LEAKAGE exists, or primary to secondary LEAKAGE is not within limits, or if UNIDENTIFIED LEAKAGE, IDENTIFIED LEAKAGE, or RCS pressure isolation valve LEAKAGE cannot be reduced to within limits within 4 hours, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It should be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE. The reactor must be brought to HOT STANDBY within 6 hours and COLD SHUTDOWN within the following 30 hours. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In COLD SHUTDOWN, the pressure stresses acting on the reactor coolant pressure boundary are much lower, and further deterioration is much less likely.
MILLSTONE - UNIT 3                        B 3/4 4-4e                        Amendment No.~.
 
LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)
SURVEILLANCE REQUIREMENTS 4.4.6.2.1.c CONTROLLED LEAKAGE is determined under a set of reference conditions, listed below:
: a.      One Charging Pu.mp in operation.
: b.      RCS pressure at 2250 +/- 20 psia.
By limiting CONTROLLED LEAKAGE to 40 gpm during normal operation, it can be assured that during an SI with only one charging pump injecting, RCP seal injection flow will continue to remain less than 80 gpm as assumed in the accident analysis. When the seal injection throttle valves are set with a normal charging lineup, the throttle valve position bounds conditions where higher charging header pressures could exist. Therefore, conditions which create higher charging header pressures such as an isolated charging line, or two pumps in service are bounded by the single pump-normal system lineup surveillance configuration. Basic accident analysis assumptions are that 80 gpm flow is provided to the seals by a single pump in a runout condition.
4.4.6.2.1.d Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the reactor coolant pressure boundary is maintained. PRESSURE BOUNDARY LEAKAGE would at first appear as UNIDENTIFIED LEAKAGE and can only be positively identified by inspection. It should be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE.
UNIDENTIFIED LEAKAGE and IDENTIFIED LEAKAGE are determined by performance of an RCS water inventory balance.
The RCS water inventory balance must be performed with the reactor at steady state operating conditions (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows). The Surveillance is modified by two Notes.
Note 1 states that this SR is not required to be performed until 12 hours after establishing steady state operation. The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established.
Steady state operation is required to perform a proper water inventory balance since calculations during maneuvering are not useful. For RCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.
MILLSTONE - UNIT 3                          B 3/4 4-4f                              Amendment No.
 
LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)
An early warning of PRESSURE BOUNDARY LEAKAGE or UNIDENTIFIED LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. It should be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE. These leakage detection systems are specified in RCS LCO 3.4.6.1, "Leakage Detection Systems."
Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 150 gallons per day cannot be measured accurately by an RCS water inventory balance.
The surveillance frequency is controlled under the Surveillance Frequency Control Program.
4.4.6.2.1.e This SR verifies that primary to secondary LEAKAGE is less than or equal to 150 gallons per day through any one SG. Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met, compliance with LCO 3.4.5, "Steam Generator Tube Integrity," should be evaluated. The 150 gallons per day limit is measured at room temperature as described in Reference 5. The operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical to assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.
The Surveillance is modified by a Note which states that the surveillance is not required to be performed until 12 hours after establishment of steady state operation. For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.
The surveillance frequency is controlled under the Surveillance Frequency Control Program. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRI guidelines (Reference 5).
4.4.6.2.2 The Surveillance Requirements for RCS pressure isolation valves provide assurance of valve integrity thereby reducing the probability of gross valve failure and consequent intersystem LOCA.
Leakage from the RCS pressure isolation valve is IDENTIFIED LEAKAGE and will be considered as a portion of the allowed limit.
MILLSTONE - UNIT 3                          B 3/4 4-4g                              Amendment No.
 
LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)
Entry into MODES 3 and 4 is allowed to establish the necessary differential pressures and stable conditions for performance of Surveillance Requirement 4.4.6.2.2 (including Surveillance Requirement 4.4.6.2.2.d) for RCS pressure isolation valves which can only be leak-tested at elevated RCS pressures. The requirements of Surveillance Requirement 4.4.6.2.2.d to verify that a pressure isolation valve is OPERABLE shall be performed within 24 hours after the required RCS pressures has been met.
In MODES 1 and 2, the plant is at normal operating pressure and Surveillance Requirement 4.4.6.2.2.d shall be performed within 24 hours of valve actuation due to automatic or manual action or flow through the valve. In MODES 3 and 4, Surveillance Requirement 4.4.6.2.2.d shall be performed within 24 hours of valve actuation due to automatic or manual actuation of flow through the valve if and when RCS pressure is sufficiently high for performance of this surveillance.
BACKGROUND Components that contain or transport the coolant to or from the reactor core make up the reactor coolant system (RCS). Component joints are made by welding, bolting, rolling, or pressure
* loading, and valves isolate connecting systems from the RCS.
During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the RCS "Operational LEAKAGE" LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.
10 CFR 50, Appendix A, GDC 30 (Reference 1), requires means for detecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Reference
: 2) describes acceptable methods for selecting leakage detection systems.
The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is necessary. Quickly separating the IDENTIFIED LEAKAGE from the UNIDENTIFIED LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur detrimental to the safety of the facility and the public.
A limited amount ofleakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight. Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with RCS LEAKAGE detection.
This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analysis radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA).
MILLSTONE - UNIT 3                          B 3/4 4-4h                              Amendment No.
 
LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)
APPLICABLE SAFETY ANALYSES - OPERATIONAL LEAKAGE Except for primary to secondary LEAKAGE, the safety analyses do not address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGE from all steam generators (SGs) is 1 gallon per minute or increases to 1 gallon per minute as a result of accident induced conditions. The LCO requirement to limit primary to secondary LEAKAGE through any one SG to less than or equal to 150 gallons per day is significantly less than the conditions assumed in the safety analysis.
Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a main steam line break (MSLB). To a lesser extent, other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR) accident. The leakage contaminates the secondary fluid.
The FSAR (Reference 3) analysis for SGTR assumes the contaminated secondary fluid is released via atmospheric dump valves. The 1 gpm primary to secondary LEAKAGE safety analysis assumption is relatively inconsequential.
The safety analysis for the MSLB accident assumes 500 gpd primary to secondary LEAKAGE is through the affected steam generator and the remainder of the 1 gpm is through the intact SGs as an initial condition. The dose consequences resulting from the MSLB accident are within the guidelines based on 10 CFR 50. 67 or other staff approved licensing basis.
The RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
REFERENCES
: 1. 10 CFR 50, Appendix A, GDC 30.
: 2.      Regulatory Guide 1.45, May 1973.
: 3.      FSAR, Section 15.
: 4.      NEI 97-06, "Steam Generator Program Guidelines."
: 5.      EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."
: 6.      Letter FSD/SS-NEU-3713, dated March 25, 1985.
: 7.      Letter NEU-89-639, dated December 4, 1989.
MILLSTONE - UNIT 3                        B 3/4 4-4i                              Amendment No.
 
LBDCR No. 08-MP3-013 March 18, 2008 REACTOR COOLANT SYSTEM BASES 3/4.4.7 DELETED 3/4.4.8 SPECIFIC ACTIVITY BACKGROUND The maximum dose that an individual at the exclusion area boundary can receive for 2 hours following an accident, or at the low population zone outer boundary for the radiological release duration, is specified in 10 CFR 50.67 (Reference 1). Doses to control room occupants must be limited per GDC 19. The limits on specific activity ensure that the offsite and Control Room Envelope (CRE) doses are appropriately limited during analyzed transients and accidents.
The RCS specific activity LCO limits the allowable concentration of radionuclides in the reactor coolant. The LCO limits are established to minimize the dose consequences in the event of a steam line break (SLB) or steam generator tube rupture (SGTR) accident.
The LCO contains specific activity limits for both DOSE EQUNALENT 1-131 and DOSE EQUNALENT XE-133. The allowable levels are intended to ensure that offsite and CRE doses meet the appropriate acceptance criteria in the Standard Review Plan (Reference 2).
APPLICABLE SAFETY ANALYSES The LCO limits on the specific activity of the reactor coolant ensure the resulting offsite and CRE doses meet the appropriate SRP acceptance criteria following a SLB or SGTR accident. The safety analyses (References 3 and 4) assume the specific activity of the reactor coolant is at the LCO limits, and an existing reactor coolant steam generator (SG) tube leakage rate of 1 gpm exists. The safety analyses assume the specific activity of the secondary coolant is at its limit of 0.1 &#xb5;Ci/gm DOSE EQUIVALENT 1-131 from LCO 3.7.1.4, "Specific Activity."
The analyses for the SLB and SGTR accidents establish the acceptance limits for RCS specific activity. Reference to these analyses is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.
The safety analyses consider two cases of reactor coolant iodine specific activity. One case assumes specific activity at 1.0 &#xb5;Ci/gm DOSE EQUIVALENT 1-131 with a concurrent large iodine spike that increases the rate of release of iodine from the fuel rods containing cladding defects to the primary coolant immediately after a SLB (by a factor of 500), or SGTR (by a factor of 335) respectively. The second case assumes the initial reactor coolant iodine activity at 60.0
&#xb5;Ci/gm DOSE EQUIVALENT 1-131 due to an iodine spike caused by a reactor or an RCS transient prior to the accident. In both cases, the noble gas specific activity is assumed to be 81.2
&#xb5;Ci/gm DOSE EQUIVALENT XE-133.
The SGTR analysis also assumes a loss of offsite power at the same time as the reactor trip. The SGTR causes a reduction in reactor coolant inventory. The reduction initiates a reactor trip from a low pressurizer pressure signal or an RCS overtemperature /),. T signal.
MILLSTONE - UNIT 3                          B 3/4 4-5                                Amendment No. W4
 
LBDCRNo. 08-MP3-013 March 18, 2008 REACTOR COOLANT SYSTEM BASES SPECIFIC ACTIVITY (Continued)
The loss of offsite power causes the steam dump valves to close to protect the condenser. The rise in pressure in the ruptured SG discharges radioactively contaminated steam to the atmosphere through the SG power operated relief valves and/or the main steam safety valves. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends and the Residual Heat Removal (RHR) system is put in service.
The SLB radiological analysis assumes offsite power is lost at the same time as the pipe break occurs outside containment. Reactor trip occurs after the generation of an SI signal on low steam line pressure. The affected SG blows down completely and steam is vented directly to the atmosphere. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends and the RHR system is placed in service.
Operation with iodine specific activity levels greater than 1 &#xb5;Ci/gm but less than or equal to 60.0 &#xb5;Ci/gm is permissible for up to 48 hours while efforts are made to restore DOSE EQUIVALENT I-131 to within the 1 &#xb5;Ci/gm LCO limit. Operation with iodine specific activity levels greater than 60 &#xb5;Ci/gm is not permissible.
The RCS specific activity limits are also used for establishing standardization in radiation shielding and plant personnel radiation protection practices.
RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO The iodine specific activity in the reactor coolant is limited to 1.0 &#xb5;Ci/gm DOSE EQUIVALENT I-131, and the noble gas specific activity in the reactor coolant is limited to 81.2 &#xb5;Ci/gm DOSE EQUIVALENT XE-133. The limits on specific activity ensure that offsite and CRE doses will meet the appropriate SRP acceptance criteria (Reference 2).
The SLB and SGTR accident analyses (References 3 and 4) show that the calculated doses are within acceptable limits. Operation with activities in excess of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SLB or SGTR, lead to doses that exceed the SRP acceptance criteria (Reference 2).
APPLICABILITY In MODES 1, 2, 3, and 4, operation within the LCO limits for DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133 is necessary to limit the potential consequences of a SLB or SGTR to within the SRP acceptance criteria (Reference 2).
In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS and steam generators are depressurized, and primary to secondary LEAKAGE is minimal. Therefore, the monitoring of RCS specific activity is not required.
MILLSTONE - UNIT 3                          B 3/4 4-6                                    Amendment No.
 
LBDCR No. 08-MP3-013 March 18, 2008 REACTOR COOLANT SYSTEM BASES SPECIFIC ACTMTY (Continued)
ACTIONS
: a. and b.
With the DOSE EQUIVALENT 1-131 greater than the LCO limit, samples at intervals of four hours must be taken to demonstrate that the specific activity is ~ 60 &#xb5;Ci/gm. Four hours is required to obtain and analyze a sample. Sampling is continued every four hours to provide a trend.
The DOSE EQUIVALENT 1-131 must be restored to within limit within 48 hours. The completion time of 48 hours is acceptable since it is expected that, if there were an iodine spike, the normal coolant iodine concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.
A statement in ACTION b. indicates the provisions ofLCO 3.0.4 are not applicable. This exception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTIONS a. and
: b. while the DOSE EQUIVALENT 1-131 LCO is not met. This exception is acceptable due to the significant conservatism incorporated into the RCS specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, POWER OPERATION.
c.
If the required action and completion time of ACTION b. is not met, or if the DOSE EQUIVALENT 1-131 is > 60 &#xb5;Ci/gm, the reactor must be brought to HOT STANDBY (MODE 3) within 6 hours and COLD SHUTDOWN (MODE 5) within 36 hours. The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
d.
With the RCS DOSE EQUIVALENT XE-133 greater than the LCO limit, DOSE EQUIVALENT XE-133 must be restored to within limit within 48 hours. The allowed completion time of 48 hours is acceptable since it is expected that, if there were a noble gas spike, the normal coolant noble gas concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.
A statement in ACTION d. indicates the provisions ofLCO 3.0.4 are not applicable. This exception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTION d. while the DOSE EQUIVALENT XE-133 LCO is not met. This exception is acceptable due to the significant conservatism incorporated into the RCS specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, POWER OPERATION.
MILLSTONE - UNIT 3                          B 3/4 4-6a                  Amendment No.
 
LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES SPECIFIC ACTIVITY (Continued)
ACTIONS (Continued) e.
If the required action and completion time of ACTION d. is not met, the reactor must be brought to HOT STANDBY (MODE 3) within 6 hours and COLD SHUTDOWN (MODE 5) within 36 hours. The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE REQUIREMENTS 4.4.8.1 Surveillance Requirement 4.4.8.1 requires performing a gamma isotopic analysis as a measure of the noble gas specific activity of the reactor coolant at the frequency specified in the Surveillance Frequency Control Program. This measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance Requirement provides an indication of any increase in the noble gas specific activity.
Trending the results of this Surveillance Requirement allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
Due to the inherent difficulty in detecting Kr-85 in a reactor coolant sample due to masking from radioisotopes with similar decay energies, such as F-18 and 1-134, it is acceptable to include the minimum detectable activity for Kr-85 in the Surveillance Requirement 4.4.8.1 calculation. If a specific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE-133 is not detected, it should be assumed to be present at the minimum detectable activity.
A Note modifies the Surveillance Requirement to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows the Surveillance Requirement to be performed in those MODES, prior to entering MODE 1.
4.4.8.2 This Surveillance Requirement is performed to ensure iodine specific activity remains within the LCO limit during normal operation and following fast power changes when iodine spiking is more apt to occur. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The frequency of between 2 and 6 hours after a power change;::: 15% RTP within a 1 hour period is established because the iodine levels peak during this time following iodine spike initiation; samples at other times would provide inaccurate results.
MILLSTONE - UNIT 3                          B 3/4 4-6b                              Amendment No.
 
LBDCR No. 08-MP3-013 March 18, 2008 REACTOR COOLANT SYSTEM BASES SPECIFIC ACTIVITY (Continued)
SURVEILLANCE REQUIREMENTS (Continued)
The Note modifies this Surveillance Requirement to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows the Surveillance Requirement to be performed in those MODES, prior to entering MODE 1.
REFERENCES
: 1. 10 CFR 50.67.
: 2. Standard Review Plan (SRP) Section 15.0.1, "Radiological Consequence Analyses Using Alternate Source Terms."
: 3. FSAR, Section 15.1.5.
: 4. FSAR, Section 15.6.3.
3/4.4.9 PRESSURE/TEMPERATURE LIMITS REACTOR COOLANT SYSTEM (EXCEPT THE PRESSURIZER)
BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.
Figures 3.4-2 and 3.4-3 contain PIT limit curves for heatup, cooldown, inservice leak and hydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolant temperature.
Each P/T limit curve defines an acceptable region for normal operation. The usual use of the curves is operational requirements during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region. A heatup or cooldown is defined as a temperature increase or decrease of greater than or equal to 10&deg;F in any one hour period. This defmition of heatup and cooldown is based upon the ASME defmiti on of isothermal conditions described in ASME, Section XI, Appendix E.
MILLSTONE - UNIT 3                        B 3/4 4-7                        Amendment No. -l-&sect;-1, 9-1,
 
LBDCR 3-4-03 May 20, 2004 REACTOR COOLANT SYSTEM BASES PRESSURE/TEMPERATURE LIMITS (continued)
Steady state thermal conditions exist when temperature increases or decreases are <l 0&deg;P in any one hour period and when the plant is not performing a planned heatup or cooldown in accordance with a procedure.
The LCO establishes operating limits that provide a margin to brittle failure, applicable to the ferritic material of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the Pressurizer.
The PIT limits have been established for the ferritic materials of the RCS considering ASME Boiler and Pressure Vessel Code Section XI, Appendix G (Reference 1) as modified by ASME Code Case N-640 (Reference 2), and the additional requirements of 10 CPR 50 Appendix G (Reference 3). Implementation of the specific requirements provide adequate margin to brittle fracture of ferritic materials during normal operation, anticipated operational occurrences, and system leak and hydrostatic tests.
The neutron embrittlement effect on the material toughness is reflected by increasing the nil ductility reference temperature (RTNDT) as exposure to neutron fluence increases.
The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 4) and Appendix Hof 10 CPR 50 (Ref. 5). The operating PIT limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of Regulatory Guide 1.99 (Ref. 6).
The PIT limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive.
At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the PIT limit curves, different locations may be more restrictive, and thus, the curves are composites of the most restrictive regions.
The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.
The PIT limits include uncertainty margins to ensure that the calculated limits are not inadvertently exceeded. These margins include gauge and system loop uncertainties, elevation differences, containment pressure conditions and system pressure drops between the beltline region of the vessel and the pressure gauge or relief valve location.
MILLSTONE - UNIT 3                            B 3/4 4-8                    Amendment No. 48-, ffi, 9-1-,
Acknowledged by NRC letter dated 08/25/05
 
August 27, 2001 REACTOR COOLANT SYSTEM BASES PRESSURE/TEMPERATURE LIMITS (continued)
The criticality limit curve includes the Reference 1 requirement that it be ~ 40&deg;F above the heatup curve or the cooldown curve, and not less than 160&deg;F above the minimum permissible temperature for ISLH testing. This limit provides the required margin relative to brittle fracture.
However, the criticality curve is not operationally limiting; a more restrictive limit exists in LCO 3.1.1.4, "Minimum Temperature for Criticality."
The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the ferritic RCPB materials, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components.
The ASME Code, Section XI, Appendix E (Ref. 7) provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.
APPLICABLE SAFETY ANALYSIS The PIT limits are not derived from Design Basis Accident (DBA) analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB, an unanalyzed condition. Reference 1, as modified by Reference 2, combined with the additional requirements of Reference 3 provide the methodology for determining the PIT limits. Although the PIT limits are not derived from any DBA, the PIT limits are acceptance limits since they preclude operation in an unanalyzed condition.
RCS PIT limits satisfy Criterion 2 of 10CFR50.36(c)(2)(ii).
LCO The LCO limits apply to ferritic components of the RCS, except the Pressurizer. These limits define allowable operating regions while providing margin against nonductile failure for the controlling ferritic component.
The limitations imposed on the rate of change of temperature have been established to ensure consistency with the resultant heatup, cooldown, and ISLH testing PIT limit curves. These limits control the thermal gradients (stresses) within the reactor vessel beltline (the limiting component).
Note that while these limits are to provide protection to ferritic components within the reactor coolant pressure boundary, a limit of 100&deg;F/hr applies to the reactor coolant pressure boundary (except the pressurizer) to ensure that operation is maintained within the ASME Section III design loadings, stresses, and fatigue analyses for heatup and cooldown.
MILLSTONE - UNIT 3                            B 3/4 4-9                    AmendmentNo.-1-51, 197
 
LBDCR 04-MP3-001 December 10, 2003 REACTOR COOLANT SYSTEM BASES PRESSURE/TEMPERATURE LIMITS (continued)
Violating the LCO limits places the reactor vessel outside of the bounds of the analyses and can increase stresses in other RCPB components. The consequences depend on several factors, as follows:
: a.      The severity of the departure from the allowable operating PIT regime or the severity of the rate of change of temperature;
: b.      The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and
: c.      The existences, sizes, and orientations of flaws in the vessel material.
APPLICABILITY The RCS PIT limits LCO provides a definition of acceptable operation for prevention of nonductile failure of ferritic RCS components using ASME Section XI Appendix G, as modified by Code Case N-640 and the additional requirements of 10CFR50, Appendix G (Ref. 1). The PIT limits were developed to provide requirements for operation during heatup or cooldown (MODES 3, 4, and 5) or ISLH testing, in keeping with the concern for nonductile failure. The limits do not apply to the Pressurizer.
During MODES 1 and 2, other Technical Specifications provide limits for operation that can be more restrictive than or can supplement these PIT limits. LCO 3.2.5, "DNB Parameters"; LCO 3.2.3.1, "RCS Flow Rate and Nuclear Enthalpy Rise Hot Channel Factor"; LCO 3.1.1.4, "Minimum Temperature for Criticality"; and Safety Limit 2.1, "Safety Limits," also provide operational restrictions for pressure and temperature and maximum pressure. Furthermore, MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stress analyses have been performed for normal maneuvering profiles, such as power ascension or descent.
ACTIONS Operation outside the PIT limits must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses. The Allowed Outage Times (AOTs) reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.
Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed before continuing operation. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.
MILLSTONE - UNIT 3                          B 3/4 4-10                  Amendment No. W, -l-9-1-, m, Acknowledged by NRC letter dated 08/25/05
 
LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES PRESSURE/TEMPERATURE LIMITS (continued)
ASME Code, Section XI, Appendix E (Ref. 7), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.
The 72 hour AOT when operating in MODES 1 through 4 is reasonable to accomplish the evaluation. The evaluation for a mild violation is possible within this time, but more severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed before continuing to operate.
This evaluation must be completed whenever a limit is exceeded. Restoration within the AOT alone is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
If the required remedial actions are not completed within the allowed times, the plant must be placed in a lower MODE or not allowed to enter MODE 4 because either the RCS remained in an unacceptable P/T region for an extended period of increased stress or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature.
In reduced pressure and temperature conditions, the possibility of propagation with undetected flaws is decreased.
If the required evaluation for continued operation in MODES 1 through 4 cannot be accomplished within 72 hours or the results are indeterminate or unfavorable, action must proceed to reduce pressure and temperature as specified in the ACTION statement. A favorable evaluation must be completed and documented before returning to operating pressure and temperature conditions.
Pressure and temperature are reduced by bringing the plant to MODE 3 within 6 hours and to MODE 5 with RCS pressure < 500 psia within the next 30 hours.
Completion of the required evaluation following limit violation in other than MODES 1 through 4 is required before plant startup to MODE 4 can proceed.
The AOTs are reasonable, based on operating experience to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE REQUIREMENTS Verification that operation is within the LCO limits as well as the limits of Figures 3.4-2 and 3.4-3 is required every 30 minutes when RCS pressure and temperature conditions are undergoing planned changes. This frequency is considered reasonable in view of the control room indication available to monitor RCS status.
MILLSTONE - UNIT 3                          B 3/4 4-11              Amendment No. 48, -89, H-1, m, Acknowledged by NRC letter dated 08/25/05
 
LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES PRESSURE/TEMPERATURE LIMITS (continued)
Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied.
This Surveillance Requirement is only required to be performed during system heatup, cooldown, and ISLH testing. No Surveillance Requirement is given for criticality operations because LCO 3.1.1.4 contains a more restrictive requirement.
It is not necessary to perform Surveillance Requirement 4.4.9.1.1 to verify compliance with Figures 3.4-2 and 3.4-3 when the reactor vessel is fully detensioned. During REFUELING, with the head fully detensioned or off the reactor vessel, the RCS is not capable of being pressurized to any significant value. The limiting thermal stresses which could be encountered during this time would be limited to flood-up using RWST water as low as 40&deg;F. It is not possible to cause crack growth of postulated flaws in the reactor vessel at normal REFUELING temperatures even injecting 40&deg;F Water.
REFERENCES
: 1. ASME Boiler and Pressure Vessel Code, Section XI, Appendix G, "Fracture Toughness for Protection Against Failure," 1995 Edition.
: 2. ASME Section XI, Code Case N-640, "Alternative Reference Fracture Toughness for Development of P-T Limit Curves," dated February 26, 1999.
: 3. 10 CFR 50 Appendix G, "Fracture Toughness Requirements."
: 4.      ASTM E 185-82, "Standard Practice for Conducting Surveillance Tests for Light-Water Cooled Nuclear Power Reactor Vessels, E 706."
: 5.      10 CFR 50 Appendix H, "Reactor Vessel Material Surveillance Program Requirements."
: 6.      Regulatory Guide 1.99 Revision 2, "Radiation Embrittlement of Reactor Vessel Materials," dated May 1988.
: 7.      ASME Boiler and Pressure Vessel Code, Section XI, Appendix E, "Evaluation of Unanticipated Operating Events," 1995 Edition.
MILLSTONE - UNIT 3                        B 3/4 4-12          Amendment No. 48-, 1/4-1-, 9-1, ~ . 2-1-4, Acknowledged by NRC letter dated 08/25/05
 
May 8, 2002 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3            B 3/4 4-13        Amendment No. 48, H-1-, 204
 
May 8, 2002 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3            B 3/4 4-14    Amendment No. 48-, 8-8-, 5-1-, 204
 
May 8, 2002 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS BACKGROUND The Cold Overpressure Protection System limits RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the isothermal beltline pressure and temperature (P/T) limits developed using the guidance of ASME Section XI, Appendix G (Reference 1) as modified by ASME Code Case N-640 (Reference 2).
The reactor vessel is the limiting RCPB component for demonstrating such protection.
Cold Overpressure Protection consists of two PORVs with nominal lift setting as specified in Figures 3.4-4a and 3.4-4b, or two residual heat removal (RHR) suction relief valves, or one PORV and one RHR suction relief valve, or a depressurized RCS and an RCS vent of sufficient size. Two relief valves are required for redundancy. One relief valve has adequate relieving capability to prevent overpressurization of the RCS for the required mass input capability.
MILLSTONE - UNIT 3                          B 3/4 4-15    Amendment No. 48-, 8, -l-3-8, -!-51, 9-1, 204
 
REVERSE OF PAGE B 3/4 4-15 INTENTIONALLY LEFT BLANK
 
LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued)
The use of a PORV for Cold Overpressure Protection is limited to those conditions when no more than one RCS loop is isolated from the reactor vessel. When two or more loops are isolated, Cold Overpressure Protection must be provided by eitqer the two RHR suction relief valves or a depressurized and vented RCS.
The reactor vessel material is less tough at low temperatures than at normal operating temperature. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to stress at low temperatures (Ref. 3). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.
The potential for vessel overpressurization is most acute when the RCS is water solid, occurring while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. Exceeding the RCS PIT limits by a significant amount could cause nonductile cracking of the reactor vessel. LCO 3.4.9.1, "Pressure/Temperature Limits - Reactor Coolant System," requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the limits provided in Figures 3.4-2 and 3.4-3.
This LCO provides RCS overpressure protection by limiting mass input capability and requiring adequate pressure relief capacity. Limiting mass input capability requires all Safety Injection (SIR) pumps and all but one centrifugal charging pump to be incapable of injection into the RCS.
The pressure relief capacity requires either two redundant relief valves or a depressurized RCS and an RCS vent of sufficient size. One relief valve or the open RCS vent is the overpressure protection device that acts to terminate an increasing pressure event.
With minimum mass input capability, the ability to provide core coolant addition is restricted. The LCO does not require the makeup control system deactivated or the safety injection (SI) actuation circuits blocked. Due to the lower pressures in the Cold Overpressure Protection modes and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve.
If a loss of RCS inventory or reduction in SHUTDOWN MARGIN event occurs, the appropriate response will be to correct the situation by starting RCS makeup pumps. If the loss of inventory or SHUTDOWN MARGIN is significant, this may necessitate the use of additional RCS makeup pumps that are being maintained not capable of injecting into the RCS in accordance with Technical Specification 3.4.9.3. The use of these additional pumps to restore RCS inventory or SHUTDOWN MARGIN will require entry into the associated ACTION statement. The ACTION statement requires immediate action to comply with the specification. The restoration of RCS inventory or SHUTDOWN MARGIN can be considered to be part of the immediate action to restore the additional RCS makeup pumps to a not capable of injecting status. While recovering RCS inventory or SHUTDOWN MARGIN, RCS pressure will be maintained below the PIT limits. After RCS inventory or SHUTDOWN MARGIN has been restored, the additional pumps should be immediately made not capable of injecting and the ACTION statement exited.
MILLSTONE - UNIT 3                          B 3/4 4-16          Amendment No. 4&, 8-8-, H-8-, 51, 9-1, Acknowledged by NRC letter dated 08/25/05
 
August 27, 2001 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued)
PORV Requirements As designed, the PORV Cold Overpressure Protection (COPPS) is signaled to open if the RCS pressure approaches a limit determined by the COPPS actuation logic. The COPPS actuation logic monitors both RCS temperature and RCS pressure and determines when the nominal setpoint of Figure 3.4-4a or Figure 3.4-4b is approached. The wide range RCS temperature indications are auctioneered to select the lowest temperature signal.
The lowest temperature signal is processed through a function generator that calculates a pressure setpoint for that temperature. The calculated pressure setpoint is then compared with RCS pressure measured by a wide range pressure channel. If the measured pressure meets or exceeds the calculated value, a PORV is signaled to open.
The use of the PORVs is restricted to three and four RCS loops unisolated: for a loop to be considered isolated, both RCS loop stop valves must be closed. If more than one loop is isolated, then the PORVs must have their block valves closed or COPPS must be blocked. For these cases, Cold Overpressure Protection must be provided by either the two RHR suction relief valves or a depressurized RCS and an RCS vent. This is necessary because the PORV mass and heat injection transients have only been analyzed for a maximum of one loop isolated, the use of the PORVs is restricted to three and four RCS loops unisolated.
The RHR suction relief valves have been qualified for all mass injection transients for any combination of isolated loops. In addition, the heat injection transients not prohibited by the Technical Specifications have also been considered in the qualification of the RHR suction relief valves.
Figure 3.4-4a and Figure 3.4-4b present the PORV setpoints for COPPS. The setpoints are staggered so only one valve opens during a low temperature overpressure transient. Setting both valves to the values of Figure 3.4-4a and Figure 3.4-4b within the tolerance allowed for the calibration accuracy, ensures that the isothermal PIT limits will not be exceeded for the analyzed isothermal events.
When a PORV is opened, the release of coolant will cause the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.
MILLSTONE - UNIT 3                        B 3/4 4-16a            ArnendrnentNo.48-,8-8-,H-1, 197
 
August 27, 2001 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS RHR Suction Relief Valve Requirements The isolation valves between the RCS and the RHR suction relief valves must be open to make the RHR suction relief valves OPERABLE for RCS overpressure mitigation. The RHR suction relief valves are spring loaded, bellows type water relief valves with setpoint tolerances and accumulation limits established by Section III of the American Society of Mechanical Engineers (ASME) Code (Ref. 4) for Class 2 relief valves.
When the RHR system is operated for decay heat removal or low pressure letdown control, the isolation valves between the RCS and the RHR suction relief valves are open, and the RHR suction relief valves are exposed to the RCS and are able to relieve pressure transients in the RCS.
RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS at acceptable pressure levels in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting mass or heat input transient, and maintaining pressure below the PIT limits for the analyzed isothermal events.
For an RCS vent to meet the flow capacity requirement, it requires removing a Pressurizer safety valve, removing a Pressurizer manway, or similarly establishing a vent by opening an RCS vent valve provided that the opening meets the relieving capacity requirements. The vent path must be above the level of reactor coolant, so as not to drain the RCS when open.
MILLSTONE - UNIT 3                        B 3/4 4-17                    Amendment No. &sect;.1, 197
 
LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued)
APPLICABLE SAFETY ANALYSIS Safety analyses (Ref. 5) demonstrate that the reactor vessel is adequately protected against exceeding the PIT limits for the analyzed isothermal events. In MODES 1, 2, AND 3, and in MODE 4, with RCS cold leg temperature exceeding 226&deg;F, the pressurizer safety valves will provide RCS overpressure protection in the ductile region. At 226&deg;F and below, overpressure prevention is provided by two means: (1) two OPERABLE relief valves, or (2) a depressurized RCS with a sufficiently sized RCS vent, consistent with ASME Section XI, Appendix G for temperatures less than RTNDT + 50&deg;F. Each of these means has a limited overpressure relief capability.
The required RCS temperature for a given pressure increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the Technical Specification curves are revised, the cold overpressure protection must be re-evaluated to ensure its functional requirements continue to be met using the RCS relief valve method or the depressurized and vented RCS condition.
Transients capable of overpressurizing the RCS are categorized as either mass or heat input transients, examples of which follow:
Mass Input Transients
: a. Inadvertent safety injection; or
: b. Charging/letdown flow mismatch Heat Input Transients
: a. Inadvertent actuation of Pressurizer heaters;
: b. Loss ofRHR cooling; or
: c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.
The Technical Specifications ensure that mass input transients beyond the OPERABILITY of the cold overpressure protection means do not occur by rendering all Safety Injection Pumps and all but one centrifugal charging pump incapable of injecting into the RCS whenever an RCS cold leg is :::;; 226&deg;F.
The Technical Specifications ensure that energy addition transients beyond the OPERABILITY of the cold overpressure protection means do not occur by limiting reactor coolant pump starts.
LCO 3.4.1.4.1, "Reactor Coolant Loops and Coolant Circulation - COLD SHUTDOWN - Loops Filled," LCO 3.4.1.4.2, "Reactor Coolant MILLSTONE - UNIT 3                        B 3/4 4-18                        Amendment No. 5-1, -9-1, Acknowledged by NRC letter dated 08/25/05
 
LBDCRNo. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued)
Loops and Coolant Circulation - COLD SHUTDOWN - Loops Not Filled," and LCO 3.4.1.3, "Reactor Coolant Loops and Coolant Circulation - HOT SHUTDOWN" limit starting the first reactor coolant pump such that it shall not be started when any RCS loop wide range cold leg temperature is ~ 226&deg;F unless the secondary side water temperature of each steam generator is
< 50&deg;F above each RCS cold leg temperature. The restrictions ensure the potential energy addition to the RCS from the secondary side of the steam generators will not result in an RCS overpressurization event beyond the capability of the COPPS to mitigate. The COPPS utilizes the pressurizer PORVs and the RHR relief valves to mitigate the limiting mass and energy addition events, thereby protecting the isothermal reactor vessel beltline P/T limits. The restrictions will ensure the reactor vessel will be protected from a cold overpressure event when starting the first RCP. If at least one RCP is operating, no restrictions are necessary to start additional RCPs for reactor vessel protection. In addition, this restriction only applies to RCS loops and associated components that are not isolated from the reactor vessel.
The RCP starting criteria are based on the equipment used to provide cold overpressure protection. A maximum temperature differential of 50&deg;F between the steam generator secondary sides and RCS cold legs will limit the potential energy addition to within the capability of the pressurizer PORVs to mitigate the transient. The RHR relief valve are also adequate to mitigate energy addition transients constrained by this temperature differential limit, provided all RCS cold leg temperature are at or below 150&deg;F. The ability of the RHR relief valves to mitigate energy addition transients when RCS cold leg temperature is above 150&deg;F has not been analyzed.
As a result, the temperature of the steam generator secondary sides must be at or below the RCS cold leg temperature if the RHR relief valves are providing cold overpressure protection and the RCS cold leg temperature is above 150&deg;F.
MILLSTONE - UNIT 3                          B 3/4 4-19                      Amendment No. 5-1, 91, Acknowledged by NRC letter dated 08/25/05
 
August 27, 2001 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued)
The cold overpressure transient analyses demonstrate that either one relief valve or the depressurized RCS and RCS vent can maintain RCS pressure below limits when RCS letdown is isolated and only one centrifugal charging pump is operating. Thus, the LCO allows only one centrifugal charging pump capable of injecting when cold overpressure protection is required.
The cold overpressure protection enabling temperature is conservatively established at a value
:s; 226&deg;F based on the criteria provided by ASME Section XI, Appendix G.
PORV Performance The analyses show that the vessel is protected against non-ductile failure when the PORVs are set to open at the values shown in Figures 3 .4-4a and 3 .4-4b within the tolerance allowed for the calibration accuracy. The curves are derived by analyses for both three and four RCS loops unisolated that model the performance of the PORV cold overpressure protection system (COPPS), assuming the limiting mass and heat transients of one centrifugal charging pump injecting into the RCS, or the energy addition as a result of starting an RCP with temperature asymmetry between the RCS and the steam generators. These analyses consider pressure overshoot beyond the PORV opening setpoint resulting from signal processing and valve stroke times.
The PORV setpoints in Figures 3 .4-4a and 3 .4-4b will be updated when the PIT limits conflict with the cold overpressure analysis limits. The PIT limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement. Revised limits are determined using neutron fluence projections and the results of testing of the reactor vessel material irradiation surveillance specimens. The Bases for LCO 3.4.9.1, "Pressure/Temperature Limits -
Reactor Coolant System (Except the Pressurizer)," discuss these evaluations.
The PORVs are considered active components. Thus, the failure of one PORV is assumed to represent the worst case, single active failure.
RHR Suction Relief Valve Performance The RHR suction relief valves do not have variable pressure and temperature lift setpoints as do the PORVs. Analyses show that one RHR suction relief valve with a setpoint at or between 426.8 psig and 453.2 psig will pass flow greater than that required for the limiting cold overpressure transient while maintaining RCS pressure less than the isothermal PIT limit curve.
Assuming maximum relief flow requirements during the limiting cold overpressure event, an RHR suction relief valve will maintain RCS pressure to :s; 110% of the nominal lift setpoint.
Although each RHR suction relief valve is a passive spring loaded device, which meets single failure criteria, its location within the RHR System precludes meeting single failure criteria when spurious RHR suction isolation valve or RHR suction valve closure is postulated. Thus the loss of an RHR suction relief MILLSTONE - UNIT 3                          B 3/4 4-20                    AmendmentNo.~, 197
 
August 27, 2001 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued) valve is the worst case single failure. Also, as the RCS PIT limits are revised to reflect change in toughness in the reactor vessel materials, the RHR suction relief valve's analyses must be re-evaluated to ensure continued accommodation of the design bases cold overpressure transients.
RCS Vent Performance With the RCS depressurized, analyses show a vent size of ~ 2.0 square inches is capable of mitigating the limiting cold overpressure transient. The capacity of this vent size is greater than the flow of the limiting transient, while maintaining RCS pressure less than the maximum pressure on the isothermal PIT limit curve.
The RCS vent size will be re-evaluated for compliance each time the isothermal PIT limit curves are revised.
The RCS vent is a passive device and is not subject to active failure.
The RCS vent satisfies Criterion 2 of 10CFR50.36(c)(2)(ii).
MILLSTONE - UNIT 3                          B 314 4-21                    Amendment No.      l-&sect;-1-, 197
 
August 27, 2001 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued)
This LCO requires that cold overpressure protection be OPERABLE and the maximum mass input be limited to one charging pump. Failure to meet this LCO could lead to the loss of low temperature overpressure mitigation and violation of the reactor vessel isothermal PIT limits as a result of an operational transient.
To limit the mass input capability, the LCO requires a maximum of one centrifugal charging pump capable of injecting into the RCS.
The elements of the LCO that provides low temperature overpressure mitigation through pressure relief are:
: 1.      Two OPERABLE PORVs; or A PORV is OPERABLE for cold overpressure protection when its block valve is open, its lift setpoint is set to the nominal setpoints provided for both three and four loops unisolated by Figure 3 .4-4a or 3 .4-4b and when the surveillance requirements are met.
: 2.      Two OPERABLE RHR suction relief valves; or An RHR suction relief valve is OPERABLE for cold overpressure protection when its isolation valves from the RCS are open and when its setpoint is at or between 426.8 psig and 453 .2 psig, as verified by required testing.
: 3.      One OPERABLE PORV and one OPERABLE RHR suction relief valve; or
: 4.      A depressurized RCS and an RCS vent.
An RCS vent is OPERABLE when open with an area of~ 2.0 square inches.
Each of these methods of overpressure prevention is capable of mitigating the limiting cold overpressure transient.
MILLSTONE - UNIT 3                            B 3/4 4-22                    AmendmentNo.-1-5-1, 197
 
LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued)
APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is =:; ; 226&deg;F, in MODE 5, and in MODE 6 when the head is on the reactor vessel. The Pressurizer safety valves provide RCS overpressure protection in the ductile region (i.e.,> 226&deg;F). When the reactor head is off, overpressurization cannot occur.
LCO 3.4.9.1 "Pressure/Temperature Limits" provides the operational PIT limits for all MODES.
LCO 3.4.2, "Safety Valves," requires the OPERABILITY of the Pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and 4 when all RCS cold leg temperatures are > 226&deg;F.
Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a rapid increase in RCS pressure when little or no time exists for operator action to mitigate the event.
ACTIONS
: a. and b.
With two or more centrifugal charging pumps capable of injecting into the RCS, or with any SIR pump capable of injecting into the RCS, RCS overpressurization is possible.
To immediately initiate action to restore restricted mass input capability to the RCS reflects the urgency of removing the RCS from this condition.
Required ACTION a. is modified by a Note that permits two centrifugal charging pumps capable of RCS injection for=:;;; 1 hour to allow for pump swaps. This is a controlled evolution of short duration and the procedure prevents having two charging pumps simultaneously out of pull-to-lock while both charging pumps are capable of injecting into the RCS.
c.
In MODE 4 when any RCS cold leg temperature is~ 226&deg;F, with one required relief valve inoperable, the RCS relief valve must be restored to OPERABLE status within an allowed outage time (AOT) of7 days. Two relief valves in any combination of the PORVs and the RHR suction relief valves are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component.
MILLSTONE - UNIT 3                          B 3/4 4-23                      Amendment No. -l-&sect;1, 1, Acknowledged by NRC letter dated 08/25/05
 
LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued)
TheAOT in MODE 4 considers the facts that only one of the relief valves is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low. The RCS must be depressurized and a vent must be established within the following 12 hours if the required relief valve is not restored to OPERABLE within the required AOT of 7 days.
d.
The consequences of operational events that will overpressure the RCS are more severe at lower temperatures (Ref. 8). Thus, with one of the two required relief valves inoperable in MODE 5 or in MODE 6 with the head on, the AOT to restore two valves to OPERABLE status is 24 hours.
The AOT represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only one OPERABLE relief valve to protect against overpressure events. The RCS must be depressurized and a vent must be established within the following 12 hours if the required relief valve is not restored to OPERABLE within the required AOT of 24 hours.
e.
The RCS must be depressurized and a vent must be established within 12 hours when both required Cold Overpressure Protection relief valves are inoperable.
The vent must be sized~ 2.0 square inches to ensure that the flow capacity is greater than that required for the worst case cold overpressure transient reasonable during the applicable MODES.
This action is needed to protect the RCPB from a low temperature overpressure event and a possible non-ductile failure of the reactor vessel.
The time required to place the plant in this Condition is based on the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.
SURVEILLANCE REQUIREMENTS 4.4.9.3.1 Performance of an ANALOG CHANNEL OPERATIONAL TEST is required within 31 days prior to entering a condition in which the PORV is required to be OPERABLE and at the frequency specified in the Surveillance Frequency Control Program thereafter on each required PORV to verify and, as necessary, adjust its lift setpoint. The ANALOG CHANNEL OPERATIONAL TEST will verify the setpoint in accordance with the nominal values given in Figures 3.4-4a and 3.4-4b. PORV actuation could depressurize the RCS; therefore, valve operation is not required.
MILLSTONE - UNIT 3                          B 3/4 4-24                      Amendment No. 5-1,-191
 
LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued)
Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required periodically to adjust the channel so that it responds and the valve opens within the required range and accuracy to a known input. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
The PORV block valve must be verified open and COPPS must be verified armed periodically to provide a flow path and a cold overpressure protection actuation circuit for each required PORV to perform its function when required. The valve is remotely verified open in the main control room. This Surveillance is performed if credit is being taken for the PORV to satisfy the LCO.
The block valve is a remotely controlled, motor operated valve. The power to the valve operator is not required to be removed, and the manual operator is not required to be locked in the open position. Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure transient.
The surveillance frequency is controlled under the Surveillance Frequency Control Program.
4.4.9.3.2 Each required RHR suction relief valve shall be demonstrated OPERABLE by verifying the RHR suction valves, 3RHS*MV8701A and 3RHS*M8701C, are open when suction relief valve 3RHS*RV8708A is being used to meet the LCO and by verifying the RHR suction valves, 3RHS*MV8702B and 3RHS*MV8702C, are open when suction relief valve 3RHS*RV8708B is being used to meet the LCO. Each required RHR suction relief valve shall also be demonstrated OPERABLE by testing it in accordance with 4.0.5. This Surveillance is only required to be performed if the RHR suction relief valve is being used to meet this LCO.
The RHR suction valves are periodically verified to be open. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
The ASME Code for Operation and Maintenance of Nuclear Power Plants, (Reference 9), test per 4.0.5 verifies OPERABILITY by proving proper relief valve mechanical motion and by measuring and, if required, adjusting the lift setpoint.
MILLSTONE - UNIT 3                          B 3/4 4-25                  AmendmentNo.-1-&sect;1,-1-9-1,~
 
LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued) 4.4.9.3.3 The RCS vent of~ 2.0 square inches is proven OPERABLE periodically by verifying its open condition. A removed Pressurizer safety valve fits this category.
This passive vent arrangement must only be open to be OPERABLE. This Surveillance is required to be performed if the vent is being used to satisfy the pressure relief requirements of the LCO. The surveillance :frequency is controlled under the Surveillance Frequency Control Program.
4.4.9.3.4 and 4.4.9.3.5 To minimize the potential for a low temperature overpressure event by limiting the mass input capability, all SIH pumps and all but one centrifugal charging pump are verified incapable of injecting into the RCS.
The SIH pumps and charging pumps are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control.
Alternate methods of control may be employed using at least two independent means to prevent an injection into the RCS. This may be accomplished through any of the following methods:
: 1) placing the pump in pull to lock (PTL) and pulling its UC fuses, 2) placing the pump in pull to lock (PTL) and closing the pump discharge valve(s) to the injection line, 3) closing the pump discharge valve(s) to the injection line and either removing power :from the valve operator(s) or locking manual valves closed, and 4) closing the valve(s) :from the injection source and either removing power :from the valve operator(s) or locking manual valves closed.
An SIH pump may be energized for testing or for filling the Accumulators provided it is incapable of injecting into the RCS.
The surveillance :frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES
: 1.      ASME Boiler and Pressure Vessel Code, Section XI, Appendix G, "Fracture Toughness for Protection Against Failure," 1995 Edition.
: 2.      ASME Section XI, Code Case N-640, "Alternative Reference Fracture Toughness for Development of P-T Limit Curves," dated February 26, 1999.
: 3.      Generic Letter 88-11
: 4.      ASME, Boiler and Pressure Vessel Code, Section III
: 5.      FSAR, Chapter 15
: 6.      10CFR50, Section 50.46
: 7.      10CFR50, Appendix K
: 8.      Generic Letter 90-06
: 9.      ASME Code for Operation and Maintenance of Nuclear Power Plants MILLSTONE - UNIT 3                        B 3/4 4-26                          AmendmentNo.1/4-1-,-1-9-1
 
May 8, 2002 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3            B 3/4 4-27 Amendment No. 48-, , 3-&, ill, W, 204
 
REVERSE OF PAGE B 3/4 4-27 INTENTIONALLY LEFT BLANK
 
LBDCR No. 14-MP3-0ll January 8, 2015 3/4.5 EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.1 ACCUMULATORS The OPERABILITY of each Reactor Coolant System (RCS) accumulator ensures that a sufficient volume of borated water will be immediately forced into the reactor core through each of the cold legs in the event the RCS pressure falls below the pressure of the accumulators. This initial surge of water into the core provides the initial cooling mechanism during large RCS pipe ruptures.
The limits on accumulator volume, boron concentration and pressure ensure that the assumptions used for accumulator injection in the safety analysis are met.
The accumulator power operated isolation valves are required to meet the guidance of "operating bypasses" in the context of IEEE Std. 279-1971, which requires that bypasses of a protective function be removed automatically whenever permissive conditions are not met. The "operating bypass" designed for the isolation valves is applicable to MODES 1, 2, and 3 with Pressurizer pressure above P-11 setpoint. In addition, as these accumulator isolation valves fail to meet single failure criteria, removal of power to the valves is required.
The limits for operation with an accumulator inoperable for any reason except an isolation valve closed minimizes the time exposure of the plant to a LOCA event occurring concurrent with failure of an additional accumulator which may result in unacceptable peak cladding temperatures. If a closed isolation valve cannot be immediately opened, the full capability of one accumulator is not available and prompt action is required to place the reactor in a mode where this capability is not required.
3/4.5.2 AND 3/4.5.3 ECCS SUBSYSTEMS The OPERABILITY of two independent ECCS subsystems ensures that sufficient emergency core cooling capability will be available in the event of a LOCA assuming the loss of one subsystem through any single failure consideration. Either subsystem operating in conjunction with the accumulators is capable of supplying sufficient core cooling to limit the peak cladding temperatures within acceptable limits for all postulated break sizes ranging from the double ended break of the largest RCS cold leg pipe downward. In addition, each ECCS subsystem provides long-term core cooling capability in the recirculation mode during the accident recovery period. Management of gas voids is important to ECCS OPERABILITY.
With the RCS temperature below 350&deg;F, one OPERABLE ECCS subsystem is acceptable without single failure consideration and with some valves out of normal injection lineup, on the basis of the stable reactivity condition of the reactor and the limited core cooling requirements.
The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System is required to be available to support charging pump operation. The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System consists of two redundant trains, each capable of providing 100% of the required flow. Each train has a two position, "Off' and "Auto,"
remote control switch. With the remote control switches for each train in the "Auto" position, the system is capable of automatically transferring operation to the redundant train in the event of a low flow condition in the operating train. The associated fans do not receive any safety related automatic start signals (e.g., Safety Injection Signal).
MILLSTONE - UNIT 3                          B 3/4 5-1                            Amendment No. 51,
 
LBDCR No. 14-MP3-0ll January 8, 2015 EMERGENCY CORE COOLING SYSTEMS BASES ECCS SUBSYSTEMS (Continued)
Placing the remote control switch for a Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train in the "Off" position to start the redundant train or to perform post maintenance testing to verify availability of the redundant train will not affect the availability of that train, provided appropriate administrative controls have been established to ensure the remote control switch is immediately returned to the "Auto" position after the completion of the specified activities or in response to plant conditions. These administrative controls include the use of an approved procedure and a designated individual at the control switch for the respective Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respond to instructions from procedures, or control room personnel, based on plant conditions.
The Surveillance Requirements provided to ensure OPERABILITY of each component ensures that at a minimum, the assumptions used in the safety analyses are met and that subsystem OPERABILITY is maintained. Surveillance Requirements for throttle valve position stops provide assurance that proper ECCS flows will be maintained in the event of a LOCA.
Maintenance of proper flow resistance and pressure drop in the piping system to each injection point is necessary to: (1) prevent total pump flow from exceeding runout conditions when the system is in its minimum resistance configuration, (2) provide the proper flow split between injection points in accordance with the assumptions used in the ECCS-LOCA analyses, and (3) provide an acceptable level of total ECCS flow to all injection points equal to or above that assumed in the ECCS-LOCA analyses.
Surveillance Requirement 4.5.2.b.2 verifies each valve (manual, power-operated, or automatic) in the ECCS flow path that is not locked, sealed, or otherwise secured in position, is verified to be in its correct position is modified to exempt system vent flow paths opened under administrative control. The administrative controls are proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.
Any time the OPERABILITY of an ECCS throttle valve or an ECCS subsystem has been affected by repair, maintenance, modification, or replacement activity that alter flow characteristics, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY.
Surveillance Requirement 4.5 .2.b.1 requires verifying that the ECCS piping is sufficiently full of water. The ECCS pumps are normally in a standby, nonoperating mode, with the exception of the operating centrifugal charging pump(s). As such, the ECCS flow path piping has the potential to develop voids and pockets of entrained gases. Maintaining the piping from the ECCS pumps to the RCS sufficiently full of water ensures that the system will perform properly injecting its full capacity into the RCS upon demand. This will also prevent water hammer, degraded performance, cavitation, and gas binding of ECCS pumps, and reduce to the greatest MILLSTONE - UNIT 3                          B 3/4 5-2                    Amendment No. -l-00, 4+, m,
 
LBDCR No. 14-MP3-0ll January 8, 2015 EMERGENCY CORE COOLING SYSTEMS BASES ECCS SUBSYSTEMS (Continued) extent practical the pumping of non-condensible gases (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling.
ECCS piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the ECCS and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel.
Selection ofECCS locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The ECCS is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criterion for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the ECCS is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
ECCS locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
This Surveillance Requirement is met by:
* VENTING the ECCS pump casings and VENTING or Ultrasonic Test (UT) of the accessible suction and discharge piping high points including the ECCS pump suction crossover piping (i.e., downstream of valves 3RSS*MV8837A/B and MILLSTONE - UNIT 3                          B 3/4 5-2a                  Amendment No. -100, W, -l-S-1, Aeknov:,*ledged by NRt:1 Letter dated 04/12/06
 
LBDCR No. 14-MP3-0ll January 8, 2015 EMERGENCY CORE COOLING SYSTEMS BASES ECCS SUBSYSTEMS (Continued) 3RSS*MV8838A/B to safety injection and charging pump suction). VENTING of the accessible suction and discharge piping high points including the ECCS pump suction crossover piping is required when gas accumulations exceed the gas accumulation limits.
NOTE: Certain maintenance (e.g., ECCS pump overhaul) or other evolutions can cause gas or air to enter the ECCS. VENTING of the affected portion of the ECCS is necessary for these evolutions.
* VENTING of the nonoperating centrifugal charging pumps at the suction line test connection. The nonoperating centrifugal charging pumps do not have casing vent connections and VENTING the suction pipe will assure that the pump casing does not contain voids and pockets of entrained gases.
* using an external water level detection method for the water filled portions of the RSS piping upstream of valves 3RSS*MV8837A/B and 3RSS*MV8838A/B. When deemed necessary by an external water level detection method, filling and venting to reestablish the acceptable water levels may be performed after entering LCO ACTION statement 3.6.2.2 since VENTING without isolation of the affected train would result in a breach of the containment pressure boundary.
The following ECCS subsections are exempt from this Surveillance:
* the operating centrifugal charging pump(s) and associated piping - as an operating pump is self VENTING and cannot develop voids and pockets of entrained gases.
* the RSS pumps, since this equipment is partially dewatered during plant operation. Each RSS pump is equipped with a pump casing vent line that allows automatic VENTING of the pump casing prior to pump operation following an accident.
* the RSS heat exchangers, since this equipment is laid-up dry during plant operation. Gas is flushed out of the heat exchangers during the initial operation of the RSS pumps following an accident.
* the RSS piping that is not maintained filled with water during plant operation. The configuration of this piping is such that it is self VENTING upon initial operation of the RSS pumps.
* the ECCS discharge piping within containment. These piping sections are inaccessible during reactor operations due to accessibility (containment entry), safety, and radiological concerns. They are static sections of piping relatively insensitive to gas accumulations since these lines are stagnant during normal power operation. The ECCS discharge piping inside containment is filled and vented upon system return to service.
* the Residual Heat Removal (RHR) heat exchangers. These are dual pass, vertical u-tube heat exchangers that do not allow direct measurement of gas voids. System flush upon heat exchanger return to service and procedural compliance is relied upon to ensure that gas is not present within the heat exchanger u-tubes.
MILLSTONE - UNIT 3                      B 3/4 5-2b                  ArnendrnentNo.-l-00,W,ill
 
LBDCR No. 14-MP3-011 January 8, 2015 EMERGENCY CORE COOLING SYSTEMS BASES ECCS SUBSYSTEMS (Continued)
The monitoring frequency of the locations that are susceptible to gas accumulation takes into consideration the gradual nature of gas accumulation in the ECCS Subsystem piping and the procedural controls governing system operation. The surveillance frequency is controlled by the Surveillance Frequency Control Program. The surveillance frequency may vary by each location's susceptibility to gas accumulation.
Surveillance Requirement 4.5.2.C.2 requires that the visual inspection of the containment be performed at least once daily if the containment has been entered that day and when the final containment entry is made. This will reduce the number of unnecessary inspections and also reduce personnel exposure.
Surveillance Requirement 4.5.2.d.2 addresses periodic inspection of the containment sump to ensure that it is unrestricted and stays in proper operating condition. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
The Emergency Core Cooling System (ECCS) has several piping cross connection points for use during the post-LOCA recirculation phase of operation. These cross-connection points allow the Recirculation Spray System (RSS) to supply water from the containment sump to the safety injection and charging pumps. The RSS has the capability to supply both Train A and B safety injection pumps and both Train A and B charging pumps. Operator action is required to position valves to establish flow from the containment sump through the RSS subsystems to the safety injection and charging pumps since the valves are not automatically repositioned. The quarterly stroke testing (Technical Specification 4.0.5) of the ECC/RSS recirculation flowpath valves discussed below will not result in subsystem inoperability (except due to other equipment manipulations to support valve testing) since these valves are manually aligned in accordance with the Emergency Operating Procedures (EOPs) to establish the recirculation flowpaths. It is expected the valves will be returned to the normal pre-test position following termination of the surveillance testing in response to the accident. Failure to restore any valve to the normal pre-test position will be indicated to the Control Room Operators when the ESF status panels are checked, as directed by the EOPs. The EOPs direct the Control Room Operators to check the ESF status panels early in the event to ensure proper equipment alignment. Sufficient time before the recirculation flowpath is required is expected to be available for operator action to position any valves that have not been restored to the pretest position, including local manual valve operation.
Even if the valves are not restored to the pre-test position, sufficient capability will remain to meet ECCS post-LOCArecirculation requirements. As a result, stroke testing of the ECCS recirculation valves discussed below will not result in a loss of system independence or redundancy, and both ECCS subsystems will remain OPERABLE.
MILLSTONE - UNIT 3                          B 3/4 5-2c                    Amendment No. -l-00, -141, &sect;..1, Aekno\vledged by NRG Letter dated 04/12/06
 
LBDCR No. 14-MP3-011 January 8, 2015 EMERGENCY CORE COOLING SYSTEMS BASES ECCS SUBSYSTEMS (Continued)
When performing the quarterly stroke test of 3SIH*MV8923A, the control switch for safety injection pump 3SIH*PlA is placed in the pull-to-lock position to prevent an automatic pump start with the suction valve closed. With the control switch for 3SIH*PlA in pull-to-lock, the TrainAECCS subsystem is inoperable and Technical Specification 3.5.2, ACTION a.,
applies. This ACTION statement is sufficient to administratively control the plant configuration with the automatic start of 3SIH*PlA defeated to allow stroke testing of 3SIH*MV8923A. In addition, the EOPs and the ESP status panels will identify this abnormal plant configuration, if not corrected following the termination of the surveillance testing, to the plant operators to allow restoration of the normal post-LOCA recirculation flowpath. Even if system restoration is not accomplished, sufficient equipment will be available to perform all ECCS and RSS injection and recirculation functions, provided no additional ECCS or RSS equipment is inoperable, and an additional single failure does not occur (an acceptable assumption since the Technical Specification ACTION statement limits the plant configuration time such that no additional equipment failure need be postulated). During the injection phase the redundant subsystem (Train B) is fully functional, as is a significant portion of the Train A subsystem. During the recirculation phase, the Train A RSS subsystem can supply water from the containment sump to the Train A and B charging pumps, and the Train B RSS subsystem can supply water from the containment sump to the B safety injection pump.
When performing the quarterly stroke test of 3SIH*MV8923B, the control switch for safety injection pump 3SIH*PlB is placed in the pull-to-lock position to prevent an automatic pump start with the suction valve closed. With the control switch for 3SIH*PlB in pull-to-lock, the Train B ECCS subsystem is inoperable and Technical Specification 3.5.2, ACTION a.,
applies. This ACTION statement is sufficient to administratively control the plant configuration with the automatic start of 3SIH*PlB defeated to allow stroke testing of3SIH*MV8923B. In addition, the EOPs and the ESP status panels will identify this abnormal plant configuration, if not corrected following the termination of the surveillance testing, to the plant operators to allow restoration of the normal post-LO CA recirculation flowpath. Even if system restoration is not accomplished, sufficient equipment will be available to perform all ECCS and RSS injection and recirculation functions, provided no additional ECCS or RSS equipment is inoperable, and an additional single failure does not occur (an acceptable assumption since the Technical Specification ACTION statement limits the plant configuration time such that no additional equipment failure need be postulated). During the injection phase the redundant subsystem (Train-A) is fully functional, as is a significant portion of the Train B subsystem. During the recirculation phase, the Train A RSS subsystem can supply water from the containment sump to the Train A and B charging pumps and the Train A safety injection pump. The Train B RSS subsystem cannot supply water from the containment sump to any of the remaining pumps.
MILLSTONE - UNIT 3                            B 3/4 5-2d                  Amendment No. 00, -l-41-, -l-S1, Aeknovlledged by NRG letter dated 08/25/05
 
LBDCR No. 14-MP3-0ll January 8, 2015 EMERGENCY CORE COOLING SYSTEMS BASES ECCS SUBSYSTEMS (Continued)
When performing the quarterly stroke test of 3 SIH*MV8807A or 3 SIH*MV8 807B, 3SIH*MV8924 is closed first to prevent the potential injection ofRWST water into the RCS through the operating charging pump. When 3SIH*MV8924 is closed, it is not necessary to declare either ECCS subsystem inoperable. Although expected to be open for post-LOCA recirculation, sufficient time is expected to be available post-LOCA to identify and open 3SIH*MV8924 either from the Control Room or locally at valve. The EOPs and the ESF status panels will identify this abnormal plant configuration, if not corrected following the termination of the surveillance testing, to the plant operators to allow restoration of the normal post-LOCA recirculation flowpath. Even if system restoration is not accomplished, sufficient equipment will be available to perform all ECCS and RSS injection and recirculation functions, provided no additional ECCS or RSS equipment is inoperable, even if a single failure is postulated. The failure to open 3SIH*MV8924 due to mechanical binding or the loss of power to ECCS Train A could be the single failure. If a different single failure is postulated, restoration of 3SIH*MV8924 can be accomplished. The closure of 3SIH*MV8924 has no affect on the injection phase. During the recirculation phase, assuming 3SIH*MV8924 remains closed (i.e., the single failure), the Train A RSS subsystem can supply water from the containment sump to the Train A and B charging pumps, and the Train B RSS subsystem can supply water from the containment sump to the Train A and B safety injection pumps. If power is lost to ECCS Train A and 3SIH*MV8924 is not opened locally (i.e., the single failure), cold leg recirculation can be accomplished by using RSS Train B to supply containment sump water via 3SIH*P1B to the RCS cold legs and 3SIL*MV8809B can be opened to supply containment sump water via RSS Train B to the RCS cold legs. Hot leg recirculation can be accomplished by using RSS Train B to supply containment sump water via 3SIH*P1B to the RCS hot legs and maintaining 3SIL*MV8809B open to supply containment sump water via RSS Train B to the RCS cold legs.
ECCS Subsystems: Auxiliary Building RPCCW Ventilation Area Temperature Maintenance:
In MODES 1, 2, 3 and 4, two trains of 4 heaters each, powered from class lE power supplies, are required to support charging pump OPERABILITY during cold weather conditions.
These heaters are required whenever outside temperature is less than or equal to l 7&deg;F.
When outside air temperature is below l 7&deg;F, if both trains of heaters in the RPCCW Ventilation Area are available to maintain at least 65&deg;F in the Charging Pump and Reactor Component Cooling Water Pump areas of the Auxiliary Building, both charging pumps are OPERABLE for MODES 1, 2 and 3.
When outside air temperature is below l 7&deg;F, if one train of heaters in the RPCCW Ventilation Area is available to maintain at least 32&deg;F in the Charging Pump and Reactor Component Cooling Water Pump areas of the Auxiliary Building, the operating charging pump is OPERABLE, for MODE 4.
MILLSTONE - UNIT 3                            B 3/4 5-2e                              Amendment No.
 
LBDCR No. 14-MP3-0ll January 8, 2015 EMERGENCY CORE COOLING SYSTEMS BASES ECCS SUBSYSTEMS (Continued)
With less than 4 OPERABLE heaters in either train, the corresponding train of charging is inoperable. This condition will require entry into the applicable ACTION statement for LCOs 3.5.2 and 3.5.3.
LCO 3.5.2 ACTION statement "b", and LCO 3.5.3 ACTION statement "c" address special reporting requirements in response to ECCS actuation with water injection to the RCS.
The special report completion is not a requirement for logging out of the ACTION statements that require the reports.
3/4.5.4 REFUELING WATER STORAGE TANK The OPERABILITY of the refueling water storage tank (RWST) as part of the ECCS ensures that a sufficient supply of borated water is available for injection by the ECCS in the event of a LOCA. The limits on RWST minimum volume and boron concentration ensure that: ( 1) sufficient water is available within containment to permit recirculation cooling flow to the core, and (2) the reactor will remain subcritical in the cold condition following a large break (LB)
LOCA, assuming mixing of the RWST, RCS, ECCS water, and other sources of water that may eventually reside in the sump, with all control rods assumed to be out. These assumptions are consistent with the LOCA analyses.
The contained water volume limit includes an allowance for water not usable because of tank discharge line location or other physical characteristics.
The limits on contained water volume and boron concentration of the RWST also ensure a pH value of between 7.0 and 7.5 for the solution recirculated within containment after a LOCA.
This pH band minimizes the effect of chloride and caustic stress corrosion on mechanical systems and components.
The minimum and maximum solution temperatures for the RWST in MODES 1, 2, 3 and 4 are based on the following:
The 42&deg;F minimum and 73&deg;F maximum solution temperature values identified within the Technical Specifications include an operational margin of 2&deg;F (e.g., measurement uncertainties, analytical uncertainties, and design uncertainties) from values used in accident analysis/piping stress analysis. Accident analysis/piping stress analysis used 40&deg;F and 75&deg;F for the minimum and maximum RWST solution temperature.
MILLSTONE - UNIT 3                        B 3/4 5-2f                                Amendment No.
 
May 26, 1995 EMERGENCY CORE COOLING SYSTEMS 3/4.5.5 TRISODIUM PHOSPHATE STORAGE BASKETS BASES BACKGROUND Trisodium phosphate (TSP) dodecahydrate is stored in porous wire mesh baskets on the floor or in the sump of the containment building to ensure that iodine, which may be dissolved in the recirculated reactor cooling water following a loss of coolant accident (LOCA), remains in solution. TSP also helps inhibit stress corrosion cracking (SCC) of austenitic stainless steel components in containment during the recirculation phase following an accident.
Fuel that is damaged during a LOCA will release iodine in several chemical forms to the reactor coolant and to the containment atmosphere. A portion of the iodine in the containment atmosphere is washed to the sump by containment sprays (i.e., Quench Spray and/or Containment Recirculation Spray). The emergency core cooling water is borated for reactivity control. This borated water causes the sump solution to be acidic. In a low pH (acidic) solution, dissolved iodine will be converted to a volatile form. The volatile iodine will evolve out of solution into the containment atmosphere, significantly increasing the levels of airborne iodine. The increased levels of airborne iodine in containment contribute to the radiological releases and increase the consequences from the accident due to containment atmosphere leakage.
After a LOCA, the components of the core cooling and containment spray systems will be exposed to high temperature borated water. Prolonged exposure to the core cooling water combined with stresses imposed on the components can cause SCC. The SCC is a function of stress, oxygen and chloride concentrations, pH, temperature, and alloy composition of the components. High temperatures and low pH, which would be present after a LOCA, tend to promote SCC. This can lead to the failure of necessary safety systems or components.
Adjusting the pH of the recirculation solution to levels above 7.0 prevents a significant :fraction of the dissolved iodine from converting to a volatile form. The higher pH thus decreases the level of airborne iodine in containment and reduces the radiological consequences from containment atmosphere leakage following a LOCA. Maintaining the solution pH :2: 7 .0 also reduces the occurrence of SCC of austenitic stainless steel components in containment. Reducing SCC reduces the probability of failure of components.
Granular TSP dodecahydrate is employed as a passive form of pH control for post LOCA containment spray and core cooling water. Baskets of TSP are placed on the floor or in the sump of the containment building to dissolve MILLSTONE - UNIT 3                          B 3/4 5-3                          Amendment No. 115
 
May 26, 1995 EMERGENCY CORE COOLING SYSTEMS BASES (continued)
BACKGROUND (continued)
:from released reactor coolant water and containment sprays after a LOCA. Recirculation of the water for core cooling and containment sprays then provides mixing to achieve a uniform solution pH. The dodecahydrate form of TSP is used because of the high humidity in the containment building during normal operation. Since the TSP is hydrated, it is less likely to absorb large amounts of water from the humid atmosphere and will undergo less physical and chemical change than the anhydrous form of TSP.
APPLICABLE SAFETY ANALYSES The LOCA radiological consequences analysis takes credit for iodine retention in the sump solution based on the recirculation water pH being ~ 7. 0. The radionuclide releases :from the containment atmosphere and the consequences of a LOCA would be increased if the pH of the recirculation water were not adjusted to 7.0 or above.
LIMITING CONDITION FOR OPERATION The TSP is required to adjust the pH of the recirculation water to~ 7.0 after a LOCA. A pH~ 7.0 after a LOCA is necessary to prevent significant amounts of iodine released :from fuel failures and dissolved in the recirculation water from converting to a volatile form and evolving into the containment atmosphere. Higher levels of airborne iodine in containment may increase the release ofradionuclides and the consequences of the accident. A pH~ 7.0 is also necessary to prevent SCC of austenitic stainless steel components in containment. SCC increases the probability of failure of components.
The required amount of TSP is based upon the extreme cases of water volume and pH possible in the containment sump after a large break LOCA. The minimum required volume is the volume of TSP that will achieve a sump solution pH of~ 7.0 when taking into consideration the maximum possible sump water volume and the minimum possible pH. The amount of TSP needed in the containment building is based on the mass of TSP required to achieve the desired pH. However, a required volume is specified, rather than mass, since it is not feasible to weigh the entire amount of TSP in containment. The minimum required volume is based on the manufactured density of TSP dodecahydrate. Since TSP can have a tendency to agglomerate :from high humidity in the containment building, the density may increase and the volume decrease during normal plant operation. Due to possible agglomeration and increase in density, estimating the minimum volume of TSP in containment is conservative with respect to achieving a minimum required pH.
MILLSTONE - UNIT 3                          B 3/4 5-4                        Amendment No. 115
 
LBDCR 12-MP3-010 September 20, 2012 EMERGENCY CORE COOLING SYSTEMS BASES (Continued)
APPLICABILITY In MODES 1, 2, 3, and 4, a design basis accident (DBA) could lead to a fission product release to containment that leaks to the secondary containment boundary. The large break LOCA, on which this system's design is based, is a full-power event. Less severe LOCAs and leakage still require the system to be OPERABLE throughout these MODES. The probability and severity of a LOCA decrease as core power and reactor coolant system pressure decrease. With the reactor shut down, the probability of release of radioactivity resulting from such an accident is low.
In MODES 5 and 6, the probability and consequence of a DBA are low due to the pressure and temperature limitations in these MODES. Under these conditions, the SLCRS is not required to be OPERABLE.
ACTIONS If it is discovered that the TSP in the containment building sump is not within limits, action must be taken to restore the TSP to within limits. During plant operation, the containment sump is not accessible and corrections may not be possible.
The 7-day Completion Time is based on the low probability of a DBA occurring during this period. The Completion Time is adequate to restore the volume of TSP to within the technical specification limits.
If the TSP cannot be restored within limits within the 7-day Completion Time, the plant must be brought to a MODE in which the LCO does not apply. The specified Completion Times for reaching MODES 3 and 4 are those used throughout the technical specifications; they were chosen to allow reaching the specified conditions from full power in an orderly manner and without challenging plant systems.
SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.5.5 Periodic determination of the volume of TSP in containment must be performed due to the possibility of leaking valves and components in the containment building that could cause dissolution of the TSP during normal operation. This requirement ensures that there is an adequate volume of TSP to adjust the pH of the post LOCA sump solution to a value~ 7.0. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
MILLSTONE - UNIT 3                          B 3/4 5-5                  AmendmentNo.-1--l.&sect;-,~
 
REVERSE OF PAGE B 3/4 5-5 INTENTIONALLY LEFT BLANK
 
LBDCR No. 06-MP3-026 October 15, 2006 3/4.6  CONTAINMENT SYSTEMS BASES 3/4.6.1 PRIMARY CONTAINMENT 3/4.6.1.1 CONTAINMENT INTEGRITY Primary CONTAINMENT INTEGRITY ensures that the release of radioactive materials from the containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the safety analyses. This restriction, in conjunction with the leakage rate limitation, will limit the SITE BOUNDARY radiation doses to within the dose guidelines of 10 CFR 50.67 during accident conditions and the control room operators dose to within the guidelines of GDC 19.
Primary CONTAINMENT INTEGRITY is required in MODES 1 through 4. This requires an OPERABLE containment automatic isolation valve system. In MODES 1, 2 and 3 this is satisfied by the automatic containment isolation signals generated by high containment pressure, low pressurizer pressure and low steamline pressure. In MODE 4 the automatic containment isolation signals generated by high containment pressure, low pressurizer pressure and low steamline pressure are not required to be OPERABLE. Automatic actuation of the containment isolation system in MODE 4 is not required because adequate time is available for plant operators to evaluate plant conditions and respond by manually operating engineered safety features components. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. Since the manual actuation pushbuttons portion of the containment isolation system is required to be OPERABLE in MODE 4, the plant operators can use the manual pushbuttons to rapidly position all automatic containment isolation valves to the required accident position. Therefore, the containment isolation actuation pushbuttons satisfy the requirement for an OPERABLE containment automatic isolation valve system in MODE 4.
3/4.6.1.2 CONTAINMENT LEAKAGE The limitations on containment leakage rates, as specified in the Containment Leakage Rate Testing Program, ensure that the total containment leakage volume will not exceed the value assumed in the safety analyses at the peak accident pressure, Pa* As an added conservatism, the measured overall integrated leakage rate is further limited to less than O. 7 5 La during performance of the periodic test to account for possible degradation of the containment leakage barriers between leakage tests.
The Limiting Condition for Operation defines the limitations on containment leakage.
The leakage rates are verified by surveillance testing as specified in the Containment Leakage Rate Testing Program, in accordance with the requirements of Appendix J. Although the LCO specifies the leakage rates at accident pressure, Pa, it is not feasible to perform a test at such an exact value for pressure. Consequently, the surveillance testing is performed at a pressure greater than or equal to Pa to account for test instrument uncertainties and stabilization changes. This conservative test pressure ensures that the measured leakage rates MILLSTONE - UNIT 3                          B 3/4 6-1        AmendmentNo.-S:9,-89-,ill,1/44,+&6,~
NRC Verbal Acknowledgment: 07/05/07
 
May 15, 2002 3/4.6 CONTAINMENT SYSTEMS BASES 3/4.6.1.2 CONTAINMENT LEAKAGE (continued) are representative of those which would occur at accident pressure while meeting the intent of the LCO. This test methodology is in accordance with the Containment Leakage Rate Testing Program.
The surveillance testing for measuring leakage rates are in accordance with the Containment Leakage Rate Testing Program.
The enclosure building bypass leakage paths are listed in the "Technical Requirements Manual." The addition or deletion of the enclosure building bypass leakage paths shall be made in accordance with Section 50.59 of 10CFR50 and approved by the Plant Operations Review Committee.
3/4.6.1.3 CONTAINMENT AIRLOCKS The ACTION requirements are modified by a Note that allows entry and exit to perform repairs on the affected air lock components. This means there may be a short time during which the containment boundary is not intact (e.g., during access through the OPERABLE door). The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed.
ACTION a. is only applicable when one air lock door is inoperable. With only one air lock door inoperable, the remaining OPERABLE air lock door must be verified closed within 1 hour.
This ensures a leak tight containment barrier is maintained by use of the remaining OPERABLE air lock door. The 1 hour requirement is consistent with the requirements of Technical Specification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, the remaining OPERABLE air lock door must be locked closed within 24 hours and then verified periodically to ensure an acceptable containment leakage boundary is maintained. Otherwise, a plant shutdown is required.
ACTION b. is only applicable when the air lock door interlock mechanism is inoperable.
With only the air lock interlock mechanism inoperable, an OPERABLE air lock door must be verified closed within 1 hour. This ensures a leak tight containment barrier is maintained by use of an OPERABLE air lock door. The 1 hour requirement is consistent with the requirements of Technical Specification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, an OPERABLE air lock door must be locked closed within 24 hours and then verified periodically to ensure an acceptable containment leakage boundary is maintained. Otherwise, a plant shutdown is required. In addition, entry into and exit from containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock) is permitted.
ACTION c. is applicable when both air lock doors are inoperable, or the air lock is inoperable for any other reason excluding the door interlock mechanism. With both air lock doors inoperable or the air lock otherwise inoperable, an evaluation of the overall containment leakage rate per Specification 3. 6 .1.2 MILLSTONE - UNIT 3                          B 3/4 6-la      Amendment No. 9, , M, m, -!-8-6, 205
 
May 15, 2002 3/4.6  CONTAINMENT SYSTEMS BASES 3/4.6.1.3 CONTAINMENT AIRLOCKS (continued) shall be initiated immediately, and an air lock door must be verified closed within 1 hour. An evaluation is acceptable since it is overly conservative to immediately declare the containment inoperable if both doors in the air lock have failed a seal test or if overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), containment remains OPERABLE, yet only 1 hour (per Specification 3.6.1.1) would be provided to restore the air lock to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits. The 1 hour requirement is consistent with the requirements of Technical Specification 3. 6 .1.1 to restore CONTAINMENT INTEGRITY. In addition, the air lock and/or at least one air lock door must be restored to OPERABLE status within 24 hours or a plant shutdown is required.
Surveillance Requirement 4.6.1.3.a verifies leakage through the containment air lock is within the requirements specified in the Containment Leakage Rate Testing Program. The containment air lock leakage results are accounted for in the combined Type B and C containment leakage rate. Failure of an air lock door does not invalidate the previous satisfactory overall air lock leakage test because either air lock door is capable of providing a fission product barrier in the event of a design basis accident.
The limitations on closure and leak rate for the containment air locks are required to meet the restrictions on CONTAINMENT INTEGRITY and containment leak rate. Surveillance testing of the air lock seals is performed in accordance with the Containment Leakage Rate Testing Program, which ensures that the overall air lock leakage will not become excessive due to seal damage during the intervals between air lock leakage tests. While the leakage rate limitation is specified at accident pressure, Pa, the actual surveillance testing is performed by applying a pressure greater than or equal to Pa* This higher pressure accounts for test instrument uncertainties and test volume stabilization changes which occurs under actual test conditions.
3/4.6.1.4 and 3/4.6. 1.5 AIR PRESSURE and AIR TEMPERATURE The limitations on containment pressure and average air temperature ensure that: (1) the containment structure is prevented from exceeding its design negative pressure of 8 psia, and (2) the containment peak pressure does not exceed the design pressure of 60 psia during LOCA conditions. Measurements shall be made at all listed locations, whether by fixed or portable instruments, prior to determining the average air temperature. The limits on the pressure and average air temperature are consistent with the assumptions of the safety analysis. The minimum total containment pressure of 10.6 psia is determined by summing the minimum permissible air partial pressure of 8.9 psia and the maximum expected vapor pressure of 1. 7 psia (occurring at the maximum permissible containment initial temperature of 120&deg;F).
MILLSTONE - UNIT 3                          B 3/4 6-lb        Amendment No. ~. &9-, 1/44, +::Ff, +8-6, 205
 
REVERSE OF PAGE 3/4 6-1 b INTENTIONALLY LEFT BLANK
 
LBDCR No. 14-MP3-0ll January 8, 2015 CONTAINMENT SYSTEMS BASES 3/4.6.1.6 CONTAINMENT STRUCTURAL INTEGRITY This limitation ensures that the structural integrity of the containment will be maintained comparable to the original design standards for the life of the facility. Structural integrity is required to ensure that the containment will withstand the maximum pressure of 60 psia in the event of a LOCA. A visual inspection, in accordance with the Containment Leakage Rate Testing Program, is sufficient to demonstrate this capability.
3/4.6.1.7 CONTAINMENT VENTILATION SYSTEM The 42-inch containment purge supply and exhaust isolation valves are required to be locked closed during plant operation since these valves have not been demonstrated capable of closing during a LOCA or steam line break accident. Maintaining these valves closed during plant operations ensures that excessive quantities of radioactive materials will not be released via the Containment Purge System. To provide assurance that these containment valves cannot be inadvertently opened, the valves are locked closed in accordance with Standard Review Plan 6.2.4 which includes mechanical devices to seal or lock the valve closed, or prevents power from being supplied to the valve operator.
The Type C testing frequency required by 4.6.1.2 is acceptable, provided that the resilient seats of these valves are replaced every other refueling outage.
3/4.6.2  DEPRESSURIZATION AND COOLING SYSTEMS 3/4.6.2.1 and 3/4.6.2.2 CONTAINMENT QUENCH SPRAY SYSTEM and RECIRCULATION SPRAY SYSTEM The OPERABILITY of the Containment Spray Systems ensures that containment depressurization and iodine removal will occur in the event of a LOCA. The pressure reduction, iodine removal capabilities and resultant containment leakage are consistent with the assumptions used in the safety analyses.
Management of gas voids is important to the OPERABILITY of the containment spray systems.
Based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations, as supplemented by system walk downs, the Containment Quench Spray and Recirculation Spray Systems are not susceptible to gas intrusion. Once the piping in the Containment Quench Spray System is procedurally filled and placed in service for normal operation, no external sources of gas accumulation or intrusion have been identified for the system that would affect spray system operation or performance.
Thus, the piping in the Containment Quench Spray Systems will remain sufficiently full during normal operation and periodic monitoring for gas accumulation or intrusion is not required. In the standby mode the majority of the Recirculation Spray System is dry. The water filled portion of the Recirculation Spray System, which includes the ECCS cross connect piping and loop seals, is monitored with the ECCS piping that is susceptible to gas accumulations.
MILLSTONE - UNIT 3                          B 3/4 6-2                  AmendrnentNo.-s9-,-l-l-S-,--l-86, "Revised by NR&#xa3; Letter Al5710"
 
LBDCR No. 14-MP3-0ll January 8, 2015 CONTAINMENT SYSTEMS BASES LCO 3.6.2.2 One Recirculation Spray System consists of:
* Two OPERABLE containment recirculation heat exchangers
* Two OPERABLE containment recirculation pumps The Containment Recirculation Spray System (RSS) consists of two parallel redundant subsystems which feed two parallel 360 degree spray headers. Each subsystem consists of two pumps and two heat exchangers. Train A consists of 3RSS*PIA and 3RSS*PlC. Train B consists of 3RSS*P1B and 3RSS*PlD.
The design of the Containment RSS is sufficiently independent so that an active failure in the recirculation spray mode, cold leg recirculation mode, or hot leg recirculation mode of the ECCS has no effect on its ability to perform its engineered safety function. In other words, the failure in one subsystem does not affect the capability of the other subsystem to perform its designated safety function of assuring adequate core cooling in the event of a design basis LOCA. As long as one subsystem is OPERABLE, with one pump capable of assuring core cooling and the other pump capable ofremoving heat from containment, the RSS system meets its design requirements.
The LCO 3.6.2.2. ACTION applies when any of the RSS pumps, heat exchangers, or associated components are declared inoperable. All four RSS pumps are required to be OPERABLE to meet the requirements of this LCO 3.6.2.2. During the injection phase of a Loss Of Coolant Accident all four RSS pumps would inject into containment to perform their containment heat removal function. The minimum requirement for the RSS to adequately perform this function is to have at least one subsystem available. Meeting the requirements ofLCO 3.6.2.2. ensures the minimum RSS requirements are satisfied.
Surveillance Requirement 4.6.2.2.c requires that verification is made that on a CDA test signal, each RSS pump starts automatically after receipt of an RWST Low-Low level signal. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
Surveillance Requirements 4.6.2.1.d and 4.6.2.2.e require verification that each spray nozzle is unobstructed following maintenance that could cause nozzle blockage. Normal plant operation and maintenance activities are not expected to trigger performance of these surveillance requirements. However, activities, such as an inadvertent spray actuation that causes fluid flow through the nozzles, a major configuration change, or a loss of foreign material control when working within the respective system boundary may require surveillance performance. An evaluation, based on the specific situation, will determine the appropriate test method (e.g., visual inspection, air or smoke flow test) to verify no nozzle obstruction.
MILLSTONE - UNIT 3                          B 3/4 6-2a                                  Amendment No.
 
LBDCR 12-MP3-010 September 20, 2012 CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES The OPERABILITY of the containment isolation valves ensures that the containment atmosphere will be isolated from the outside environment in the event of a release of radioactive matenal to the containment atmosphere or pressurization of the containment and is consistent with the requirements of General Design Criteria 54 through 57 of Appendix A to 10 CFR Part 50. Containment isolation within the time limits specified for these isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a LOCA. FSAR Table 6.2-65 lists all containment isolation valves. The addition or deletion of any containment isolation valve shall be made in accordance with Section 50.59 of 10CFR50 and approved by the cornrnittee(s) as described in the QAP Topical Report.
For the purposes of meeting this LCO, the safety function of the containment isolation valves is to shut within the time limits assumed in the accident analyses. As long as the valves can shut within the time limits assumed in the accident analyses, the valves are OPERABLE. Where the valve position indication does not affect the operation of the valve, the indication is not required for valve OPERABILITY under this LCO. Position indication for containment isolation valves is covered by Technical Specification 6.8.4.e., Accident Monitoring Instrumentation.
Failed position indication on these valves must be restored "as soon as practicable" as required by Technical Specification 6.8.4.e.3. Maintaining the valves OPERABLE, when position indication fails, facilitates troubleshooting and correction of the failure, allowing the indication to be restored "as soon as practicable."
With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and deactivated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration.
If the containment isolation valve on a closed system becomes inoperable, the remaining barrier is a closed system since a closed system is an acceptable alternative to an automatic valve.
However, actions must still be taken to meet Technical Specification ACTION 3 .6.3 .d and the valve, not normally considered as a containment isolation valve, and closest to the containment wall should be put into the closed position. No leak testing of the alternate valve is necessary to satisfy the ACTION statement. Placing the manual valve in the closed position sufficiently deactivates the penetration for Technical Specification compliance.
Closed system isolation valves applicable to Technical Specification ACTION 3.6.3.d are included in FSAR Table 6.2-65, and are the isolation valves for those penetrations credited as General Design Criteria 57. The specified time (i.e., 72 hours) of Technical Specification ACTION 3.6.3.d is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3 and 4. In the event the affected penetration is isolated in accordance with 3.6.3.d, the affected penetration flow path must be verified to be isolated on a periodic basis, (Surveillance Requirement 4.6.1.1.a). This is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
MILLSTONE - UNIT 3                            B 3/4 6-3                ArnendrnentNo.~,63-,~,~
 
LBDCR 05-MP3-028 November 30, 2005 CONTAINMENT SYSTEMS BASES For the purposes of meeting this LCO, neither the containment isolation valve, nor any alternate valve on a closed system have a leakage limit associated with valve OPERABILITY.
The opening of containment isolation valves on an intermittent basis under administrative controls includes the following considerations: (1) stationing an operator, who is in constant communication with the control room, at the valve controls, (2) instructing this operator to close these valves in an accident situation, and (3) assuring that environmental conditions will not preclude access to close the valves and that this action will prevent the release of radioactivity outside the containment.
The appropriate administrative controls, based on the above considerations, to allow containment isolation valves to be opened are contained in the procedures that will be used to operate the valves. Entries should be placed in the Shift Manager Log when these valves are opened or closed. However, it is not necessary to log into any Technical Specification ACTION Statement for these valves, provided the appropriate administrative controls have been established.
Opening a closed containment isolation valve bypasses a plant design feature that prevents the release of radioactivity outside the containment. Therefore, this should not be done frequently, and the time the valve is opened should be minimized. The determination of the appropriate administrative controls for containment isolation valves requires an evaluation of the expected environmental conditions. This evaluation must conclude environmental conditions will not preclude access to close the valve, and this action will prevent the release of radioactivity outside of containment through the respective penetration.
When the Residual Heat Removal (RHR) System is placed in service in the plant cooldown mode of operation, the RHR suction isolation remotely operated valves 3RHS*MV8701A and 3RHS*MV8701B, and/or 3RHS*MV8702A and 3RHS*MV8702B are opened. These valves are normally operated from the control room. They do not receive an automatic containment isolation closure signal, but are interlocked to prevent their opening if Reactor Coolant System (RCS) pressure is greater than approximately 412.5 psia. When any of these valves are opened, either one of the two required licensed (Reactor Operator) control room operators can be credited as the operator required for administrative control. It is not necessary to use a separate dedicated operator.
3/4.6.4 DELETED MILLSTONE - UNIT 3                        B 3/4 6-3a                Amendment No. :2-8-, 63-, -le,~.
Acknowledged by NRC Letter dated 04/12/06
 
LBDCR 05-MP3-028 November 30, 2005 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3        B 3/4 6-3b          Amendment No.~. fil, ~ . Ue, Acknowledged by NRC Letter dated 04/12/06
 
LBDCR 05-MP3-028 November 30, 2005 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3      B 3/4 6-3c              Amendment No. 63-, ~ . :2-1-6, Acknowledged by NRC Letter dated 04/12/06
 
LBDCR 05-MP3-028 November 30, 2005 CONTAINMENT SYSTEMS BASES 3/4.6.5 SUBATMOSPHERIC PRESSURE CONTROL SYSTEM 3/4.6.5.1 STEAM JET AIR EJECTOR The closure of the isolation valves in the suction of the steam jet air ejector ensures that:
(1) the containment internal pressure may be maintained within its operation limits by the mechanical vacuum pumps, and (2) the containment atmosphere is isolated from the outside environment in the event of a LOCA. These valves are required to be closed for containment isolation.
MILLSTONE - UNIT 3                        B 3/4 6-3d                    Amendment No. 63-, -le, i-l-6, Acknowledged by NRC Letter dated 04/12/06
 
REVERSE OF PAGE B 3/4 6-3d INTENTIONALLY LEFT BLANK
 
June 3, 2002 CONTAINMENT SYSTEMS BASES 3/4.6.6    SECONDARY CONTAINMENT 3/4.6.6.1  SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM
 
===Background===
The OPERABILITY of the Supplementary Leak Collection and Release System (SLCRS) ensures that radioactive materials thatleak from tbe primary containment into the Secondary Containment foll(?wing a Design Basis Accident (DBA) are filtered out and adsorbed prior to any release to the envrronment.
SLCRS Ductwork Integrity:
The Supplementary Leak Collection and Release System (SLCRS) remains OPERABLE with the following bolting configuration:
: a. For 3HVR*DMPF44:
* Eight bolts properly installed on the ductwork access panels.
* At least one bolt must be installed in each comer area.
* The remaining bolts should be installed in the center area of each side.
: b. For 3HVR*DMPF29:
* 12 bolts properly installed on the ductwork access panel.
* At least one bolt must be installed in each comer area.
* T}:le remaining bolts_ should be approximately equally spaced along each side with two bolts per side.
With the above bolting specified for 3HVR*DMPF44 and 3HVR*DMPF29, reference (1) concluded the following:
* Any leakage around the plates is minimal and causes negligible effect on the performance of the SLCRS system.
* Assures the gasket will not be extruded from between the plate and duct flange when the SLCRS fans are started.
* The remaining bolts may be installed with the fans running.
* Provides adequate structural integrity in the seismic event based on engineering analysis.
Applicable Safety Analyses The SLCRS design basis is established by the consequences of the limiting DBA, which is a LOCA. The accident analysis assumes that only one train of the SLCRS and one train of the auxiliary building filter system is functional due to a single failure that disables the other train.
The accident analysis accounts for the reduction of the arrbome radioactive material provided by the remaining one train of this filtration system. The amount of fission products avaifable for release from the containment is determined for a LOCA.
The SLCRS is not normally in operation. The SLCRS starts on a SIS signal. The modeled SLCRS actuation in the safety analysis tthe Millstone 3 MILLSTONE - UNIT 3                          B 3/4 6-4                      Amendment No. &:/-, He "Revised by NRC Letter A15710"
 
LBDCRNo. 04-MP3-015 February 24, 2005 CONTAINMENT SYSTEMS BASES 3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued)
FSAR Chapter 15, Section 15.6) is based upon a worst-case response time following an SI initiated at the limiting setpoint. One train of the SLCRS in conjunction with the Auxiliary Building Filter (ABF) system is capable of drawing a negative pressure (0.4 inches water gauge at the auxiliary building 24'6" elevation) within 120 seconds after a LOCA. This time includes diesel generator startup and sequencing time, system startup time, and time for the system to attain the required negative pressure after starting.
LCO In the event of a DBA, one SLCRS is required to provide the minimum postulated iodine removal assumed in the safety analysis. Two trains of the SLCRS must be OPERABLE to ensure that at least one train will operate, assuming that the other train is disabled by a single-active failure. The SLCRS works in conjunction with the ABF system. Inoperability of one train of the ABF system also results in inoperability of the corresponding train of the SLCRS. Therefore, wheneverLCO 3.7.9 is entered due to theABF trainA(B) being inoperable, LCO 3.6.6.1 must be entered due to the SLCRS train A (B) being inoperable.
When a SLCRS LCO is not met, it is not necessary to declare the secondary containment inoperable. However, in this event, it is necessary to determine that a loss of safety function does not exist. A loss of safety function exists when, assuming no concurrent single failure, a safety function assumed in the accident analysis cannot be performed.
Applicability In MODES 1, 2, 3, and 4, a DBA could lead to a fission product release to containment that leaks to the secondary containment. The large break LOCA, on which this system's design is based, is a full-power event. Less severe LOCAs and leakage still require the system to be OPERABLE throughout these MODES. The probability and severity of a LOCA decrease as core power and reactor coolant system pressure decrease. With the reactor shut down, the probability of release of radioactivity resulting from such an accident is low.
In MODES 5 and 6, the probability and consequences of a DBA are low due to the pressure and temperature limitations in these MODES. Under these conditions, the SLCRS is not required to be OPERABLE.
ACTIONS With one SLCRS train inoperable, the inoperable train must be restored to OPERABLE status within 7 days. The OPERABLE train is capable of providing 100 percent of the iodine removal needs for a DBA. The 7-day Completion Time is based on consideration of such factors as the reliability of the OPERABLE redundant SLCRS train and the low probability of a DBA occurring during this period. The Completion Time is adequate to make most repairs. If the SLCRS cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and MODE 5 within the following 30 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full-power conditions in an orderly manner and without challenging plant systems.
MILLSTONE - UNIT 3                          B 3/4 6-5                          Amendment No. &1, -1+/-6, Acknowledged by NRC letter dated 08/25/05
 
LBDCR 18-MP3-009 February 21, 2019 CONTAINMENT SYSTEMS BASES 3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued)
Surveillance Requirements a
Operating each SLCRS train for greater than or equal to 15 continuous minutes ensures that all trains are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action.
Since adsorption testing is performed at 70% relative humidity, the filter heaters are required to operate. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
b, c, e, andf These surveillances verify that the required SLCRS filter testing is performed in accordance with Regulatory Guide 1.52, Revision 2. ANSI N510-1980 shall be used in place of ANSI N510-1975 referenced in Regulatory Guide 1.52, Revision 2. Laboratory testing of methyl iodide penetration shall be performed in accordance with ASTM D3803-89 and Millstone Unit 3 specific parameters. The surveillances include testing HEPA filter performance, charcoal adsorber efficiency, system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). The heater kW measured must be corrected to its nameplate rating.
Variations in system voltage can lead to measurements of kW which cannot be compared to the nameplate rating because the output kW is proportional to the square of the voltage.
Any time the OPERABILITY of a HEPA filter or charcoal adsorber housing has been affected by repair, maintenance, modification, or replacement activity, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY.
The 720 hours of operation requirement originates from Regulatory Guide 1. 52, Revision 2, March 1978, Table 2, Note "c", which states that "Testing should be performed (1) initially, (2) at least once per 18 months thereafter for systems maintained in a standby status or after 720 hours of system operations, and (3) following painting, fire, or chemical release in any ventilation zone communicating with the system." This testing ensures that the charcoal adsorbency capacity has not degraded below acceptable limits, as well as providing trend data. The 720 hour figure is an arbitrary number which is equivalent to a 30 day period. This criteria is directed to filter systems that are normally in operation and also provide emergency air cleaning functions in the event of a Design Basis Accident. The applicable filter units are not normally in operation and the sample canisters are typically removed due to the 18 month criteria.
d The periodic automatic startup ensures that each SLCRS train responds properly. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The surveillance verifies that the SLCRS starts on a SIS test signal. It also includes the automatic functions to isolate the other ventilation systems that are not part of the safety-related postaccident operating configuration and to start up and to align the ventilation systems that flow through the secondary containment to the accident condition.
MILLSTONE - UNIT 3                          B 3/4 6-6                  Amendment No. &cl-,~. +84,~
 
LBDCR 05-MP3-025 March 7, 2006 CONTAINMENT SYSTEMS BASES 3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued)
* The main steam valve building ventilation system isolates.
* Auxiliary building ventilation (normal) system isolates.
* Charging pump/reactor plant component cooling water pump area cooling subsystem aligns and discharges to the auxiliary building filters and a filter fan starts.
* Hydrogen recombiner ventilation system aligns to the postaccident configuration.
* The engineered safety features building ventilation system aligns to the postaccident configuration.
 
==References:==
: 1.      Engineering analysis, Memo MP3-DE-94-539, "Bolting Requirements for Access Panels on Dampers 3HVR*DMPF29 & 44," dated June 16, 1994.
MILLSTONE - UNIT 3                        B 3/4 6-6a                      Amendment No. &:1-, -1+/-3-, -l-84,
 
LBDCR No. 06-MP3-026 October 15, 2006 CONTAINMENT SYSTEMS BASES 3/4.6.6.2    SECONDARY CONTAINMENT The Secondary Containment is comprised of the containment enclosure building and all contiguous buildings (main steam valve building [partially], engineering safety features building
[partially], hydrogen recombiner building [partially], and auxiliary building). The Secondary Containment shall exist when:
: a.      Each door in each access opening is closed except when the access opening is being used for normal transit entry and exit,
: b.      The sealing mechanism associated with each penetration (e.g., welds, bellows, or O-rings) is OPERABLE.
Secondary Containment ensures that the release ofradioactive materials from the primary containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the safety analyses. This restriction, in conjunction with operation of the Supplementary Leak Collection and Release System, and Auxiliary Building Filter System will limit the SITE BOUNDARY radiation doses to within the dose guideline values of 10 CFR 50.67 during accident conditions.
The SLCRS and the ABF fans and :filtration units are located in the auxiliary building. The SLCRS is described in the Millstone Unit No. 3 FSAR, Section 6.2.3.
In order to ensure a negative pressure in all areas within the Secondary Containment under most meteorological conditions, the negative pressure acceptance criterion at the measured location (i.e., 24' 6" elevation in the auxiliary building) is 0.4 inches water gauge.
LCO The Secondary Containment OPERABILITY must be maintained to ensure proper operation of the SLCRS and the auxiliary building filter system and to limit radioactive leakage from the containment to those paths and leakage rates assumed in the accident analyses.
Applicability Maintaining Secondary Containment OPERABILITY prevents leakage ofradioactive material from the Secondary Containment. Radioactive material may enter the Secondary Containment from the containment following a LOCA. Therefore, Secondary Containment is required in MODES 1, 2, 3, and 4 when a design basis accident such as a LOCA could release radioactive material to the containment atmosphere.
MILLSTONE - UNIT 3                          B 3/4 6-7                        Amendment No. s::1-, Ya NRC Verbal Acknowledgment: 07/05/07
 
LBDCR 12-MP3-010 September 20, 2012 CONTAINMENT SYSTEMS BASES 3/4.6.6.2 SECONDARY CONTAINMENT (continued)
In MODES 5 and 6, the probability and consequences of a DBA are low due to the RCS temperature and pressure limitation in these MODES. Therefore, Secondary Containment is not required in MODES 5 and 6.
ACTIONS In the event Secondary Containment OPERABILITY is not maintained, Secondary Containment OPERABILITY must be restored within 24 hours. Twenty-four hours is a reasonable Completion Time considering the limited leakage design of containment and the low probability of a DBA occurring during this time period.
Inoperability of the Secondary Containment does not make the SLCRS fans and filters inoperable. Therefore, while in this ACTION Statement solely due to inoperability of the Secondary Containment, the conditions and required ACTIONS associated with Specification 3.6.6.1 (i.e., Supplementary Leak Collection and Release System) are not required to be entered.
If the Secondary Containment OPERABILITY cannot be restored to OPERABLE status within the required completion time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within the following 30 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full-power conditions in an orderly manner and without challenging plant systems.
Surveillance Requirements 4.6.6.2.1 Maintaining Secondary Containment OPERABILITY requires maintaining each door in each access opening in a closed position except when the access opening is being used for normal entry and exit. The normal time allowed for passage of equipment and personnel through each access opening at a time is defined as no more than 5 minutes. The access opening shall not be blocked open. During this time, it is not considered necessary to enter the ACTION statement. A 5-minute time is considered acceptable since the access opening can be quickly closed without special provisions and the probability of occurrence of a DBA concurrent with equipment and/or personnel transit time of 5 minutes is low.
The surveillance frequency is controlled under the Surveillance Frequency Control Program.
MILLSTONE - UNIT 3                        B 3/4 6-8                          ArnendrnentNo.-8-1,-1-U
 
February 5, 1996 CONTAINMENT SYSTEMS BASES 3/4.6.6.2 SECONDARY CONTAINMENT (continued) 4.6.6.2.2 The ability of a SLCRS to produce the required negative pressure during the test operation within the required time provides assurance that the Secondary Containment is adequately sealed.
With the SLCRS in postaccident configuration, the required negative pressure in the Secondary Containment is achieved in 110 seconds from the time of simulated emergency diesel generator breaker closure. Time delays of dampers and logic delays must be accounted for in this surveillance. The time to achieve the required negative pressure is 120 seconds, with a loss-of-offsite power coincident with a SIS. The surveillance verifies that one train of SLCRS in conjunction with the ABF system will produce a negative pressure of O.4 inches water gauge at the auxiliary building 24'6" elevation relative to the outside atmosphere in the Secondary Containment. For the purpose of this surveillance, pressure measurements will be made at the 2416 11 elevation in the auxiliary building. This single location is considered to be adequate and representative of the entire Secondary Containment due to the large cross-section of the air passages which interconnect the various buildings within the Secondary Containment. In order to ensure a negative pressure in all areas inside the Secondary Containment under most meteorological conditions, the negative pressure acceptance criterion at the measured location is 0.4 inch water gauge. It is recognized that there will be an occasional meteorological condition under which slightly positive pressure may exist at some localized portions of the boundary (e.g.,
the upper elevations on the down-wind side of a building). For example, a very low outside temperature combined with a moderate wind speed could cause a slightly positive pressure at the upper elevations of the containment enclosure building on the leeward face. The probability of occurrence of meteorological conditions which could result in such a positive differential pressure condition in the upper levels of the enclosure building has been estimated to be less than 2% of the time.
The probability of wind speed within the necessary moderate band, combined with the probability of extreme low temperature, combined with the small portion of the boundary affected, combined with the low probability of airborne radioactive material migrating to the upper levels ensures that the overall effect on the design basis dose calculations is insignificant.
The SLCRS system and fan sizing was based on an estimated infiltration rate. The fan flow rates are verified within a minimum and maximum on a monthly basis. Initial testing verified that the drawdown criterion was met at the lowest acceptable flow rate. The new standard Technical Specification (NUREG-1431) 3.6.6.2 surveillance requirement requires that the drawdown MILLSTONE - UNIT 3                            B 3/4 6-9                      AmendmentNo.-8+, 126
 
February 5, 1996 CONTAINMENT SYSTEMS BASES 3/4.6.6.2 SECONDARY CONTAINMENT (continued) criterion be met while not exceeding a maximum flow rate. It is assumed that the purpose of this flow limit is to ensure that adequate attention is given to maintain the SLCRS boundary integrity and not using excess system capacity to cover for boundary degradation.
The SLCRS system was designed with minimal margin and, therefore, does not have excess capacity that can be substituted for boundary integrity. Additionally, since SLCRS fan flow rates are verified to be acceptable on a more frequent basis than the drawdown test surveillance, and by means of previous testing the minimum flow rate is acceptable, verifying a flow rate during the drawdown test would not provide an added benefit. Historical SLCRS flow measurements show a lack of repeatability associated with the inaccuracies of air flow measurement. As a result, the more reliable verification of system performance is the actual negative pressure generated by the drawdown test and a measured flow rate would add little.
3/4.6.6.3    SECONDARY CONTAINMENT STRUCTURAL INTEGRITY This limitation ensures that the structural integrity of the Secondary Containment will be maintained comparable to the original design standards for the life of the facility. Structural integrity is required to provide a secondary boundary surrounding the primary containment that can be maintained at a negative pressure during accident conditions. A visual inspection is sufficient to demonstrate this capability.
MILLSTONE - UNIT 3                          B 3/4 6-10                    AmendmentNo.-81, 126
 
LBDCR 18-MP3-011 March 26, 2019 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETYVALVES BACKGROUND The primary purpose of the main steam line Code safety valves (MSSVs) is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided by the Condenser and Circulating Water System, is not available.
Five MSSVs are located on each main steam header, outside containment, upstream of the main steam isolation valves, as described in the FSAR, Section 10.3.1 (Reference 1). The MSSVs must have sufficient capacity to limit the secondary system pressure to less than or equal to 110% of the steam generator design pressure in order to meet the requirements of the ASME Code, Section III (Reference 2). In order to meet this secondary system pressure condition, the design minimum total relieving capacity for all valves on all of the steam lines must be at least 105% of total secondary steam flow at 100% RATED THERMAL POWER. The total relieving capacity for all valves on all of the steam lines is 1.816 x 107 lbs/hr which is 111.3% of the total secondary steam flow of 1.632 x 107 lbs/hr at 100% RATED THERMAL POWER. The MSSV design includes staggered setpoints, according to Table 3.7-3 in the accompanying LCO, so that only the needed valves will actuate. Staggered setpoints reduce the potential for valve chattering that is due to steam pressure insufficient to fully open all valves following a turbine reactor trip. Table 3.7-3 allows a +/- 3 % setpoint tolerance (allowable value) on the lift setting for OPERABILITY to account for drift over an operating cycle.
APPLICABLE SAFETY ANALYSES The design basis for the MSSVs comes from Reference 2 and its purpose is to limit the secondary system pressure to less than or equal to 110% of design pressure for any anticipated operational occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis.
The events that challenge the relieving capacity of the MSSVs, and thus RCS pressure, are those characterized as decreased heat removal events, which are presented in the FSAR, Section 15 .2 (Reference 3). Of these, the full power turbine trip without steam dump is typically the limiting AOO. This event also terminates normal feedwater flow to the steam generators.
The safety analysis demonstrates that the transient response for turbine trip occurring from full power without a direct reactor trip presents no hazard to the integrity of the RCS or the Main Steam System. One turbine trip analysis is performed assuming primary system pressure control MILLSTONE - UNIT 3                          B 3/4 7-1                          Amendment No. W, ~.
 
LBDCR 18-MP3-0ll March 26, 2019 3/4. 7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (Continued) via operation of the pressurizer relief valves and spray. This analysis demonstrates that the DNB design basis is met. Another analysis is performed assuming no primary system pressure control, but crediting reactor trip on high pressurizer pressure and operation of the pressurizer safety valves. This analysis demonstrates that RCS integrity is maintained by showing that the maximum RCS pressure does not exceed 110% of the design pressure. All cases analyzed demonstrate that the MSSVs maintain Main Steam System integrity by limiting the maximum steam pressure to less than 110% of the steam generator design pressure.
In addition to the decreased heat removal events, reactivity insertion events may also challenge the relieving capacity of the MSSVs. The uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power event is characterized by an increase in core power and steam generation rate until reactor trip occurs when either the Overtemperature L1T or Power Range Neutron Flux-High setpoint is reached. Steam flow to the turbine will not increase from its initial value for this event.
The increased heat transfer to the secondary side causes an increase in steam pressure and may result in opening of the MSSVs prior to reactor trip, assuming no credit for operation of the atmospheric or condenser steam dump valves. The FSAR Section 15.4 safety analysis of the RCCA bank withdrawal at power event for a range of initial core power levels demonstrates that the MSSVs are capable of preventing secondary side overpressurization for this AOO.
The FSAR safety analyses discussed above assume that all of the MSSVs for each steam generator are OPERABLE. If there are inoperable MSSV(s), it is necessary to limit the primary system power during steady-state operation and AOOs to a value that does not result in exceeding the combined steam flow capacity of the turbine (if available) and the remaining OPERABLE MSSVs. The required limitation on primary system power necessary to prevent secondary system overpressurization may be determined by system transient analyses or conservatively arrived at by a simple heat balance calculation. In some circumstances it is necessary to limit the primary side heat generation that can be achieved during an AOO by reducing the setpoint of the Power Range Neutron Flux-High reactor trip function. For example, if more than one MSSV on a single steam generator is inoperable, an uncontrolled RCCA bank withdrawal at power event occurring from a partial power level may result in an increase in reactor power that exceeds the combined steam flow capacity of the turbine and the remaining OPERABLE MSSVs. Thus, for multiple inoperable MSSVs on the same steam generator it is necessary to prevent this power increase by lowering the Power Range Neutron Flux-High setpoint to an appropriate value. If the Moderator Temperature Coefficient (MTC) is positive, the reactor power may increase above the initial value MILLSTONE - UNIT 3                          B 3/4 7-la                              Amendment No. -14+/-,
 
LBDCR 18-MP3-0ll March 26, 2019 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETYVALVES (Continued) during an RCS heatup event (e.g., turbine trip). Thus, for any number of inoperable MSSVs, it is necessary to reduce the trip setpoint if a positive MTC may exist at partial power conditions, unless it is demonstrated by analysis that a specified reactor power reduction alone is sufficient to prevent overpressurization of the steam system The MSSVs are assumed to have two active and one passive failure modes. The active failure modes are spurious opening, and failure to reclose once opened. The passive failure mode is failure to open upon demand.
The MSSVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
The accident analysis requires that five MSSVs per steam generator be OPERABLE to provide overpressure protection for design basis transients occurring at 102% RTP. The LCO requires that five MSSVs per steam generator be OPERABLE in compliance with Reference 2, and the DBA analysis.
The OPERABILITY of the MSSVs is defined as the ability to open upon demand within the setpoint tolerances, to relieve steam generator overpressure, and reseat when pressure has been reduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the Inservice Testing Program.
This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that could result in a challenge to the RCPB, or Main Steam System integrity.
APPLICABILITY In MODES 1, 2, and 3, five MSSVs per steam generator are required to be OPERABLE to prevent Main Steam System overpressurization.
In MODES 4 and 5, there are no credible transients requiring the MSSVs. The steam generators are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES.
MILLSTONE - UNIT 3                          B 3/4 7-lb                            Amendment No.
 
LBDCR 18-MP3-011 March 26, 2019 3/4. 7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETYVALVES (Continued)
ACTIONS ACTIONS are modified by a Note indicating that separate Condition entry is allowed for each MSSV With one or more MSSVs inoperable, action must be taken so that the available MSSV relieving capacity meets Reference 2 requirements for the applicable THERMAL POWER.
Operation with less than all five MSSVs OPERABLE for each steam generator is permissible, if THERMAL POWER is limited to the relief capacity of the remaining MSSVs. This is accomplished by restricting THERMAL POWER so that the energy transfer to the most limiting steam generator is not greater than the available relief capacity in that steam generator.
a In the case of only a single inoperable MSSV on one or more steam generators when the Moderator Temperature Coefficient is not positive, a reactor power reduction alone is sufficient to limit primary side heat generation such that overpressurization of the secondary side is precluded for any RCS heatup event. Furthermore, for this case there is sufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Therefore, ACTION a. requires an appropriate reduction in reactor power within 4 hours. If the power reduction is not completed within the required time, the unit must be placed in at least HOT STANDBY within the next 6 hours, and in HOT SHUTDOWN within the following 6 hours.
The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in the attachment to Reference 4 with an appropriate allowance for calorimetric power uncertainty.
The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined by the governing heat transfer relationship is the equation m
q = Llli, where q is the heat input from the primary side,    m  is the mass flow rate of the steam, and Llli is the increase in enthalpy that occurs in converting the secondary side water to steam. If it MILLSTONE - UNIT 3                          B 3/4 7-lc                              Amendment No.
 
LBDCR 18-MP3-0ll March 26, 2019 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (Continued) is conservatively assumed that the secondary side water is all saturated liquid (assuming no subcooled feedwater), then the Af1 is the heat of vaporization (hrg) at the steam relief pressure. For each steam generator, at a specified pressure, the maximum allowable power level is determined as follows:
100 QxW8 hrgN Maximum Allowable Power Level -<                  K Where:
Q = Nominal NSSS power rating of the plant (including reactor coolant pump heat), MWt K = Conversion factor, 947 .82 (B::;_~;c)
W s = Minimum total steam flow rate capability of the OPERABLE MSSVs on any one steam generator at the highest OPERABLE MSSV opening pressure including tolerance and accumulation, as appropriate, lb/sec.
hrg = Heat of vaporization at the highest MSSV opening pressure including tolerance and accumulation as appropriate, Btu/lbm.
N = Number of loops in the plant.
For use in determining the% RTP in ACTION a., the Maximum NSSS Power calculated above is reduced by 2% RTP to account for calorimetric power uncertainty.
b andc In the case of multiple inoperable MSSVs on one or more steam generators, with a reactor power reduction alone there may be insufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Furthermore, for a single inoperable MSSV on one or more steam MILLSTONE - UNIT 3                        B 3/4 7-ld                                Amendment No.
 
LBDCR 18-MP3-011 March 26, 2019 3/4. 7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (Continued) generators when the Moderator Temperature Coefficient is positive the reactor power may increase as a result of an RCS heatup event such that flow capacity of the remaining OPERABLE MSSVs is insufficient. The 4 hour completion time to reduce reactor power is consistent with ACTION a. An additional 32 hours is allowed to reduce the Power Range Neutron Flux High reactor setpoint. The total completion time of36 hours is based on a reasonable time to correct the MSSV inoperability, the time to perform the power reduction, operating experience to reset all channels of a protection function, and on the low probability of the occurrence of a transient that could result in steam generator overpressure during this period. If the required action is not completed within the associated time, the unit must be placed in at least HOT STANDBY within the next 6 hours, and in HOT SHUTDOWN within the following 6 hours.
The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in the attachment to Reference 4, with an appropriate allowance for nuclear instrumentation system trip channel uncertainties.
To determine the Table 3.7-1 Maximum Allowable Power for Required ACTIONS band c (3/4RTP), the calculated Maximum NSSS Power is reduced by 9% RTP to account for Nuclear Instrumentation System trip channel uncertainties.
ACTIONS band care modified by a Note. The Note states that the Power Range Neutron Flux High reactor trip setpoint reduction is only required in MODE 1. In MODES 2 and 3 the reactor protection system trips specified in LCO 2.2.1, "Reactor Trip System Instrumentation Setpoints,"
provide sufficient protection.
The allowed completion times are reasonable based on operating experience to accomplish the ACTIONS in an orderly manner without challenging unit systems.
d If one or more steam generators have four or more inoperable MSSVs, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least HOT STANDBY within the next 6 hours, and in HOT SHUTDOWN within the following 6 hours. The allowed completion times are reasonable, based on operating experience, to reach MILLSTONE - UNIT 3                        B 3/4 7-le                              Amendment No.
 
LBDCR 18-MP3-011 March 26, 2019 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (Continued) the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE REQUIREMENTS (SR) 4.7.1.1 This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint (Table 3.7-3) in accordance with the Inservice Testing Program. During this testing, the MSSVs are OPERABLE provided the actual lift settings are within+/- 3% of the required lift setting. The ASME Code specifies the activities and frequencies necessary to satisfy the requirements. Table 3.7-3 allows a+/- 3% setpoint tolerance for OPERABILITY; however, the valves are reset to+/- 1%
during the Surveillance to allow for drift during the next operating cycle. However, if the testing is done at the end of the operating cycle when the plant is being shut down for refueling, MILLSTONE - UNIT 3                        B 3/4 7-lf                            Amendment No.
 
REVERSE OF PAGE B 3/4 7-lf INTENTIONALLY LEFT BLANK
 
LBDCR 07-MP3-037 July 12, 2007 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETYVALVES (Continued) restoration to+/- 1% of the specified lift setting is not required for valves that will not be used (e.g.,
replaced) for the next operating cycle. While the lift settings are being restored to within the +/- 1%
of the required setting, the MSSVs remain OPERABLE provided the actual lift setting is within
+/- 3% of the required setting. The lift settings, according to Table 3.7-3, correspond to ambient conditions of the valve at nominal operating temperature and pressure.
This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.
REFERENCES
: 1.        FSAR, Section 10.3.1.
: 2.        ASME, Boiler and Pressure Vessel Code, Section III, 1971 edition.
: 3.        FSAR, Section 15.2.
: 4.      NRC Information Notice 94-60, "Potential Overpressurization of the Main Steam System," August 22, 1994.
3/4.7.1.2 AUXILIARYFEEDWATER SYSTEM The OPERABILITY of the Auxiliary Feedwater (AFW) System ensures a makeup water supply to the steam generators (SGs) to support decay heat removal from the Reactor Coolant System (RCS) upon the loss of normal feedwater supply, assuming the worst case single failure. The AFW System consists of two motor drivenAFW pumps and one steam turbine drivenAFW pump. Each motor driven AFW pump provides at least 50% of the AFW flow capacity assumed in the accident analysis. After reactor shutdown, decay heat eventually decreases so that one motor driven AFW pump can provide sufficient SG makeup flow. The steam driven AFW pump has a rated capacity approximately double that of a motor driven AFW pump and is thus defined as a 100% capacity pump.
Given the worst case single failure, the AFW System is designed to mitigate the consequences of numerous design basis accidents, including Feedwater Line Break, Loss of Normal Feedwater, Steam Generator Tube Rupture, Main Steam Line Break, and Small Break Loss of Coolant Accident.
MILLSTONE - UNIT 3                          B 3/4 7-2                    Amendment No. ~ . H9, W,
 
LBDCR 14-MP3-006 July 8, 2014 PLANT SYSTEMS BASES AUXILIARY FEEDWATER SYSTEM (Continued)
In addition, given the worst case failure, the AFW is designed to supply sufficient makeup water to replace SG inventory loss as the RCS is cooled to less than 350&deg;F at which point the Residual Heat Removal System may be placed into operation.
Motor driven auxiliary feedwater pumps and associated flow paths are OPERABLE in the following alignment during normal operation below 10% RATED THERMAL POWER.
* Motor operated isolation valves (3FWA *MOV35A/B/C/D) are open in MODE 1, 2 and 3,
* Control valves (3FWA *HV31A/B/C/D) may be throttled or closed during alignment, operation and restoration of the associated motor drivenAFW pump for steam generator inventory control.
The motor operated isolation valves must remain fully open due to single failure criteria (the valves and associated pump are powered from the opposite electrical trains).
The Turbine Driven Auxiliary Feedwater (TDAFW) pump and associated flow paths are OPERABLE with all control and isolation valves fully open in MODE 1, 2 and 3. Due to High Energy Line Break analysis, the TDAFW pump cannot be used for steam generator inventory control during normal operation below 10% RATED THERMAL POWER.
At MPS 3, only two of the three available steam supplies are required to establish an OPERABLE steam supply system. With one of the two required steam supplies inoperable, normally the third steam supply will be used to satisfy the requirement for two OPERABLE steam supplies. If the third steam supply is also inoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwater pump is OPERABLE), then ACTION a. is entered.
If the turbine-driven auxiliary feedwater pump is inoperable due to one required steam supply being inoperable in MODES 1, 2, and 3, or if a turbine-driven auxiliary feedwater pump is inoperable while in MODE 3 immediately following REFUELING, action must be taken to restore the inoperable equipment to an OPERABLE status within 7 days. The 7 day allowed outage time is reasonable, based on the following reasons:
MILLSTONE - UNIT 3                          B 3/4 7-2a              Amendment No. ~ . , SG,
 
LBDCR No. 04-MP3-0l 1 November 10, 2005 PLANT SYSTEMS BASES AUXILIARY FEEDWATER SYSTEM (Continued)
: a.      For the inoperability of the turbine-driven auxiliary feedwater pump due to one required steam supply to the turbine-driven auxiliary feedwater pump being inoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwater pump is operable), the 7 day allowed outage time is reasonable since the auxiliary feedwater system design affords adequate redundancy for the steam supply line for the turbine-driven pump.
: b.      For the inoperability of a turbine-driven auxiliary feedwater pump while in MODE 3 immediately subsequent to a refueling, the 7 day allowed outage time is reasonable due to the minimal decay heat levels in this situation.
: c.      For both the inoperability of the turbine-driven auxiliary feedwater pump due to one required steam supply to the turbine-driven auxiliary feedwater pump being inoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwater pump is operable), and an inoperable turbine-driven auxiliary feedwater pump while in MODE 3 immediately following a refueling outage, the 7 day allowed outage time is reasonable due to the availability ofredundant OPERABLE motor driven auxiliary feedwater pumps, and due to the low probability of an event requiring the use of the turbine-driven auxiliary feedwater pump.
The required ACTION dictates that if either the 7 day allowed outage time is reached the unit must be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 12 hours.
The allowed time is reasonable, based on operating experience, to reach the required conditions from full power conditions in an orderly manner and without challenging plant systems.
A Note limits the applicability of the inoperable equipment condition b. to when the unit has not entered MODE 2 following a REFUELING. Required ACTION b. allows one auxiliary feedwater pump to be inoperable for 7 days vice the 72 hour allowed outage time in required ACTION c. This longer allowed outage time is based on the reduced decay heat following REFUELING and prior to the reactor being critical.
With one of the auxiliary feedwater pumps inoperable in MODE 1, 2, or 3 for reasons other than ACTION a. orb., ACTION must be taken to restore OPERABLE status within 72 hours. This includes the loss of three steam supply lines to the turbine-driven auxiliary feedwater pump. The 72 hour allowed outage time is reasonable, based on redundant capabilities afforded by the auxiliary feedwater system, time needed for repairs, and the low probability of a DBA occurring during this time period. Two auxiliary feedwater pumps and flow paths remain to supply feedwater to the steam generators.
MILLSTONE - UNIT 3                          B 3/4 7-2b                  Amendment No. -W;, -H-9, -MO,
 
LBDCR 12-MP3-010 September 20, 2012 PLANT SYSTEMS BASES AUXILIARY FEEDWATER SYSTEM (Continued)
If all three AFW pumps are inoperable in MODE 1, 2, or 3, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with non safety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW pump to OPERABLE status. Required ACTION e. is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW pump is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into a less safe condition.
SR 4.7.1.2.la. verifies the correct alignment for manual, power operated, and automatic valves in the auxiliary feedwater water and steam supply flow paths to provide assurance that the proper flow paths exist for auxiliary feedwater operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulations; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
The SR is modified by a Note that states one or more auxiliary feedwater pumps may be considered OPERABLE during alignment and operation for steam generator level control, if it is capable of being manually (i.e., remotely or locally, as appropriate) realigned to the auxiliary feedwater mode of operation, provided it is not otherwise inoperable. This exception to pump OPERABILITY allows the pump(s) and associated valves to be out of their normal standby alignment and temporarily incapable of automatic initiation without declaring the pump(s) inoperable. Since auxiliary feedwater may be used during STARTUP, SHUTDOWN, HOT STANDBY operations, and HOT SHUTDOWN operations for steam generator level control, and these manual operations are an accepted function of the auxiliary feedwater system, OPERABILITY (i.e., the intended safety function) continues to be maintained.
MILLSTONE - UNIT 3                          B 3/4 7-2c                              Amendment No.
 
LBDCR 14-MP3-006 July 8, 2014 AUXILIARY FEEDWATER SYSTEM (Continued)
Surveillance Requirement 4. 7.1.2.1.b, which addresses periodic surveillance testing of the AFW pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems, is required by the ASME OM Code. This type of testing may be accomplished by measuring the pump developed head at only one point on the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pumps baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the unit safety analysis. The surveillance requirements are specified in the Inservice Testing Program, which encompasses the ASME OM Code. The ASME OM Code provides the activities and frequencies necessary to satisfy the requirements.
This surveillance is modified by a note to indicate that the test can be deferred for the steam driven AFW pump until suitable plant conditions are established. This deferral is required because steam pressure is not sufficient to perform the test until after MODE 3 is entered.
However, the test, ifrequired, must be performed prior to entering MODE 2.
Surveillance Requirement 4. 7 .1.2.1.c demonstrates that each AFW pump starts on receipt of an actual or simulated actuation signal. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program.
Surveillance Requirement 4. 7.1.2.2 demonstrates the AFW System is properly aligned by verifying the flow path to each steam generator prior to entering MODE 2 after more than 30 days in any combination of MODE 5 or 6 or defueled. OPERABILITY of the AFW flow paths must be verified before sufficient core heat is generated that would require operation of the AFW System during a subsequent shutdown. To further ensure AFW System alignment, the OPERABILITY of the flow paths is verified following extended outages to determine that no misalignment of valves has occurred. The frequency is reasonable, based on engineering judgement, and other administrative controls to ensure the flow paths are OPERABLE.
MILLSTONE - UNIT 3                          B 3/4 7-2d
 
LBDCR 14-MP3-006 July 8, 2014 PLANT SYSTEMS BASES 3/4.7.1.3 DEMINERALIZED WATER STORAGE TANK The OPERABILITY of the demineralized water storage tank (DWST) with a 334,000 gallon minimum measured water volume ensures that sufficient water is available to maintain the reactor coolant system at HOT STANDBY conditions for 7 hours with steam discharge to the atmosphere, concurrent with a total loss-of-offsite power, and with an additional 6-hour cooldown period to reduce reactor coolant temperature to 350&deg;F. The 334,000 gallon required water volume contains an allowance for tank inventory not usable because of tank discharge line location, other tank physical characteristics, and surveillance measurement uncertainty considerations. The inventory requirement is conservatively based on 120&deg;F water temperature which maximizes inventory required to remove RCS decay heat. In the event of a feedline break, this inventory requirement includes an allowance for 30 minutes of spillage before operator action is credited to isolate flow to the line break.
If the combined condensate storage tank (CST) and DWST inventory is being credited, there are 50,000 gallons of unusable CST inventory due to tank discharge line location, other physical characteristics, level measurement uncertainty and potential measurement bias error due to the CST nitrogen blanket. To obtain the Surveillance Requirement 4.7.l.3.2's DWST and CST combined volume, this 50,000 gallons of unusable CST inventory has been added to the 334,000 gallon DWSTwater volume specified in LCO 3.7.1.3 resulting in a 384,000 gallons requirement (334,000 + 50,000 = 384,000 gallons).
3/4.7.1.4 SPECIFICACTMTY The limitations on Secondary Coolant System specific activity ensure that the resultant offsite radiation dose will be limited to 10 CFR 50.67 and Regulatory Guide 1.183 dose guideline values in the event of a steam line rupture. This dose also includes the effects of a coincident 1 gpm primary-to-secondary tube leak in the steam generator of the affected steam line. These values are consistent with the assumptions used in the safety analyses.
MILLSTONE - UNIT 3                          B 3/4 7-2e
 
LBDCR No. 08-MP3-032 October 28, 2008 PLANT SYSTEMS BASES 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES BACKGROUND The main steam line isolation valves (MSIVs) isolate steam flow from the secondary side of the steam generators following a high energy line break (HELB). MSIV closure terminates flow from the unaffected (intact) steam generators.
One MSIV is located in each main steam line outside, but close to, containment. The MSIVs are downstream from the main steam safety valves (MSSVs) and auxiliary feedwater (AFW) pump turbine steam supply, to prevent MSSV andAFW isolation from the steam generators by MSIV closure. Closing the MSIVs isolates each steam generator from the others, and isolates the turbine, Steam Bypass System, and other auxiliary steam supplies from the steam generators.
The MSIVs close on a main steam isolation signal generated by low steam generator pressure, high containment pressure, or steam line pressure negative rate (high). The MSIVs fail closed on loss of control or actuation power.
Each MSIV has an MSIV bypass valve. Although these bypass valves are normally closed, they receive the same emergency closure signal as do their associated MSIVs. The MSIVs may also be actuated manually.
A description of the MSIVs is found in the FSAR, Section 10.3.
APPLICABLE SAFETY ANALYSIS The design basis of the MSIVs is established by the containment analysis for the large steam line break (SLB) inside containment, discussed in the FSAR, Section 6.2. It is also affected by the accident analysis of the SLB events presented in the FSAR, Section 15 .1.5. The design precludes the blowdown of more than one steam generator, assuming a single active component failure (e.g., the failure of one MSIVto close on demand).
The limiting temperature case for the containment analysis is the SLB inside containment, at 102% power with mass and energy releases based on offsite power available following turbine trip, and failure of the MSIV on the affected steam generator to close.
At hot zero power, the steam generator inventory and temperature are at their maximum, maximizing the analyzed mass and energy release to the containment. Due to reverse flow and failure of the MSIV to close, the additional mass and energy in the steam headers downstream from the other MSIV contribute to the total release. With the most reactive rod cluster control assembly assumed stuck in the fully withdrawn position, there is an increased possibility that the core will become critical and return to power. The reactor is ultimately shut down by the boric acid injection delivered by the Emergency Core Cooling System.
MILLSTONE - UNIT 3                        B 3/4 7-3                    Amendment No.
 
LBDCR No. 04-l\1P3-015 February 24, 2005 PLANT SYSTEMS BASES 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued)
The accident analysis compares several different SLB events against different acceptance criteria.
The large SLB outside containment upstream of the MSIVs is limiting for offsite dose, although a break in this short section of main steam header has a very low probability. The large SLB upstream of the MSIV at hot zero power is the limiting case for a post trip return to power. The analysis includes scenarios with offsite power available and with a loss of offsite power following turbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolant through the steam generators, maximizing the Reactor Coolant System cooldown. With a loss of offsite power, the response of mitigating systems is delayed. Significant single failures considered include failure of an MSIV to close.
The MSIVs serve only a safety function and remain open during POWER OPERATION. These valves operate under the following situations:
: a.      An HELB inside containment. In order to maximize the mass and energy release into containment, the analysis assumes that the MSIV in the affected steam generator remains open. For this accident scenario, steam is discharged into containment from all steam generators until the remaining MSIVs close. After MSIV closure, steam is discharged into containment only from the affected steam generator and from the residual steam in the main steam header downstream of the closed MSIVs in the unaffected loops. Closure of the MSIVs isolates the break from the unaffected steam generators.
: b.      A break outside of containment and upstream from the MSIVs is not a containment pressurization concern. The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown and positive reactivity addition. Closure of the MSIVs isolates the break and limits the blowdown to a single steam generator.
: c.      A break downstream of the MSIVs will be isolated by the closure of the MSIVs.
: d.      Following a steam generator tube rupture, closure of the MSIVs isolates the ruptured steam generator from the intact steam generators. In addition to minimizing radiological releases, this enables the operator to maintain the pressure of the steam generator with the ruptured tube below the MSSV setpoints, a necessary step toward isolating the flow through the rupture.
: e.      The MSIVs are also utilized during other events, such as a feedwater line break. This event is less limiting so far as MSIV OPERABILITY is concerned.
MILLSTONE - UNIT 3                          B 3/4 7-4                          AmendmentNo.-l-l-9,-1-36, Acknowledged by NRC letter dated 08/25/05
 
LBDCR 16-MP3-014 January 5, 2017 PLANT SYSTEMS BASES 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued)
This LCO requires that four MSIVs in the steam lines be OPERABLE. The MSIVs are considered OPERABLE when the isolation times are within limits, and they close on an isolation actuation signal.
This LCO provides assurance that the MSIVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 10 CFR 50.67 and Regulatory Guide 1.183 limits or the NRC Staff approved licensing basis.
APPLICABILITY The MSIVs must be OPERABLE in MODE 1 and in MODES 2, 3, and 4 except when closed and deactivated when there is significant mass and energy in the RCS and steam generators. When the MSIVs are closed, they are already performing the safety function.
In MODES 1, 2, and 3 the MSIVs are required to close within 10 seconds to ensure the accident analysis assumptions are met. In MODE 4, the MSIVs are required to close within 120 seconds to ensure the accident analysis assumptions are met. An engineering evaluation has determined that a Reactor Coolant System (RCS) temperature greater than or equal to 320&deg;F is required to provide sufficient steam energy to provide the motive force to operate the MSIVs. Therefore, below an RCS temperature of 320&deg;F the MSIVs are not OPERABLE and are required to be closed.
In MODE 5 or 6, the steam generators do not contain much energy because their temperature is below the boiling point of water; therefore, the MSIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.
ACTIONS MODEl With one MSIV inoperable in MODE 1, action must be taken to restore OPERABLE status within 8 hours. Some repairs to the MSIV can be made with the unit hot. The 8 hour Completion Time is reasonable, considering the low probability of an accident occurring during this time period that would require a closure of the MSIVs.
The 8 hour Completion Time is greater than that normally allowed for containment isolation valves because the MSIVs are valves that isolate a closed system penetrating containment. These valves differ from other containment isolation valves in that the closed system provides a passive barrier for containment isolation.
MILLSTONE - UNIT 3                        B 3/4 7-5            AmendmentNo.-H-9,-l-36,-l-48-,-l-8&sect;.
 
10/19/00 PLANT SYSTEMS BASES 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued)
If the MSIV cannot be restored to OPERABLE status within 8 hours, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours. The Completion Times are reasonable, based on operating experience, to reach MODE 2 and to close the MSIVs in an orderly manner and without challenging plant systems.
MODES 2. 3. and 4 Since the MSIVs are required to be OPERABLE in MODES 2, 3, and 4, the inoperable MSIVs may either be restored to OPERABLE status or closed. When closed, the MSIVs are already in the position required by the assumptions in the safety analysis. The MSIVs may be opened to perform Surveillance Requirement 4.7.1.5.2.
The 8 hour Completion Time is consistent with that allowed in MODE 1.
For inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, the inoperable MSIVs must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day verification time is reasonable, based on engineering judgment, in view of MSIV status indications available in the control room, and other administrative controls, to ensure that these valves are in the closed position.
If the MSIVs cannot be restored to OPERABLE status or are not closed within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed at least in MODE 3 within 6 hours, and in MODE 5 within the next 30 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems. The Action Statement is modified by a note indicating that separate condition entry is allowed for each MSIV.
SURVEILLANCE REQUIREMENTS 4.7.1.5.1 DELETED MILLSTONE - UNIT 3                        B 3/4 7-6          AmendmentNo.H-9,-1-36,-l-4&, 185
 
10/19/00 PLANT SYSTEMS BASES SURVEILLANCE REQUIREMENTS (continued) 4.7.1.5.2 This surveillance demonstrates that MSIV closure time is less than 10 seconds (120 seconds for MODE 4 only) on an actual or simulated actuation signal, when tested pursuant to Specification 4.0.5. A simulated signal is defined as any of the following engineering safety features actuation system instrumentation functional units per Technical Specifications Table 4.3-2: 4.a.1) manual initiation, individual, 4.a.2) manual initiation system, 4.c. containment pressure high-2, 4.d. steam line pressure low, or 4.e. steam line pressure-negative rate high. The MSIV closure time is assumed in the accident analyses. This surveillance is normally performed upon returning the plant to operation following a refueling outage. The test is normally conducted in MODES 3 or 4 with the plant at suitable (appropriate) conditions (e.g., pressure and temperature). The MSIVs should not be tested at power, since even a part stroke exercise increases the risk of valve closure when the unit is generating power.
This surveillance requirement is modified by an exception that will allow entry into and operation in MODES 3 and 4 prior to performing the test to establish conditions consistent with those under which the acceptance criterion was generated. Successful performance of this test within the required frequency is necessary to operate in MODES 3 and 4 with the MSIVs open, to enter MODE 2 from MODE 3, and for plant operation in MODE 1. If this surveillance has not been successfully performed within the required frequency, the MSIVs are inoperable and are required to be closed.
In MODE 4 only, the MSIVs can be considered OPERABLE if the closure time is less than 120 seconds. An engineering evaluation has determined that a RCS temperature greater than or equal to 320&deg;F is required to provide sufficient steam energy to provide the motive force to operate the MSIVs. Therefore, below an RCS temperature of 320&deg;F the MSIVs are not OPERABLE and are required to be closed.
MILLSTONE - UNIT 3                          B 3/4 7-6a              Amendment No. H-6, 4&, 185
 
REVERSE OF PAGE B 3/4 7-6a INTENTIONALLY LEFT BLANK
 
LBDCR No. 04-MP3-015 February 24, 2005 PLANT SYSTEMS BASES 3/4.7.1.6 STEAM GENERATOR ATMOSPHERIC RELIEF BYPASS LINES The OPERABILITY of the steam generator atmospheric relief bypass valve (SGARBV) lines provides a method to recover from a steam generator tube rupture (SGTR) event during which the operator is required to perform a limited cooldown to establish adequate subcooling as a necessary step to limit the primary to secondary break flow into the ruptured steam generator.
The time required to limit the primary to secondary break flow for an SGTR event is more critical than the time required to cooldown to RHR entry conditions. Because of these time constraints, these valves and associated flow paths must be OPERABLE from the control room. The number of SGARBVs required to be OPERABLE from the control room to satisfy the SGTR accident analysis requires consideration of single failure criteria. Four SGARBV are required to be OPERABLE to ensure the credited steam release pathways available to conduct a unit cooldown following a SGTR.
For other design events, the SGARBVs provide a safety grade method for cooling the unit to residual heat removal (RHR) entry conditions should the preferred heat sink via the steam bypass system or the steam generator atmospheric relief valves be unavailable. Prior to operator action to cooldown, the main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain the steam generator pressure below design limits.
Each SGARBV line consists of one SGARBV and an associated block valve (main steam atmospheric relief isolation valve, 3MSS*MOV18A/B/C/D). These block valves are used in the event a steam generator atmospheric relief valve (SGARV) or SGARBV fails to close. Because of the electrical power relationship between the SGARBV and the block valves, if a block valve is maintained closed, the SGARBV flow path is inoperable because of single failure consideration.
The bases for the required ACTIONS can be found in NUREG 1431, Rev. 1.
The LCO APPLICABILITY and ACTION statements uses the terms "MODE 4 when steam generator is relied upon for heat removal" and "in MODE 4 without reliance upon steam generator for heat removal." This means that those steam generators which are credited for decay heat removal to comply with LCO 3 .4.1.3 (Reactor Coolant System, HOT SHUIDOWN) shall have an OPERABLE SGARBV line. See Bases Section 3/4.4.1 for more detail.
3/4.7.2 DELETED MILLSTONE - UNIT 3                        B 3/4 7-7              Amendment No. 3/4, -l-48-, &sect;-l, ~ .
Acknowledged by NRC letter dated 08/25/05
 
LBDCR 3-22-02 March 14, 2002 PLANT SYSTEMS BASES 3/4.7.3 REACTOR PLANT COMPONENT COOLING WATER SYSTEM The OPERABILITY of the Reactor Plant Component Cooling Water System ensures that sufficient cooling capacity is available for continued operation of safety-related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the safety analyses.
The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System is required to be available to support reactor plant component cooling water pump operation. The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System consists of two redundant trains, each capable of providing 100% of the required flow. Each train has a two position, "Off" and "Auto," remote control switch. With the remote control switches for each train in the "Auto" position, the system is capable of automatically transferring operation to the redundant train in the event of a low flow condition in the operating train. The associated fans do not receive any safety related automatic start signals (e.g., Safety Injection Signal).
Placing the remote control switch for a Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train in the "Off' position to start the redundant train or to perform post maintenance testing to verify availability of the redundant train will not affect the availability of that train, provided appropriate administrative controls have been established to ensure the remote control switch is immediately returned to the "Auto" position after the completion of the specified activities or in response to plant conditions. These administrative controls include the use of an approved procedure and a designated individual at the control switch for the respective Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respond to instructions from procedures, or control room personnel, based on plant conditions.
3/4.7.4 SERVICE WATER SYSTEM The OPERABILITY of the Service Water System ensures that sufficient cooling capacity is available for continued operation of safety-related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the safety analyses.
An OPERABLE service water loop requires one OPERABLE service water pump and associated strainer. Two OPERABLE service water loops, with one OPERABLE service water pump and associated strainer per loop, will provide sufficient core (and containment) decay heat removal during a design basis accident coincident with a loss of offsite power and a single failure.
MILLSTONE - UNIT 3                          B 3/4 7-7a                            Amendment No. 5--l-,
Acknowledged by NRC letter dated 08/25/05
 
LBDCR No. 13-MP3-002 May 2, 2013 PLANT SYSTEMS BASES 3/4.7.5 ULTIMATE HEAT SINK BACKGROUND The ultimate heat sink (UHS) for Millstone Unit No. 3 is Long Island Sound. The Long Island Sound is connected to the Atlantic Ocean and provides the required 30 day supply of water. It serves as a heat sink for both safety and nonsafety-related cooling systems. Sensible heat is discharged to the UHS via the service water (SW) and circulating water (CW) systems.
The basic performance requirement is that a 30 day supply of water be available, and that the design basis temperatures of safety related equipment not be exceeded.
Additional information on the design and operation of the system, along with a list of components served, can be found in References 1, 2, and 3.
APPLICABLE SAFETY ANALYSES The UHS is the sink for heat removed from the reactor core following all accidents and anticipated operational occurrences in which the unit is cooled down and placed on residual heat removal (RHR) operation. With UHS as the normal heat sink for condenser cooling via the CW System, unit operation at full power is its maximum heat load. Its maximum post accident heat load occurs <1 hour after a design basis loss of coolant accident (LOCA). Near this time, the unit switches from injection to recirculation and the containment recirculation system removes the core decay heat.
The operating limits are based on conservative heat transfer analyses for the worst case LOCA.
References 1, 2, and 3 provide the details of the assumptions used in the analysis, which include worst expected meteorological conditions, conservative uncertainties when calculating decay heat, and worst case single active failure (e.g., single failure of a man-made structure).
The limitations on the temperature of the UHS ensure that the assumption for temperature used in the analyses for cooling of safety related components by the SW system are satisfied. These analyses ensure that under normal operation, plant cooldown, or accident conditions, all components cooled directly or indirectly by SW will receive adequate cooling to perform their design basis functions.
The UHS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
The UHS is required to be OPERABLE and is considered OPERABLE if it contains a sufficient volume of water at or below the maximum temperature that would allow the SW System to operate for at least 30 days following the design basis LOCA without the loss of net positive MILLSTONE - UNIT 3                          B 3/4 7-8                          Amendment No.-!3/4
 
REVERSE OF PAGE B 3/4 7-8 INTENTIONALLY LEFT BLANK
 
LBDCR No. 13-MP3-002 May 2, 2013 PLANT SYSTEMS BASES LCO (Continued) suction head (NPSH), and without exceeding the maximum design temperature of the equipment served by the SW System. To meet this condition, the UHS temperature should not exceed 80&deg;F during normal unit operation.
While the use of any supply side SW temperature indication is adequate to ensure compliance with the analysis assumptions, precision instruments installed at the inlet to the reactor plant closed cooling water (RPCCW) (CCP) heat exchanges will normally be used.
Therefore, instrument uncertainty need not be factored into the surveillance acceptance criteria. All in-service instruments must be within the limit. If all of the precision instruments are out of service, alternative instruments that measure SW supply side temperature will be used. In this case, an appropriate instrument uncertainty will be subtracted from the acceptance criteria.
Since Long Island Sound temperature changes relatively slowly and in a predictable fashion according to the tides, it is acceptable to monitor this temperature daily when there is ample
(>5&deg;F) margin to the limit. When within 5&deg;F of the limit, the temperature shall be monitored every 6 hours to ensure that tidal variations are appropriately captured.
APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is required to support the OPERABILITY of the equipment serviced by the UHS and required to be OPERABLE in these MODES.
In MODE 5 or 6, the OPERABILITY requirements of the UHS are determined by the systems its supports.
ACTION If the UHS is inoperable, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hours and in COLD SHUTDOWN within the following 30 hours.
The allowed outage times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
MILLSTONE - UNIT 3                        B 3/4 7-9                            Amendment No. -l-36, Aeknovtledged by NR{J letter dated 08/25/05
 
LBDCR 13-MP3-002 May 2, 2013 PLANT SYSTEMS BASES SURVEILLANCE REQUIREMENTS This surveillance requirement verifies that the UHS is capable of providing a 30 day cooling water supply to safety related equipment without exceeding its design basis temperature. This surveillance requirement verifies that the water temperature of the UHS is :'.S 80&deg;F.
REFERENCES
: 1. FSAR, Section 6.2, Containment Systems
: 2. FSAR, Section 9 .2, Water Systems
: 3. FSAR, Section 15.6, Decrease in Reactor Coolant Inventory 3/4.7.6 DELETED 3/4. 7 .7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM BACKGROUND The control room emergency ventilation system provides a protected environment from which operators can control the unit following an uncontrolled release of radioactivity, hazardous chemicals, or smoke. Additionally, the system provides temperature control for the control room envelope (CRE) during normal and post-accident operations.
The control room emergency ventilation system is comprised of the CRE emergency air filtration system and a temperature control system.
The control room emergency air filtration system consists of two redundant systems that recirculate and filter the air in the CRE and a CRE boundary that limits the inleakage of unfiltered air. Each control room emergency air filtration system consists of a moisture separator, electric heater, prefilter, upstream high efficiency particulate air (HEPA) filter, charcoal adsorber, downstream HEPA filter, and fan. Additionally, ductwork, valves or dampers, and instrumentation form part of the system.
The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and other non-critical areas including adjacent support offices, MILLSTONE - UNIT 3                          B 3/4 7-10              Amendment No. -H-9, 6, -144, ;?,14
 
LBDCR No. 08-MP3-014 October 21, 2008 PLANT SYSTEMS BASES 3/4. 7. 7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)
BACKGROUND (Continued) toilet and utility rooms. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, ceiling, ducting, valves, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program and UFSAR Section 6.4.2.1.
Normal Operation A portion of the control room emergency ventilation system is required to operate during normal operations to ensure the temperature of the control room is maintained at or below 95&deg;F.
Post Accident Operation The control room emergency ventilation system is required to operate during post-accident operations to ensure the temperature of the CRE is maintained and to ensure the CRE will remain habitable during and following accident conditions.
The following event occurs upon receipt of a control building isolation (CBI) signal or a signal indicating high radiation in the air supply duct to the CRE.
The control room emergency ventilation system will automatically start in the emergency mode (filtered pressurization whereby outside air is diverted through the filters to the CRE to maintain a positive pressure).
APPLICABLE SAFETY ANALYSIS The OPERABILITY of the Control Room Emergency Ventilation System ensures that: (1) the ambient air temperature does not exceed the allowable temperature for continuous-duty rating for the equipment and instrumentation cooled by this system, and (2) the CRE will remain MILLSTONE - UNIT 3                        B 3/4 7-11                AmendmentNo.H6,U9-;
 
LBDCR No. 08-MP3-014 October 21, 2008 PLANT SYSTEMS BASES 3/4. 7. 7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)
APPLICABLE SAFETY ANALYSIS (Continued) habitable for occupants during and following all credible accident conditions. The OPERABILITY of this system in conjunction with control room design provisions is based on limiting the radiation exposure to CRE occupants. For all postulated design basis accidents, the radiation exposure to CRE occupants shall be 5 rem TEDE or less, consistent with the requirements of 10 CFR 50.67. This limitation is consistent with the requirements of General Design Criterion 19 of Appendix A, 10 CFR Part 50.
LIMITING CONDITION FOR OPERATION Two independent control room emergency air filtration systems are required to be OPERABLE to ensure that at least one is available in the event the other system is disabled.
Total system failure, such as from a loss of both ventilation trains or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem TEDE to the CRE occupants in the event of a large radioactive release.
A control room emergency air filtration system is OPERABLE when the associated:
: a.      Fan is OPERABLE;
: b.        HEPA filters and charcoal adsorbers are not excessively restricting flow and are capable of performing their filtration functions; and
: c.        moisture separator, heater, ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.
In order for the CREVs to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.
TS LCO 3. 7. 7 is modified by a footnote allowing the CRE boundary to be opened intermittently under administrative controls. This footnote only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, MILLSTONE - UNIT 3                          B 3/4 7-12                Amendment No. -l-36, ~ . i-1-9,
 
LBDCR No. 08-MP3-014 October 21, 2008 PLANT SYSTEMS BASES 3/4. 7. 7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)
LIMITING CONDITION FOR OPERATION (Continued) floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.
Operation of the Control Room Emergency Ventilation System in the emergency mode is credited for design basis accident mitigation. The fuel handling accident analyses assume the emergency mode will be established within 30 minutes of a fuel handling accident. The other applicable design basis accidents (e.g., large break loss of coolant accident) assume the emergency mode will be established within 101 minutes of the accident. Even though manual operator action to establish the emergency mode could be credited within these time periods, the system has been designed to automatically establish the required equipment alignment upon receipt of a Control Building Isolation signal. Therefore, when stopping a Control Room Emergency Filter Fan by placing the control switch in OFF, the fan remains OPERABLE. The administrative controls associated with the procedure in use to stop the fan are sufficient to ensure the associated control switch is returned to the AUTO position.
In addition, the Emergency Operating Procedure will ensure a Control Room Emergency Filter fan is running in the emergency mode post accident well within the credited accident mitigation time frame.
Control Room inlet isolation valves 3HVC* AOV25 and 3HVC* AOV26 are maintained open with air isolated whenever Technical Specification 3. 7. 7 is applicable. The only procedural guidance to close 3HVC* AOV25 when this specification is applicable is in the alarm response procedure for smoke in the control room air inlet ventilation duct. The alarm response procedure will provide direction to establish the filtered recirculation mode of operation by restoring air and closing 3HVC*AOV25. During this limited time period, both Control Room Emergency Filtration trains remain OPERABLE, but degraded. Even though 3HVC* AOV25 is closed, it is a fail open valve and will automatically open on a Control Building Isolation signal, making it OPERABLE. However, should it to fail open, the system will not function. Therefore, it is not single failure proof and is degraded. Operation in this condition should be minimized.
MILLSTONE - UNIT 3                      B 3/4 7-12a            Amendment No. He, ~ . ~ .
 
REVERSE OF PAGE B 3/4 7-12a INTENTIONALLY LEFT BLANK
 
LBDCR 10-MP3-003 February 23, 2010 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)
APPLICABILITY In MODES 1, 2, 3, and 4.
During movement of recently irradiated fuel assemblies.
ACTIONS a., b., and c. of this specification are applicable at all times during plant operation in MODES 1, 2, 3, and 4. ACTIONS d. and e. are applicable during movement of recently irradiated fuel assemblies. The CREVs is required to be OPERABLE during fuel handling involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 350 hours*).
An analysis was completed that analyzed a bounding drop of a non-spent fuel component. The analysis showed that the amount of fuel damage from this drop resulted in control room dose less than 5 rem TEDE without operation of the control room ventilation system.
ACTIONS MODES      1. 2, 3, and 4
: a.      With one control room emergency air filtration system inoperable for reasons other than an inoperable CRE boundary, action must be taken to restore the inoperable system to an OPERABLE status within 7 days. In this condition, the remaining control room emergency air filtration system is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a single failure in the OPERABLE train could result in a loss of the control room emergency air filtration system function. The 7-day completion time is based on the low probability of a DBA occurring during this time period, and the ability of the remaining train to provide the required capability.
If the inoperable train cannot be restored to an OPERABLE status within 7 days, the unit must be placed in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. These completion times are reasonable, based on operating experience, to reach the required unit condition from full power conditions in an orderly manner and without challenging unit systems.
* During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a critical reactor core within the previous 525 hours.
MILLSTONE - UNIT 3                          B 3/4 7-13                    AmendmentNo.-l-3/4,+/-(B,U9
 
LBDCR 07-MP3-033 June 25, 2007 PLANT SYSTEMS BASES 3/4.7.7 CONTROLROOMEMERGENCYVENTILATION SYSTEM (Continued)
ACTIONS (Continued)
: b.      With both control room emergency air filtration systems inoperable, except due to an inoperable CRE boundary, at least one control room emergency air filtration system must be restored to OPERABLE status within 1 hour, or the unit must be in HOT STANDBY within the next 6 hours and in COLD SHUIDOWN within the following 30 hours. These completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
: c. With one or more control room emergency air filtration systems inoperable due to an inoperable CRE boundary, (1) action must be immediately initiated to implement mitigating actions; (2) action must be taken within 24 hours to verify mitigating actions ensure CRE occupant exposures to radiological and chemical hazards will not exceed limits, and mitigating actions are taken for exposure to smoke hazards; and (3) the CRE boundary must be restored to OPERABLE status within 90 days. Otherwise, the unit must be in HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.
If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses ofDBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.
During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect MILLSTONE - UNIT 3                        B 3/4 7-13a              Amendment No. 3-6, -l-8--1-, ~ . U-9,
 
LBDCR 12-MP3-010 September 20, 2012 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)
ACTIONS (Continued) their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.
Immediate action(s), in accordance with the LCO ACTION Statements, means that the required action should be pursued without delay and in a controlled manner.
During movement of recently irradiated fuel assemblies
: d.      With one control room emergency air filtration system inoperable, action must be taken to restore the inoperable system to an OPERABLE status within 7 days. After 7 days, either initiate and maintain operation of the remaining OPERABLE control room emergency air filtration system in the emergency mode or suspend the movement of fuel. Initiating and maintaining operation of the OPERABLE train in the emergency mode ensures:
(i) OPERABILITY of the train will not be compromised by a failure of the automatic actuation logic; and (ii) active failures will be readily detected.
: e.      With both control room emergency air filtration systems inoperable, or with the train required by ACTION 'd' not capable of being powered by an OPERABLE emergency power source, actions must be taken to suspend all operations involving the movement of recently irradiated fuel assemblies. This action places the unit in a condition that minimizes risk. This action does not preclude the movement of fuel to a safe position.
SURVEILLANCE REQUIREMENTS 4.7.7.a The CRE environment should be checked periodically to ensure that the CRE temperature control system is functioning properly. The surveillance frequency is controlled under the Surveillance Frequency Control Program. It is not necessary to cycle the CRE ventilation chillers. The CRE is manned during operations covered by the technical specifications. Typically, temperature aberrations will be readily apparent.
4.7.7.b Standby systems should be checked periodically to ensure that they function properly. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
MILLSTONE - UNIT 3                            B 3/4 7-13b                            Amendment No.
 
LBDCR 18-iv.1P3-009 February 21, 2019 PLANT SYSTEMS BASES 3/4. 7 .7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)
SURVEILLANCE REQUIREMENTS (Continued)
This surveillance requirement verifies a system flow rate of 1,120 cfm +/- 20%. Operation with the heaters on for greater than or equal to 15 continuous minutes demonstrates OPERABILITY of the system. Periodic operation ensures that heater failure, blockage, fan or motor failure, or excessive vibration can be detected for corrective action. Since adsorption testing is performed at 70% relative humidity, the filter heaters are required to operate.
4.7.7.c The performance of the control room emergency filtration systems should be checked periodically by verifying the HEPA filter efficiency, charcoal adsorber efficiency, minimum flow rate, and the physical properties of the activated charcoal. The frequency is as specified in the Surveillance Frequency Control Program and following painting, fire, or chemical release in any ventilation zone communicating with the system.
ANSI N510-1980 will be used as a procedural guide for surveillance testing.
Any time the OPERABILITY of a HEPA filter or charcoal adsorber housing has been affected by repair, maintenance, modification, or replacement activity, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY.
4.7.7.c.1 This surveillance verifies that the system satisfies the in-place penetration and bypass leakage testing acceptance criterion ofless than 0.05% in accordance with Regulatory Position C.5.a, C.5.c, and C.5.d of Regulatory Guide 1.52, Revision 2, March 1978, while operating the system at a flow rate of 1,120 cfm +/- 20%. ANSI N510-1980 is used in lieu of ANSI N510-1975 referenced in the regulatory guide.
4.7.7.c.2 This surveillance requires that a representative carbon sample be obtained in accordance with Regulatory Position C.6.b of Regulatory Guide 1.52, Revision 2, March 1978 and that a laboratory analysis verify that the representative carbon sample meets the laboratory testing criteria ofASTM D3803-89 and Millstone Unit 3 specific parameters. The laboratory analysis is required to be performed within 31 days after removal of the sample. ANSI N510-1980 is used in lieu of ANSI N510-1975 referenced in Revision 2 of Regulatory Guide 1.52.
MILLSTONE - UNIT 3                      B 3/4 7-14                    Amendment No. He, -l-84, We
 
LBDCR 12-MP3-010 September 20, 2012 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)
SURVEILLANCE REQUIREMENTS (Continued) 4.7.7.c.3 This surveillance verifies that a system flow rate of 1,120 cfm +/- 20%, during system operation when testing in accordance with ANSI N510-1980.
4.7.7.d After 720 hours of charcoal adsorber operation, a representative carbon sample must be obtained in accordance with Regulatory Position C.6.b of Regulatory Guide 1.52, Revision 2, March 1978, and a laboratory analysis must verify that the representative carbon sample meets the laboratory testing criteria of ASTM D3803-89 and Millstone Unit 3 specific parameters.
The laboratory analysis is required to be performed within 31 days after removal of the sample.
ANSI N510-1980 is used in lieu of ANSI N510-1975 referenced in Revision 2 of Regulatory Guide 1.52.
The maximum surveillance interval is 900 hours, per Surveillance Requirement 4.0.2. The 720 hours of operation requirement originates from Nuclear Regulatory Guide 1.52, Table 2, Note C. This testing ensures that the charcoal adsorbency capacity has not degraded below acceptable limits as well as providing trending data.
4.7.7.e.1 This surveillance verifies that the pressure drop across the combined HEPA filters and charcoal adsorbers banks at less than 6.75 inches water gauge when the system is operated at a flow rate of 1,120 cfm +/- 20%. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
4.7.7.e.2 Deleted.
4.7.7.e.3 This surveillance verifies that the heaters can dissipate 9.4 +/- 1 kW at 480V when tested in accordance with ANSI N510-1980. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The heater kW measured must be corrected to its nameplate rating. Variations in system voltage can lead to measurements of kW which cannot be compared to the nameplate rating because the output kW is proportional to the square of the voltage.
MILLSTONE - UNIT 3                        B 3/4 7-15    AmendmentNo.He,+8+,-l-84,+/-fil,;w(;
 
LBDCR 07-MP3-033 June 25, 2007 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)
SURVEILLANCE REQUIREMENTS (Continued) 4.7.7.f Following the complete or partial replacement of a HEPA filter bank, the OPERABILITY of the cleanup system should be confirmed. This is accomplished by verifying that the cleanup system satisfies the in-place penetration and bypass leakage testing acceptance criterion of less than 0.05% in accordance with ANSI N510-1980 for a DOP test aerosol while operating the system at a flow rate of 1,120 cfm +/- 20%.
4.7.7.g Following the complete or partial replacement of a charcoal adsorber bank, the OPERABILITY of the cleanup system should be confirmed. This is accomplished by verifying that the cleanup system satisfied the in-place penetration and bypass leakage testing acceptance criterion of less than 0.05% in accordance with ANSI N510-1980 for a halogenated hydrocarbon refrigerant test gas while operating the system at a flow of 1,120 cfm +/- 20%.
4.7.7.h This Surveillance verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.
The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem TEDE and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses ofDBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, ACTION c. must be entered. ACTION c. allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, which endorses, with exceptions, NEI 99-03.
These compensatory measures may also be used as mitigating actions as required by ACTION c.
Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY. Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.
MILLSTONE - UNIT 3                          B 3/4 7-16                Amendment No. -36, ~ . :2G6,
 
LBDCR 07-MP3-033 June 25, 2007 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)
 
==References:==
 
(1)    Nuclear Regulatory Guide 1.52, Revision 2 (2)    MP3 UFSAR, Table 1.8-1, NRC Regulatory Guide 1.52 (3)    NRC Generic Letter 91-04 (4)    Condition Report (CR) #M3-99-0271 (5)    NEI 99-03, "Control Room Habitability Assessment" (6)    Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability."
3/4.7.8 DELETED MILLSTONE - UNIT 3                      B 3/4 7-17                            AmendmentNo.-1-3-6;-
 
LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3        B 3/4 7-18          Amendment No. 3/4, ~ . ~
NRC Verbal Acknowledgment: 07/05/07
 
LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3        B 3/4 7-19            AmendmentNo.H-6,~,~
NRC Verbal Acknowledgment: 07/05/07
 
LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3      B 3/4 7-20        AmendmentNo.-l-36,-l-8--l-,;w3-,m NRC Verbal Aclrn.owledgment: 07/05/07
 
LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3      B 3/4 7-21            AmendmentNo.-1-3-6,~,~
NRC Verbal Acknowledgment: 07 /05/07
 
LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3      B 3/4 7-22                    Amendment No.-!3/4 NRC Verbal Acknowledgment: 07/05/07
 
LBDCR 18-MP3-009 February 21, 2019 PLANT SYSTEMS BASES 3/4.7 .9 AUXILIARY BUILDING FILTER SYSTEM The OPERABILITY of the Auxiliary Building Filter System, and associated filters and fans, ensures that radioactive materials leaking from the equipment within the charging pump, component cooling water pump and heat exchanger areas following a LOCA are :filtered prior to reaching the environment. Operating each Auxiliary Building Filtration System train for greater than or equal to 15 continuous minutes ensures that all trains are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. Since adsorption testing is performed at 70% relative humidity, the filter heaters are required to operate. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The operation of this system and the resultant effect on offsite dosage calculations was assumed in the safety analyses. ANSI N510-1980 will be used as a procedural guide for surveillance testing. Laboratory testing of methyl iodide penetration shall be performed in accordance withASTM D3803-89 and Millstone Unit 3 specific parameters. The heater kW measured must be corrected to its nameplate rating.
Variations in system voltage can lead to measurements of kW which cannot be compared to the nameplate rating because the output kW is proportional to the square of the voltage.
The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System is required to be available to support the Auxiliary Building Filter System and the Supplementary Leak Collection and Release System (SLCRS). The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System consists of two redundant trains, each capable of providing 100% of the required flow. Each train has a two position, "Off' and "Auto," remote control switch. With the remote control switches for each train in the "Auto" position, the system is capable of automatically transferring operation to the redundant train in the event of a low flow condition in the operating train. The associated fans do not receive any safety related automatic start signals (e.g., Safety Injection Signal).
Placing the remote control switch for a Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train in the "Off' position to start the redundant train or to perform post maintenance testing to verify availability of the redundant train will not affect the availability of that train, provided appropriate administrative controls have been established to ensure the remote control switch is immediately returned to the "Auto" position after the completion of the specified activities or in response to plant conditions. These administrative controls include the use of an approved procedure and a designated individual at the control switch for the respective Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respond to instructions from procedures, or control room personnel, based on plant conditions.
MILLSTONE - UNIT 3                          B 3/4 7-23        Amendment No. &cl-, -l-l--9, -86, -l-84,
                                                                                                  ~
 
LBDCR 12-MP3-003 March 12, 2012 PLANT SYSTEMS BASES LCO 3.7.9 ACTION statement:
With one Auxiliary Building Filter System inoperable, restoration to OPERABLE status within 7 days is required.
The 7 days restoration time requirement is based on the following: The risk contribution is less for an inoperable Auxiliary Building Filter System, than for the charging pump or reactor plant component cooling water (RPCCW) systems, which have a 72 hour restoration time requirement. The Auxiliary Building Filter System is not a direct support system for the charging pumps or RPCCW pumps. Because the pump area is a common area, and as long as the other train of the Auxiliary Building Filter System remains OPERABLE, the 7 day restoration time limit is acceptable based on the low probability of a DBA occurring during the time period and the ability of the remaining train to provide the required capability. A concurrent failure of both trains would require entry into LCO 3.0.3 due to the loss of functional capability. The Auxiliary Building Filter System does support the Supplementary Leak Collection and Release System (SLCRS) and the LCO ACTION statement time of 7 days is consistent with that specified for SLCRS (See LCO 3.6.6.1).
Any time the OPERABILITY of a HEPA filter or charcoal adsorber housing has been affected by repair, maintenance, modification, or replacement activity, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY.
Surveillance Requirement 4.7.9.c Surveillance requirement 4.7.9.c requires that after 720 hours of operation a charcoal sample must be taken and the sample must be analyzed within 31 days after removal.
The 720 hours of operation requirement originates from Regulatory Guide 1.52, Revision 2, March 1978, Table 2, Note "c", which states that "Testing should be performed (1) initially, (2) at least once per 18 months thereafter for systems maintained in a standby status or after 720 hours of system operations, and (3) following painting, fire, or chemical release in any ventilation zone communicating with the system." This testing ensures that the charcoal adsorb ency capacity has not degraded below acceptable limits as well as providing trending data. The 720 hour figure is an arbitrary number which is equivalent to a 30 day period. This criteria is directed to filter systems that are normally in operation and also provide emergency air cleaning functions in the event of a Design Basis Accident. The applicable filter units are not normally in operation and sample canisters are typically removed due to the 18 month criteria.
3/4.7.10 SNUBBERS All snubbers are required OPERABLE to ensure that the structural integrity of the Reactor Coolant System and all other safety-related systems is maintained during and following a seismic or other event initiating dynamic loads. For the purpose of declaring the affected system OPERABLE with the inoperable snubber(s), an engineering evaluation may be performed, in accordance with Section 50.59 of 10 CFR Part 50. '
MILLSTONE - UNIT 3                          B 3/4 7-23a              AmendmentNo.-8-7,H-9,-l-36,-l-84
 
LBDCR 12-MP3-003 March 12, 2012 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3            B 3/4 7-24    Amendment No. 6, &:/-, -H-9, -86, "Re>tised by NRG letter Al 571 O"
 
LBDCR 12-MP3-003 March 12, 2012 PLANT SYSTEMS BASES 3/4.7.11 DELETED 3/4.7.14 DELETED MILLSTONE - UNIT 3 B 3/4 7-25 Amendment Nos. 58-,-84, -l-GG, -l-l-9, 136,214
 
LBDCR No. 04-MP3-015 February 24, 2005 3/4.8 ELECTRICAL POWER SYSTEMS BASES 3/4.8.1, 3/4.8.2 and 3/4.8.3 AC. SOURCES, D.C. SOURCES, AND ONSITE POWER DISTRIBUTION The OPERABILITY of the AC. and D. C. power sources and associated distribution systems during operation ensures that sufficient power will be available to supply the safety-related equipment required for: (1) the safe shutdown of the facility, and (2) the mitigation and control of accident conditions within the facility. The minimum specified independent and redundant AC. and D.C. power sources and distribution systems satisfy the requirements of General Design Criterion 17 of Appendix A to 10 CFR Part 50.
LCO 3.8.1.1.a LCO 3.8.1. 1.a requires two independent offsite power sources. With both the RSST and the NSST available, either power source may supply power to the vital busses to meet the intent of Technical Specification 3.8.1.1. The FSAR, and Regulatory Guide 1.32, 1.6, and 1.93 provide the basis for requirements concerning off-site power sources. The basic requirement is to have two independent o:ffsite power sources. The requirement to have a fast transfer is not specifically stated. An automatic fast transfer is required for plants without a generator output trip breaker, where power from the NSST is lost on a turbine trip. The surveillance requirement for transfer from the normal circuit to the alternate circuit is required for a transfer from the NSST to the RSST in the event of an electrical failure. There is no specific requirement to have an automatic transfer from the RSST to the NSST.
The ACTION requirements specified for the levels of degradation of the power sources provide restriction upon continued facility operation commensurate with the level of degradation.
The OPERABILITY of the power sources are consistent with the initial condition assumptions of the safety analyses and are based upon maintaining at least one redundant set of onsite AC. and D.C. power sources and associated distribution systems OPERABLE during accident conditions coincident with an assumed loss-of-offsite power and single failure of the other onsite AC.
source. The A.C. and D.C. source allowable out-of-service times are based in part on Regulatory Guide 1.93, "Availability of Electrical Power Sources," December 1974. Technical Specification 3.8.1.1 ACTION Statements b.2 and c.2 provide an allowance to avoid unnecessary testing of the other OPERABLE diesel generator. If it can be determined that the cause of the inoperable diesel generator does not exist on the OPERABLE diesel generator, Surveillance Requirement 4.8.1.1.2.a.5 does not have to be performed. If the cause ofinoperability exists on the other OPERABLE diesel generator, the other OPERABLE diesel generator would be declared inoperable upon discovery, ACTION Statement e. would be entered, and appropriate actions will be taken. Once the failure is corrected, the common cause failure no longer exists, and the required ACTION Statements (b., c., and e.) will be satisfied.
If it can not be determined that the cause of the inoperable diesel generator does not exist on the remaining diesel generator, performance of Surveillance Requirement 4.8.1.1.2.a.5, within the allowed time period, suffices to provide assurance of continued OPERABILITY of the diesel generator. If the inoperable diesel generator is restored to OPERABLE status prior to the determination of the impact on the other diesel generator, evaluation will continue of the possible common cause failure. This continued evaluation is no MILLSTONE - UNIT 3                          B 3/4 8-1                          Amendment No. ~ . ~ .
Acknowledged by NRC letter dated 08/25/05
 
LBDCR No. 04-MP3-015 February 24, 2005 3/4.8 ELECTRICAL POWER SYSTEMS BASES longer under the time constraint imposed while in ACTION Statements b.2 or c.2.
The determination of the existence of a common cause failure that would affect the remaining diesel generator will require an evaluation of the current failure and the applicability to the remaining diesel generator. Examples that would not be a common cause failure include, but are not limited to:
: 1. Preplanned preventative maintenance or testing; or
: 2. An inoperable support system with no potential common mode failure for the remaining diesel generator; or
: 3. An independently testable component with no potential common mode failure for the remaining diesel generator.
When one diesel generator is inoperable, there is an additional ACTION requirement (b.3 and c.3) to verify that all required systems, subsystems, trains, components and devices, that depend on the remaining OPERABLE diesel generator as a source of emergency power, are also OPERABLE, and that the steam-driven auxiliary feedwater pump is OPERABLE. This requirement is intended to provide assurance that a loss-of-offsite power event will not result in a complete loss of safety function of critical systems during the period one of the diesel generators is inoperable. The term, verify, as used in this context means to administratively check by examining logs or other information to determine if certain components are out-of-service for maintenance or other reasons. It does not mean to perform the Surveillance Requirements needed to demonstrate the OPERABILITY of the component.
If one Millstone Unit No. 3 diesel generator is inoperable in MODES 1 through 4, a 72 hour allowed outage time is provided by ACTION Statement b.5 to allow restoration of the diesel generator, provided the requirements of ACTION Statements b. l, b.2, and b.3 are met. This allowed outage time can be extended to 14 days if the additional requirements contained in ACTION Statement b.4 are also met. ACTION Statement b.4 requires verification that the Millstone Unit No. 2 diesel generators are OPERABLE as required by the applicable Millstone Unit No. 2 Technical Specification (2 diesel generators in MODES 1 through 4, and 1 diesel generator in MODES 5 and 6) and the Millstone Unit No. 3 SBO diesel generator is available.
The term verify, as used in this context, means to administratively check by examining logs or other information to determine if the required Millstone Unit No. 2 diesel generators and the Millstone Unit No. 3 SBO diesel generator are out of service for maintenance or other reasons. It does not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITY of the required Millstone Unit No. 2 diesel generators or availability of the Millstone Unit No. 3 SBO diesel generator.
When using the 14 day allowed outage time provision and the Millstone Unit No. 2 diesel generator requirements and/or Millstone Unit No. 3 SBO diesel generator requirements are not met, 72 hours is allowed for restoration of the required Millstone Unit No. 2 diesel generators and the Millstone Unit No. 3 SBO diesel generator. If any of the required Millstone Unit No. 2 diesel generators and/or Millstone Unit No. 3 SBO diesel generator are not restored within 72 hours, and one Millstone Unit No. 3 diesel generator is still inoperable, Millstone Unit No. 3 is required to shut down.
MILLSTONE - UNIT 3                        B 3/4 8-la                        Amendment No. H, U-9, Acknowledged by NRC letter dated 08/25/05
 
LBDCR 14-MP3-013 October 16, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES The 14 day allowed outage time for one inoperable Millstone Unit No. 3 diesel generator will allow performance of extended diesel generator maintenance and repair activities (e.g., diesel inspections) while the plant is operating. To minimize plant risk when using this extended allowed outage time the following additional Millstone Unit No. 3 requirements must be met:
: 1)    The charging pump and charging pump cooling pump in operation shall be powered from the bus not associated with the out of service diesel generator. In addition, the spare charging pump will be available to replace an inservice charging pump if necessary.
: 2)  The extended diesel generator outage shall not be scheduled when adverse or inclement weather conditions and/or unstable grid conditions are predicted or present.
: 3)  The availability of the Millstone Unit No. 3 SBO DG shall be verified by test performance within 30 days prior to allowing a Millstone Unit No. 3 EDG to be inoperable for greater than 72 hours.
: 4)    All activity in the switchyard shall be closely monitored and controlled. No elective maintenance within the switchyard that could challenge offsite power availability shall be scheduled.
: 5)    A contingency plan shall be available (OP 3314J, Auxiliary Building Emergency Ventilation and Exhaust) to provide alternate room cooling to the charging and CCP pump area (24' 6" Auxiliary Building) in the event of a failure of the ventilation system prior to commencing an extended diesel generator outage.
In addition, the plant configuration shall be controlled during the diesel generator maintenance and repair activities to minimize plant risk consistent with the Configuration Risk Management Program, as required by 10 CFR 50.65(a)(4).
The OPERABILITY of the minimum specifiedA.C. and D.C. power sources and associated distribution systems during shutdown and REFUELING ensures that: (1) the facility can be maintained in the shutdown or REFUELING condition for extended time periods, and (2) sufficient instrumentation and control capability is available for monitoring and maintaining the unit status.
The Surveillance Requirements for demonstrating the OPERABILITY of the diesel generators are in accordance with the recommendations of Regulatory Guides 1.9, "Selection of Diesel Generator Set Capacity for Standby Power Supplies," March 10, 1971; 1.108, "Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants," Revision 1, August 1977; and 1.13 7, "Fuel-Oil Systems for Standby Diesel Generators,"
Revision 1, October 1979. The surveillance :frequencies for demonstrating OPERABILITY of the diesel generators are in accordance with the Surveillance Frequency Control Program.
LCO 3.8.1.1 ACTION statementb.3 and c.3 Required ACTION Statement b.3 and c.3 requires that all systems, subsystems, trains, components, and devices that depend on the remaining OPERABLE diesel as a source of emergency power be verified OPERABLE.
MILLSTONE - UNIT 3                          B 3/4 8-lb                        Amendment No. -1-i, ~ .
Aclmovtledged by NRG lettCf dated 08/25/05
 
LBDCR 12-MP3-010 September 20, 2012 3/4.8 ELECTRICAL POWER SYSTEMS BASES 3/4.8.1, 3/4.8.2, and 3/4.8.3 AC. SOURCES, D.C. SOURCES, AND ONSITE POWER DISTRIBUTION Technical Specification 3.8.1.1.b.l requires each of the diesel generator day tanks contain a minimum volume of278 gallons. Technical Specification 3.8.1.2.b.l requires a minimum volume of278 gallons be contained in the required diesel generator day tank. This capacity ensures that a minimum usable volume of 189 gallons is available. This volume permits operation of the diesel generators for approximately 27 minutes with the diesel generators loaded to the 2,000 hour rating of 5335 kw. Each diesel generator has two independent fuel oil transfer pumps. The shutoff level of each fuel oil transfer pump provides for approximately 60 minutes of diesel generator operation at the 2000 hour rating. The pumps start at day tank levels to ensure the minimum level is maintained. The loss of the two redundant pumps would cause day tank level to drop below the minimum value.
Technical Specification 3.8.1.1.b.2 requires a minimum volume of32,760 gallons be contained in each of the diesel generator's fuel storage systems. Technical Specification 3.8.1.2.b.2 requires a minimum volume of 32,760 gallons be contained in the required diesel generator's fuel storage system. This capacity ensures that a minimum usable volume (29,180 gallons) is available to permit operation of each of the diesel generators for approximately three days with the diesel generators loaded to the 2,000 hour rating of 5335 kW. The ability to cross-tie the diesel generator fuel oil supply tanks ensures that one diesel generator may operate up to approximately six days.
Additional fuel oil can be supplied to the site within twenty-four hours after contacting a fuel oil supplier.
Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining sub critical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.
Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power source and distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.
Surveillance Requirements 4.8.1.1.2.a.6, 4.8.1.1.2.b.2, and 4.8.1.1.2.j The Surveillances 4.8.1.1.2.a.6 and 4.8.1.1.2.b.2 verify that the diesel generators are capable of synchronizing with the offsite electrical system and loaded to greater than or equal to continuous rating of the machine. A minimum time of 60 minutes is required to stabilize engine temperatures, while MILLSTONE - UNIT 3                          B 3/4 8-lc      AmendmentNo.9-1-,~,~.-l-94,~,:23G
 
LBDCR 12-MP3-010 September 20, 2012 3/4.8 ELECTRICAL POWER SYSTEMS BASES minimizing the time that the diesel generator is connected to the offsite source. Surveillance Requirement 4.8.1.1.2.j requires demonstration that the diesel generator can start and run continuously at full load capability for an interval of not less than 24 hours,~ 2 hours of which are at a load equivalent to 110% of the continuous duty rating and the remainder of the time at a load equivalent to the continuous duty rating of the diesel generator. The load band is provided to avoid routine overloading of the diesel generator. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain diesel generator OPERABILITY. The load band specified accounts for instrumentation inaccuracies, operational control capabilities, and human factor characteristics. The note (*)
acknowledges that a momentary transient outside the load range shall not invalidate the test. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
Surveillance Requirements 4.8.1.1.2.a.5, 4.8.1.1.2.b.l, 4.8.1.1.2.g.4.b, 4.8.1.1.2.g.5, and 4.8.1.1.2.g.6.b Several diesel generator surveillance requirements specify that the emergency diesel generators are started from a standby condition. Standby conditions for a diesel generator means the diesel engine coolant and lubricating oil are being circulated and temperatures are maintained within design ranges. Design ranges for standby temperatures are greater than or equal to the low temperature alarm setpoints and less than or equal to the standby "keep-warm" heater shutoff temperatures for each respective sub-system. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
Surveillance Requirement 4.8 .1.1.2. j The existing "standby condition" stipulation contained in specification 4.8.1.1.2.a.5 is superseded when performing the hot restart demonstration required by 4.8.1.1.2.j.
Any time the OPERABILITY of a diesel generator has been affected by repair, maintenance, or replacement activity, or by modification that could affect its interdependency, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
MILLSTONE - UNIT 3                          B 3/4 8-ld            AmendmentNo.-91,~,W,-l-94,iM
 
LBDCR 12-MP3-010 September 20, 2012 ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES. D.C. SOURCES. and ONSITE POWER DISTRIBUTION (Continued)
The Surveillance Requirement for demonstrating the OPERABILITY of the station batteries are based on the recommendations of Regulatory Guide 1.129, "Maintenance Testing and Replacement of Large Lead Storage Batteries for Nuclear Power Plants," February 1978, and IEEE Std 450-1975 & 1980, "IEEE Recommended Practice for Maintenance, Testing, and Replacement of Large Lead Storage Batteries for Generating Stations and Substations." Sections 5 and 6 of IEEE Std 450-1980 replaced Sections 4 and 5 ofIEEE Std 450-1975. Guidance on bypassing weak cells, ifrequired, is in accordance with section 7.4 of IEEE 450-2002. The balance of IEEE Std 450-1975 applies. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
Verifying average electrolyte temperature above the minimum for which the battery was sized, total battery terminal voltage on float charge, connection resistance values, and the performance of battery service and discharge tests ensures the effectiveness of the charging system, the ability to handle high discharge rates, and compares the battery capacity at that time with the rated capacity.
Table 4.8-2a specifies the normal limits for each designated pilot cell and each connected cell for electrolyte level, float voltage, and specific gravity. The limits for the designated pilot cells float voltage and specific gravity, greater than 2.13 volts and 0.015 below the manufacturer's full charge specific gravity or a battery charger current that had stabilized at a low value, is characteristic of a charged cell with adequate capacity. The normal limits for each connected cell for float voltage and specific gravity, greater than 2.13 volts and not more than O. 020 below the manufacturer's full charge specific gravity with an average specific gravity of all the connected cells not more than 0.010 below the manufacturer's full charge specific gravity, ensures the OPERABILITY and capability of the battery.
Operation with a battery cell's parameter outside the normal limit but within the allowable value specified in Table 4.8-2a is permitted for up to 7 days. During this 7-day period: (1) the allowable values for electrolyte level ensures no physical damage to the plates with an adequate electron transfer capability; (2) the allowable value for the average specific gravity of all the cells, not more than 0.020 below the manufacturer's recommended full charge specific gravity, ensures that the decrease in rating will be less than the safety margin provided in sizing; (3) the allowable value for an individual cell's specific gravity, ensures that an individual cell's specific gravity will not be more than 0.040 below the manufacturer's full charge specific gravity and that the overall capability of the battery will be maintained within an acceptable limit; and (4) the allowable value for an individual cell's float voltage, greater than 2.07 volts, ensures the battery's capability to perform its design function.
If the required power sources or distribution systems are not OPERABLE in MODES 5 and 6, operations involving CORE ALTERATIONS, positive reactivity changes, movement ofrecently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the MILLSTONE - UNIT 3                          B 3/4 8-2                                    Amendment No.
 
LBDCR 10-MP3-003 February 23, 2010 ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES, D.C. SOURCES, and ONSITE POWER DISTRIBUTION (Continued) previous 350 hours*), crane operation with loads over the fuel storage pool, or operations with a potential for draining the reactor vessel are required to be suspended.
3/4.8.4 DELETED
* During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a critical reactor core within the previous 525 hours.
MILLSTONE - UNIT 3                          B 3/4 8-3          AmendmentNo.~,-&9,~,-1-11,m,
 
REVERSE OF PAGE B 3/4 8-3 INTENTIONALLY LEFT BLANK
 
06/28/06 3/4.9 REFUELING OPERATIONS BASES 3/4.9.1 BORON CONCENTRATION The limitations on reactivity conditions during REFUELING ensure that: (1) the reactor will remain subcritical during CORE ALTERATIONS, and (2) a uniform boron concentration is maintained for reactivity control in the water volume having direct access to the reactor vessel.
The value of 0.95 or less for 3/4ff includes a 1% Mc/k conservative allowance for uncertainties.
Similarly, the boron concentration value specified in the CORE OPERATING LIMITS REPORT includes a conservative uncertainty allowance of 50 ppm boron. The boron concentration, specified in the CORE OPERATING LIMITS REPORT, provides for boron concentration measurement uncertainty between the spent fuel pool and the RWST. The locking closed of the required valves during refueling operations precludes the possibility of uncontrolled boron dilution of the filled portion of the RCS. This action prevents flow to the RCS ofunborated water by closing flow paths from sources of unborated water.
MODE ZERO shall be the Operational MODE where all fuel assemblies have been removed from containment to the Spent Fuel Pool. Technical Specification Table 1.2 defines MODE 6 as "Fuel in the reactor vessel with the vessel head closure bolts less than fully tensioned or with the head removed." With no fuel in the vessel the definition for MODE 6 no longer applies. The transition from MODE 6 to MODE ZERO occurs when the last fuel assembly of a full core off load has been transferred to the Spent Fuel Pool and has cleared the transfer canal while in transit to a storage location. This will:
* Ensure Technical Specifications regarding sampling the transfer canal boron concentration are observed (4.9.1.1.2);
* Ensure that MODE 6 Technical Specification requirements are not relaxed prematurely during fuel movement in containment.
Concerning ACTION a., suspension of CORE ALTERATIONS and positive reactivity additions shall not preclude moving a component to a safe position. Operations that individually add limited positive reactivity (e.g., temperature fluctuations from inventory addition or temperature control fluctuations) but when combined with all other operations affecting core reactivity (e.g., intentional boration) result in overall net negative reactivity addition, are not precluded by this action.
MILLSTONE - UNIT 3                          B3/49-1                Amendment No. +/-2-, 6G, &sect;-8, -l-89, 230
 
LBDCR No. 17-MP3-009 April 26, 2018 3/4.9 REFUELING OPERATIONS BASES 3/4.9.1.2 BORON CONCENTRATION IN SPENT FUEL POOL During normal Spent Fuel Pool operation, the spent fuel racks are capable of maintaining Keff at less than 1.0 in an unborated water environment. This is accomplished in Region 1, 2, and 3 storage racks by the combination of geometry of the rack spacing, the use of fixed neutron absorbers in some fuel storage regions, the limits on fuel burnup, fuel enrichment and minimum fuel decay time, and the use of Rod Cluster Control Assemblies for certain assemblies in Region 2.
The boron requirement in the spent fuel pool specified in 3 .9 .1.2 ensures that in the event of a fuel assembly misload accident, which involves the misloading of multiple fuel assemblies, the 3/4ff of the spent fuel storage racks will remain less than or equal to 0.95.
3/4.9.2 INSTRUMENTATION The source range neutron flux monitors are used during refueling operations to monitor the core reactivity condition. The installed source range-neutron flux monitors are part of the Nuclear Instrumentation System (NIS). These detectors are located external to the reactor vessel and detect neutrons leaking from the core.
There are two sets of source range neutron flux monitors:
(1) Westinghouse source range neutron flux monitors, and (2) Gamma-Metrics source range neutron flux monitors.
The Westinghouse monitors are the normal source range monitors used during refueling activities. Gamma-Metrics source range neutron flux monitors are an acceptable equivalent control room indication for the Westinghouse source range neutron flux Monitors in MODE 6, including CORE Alterations, as follows:
with the core in place within the reactor vessel or, with the Gamma Metrics source range neutron flux monitor(s) coupled to the core.
Reactor Engineering shall determine whether each monitor is coupled to the core.
This limiting condition for operation requires two source range neutron flux monitors be OPERABLE to ensure that redundant monitoring capability is available to detect changes in core reactivity. To be OPERABLE, each monitor must provide visual indication in the control room. In addition, at least one of the two monitors must provide an OPERABLE audible count rate function in the control room and containment.
MILLSTONE - UNIT 3                          B 3/4 9-la        Amendment No. +/-, @, &sect;.8., ~ . ~ .
                                                                                                  ~
 
LBDCR No. 10-MP3-006 March 9, 2010 3/4.9 REFUELING OPERATIONS BASES The limiting condition for operation is satisfied with either two Westinghouse source range neutron flux monitors OPERABLE, or with any combination that contains one OPERABLE Westinghouse source range neutron flux monitor (to provide audible indication) and one OPERABLE Gamma-Metrics source range neutron flux monitor that is coupled to the core.
With only one Westinghouse source range neutron flux monitor OPERABLE and no Gamma-Metrics source range neutron flux monitors OPERABLE, ACTION a. must be entered.
With both Westinghouse source range neutron flux monitors inoperable and one or more Gamma-Metrics source range neutron flux monitors OPERABLE and coupled to the core, ACTION b.
must be entered, since the Gamma-Metrics source range neutron flux monitors are incapable of providing audible indication in the containment.
Concerning ACTION a., with only one of the required source range neutron flux monitor OPERABLE, redundancy has been lost. Since these instruments are the only direct means of monitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3 .9 .1.1 must be suspended immediately. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Performance of ACTION a. shall not preclude completion of movement of a component to a safe position.
3/4.9.3 DECAYTIME The minimum requirement for reactor subcriticality prior to movement of irradiated fuel assemblies in the reactor vessel ensures that sufficient time has elapsed to allow the radioactive decay of the short-lived fission products. This decay time is consistent with the assumptions used in the safety analyses.
MILLSTONE - UNIT 3                        B 3/4 9-lb
 
LBDCR No. 10-MP3-006 March 9, 2010 3/4.9 REFUELING OPERATIONS BASES 3/4.9.4 CONTAINMENT BUILDING PENETRATIONS The requirements on containment penetration closure and OPERABILIIT ensure that a release of radioactive material within containment to the environment will be minimized. The OPERABILIIT, closure restrictions, and administrative controls are sufficient to minimize the release of radioactive material from a fuel element rupture based upon the lack of containment pressurization potential during the movement of fuel within containment. The containment purge valves are containment penetrations and must satisfy all requirements specified for a containment penetration.
This specification is applicable during the movement of new and spent fuel assemblies within the containment building. The fuel handling accident analyses assume that during a fuel handling accident some of the fuel that is dropped and some of the fuel impacted upon is damaged.
Therefore, the movement of either new or irradiated fuel can cause a fuel handling accident, and this specification is applicable whenever new or irradiated fuel is moved within the containment.
Containment penetrations, including the personnel access hatch doors and equipment access hatch, can be open during the movement of fuel provided that sufficient administrative controls are in place such that any of these containment penetrations can be closed within 30 minutes.
Following a Fuel Handling Accident, each penetration, including the equipment access hatch, is closed such that a containment atmosphere boundary can be established. However, if it is determined that closure of all containment penetrations would represent a significant radiological hazard to the personnel involved, the decision may be made to forgo the closure of the affected penetration(s). The containment atmosphere boundary is established when any penetration which provides direct access to the outside atmosphere is closed such that at least one barrier between the containment atmosphere and the outside atmosphere is established. Additional actions beyond establishing the containment atmosphere boundary, such as installing flange bolts for the equipment access hatch or a containment penetration, are not necessary.
Administrative controls for opening a containment penetration require that one or more designated persons, as needed, be available for isolation of containment from the outside atmosphere. Procedural controls are also in place to ensure cables or hoses which pass through a containment opening can be quickly removed. The location of each cable and hose isolation device for those cables and hoses which pass through a containment opening is recorded to ensure timely closure of the containment boundary. Additionally, a closure plan is developed for each containment opening which includes an estimated time to close the containment opening. A log of personnel designated for containment closure is maintained, including identification of which containment openings each person has responsibility for closing. As necessary, equipment will be pre-staged to support timely closure of a containment penetration.
MILLSTONE - UNIT 3                        B 3/4 9-lc                        Amendment No. :230
 
LBDCR 16-MP3-018 February 2, 2017 3/4.9 REFUELING OPERATIONS BASES 3/4.9.4 CONTAINMENT BUILDING PENETRATIONS (Continued)
The ability to close the equipment access hatch penetration within 30 minutes is verified each refueling outage prior to the first fuel movement in containment with the equipment access hatch open. Prior to opening a containment penetration, a review of containment penetrations currently open is performed to verify that sufficient personnel are designated such that all containment penetrations can be closed within 30 minutes. Designated personnel may have other duties, however, they must be available such that their assigned containment openings can be closed within 30 minutes. Additionally, each new work activity inside containment is reviewed to consider its effect on the closure of the equipment access hatch, at least one personnel access hatch door, and/or other open containment penetrations. The required number of designated personnel are continuously available to perform closure of their assigned containment openings whenever fuel is being moved within the containment.
Controls for monitoring radioactivity within containment and in effluent paths from containment are maintained consistent with General Design Criterion 64. Local area radiation monitors, effluent discharge radiation monitors, and containment particulate radiation monitors provide a defense-in-depth monitoring of the containment atmosphere and effluent releases to the environment. These monitors are adequate to identify the need for establishing the containment atmosphere boundary. When containment penetrations are open during a refueling outage under administrative control for extended periods of time, routine grab samples of the containment atmosphere, equipment access hatch, and personnel access hatch will be required.
The containment atmosphere is monitored during normal and transient operations of the reactor plant by the containment structure particulate and gas monitor located in the upper level of the Auxiliary Building or by grab sampling. Normal effluent discharge paths are monitored during plant operation by the ventilation particulate samples and gas monitors in the Auxiliary Building.
Administrative controls are also in place to ensure that the containment atmosphere boundary is established if adverse weather conditions which could present a potential missile hazard threaten the plant. Weather conditions are monitored during fuel movement whenever a containment penetration, including the equipment access hatch and personnel access hatch, is open and a storm center is within the plant monitoring radius of 150 miles.
The administrative controls ensure that the containment atmosphere boundary can be quickly established (i.e., within 30 minutes) upon determination that adverse weather conditions exist which pose a significant threat to the Millstone Site. A significant threat exists when a hurricane warning or tornado warning is issued which applies to the Millstone Site, or if an average wind speed of 60 miles an hour or greater is recorded by plant meteorological equipment at the meteorological tower. If the meteorological equipment is inoperable, information from the National Weather Service can be used as a backup in determining plant wind speeds. Closure of containment penetrations, including the equipment access hatch penetration and at least one personnel access hatch door, begin immediately upon determination that a significant threat exists.
MILLSTONE - UNIT 3                          B 3/4 9-2                      AmendmentNo,-l-9'.7,i-1-9
 
LBDCR 04-MP3-013 November 29, 2004 3/4.9 REFUELING OPERATIONS BASES 3/4.9.5 DELETED 3/4.9.6 DELETED 3/4.9.7 DELETED 3/4.9.8 RESIDUAL HEAT REMOVAL AND COOLANT CIRCULATION 3/4.9.8.1 HIGH WATER LEVEL BACKGROUND The purpose of the Residual Heat Removal (RHR) System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant and to prevent boron stratification. Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchanger(s), where the heat is transferred to the Reactor Plant Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR system for normal cooldown or decay heat removal is manually accomplished from the control room. The heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR system.
MILLSTONE - UNIT 3                        B 3/4 9-2a                            Amendment No. ~ .
Acknowledged by NRC Letter dated 04/12/06
 
LBDCR No. 14-MP3-0ll January 8, 2015 3/4.9 REFUELING OPERATIONS BASES 3/4.9.8.1 HIGH WATER LEVEL (continued)
APPLICABLE SAFETY ANALYSES If the reactor coolant temperature is not maintained below 200&deg;F, boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant would eventually challenge the integrity of the fuel cladding, which is fission product barrier. One train of the RHR system is required to be operational in MODE 6, with the water level~ 23 ft above the top of the reactor vessel flange to prevent this challenge. The LCO does permit deenergizing the RHR pump for short durations, under the conditions that the boron concentration is not diluted. This conditional deenergizing of the RHR pump does not result in a challenge to the fission product barrier.
APPLICABILITY One RHR loop must be OPERABLE and in operation in MODE 6, with the water level ~ 23 ft above the top of the reactor vessel flange, to provide decay heat removal. The 23 ft level was selected because it corresponds to the 23 ft requirement established for fuel movement in LCO 3 .9 .10, "Water Level - Reactor Vessel." Requirements for the RHR system in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5, Emergency Core Cooling Systems (ECCS). RHR loop requirements in MODE 6 with the water level< 23 ft are located in LCO 3.9.8.2, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level."
LIMITING CONDITION FOR OPERATION The requirement that at least one RHR loop be in operation ensures that: (1) sufficient cooling capacity is available to remove decay heat and maintain the water in the reactor vessel below 140&deg;F as required during the REFUELING MODE, and (2) sufficient coolant circulation is maintained through the core to minimize the effect of a boron dilution incident and prevent stratification.
An OPERABLE RHR loop includes an RHR pump, a heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path. An operating RHR flow path should be capable of determining the low-end temperature. The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs. Management of gas voids is important to RHR System OPERABILITY.
The LCO is modified by a Note that allows the required operating RHR loop to be removed from operation for up to 1 hour per 8 hour period, provided no operations are permitted that would dilute the RCS boron concentration by introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3 .9 .1.1. Boron concentration reduction with coolant at boron concentrations less than required to assure the RCS boron concentration is maintained is prohibited because uniform concentration distribution cannot be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles and RCS to RHR isolation valve testing. During this 1 hour period, decay heat is removed by natural convection to the large mass of water in the refueling cavity.
MILLSTONE - UNIT 3                          B 3/4 9-3                AmendmentNo.-1-01,i-l-9,~
 
LBDCR No. 14-MP3-011 January 8, 2015 3/4.9 REFUELING OPERATIONS BASES 3/4.9.8.1 HIGH WATER LEVEL (continued)
ACTIONS RHR loop requirements are met by having one RHR loop OPERABLE and in operations, except as permitted in the Note to the LCO.
If RHR loop requirements are not met, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration.
This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
If RHR loop requirements are not met, actions shall be taken immediately to suspend loading of irradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removal from the core occurs by natural convection to the heat sink provided by the water above the core.
A minimum refueling water level of 23 ft above the reactor vessel flange provides an adequate available heat sink. Suspending any operation that would increase decay heat load, such as loading a fuel assembly, is a prudent action under this condition.
If RHR loop requirements are not met, actions shall be initiated and continued in order to satisfy RHR loop requirements. With the unit in MODE 6 and the refueling water level~ 23 ft above the top of the reactor vessel flange, corrective actions shall be initiated immediately.
IfRHR loop requirements are not met, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours. With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing containment penetrations that are open to the outside atmosphere ensures dose limits are not exceeded.
The Completion Time of 4 hours is reasonable, based on the low probability of the coolant boiling in that time.
Surveillance Requirements Surveillance Requirement 4.9.8.1.1 demonstrates that the RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
MILLSTONE - UNIT 3                          B 3/4 9-4                AmendmentNo.-1-9-1,U-9,~
 
LBDCR No. 14-MP3-0ll January 8, 2015 3/4.9 REFUELING OPERATIONS BASES 3/4.9.8.1 HIGH WATER LEVEL (continued)
RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR loops and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Surveillance Requirement 4.9.8.1.2 is performed for RHR System locations susceptible to gas accumulation and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
The monitoring frequency of the locations that are susceptible to gas accumulation takes into consideration the gradual nature of gas accumulation in the RHR System piping and the procedural controls governing system operation. The frequency is controlled by the Surveillance Frequency Control Program. The frequency may vary by each location's susceptibility to gas accumulation.
3/4.9 .8.2 LOW WATER LEVEL BACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant, and to prevent boron stratification. Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchangers where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass lines. Mixing of the reactor coolant is maintained by this continuous circulation ofreactor coolant through the RHR system.
MILLSTONE - UNIT 3                          B 3/4 9-5                        Amendment No. -0-1
 
LBDCR No. 14-MP3-011 January 8, 2015 3/4.9 REFUELING OPERATIONS BASES 3/4.9.8.2 LOW WATER LEVEL (continued)
APPLICABLE SAFETY ANALYSES If the reactor coolant temperature is not maintained below 200&deg;F, boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to the boron plating out on components near the areas of the boiling activity. The loss ofreactor coolant and the reduction of boron concentration in the reactor coolant will eventually challenge the integrity of the fuel cladding, which is a fission product barrier. Two trains of the RHR System are required to be OPERABLE, and one train in operation, in order to prevent this challenge.
LIMITING CONDITION FOR OPERATION In MODE 6, with the water level< 23 ft above the top of the reactor vessel flange, both RHR loops must be OPERABLE. Additionally, one loop ofRHR must be in operation in order to provide:
: a. Removal of decay heat;
: b. Mixing of borated coolant to minimize the possibility of criticality; and
: c. Indication of reactor cooling temperature.
The requirement to have two RHR loops OPERABLE when there is less than 23 feet of water above the reactor vessel flange ensures that a single failure of the operating RHR loop will not result in a complete loss of residual heat removal capability. With the reactor vessel head removed and at least 23 feet of water above the reactor pressure vessel flange, a large heat sink is available for core cooling. Thus, in the event of a failure of the operating RHR loop, adequate time is provided to initiate emergency procedure to cool the core.
An OPERABLE RHR loop consists of an RHR pump, a heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path. An operating RHR flow path should be capable of determining the low end temperature. The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs. Management of gas voids is important to RHR System OPERABILITY APPLICABILITY Two RHR loops are required to be OPERABLE, and one RHR loop must be in operation in MODE 6, with the water level< 23 ft above the top of the reactor vessel flange, to provide decay heat removal. Requirements for the RHR System in other MODES are covered by LCOs in Section 3 .5, Emergency Core Cooling Systems (ECCS). RHR loop requirements in MODE 6 with the water level~ 23 ft are located in LCO 3.9.8.1, "Residual Removal (RHR) AND Coolant Circulation-High Water Level."
MILLSTONE - UNIT 3                          B 3/4 9-6                    AmendmentNo.-1-91,~
 
LBDCR No. 14-MP3-011 January 8, 2015 3/4.9 REFUELING OPERATIONS BASES 3/4.9.8.2 LOW WATER LEVEL (continued)
ACTIONS
: a.      If less than the required number of RHR loops are OPERABLE, actions shall be immediately initiated and continued until the RHR loop is restored to OPERABLE status and to operation, or until ~ 23 ft of water level is established above the reactor vessel flange. When the water level is ~ 23 ft above the reactor vessel flange, the Applicability changes to that ofLCO 3.9.8.1, and only one RHR loop is required to be OPERABLE and in operation. An immediate Completion Time is ,necessary for an operator to initiate corrective action.
: b.      If no RHR loop is in operation, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
If no RHR loop is in operation, actions shall be initiated immediately, and continued, to restore one RHR loop to operation. Since the unit is in ACTIONS 'a' and 'b' concurrently, the restoration of two OPERABLE RHR loops and one operating RHR loop should be accomplished expeditiously.
If no RHR loop is in operation, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours. With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing containment penetrations that are open to the outside atmosphere ensures that dose limits are not exceeded.
The Completion Time of 4 hours is reasonable, based on the low probability of the coolant boiling in that time.
Surveillance Requirements Surveillance Requirement 4.9 .8.2.1 demonstrates that one RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. In addition, during operation of the RHR loop with the water level in the vicinity of the reactor vessel nozzles, the RHR pump suction requirements must be met. The surveillance frequency is controlled under the Surveillance Frequency Control Program.
MILLSTONE - UN1T 3                          B 3/4 9-7                AmendmentNo.-1-9'.7-,~,~
 
LBDCRNo. 14-MP3-011 January 8, 2015 3/4.9 REFUELING OPERATIONS BASES 3/4.9.8.2 LOW WATER LEVEL (continued)
RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR loops and may also prevent water hammer, pump cavitation, and pumping of non condensible gas into the reactor vessel.
Surveillance Requirement 4.9.8.2.2 is performed for RHR System locations susceptible to gas accumulation and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
The monitoring frequency of the locations that are susceptible to gas accumulation takes into consideration the gradual nature of gas accumulation in the RHR System piping and the procedural controls governing system operation. The frequency is controlled by the Surveillance Frequency Control Program. The :frequency may vary by each location's susceptibility to gas accumulation.
3/4.9.10 AND 3/4.9.11 WATER LEVEL - REACTOR VESSEL AND STORAGE POOL The restrictions on minimum water level ensure that sufficient water depth is available to remove at least 99% of the assumed iodine gap activity released from the rupture of an irradiated fuel assembly. The minimum water depth is consistent with the assumptions of the safety analysis.
MILLSTONE - UNIT 3                        B 3/4 9-8      AmendmentNo.3-9,-l-05,-l-0-'.7-,-l-&sect;.&,-1-84,-l-89,
                                                                                                  ~,U9 NRG Verbal Aeknowledgment: 07/05/07
 
LBDCR No. 17-MP3-009 April 26, 2018 REFUELING OPERATIONS BASES 3/4.9.13 SPENT FUEL POOL- STORAGE During normal spent fuel pool operation, the spent fuel racks are capable of maintaining Keffat less than 1.0 in an unborated water environment, and less than or equal to 0.95 with 600 ppm soluble boron in the spent fuel pool water.
Maintaining 3/4ff less than or equal to 0.95 is accomplished in Region lA storage rack locations by the combination of geometry of the rack spacing, the use of fixed neutron absorbers (BORAL) in the racks, and prohibiting storage of fuel assemblies with an enrichment greater than 4.75 w/o U-235 unless its fuel burnup is greater than or equal to 2.0 GWD/MTU or it contains twelve (12) or more IFBA rods.
Maintaining 3/4ff less than or equal to 0.95 is accomplished in Region lB storage rack locations by the combination of geometry of the rack spacing, the use of fixed neutron absorbers (BORAL) in the racks, a maximum 5 .0 weight percent initial fuel enrichment, and specifying which storage locations are designated as Region lB.
Maintaining 3/4ff less than or equal to 0.95 is accomplished in Region 2 storage racks by the combination of geometry of the rack spacing, the use of fixed neutron absorbers (BORAL) in the racks, and the limits on initial fuel enrichment/fuel bumup specified in Figure 3.9-2. As an alternative, maintaining 3/4ff less than or equal to 0.95 can also be accomplished in Region 2 storage rack locations if the assembly has a maximum initial enrichment less than or equal to 5.0 weight percent and contains a Rod Cluster Control Assembly.
Maintaining 3/4ff less than or equal to 0.95 is accomplished in Region 3 storage racks by the combination of geometry of the rack spacing and the limits on initial fuel enrichment/fuel bumup and fuel decay time specified in Figure 3.9-3. Fixed neutron absorbers are not credited in the Region 3 fuel storage racks.
The limitations described by Figures 3.9-1, 3.9-2, 3.9-3, the burnup/IFBArequirement in Region lA, and the use of Rod Cluster Control Assemblies in Region 2 ensure that the reactivity of the fuel assemblies stored in the spent fuel pool is conservatively within the assumptions of the safety analysis.
Administrative controls have been developed and instituted to verify that the initial fuel enrichment, fuel burnup, and fuel decay times specified in Figures 3.9-1, 3.9-2, 3.9-3, the bumup/IFBA requirement in Region lA, and the presence of a Rod Cluster Control Assembly (Region 2) are complied with.
Initial enrichment, when used to compare to fuel storage requirements, is the maximum initial planar volume averaged as-built U-235 enrichment in the assembly. If the assembly has axial blankets the lower enriched fuel is not credited in determining the enrichment. Fuel burnup when used to compare to fuel storage requirements is the volume averaged burnup of the assembly as determined using the measured reaction rates with no reduction for measurement uncertainty.
3/4.9.14 DELETED MILLSTONE - UNIT 3                          B 3/4 9-9    AmendmentNo.39-,-14&sect;.,-l-9-1,-l-&sect;.8,-l-8-9-,~
 
REVERSE OF PAGE B 3/4 9-9 INTENTIONALLY LEFT BLANK
 
July 30, 2002 3/4.10 SPECIAL TEST EXCEPTIONS BASES 3/4.10.1 SHUTDOWN MARGIN This special test exception provides that a minimum amount of control rod worth is immediately available for reactivity control when tests are performed for control rod worth measurement. This special test exception is required to permit the periodic verification of the actual versus predicted core reactivity condition occurring as a result of fuel burnup or fuel cycling operations.
3/4.10.2 GROUP HEIGHT, INSERTION, AND POWER DISTRIBUTION LIMITS This special test exception permits individual control rods to be positioned outside of their normal group heights and insertion limits during the performance of such PHYSICS TESTS as those required to: (1) measure control rod worth, and (2) determine the reactor stability index and damping factor under xenon oscillation conditions.
3/4.10.3 PHYSICS TESTS This special test exception permits PHYSICS TESTS to be performed at less than or equal to 5% of RATED THERMAL POWER with the RCS Tavg slightly lower than normally allowed so that the fundamental nuclear characteristics of the core and related instrumentation can be verified. In order for various characteristics to be accurately measured, it is at times necessary to operate outside the normal restrictions of these Technical Specifications. For instance, to measure the moderator temperature coefficient at BOL, it is necessary to position the various control rods at heights which may not normally be allowed by Specification 3.1.3.6 which in turn may cause the RCS T avg to fall slightly below the minimum temperature of Specification 3 .1.1.4.
3/4.10.4 REACTOR COOLANT LOOPS This special test exception permits reactor criticality under no flow conditions and is required to perform certain STARTUP and PHYSICS TESTS while at low THERMAL POWER levels.
3/4.10.5 DELETED.
MILLSTONE - UNIT 3                          B 3/4 10-1                    AmendmentNo.ffi,207
 
July 30, 2002 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3            B 3/4 10-2          AmendmentNo.H+,207
 
November 28, 2000 3/4.11 DELETED BASES 3/4.11.1 DELETED 3/4.11.2 DELETED 3/4.11/3 DELETED MILLSTONE - UNIT 3 B 3/4 11-1  Amendment 188
 
November 28, 2000 TIITS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3              B 3/4 11-2            Amendment 188
 
November 28, 2000 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3            B 3/4 11-3              Arnendment-89, 188
 
REVERSE OF PAGE B 3/4 11-3 INTENTIONALLY LEFT BLANK}}

Revision as of 05:37, 18 January 2022

Attachment 2: MPS3 Technical Specification Bases Pages
ML21047A433
Person / Time
Site: Millstone Dominion icon.png
Issue date: 02/15/2021
From:
Dominion Energy Nuclear Connecticut
To:
Office of Nuclear Reactor Regulation
Shared Package
ML21047A430 List:
References
21-031, LBDCR 06-MP3-013
Download: ML21047A433 (204)
v • d • e


Text

Retrieved from "https://kanterella.com/w/index.php?title=ML21047A433&oldid=3400517"