ML14122A158
Text
EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:EAL:H -Hazards and Other Conditions Affecting Plant Safety3 -Natural or Technological HazardHazardous event affecting a SAFETY SYSTEM needed for thecurrent operating modeHA3.1 AlertThe occurrence of any Table H-1 hazardous event resulting in EITHER of the following:" Event damage has caused indications of degraded performance in at least one trainof a SAFETY SYSTEM needed for the current operating mode* The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component orstructure needed for the current operating modeTable H-1 Hazardous Events* Internal or external FLOODING event* High winds or tornado strike* Other events with similar hazard characteristicsas determined by the Shift SupervisorMode Applicability:AllDefinition(s):FLOODING -A condition where water is entering a room or area faster than installedequipment is capable of removal, resulting in a rise of water level within the room or area.SAFETY SYSTEM -A system required for safe plant operation, cooling down the plantand/or placing it in the cold shutdown condition, including the ECCS. These are typicallysystems classified as safety-related (as defined in 10CFR50.2):Those structures, systems and components that are relied upon to remain functionalduring and following design basis events to assure:(1) The integrity of the reactor coolant pressure boundary;Page 177 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E](2) The capability to shut down the reactor and maintain it in a safe shutdown condition;(3) The capability to prevent or mitigate the consequences of accidents which couldresult in potential offsite exposures.VISIBLE DAMAGE -Damage to a component or structure that is readily observablewithout measurements, testing, or analysis. The visual impact of the damage is sufficientto cause concern regarding the operability or reliability of the affected component orstructure.Basis:Plant-Specific* Internal FLOODING may be caused by events such as component failures, equipmentmisalignment, or outage activity mishaps (ref. 1)." Seismic Category I structures are analyzed to withstand a sustained, design windvelocity of at least 100 mph (sustained). (ref. 2).GenericThis IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or astructure containing SAFETY SYSTEM components, needed for the current operatingmode. This condition significantly reduces the margin to a loss or potential loss of a fissionproduct barrier, and therefore represents an actual or potential substantial degradation ofthe level of safety of the plant.EAL !.b.!The first conditional addresses damage to a SAFETY SYSTEM train that is inservice/operation since indications for it will be readily available. The indications ofdegraded performance should be significant enough to cause concern regarding theoperability or reliability of the SAFETY SYSTEM train.EAL 1-t2The second conditional addresses damage to a SAFETY SYSTEM componentthat is not in service/operation or readily apparent through indications alone, or to astructure containing SAFETY SYSTEM components. Operators will make thisdetermination based on the totality of available event and damage report information. ThisPage 178 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]is intended to be a brief assessment not requiring lengthy analysis or quantification of thedamage.Escalation of the emergency cla..ifiat,,, levelE L would be via IC CS1 or AS-I-RS1.VCSNS Basis Reference(s):1. VCSNS IPE Internal Flooding Analysis Workbook2. FSAR Section 3.3.13. NEI 99-01 CA6Page 179 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category: H -Hazards and Other Conditions Affecting Plant SafetySubcategory: 4 -FireInitiating Condition: FIRE potentially degrading the level of safety of the plantEAL:HU4.1 Unusual EventA FIRE is NOT extinguished within 15 min. of any of the following FIRE detectionindications (Note 1):* Report from the field (i.e., visual observation)" Receipt of multiple (more than 1) fire alarms or indications* Field verification of a single fire alarmANDThe FIRE is located within any Table H-2 areaNote 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Table H-2 Fire Areas* Reactor Building* Auxiliary Building* Control Building* Fuel Handling Building* Intermediate Building* Diesel Generator Building" Turbine Building* Service water Pumphouse" Safe Shutdown Yard Areas:* RWST* CST* DG Fuel Oil StorageMode Applicability:AllDefinition(s):Page 180 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]FIRE -Combustion characterized by heat and light. Sources of smoke such as slippingdrive belts or overheated electrical equipment do not constitute FIRES. Observation offlame is preferred but is NOT required if large quantities of smoke and heat are observed.Basis:Plant-SpecificVCSNS Fire Protection Evaluation Report, Section 4.0 "Hazards Analysis" was used toidentify areas (Table H-2) containing functions and systems required for safe shutdown ofthe plant (ref. 1).GenericThis IC addresses the magnitude and extent of FIRES that may be indicative of a potentialdegradation of the level of safety of the plant.EAt-4*T-he-For EAL HU4.1 the intent of the 15-minute duration is to size the FIRE and todiscriminate against small FIRES that are readily extinguished (e.g., smoldering wastepaper basket). In addition to alarms, other indications of a FIRE could be a drop in firemain pressure, automatic activation of a suppression system, etc.Upon receipt, operators will take prompt actions to confirm the validity of an initial firealarm, indication, or report. For EAL assessment purposes, the emergency declarationclock starts at the time that the initial alarm, indication, or report was received, and not thetime that a subsequent verification action was performed. Similarly, the fire duration clockalso starts at the time of receipt of the initial alarm, indication or report.EAL-#2This EAL addresses receipt of a single fire alarm, and the existence Of a FIRE is notverified (i.e., proved or disproved) within 30 mninutes of the alarm. Upon receipt, operatorswill take prompt actioRn the validity of a single fire alarm. For EAL assessmentpurposes, the 30_minute nlock starts at the t time hat the initial alarm was, reGeived, and notthe time that a subsequent verification action was perfeaned.A single fire alarm, absent other indication(s) of a FIRE, ma" be indicative of equipmentfailure or asu iou ativation, and not an actual FIRE. For this reason;, addiinalI time.iallowed to vrfthvalidity of the alarm. The 30-minute period is a reasonable amnount oftime to determine if an actual FIRE exists; howe ve.r, afterthat time, and absent informationto the Gontrarn, it is assumaed that an actual FIRE is in progress.Page 181 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]if an actua! FIRE is verified by a report from the Tfi'eld, ;tihen EAL #1 i me~tlapplicablc, and the emergency must be d-l~ared if the FIRE is not extinRguihed within 15minutes, of the repo.t. if the alarm is.erified to be due to anequipment failu-re Or aprius, o vativation, and this v-ifio Sn ourR, ,,ithin30 m.,int-,es o.f the rFeGeipt of thealarm the this EAL is not applicable and no emnergency declaration is warranted.In addition to a FIRE addressed by EAL #1 or EAL #2, a FIRE within the plaRnPROT-ECTED AREARnot extinguished Within 60 minutes May also potnial degade theleve! of plant safety. This basis xtend to a FIRE= occURrig within the- PROT-ECTEAREA of an ISF-l lo0ated outside the plant PROTECTE AREA. [Sentence for plants withan.P ISESI outside the Plant PrtecGted Area]EAL-#4ifaFI RE Aithinthe pilantor IS-SI [for plants Kith an ISQFSI utsi the plant ProtectedArea] PROTIECTED AREA is of su-fficafient size to require a response by an 9fstfiefighting agency (e.g., a loal town Fire Depament), then the level of plant safety ispotentially degraded. The di ,patch of aR ,ffite firofighting the site anemergency declaration only if it is needed to actively support firefighting effo4t becausethe fire is beyond the capabii~ty of the Fire Brigade to extinguish. D~eclarationR i6 Rot.necessary if the agency resources are placed on stand-by, or sUPPE)rting posextinguishment recover or inetigation actions.Depending upon the plant mode at the time of the event, escalation of the emergeRGYclassiofication 'evelEOL would be via IC CA6 or SA9.VCSNS Basis Reference(s):1. VCSNS Fire Protection Evaluation Report2. NEI 99-01 HU4Page 182 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category: H -Hazards and Other Conditions Affecting Plant SafetySubcategory: 4- FireInitiating Condition: FIRE potentially degrading the level of safety of the plantEAL:HU4.2 Unusual EventReceipt of a single fire alarm (i.e., no other indications of a FIRE)ANDThe fire alarm is indicating a FIRE within any Table H-2 areaANDThe existence of a FIRE is not verified within 30 min. of alarm receipt (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Table H-2 Fire Areas* Reactor Building* Auxiliary Building* Control Building* Fuel Handling Building* Intermediate Building* Diesel Generator Building" Turbine Building* Service water Pumphouse" Safe Shutdown Yard Areas:* RWSTC OST* DG Fuel Oil StorageMode Applicability:AllDefinition(s):Page 183 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]FIRE -Combustion characterized by heat and light. Sources of smoke such as slippingdrive belts or overheated electrical equipment do not constitute fires. Observation of flameis preferred but is NOT required if large quantities of smoke and heat are observed.Basis:Plant-SpecificVCSNS Fire Protection Evaluation Report, Section 4.0 "Hazards Analysis" was used toidentify areas (Table H-2) containing functions and systems required for safe shutdown ofthe plant (ref. 1).GenericThis IC addresses the magnitude and extent of FIRES that may be indicative of a potentialdegradation of the level of safety of the plant.EAL-#4The intent of the 15 -Minutc dur~atie;onris to size the FI=RE and to diccrirn~nate against smallFIRES that are rcadily extinguished (e.g., smolder~ing waste paper: basket). in addition to,a.a...,, other: ndication of a FIRE .ould be a drop in fire main pre.sure, automati;activation of a suppression system, etc.Upon receipt, operators will take prompt actionn to ccofirm the validity of anr iAL firesalarm, inldication, or report. For E=AL assessment purposes, the mernegency declarationcloesk starts at the time that the initial alarm, indiation, or report was received, and not thetime that a subsequent verification action was performed. Similarly, the fire durationalso starts at the time of receipt of the initial alarm, indication or report.EAL-#2This EAL addresses receipt of a single fire alarm, and the existence of a FIRE is notverified (i.e., proved or disproved) within 30-minutes of the alarm. Upon receipt, operatorswill take prompt actions to confirm the validity of a single fire alarm. For EAL assessmentpurposes, the 30-minute clock starts at the time that the initial alarm was received, and notthe time that a subsequent verification action was performed.A single fire alarm, absent other indication(s) of a FIRE, may be indicative of equipmentfailure or a spurious activation, and not an actual FIRE. For this reason, additional time isallowed to verify the validity of the alarm. The 30-minute period is a reasonable amount ofPage 184 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]time to determine if an actual FIRE exists; however, after that time, and absent informationto the contrary, it is assumed that an actual FIRE is in progress.If an actual FIRE is verified by a report from the field, then EAL--#4-HU4.1 is immediatelyapplicable, and the emergency must be declared if the FIRE is not extinguished within 15-minutes of the report. If the alarm is verified to be due to an equipment failure or aspurious activation, and this verification occurs within 30-minutes of the receipt of thealarm, then this EAL is not applicable and no emergency declaration is warranted.In additing to a FIRE addres1cd by EAL #1 of EAL #2, a FIRE Within the plantPRO)TECTED=_ AIREA not eXtinguishcd Within 60 minuters may alrso potentially degrade th!eve ofplat safety. This basis extnd& to a F4RE= occUrring wiithin theA PROTECTEA.REA of an ISE-91 located outside the plant PROTECGTED=_ AREA. [Sentenco for- plants witan SSIoutside the plant Proteted Area]&AL-#4Depending upon the plant mode at the time of the event, escalation of the ei~e~geRGYGIa66ificat*9n lcveIECL would be via IC CA6 or SA9.VCSNS Basis Reference(s):1. VCSNS Fire Protection Evaluation Report2. NEI 99-01 HU4Page 185 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category: H -Hazards and Other Conditions Affecting Plant SafetySubcategory: 4- FireInitiating Condition: FIRE potentially degrading the level of safety of the plantEAL:HU4.3 Unusual EventA FIRE within the plant PROTECTED AREA not extinguished within 60 min. of the initialreport, alarm or indication (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Mode Applicability:AllDefinition(s):FIRE -Combustion characterized by heat and light. Sources of smoke such as slippingdrive belts or overheated electrical equipment do not constitute FIRES. Observation offlame is preferred but is NOT required if large quantities of smoke and heat are observed.PROTECTED AREA -An area encompassed by physical barriers and to which access iscontrolled. The Protected Area refers to the designated security area around the processbuildings and is depicted in Drawing SS-024-019 Site Plan (ref. 1).Basis:Plant-SpecificNoneGenericThis IC addresses the magnitude and extent of FIRES that may be indicative of a potentialdegradation of the level of safety of the plant.The intentSof the ,4n, .... is .. size t PRE and to , ...... 6MFIRES that are readily eXtinguished (e.g., smoldering waste paper basket). In addition toPage 186 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]~~~~Jiiz ~ ~ ~ ~ ~ ~ ~ -M --A FtR Mel Hu MR HM et".itu "tt§ F:, i ~ tui i ALIii I : iviiii:tt.-rS. .. ..activation of a ,upprcssien system, etc.Upon rFceipt, operators will take p.rmpt actioR.o cn the validity of an iRitial fireal~ , ind iiR or Fep.it r ..F AL.. a..s,.6.Me, t pu.."e6 th eInI, A~ de, ai Eclock starts at the time that the initial alarm, indicatfion, or report was received, and not thetime that a subsequent verification action was, pe~formed. Similarly, the fire duration Gdockalso Mtarts at the time of receipt of the initial alarm, indication or repo.EAL-#2This EAL addresses- receipt of a single fire alaFrm, and the existence of a FIRE is notverified (i.e., proved or disproved) Within 30.minutes of the alarm. Upon receipt, operatorswiltake prompt actions to confi~rm the v.alidity of a rsnl oeaam. q .l r.eG~~nme.o.e. the Glek at the time that the initial alarm was reGeied and not*kr'.. *;rnr.. ii, .,* ., e., nkr.an, mant * ,nr;4;n..~t;nn n,-4,,-~n *An r. nar4nrnnIIA single fire alafm, absent other indcation(s) of a FIRE, may be indicative of equipmentfailure or a Iu acttion, and b ot an actual FIRE. Feo this reason, addithinal time isallowed to vrfthvalidity of the alarm. The 30-minute period is a reasonable am~ount oftime to deterMine ifan actual FIRE exists; however, after that time, and absentinomtnto the GOntrar~i, it isassumed that an actual FIRE is in prFogress.if an actual FIRE isverified by a report from the field, then EAL #1 isimditlapplicable, and the emnergency must be decaGredi the FIRE is not extinguished within 1mninutes, of the report. If the alaarm is verified to be due to an equipment failure or aspurius ativation, andi this verification occrsnF within 30 minutes of tercit of thealar, thn tis EL16 not applicable and no em~ergency declaratioiswratdIn addition to a FIRE addressed by EAL #14-HU4.1 or EA1 4#2HU4.2, a FIRE within the plantPROTECTED AREA not extinguished within 60-minutes may also potentially degrade thelevel of plant safety. This basis extends to a FFE .e.urrg within the PROTECTEDA929A nf. an M"!c Loo.-Qtorl uji4 ,bhn nh~ Lant AQC)TQC=Tf AQJrA [I~r onon-- frIn~rnfc IAI.an ISQF.'I n~irJ. thin nlant Pmtrotei~h 4roag]if a FIRE within the plant or: ISESI [for plants Mit an iSF-SI outside the plant P-rotectedArea] PROTECTED AREA is Of sufficient size to require a response by an Gfstfirefighting agency (e.g., a local town Fire Department), then the level of plant safety ispotentially degraded. The disGpatch of an offsite firefightin agency to) the site requires anem~ergency declaratio~n o~nly if it is needed to activ.ely support firefighting efforts becausethin f ire is' hne~nnc the reanahilit" of the Pire nrigaaa tn iztuAin ac~h flo'iaratinn , nnt -U.Ut-.i .4exhinqufVishment recover; to..i ation actions..Page 187 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Depending upon the plant mode at the time of the event, escalation of the emergeRcycla6sificGaton levelECL would be via IC CA6 or SA9.VCSNS Basis Reference(s):1. Drawing SS-024-019 Site Plan2. NEI 99-01 HU4Page 188 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT ElCategory: H -Hazards and Other Conditions Affecting Plant SafetySubcategory: 4- FireInitiating Condition: FIRE potentially degrading the level of safety of the plantEAL:HU4.4 Unusual EventA FIRE within the plant PROTECTED AREA that requires firefighting support by an off sitefire response agency to extinguishMode Applicability:AllDefinition(s):FIRE -Combustion characterized by heat and light. Sources of smoke such as slippingdrive belts or overheated electrical equipment do not constitute fires. Observation of flameis preferred but is NOT required if large quantities of smoke and heat are observed.PROTECTED AREA -An area encompassed by physical barriers and to which access iscontrolled. The Protected Area refers to the designated security area around the processbuildings and is depicted in Drawing SS-024-019 Site Plan (ref. 1).Basis:Plant-SpecificNoneGenericThis IC addresses the magnitude and extent of FIRES that may be indicative of a potentialdegradation of the level of safety of the plant.EAL-44The intent of thc 15 _-;nute duratien is to size the FIRE and to disFcirminate against smallFIRES that are readily extinguished (e.g., smoldering waste paper basket). in addition toalarms, other ,nd,,ations of a FIRE could be a drop in fire ,main pressure, automaticactivation of a suppre~ss on system, etc.Page 189 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Upon roccipt, operators will take prompt actions to confirmn the validity of an initial fireidication, repo,. For E AL, et , the emergency deGlFationclock starts at the time that the initial alarm, indicatiGn, Or report Was rec-eived, and not thetime that a s.ubsequent Verificatio-mn acion w~as pe~f)Rmed. Similarly, the fire duration clockalso starts at the time of receipt of the initial alarm, indicatiOn or rcpo.EAL-#2T-his EAL addresses Feceipt of a single fire alarm, and the eXistence of a FIRE is notvrf 1ed (i.e., proved Or withiln 30minutes of the alarm. Upen receipt, operatorswill take prompt ac~tion to confirm the validity of a single fire alarm. For E.AL _assessmentpurposes6, the 30 minute clock starts at the time that the initial alarmA ?a eevd, and notthe time that a subsequent verification action was Pe~eom~ed.A 6inglc fire alarm, absent other indication(s) of a FIRE, ma" be indicativ.e of eqUipMentfailure Or a puiusativation, and Rot an actual FIRE. For this reason, additional ti*me isallowed to vrythvalidity of the alarm. The 30- minute period is a reasonRable amount oftime. .to UULUirimi;:Ue .. aan a.. .u.i r-n- .xit., after tI, t time , a U t ...............to the contrar,', it is assumed that an atual FIRE isi rgesif an actual FIRE is verified by a report from the field, then EAL #1 *6imditlapplicable, and the emergency mu be declared if the FIRE is nt within 15-m~inutes of the report. if the alarm is erified to be due to anequipmet failure Or aspuriusativation, and- this verification occurs within 30-minutes of the receipt of thea~arm the this E=AL isnot applicable and no emnergency declaratien is warranted.EAL-43in addition to a FIRE adderessed by EAL #1 or EAL #2, a FIRE within the plantAR EA R Q TFGno A .R ,.+ .t eXtinguished within 60Dminute .may also potentially degrade thelevel of plant rsafety. Thi basis extends to a F4RE occu~rrng withiin the PROTECTEAREA4 of an ISFSI located outside the plant PROTECTED AREA4. [Sentence for- plants wtan ISESI outside the plant Protected Area]E-AL-44If a FIRE within the plant or ISFS [for ,-,plants .Wth an eutside the plant ProtecteArea]-PROTECTED AREA is of sufficient size to require a response by an offsitefirefighting agency (e.g., a local town Fire Department), then the level of plant safety ispotentially degraded. The dispatch of an offsite firefighting agency to the site requires anemergency declaration only if it is needed to actively support firefighting efforts becausethe FIRE is beyond the capability of the Fire Brigade to extinguish. Declaration is notnecessary if the agency resources are placed on stand-by, or supporting post-extinguishment recovery or investigation actions.Page 190 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Depending upon the plant mode at the time of the event, escalation of the eMegeGYclassification leve!ECL would be via IC CA6 or SA9.VCSNS Basis Reference(s):1. Drawing SS-024-019 Site Plan2. NEI 99-01 HU4Page 191 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:EAL:H -Hazards and Other Conditions Affecting Plant Safety4 -FIREFIRE or EXPLOSION event affecting a SAFETY SYSTEM neededfor the current operating modeHA4.1 AlertFIRE or EXPLOSION resulting in EITHER of the following:* Event damage has caused indications of degraded performance in at least one trainof a SAFETY SYSTEM needed for the current operating mode" The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component orstructure needed for the current operating modeMode Applicability:AllDefinition(s):EXPLOSION -A rapid, violent and catastrophic failure of a piece of equipment due tocombustion, chemical reaction or overpressurization. A release of steam (from highenergy lines or components) or an electrical component failure (caused by short circuits,grounding, arcing, etc.) should not automatically be considered an EXPLOSION. Suchevents require a post-event inspection to determine if the attributes of an EXPLOSION arepresent.FIRE -Combustion characterized by heat and light. Sources of smoke such as slippingdrive belts or overheated electrical equipment do not constitute fires. Observation of flameis preferred but is NOT required if large quantities of smoke and heat are observed.SAFETY SYSTEM -A system required for safe plant operation, cooling down the plantand/or placing it in the cold shutdown condition, including the ECCS. These are typicallysystems classified as safety-related (as defined in 10CFR50.2):Those structures, systems and components that are relied upon to remain functionalduring and following design basis events to assure:Page 192 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E](1) The integrity of the reactor coolant pressure boundary;(2) The capability to shut down the reactor and maintain it in a safe shutdown condition;(3) The capability to prevent or mitigate the consequences of accidents which couldresult in potential offsite exposures.VISIBLE DAMAGE -Damage to a component or structure that is readily observablewithout measurements, testing, or analysis. The visual impact of the damage is sufficientto cause concern regarding the operability or reliability of the affected component orstructure.Basis:Plant-Specific" Refer to VCSNS Fire Protection Evaluation Report, Section 4.0 "Hazards Analysis" toidentify areas containing functions and systems required for safe shutdown of the plant(ref. 4)* An EXPLOSION (including a steam line explosion) that degrades the performance of aSAFETY SYSTEM train or visibly damages a SAFETY SYSTEM component orstructure would be classified under this EAL. The need to classify a steam line breaknot considered an EXPLOSION itself is considered in fission product barrierdegradation monitoring (EAL Category F).GenericThis IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or astructure containing SAFETY SYSTEM components, needed for the current operatingmode. This condition significantly reduces the margin to a loss or potential loss of a fissionproduct barrier, and therefore represents an actual or potential substantial degradation ofthe level of safety of the plant.EAL14bThe first conditional addresses damage to a SAFETY SYSTEM train that is inservice/operation since indications for it will be readily available. The indications ofPage 193 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]degraded performance should be significant enough to cause concern regarding theoperability or reliability of the SAFETY SYSTEM train.I -AL- b2The second conditional addresses damage to a SAFETY SYSTEM componentthat is not in service/operation or readily apparent through indications alone, or to astructure containing SAFETY SYSTEM components. Operators will make thisdetermination based on the totality of available event and damage report information. Thisis intended to be a brief assessment not requiring lengthy analysis or quantification of thedamage.Escalation of the emergency classification leve!ECL would be via IC CS1 or AS-I-RS1.VCSNS Basis Reference(s):1. VCSNS Fire Protection Evaluation Report2. NEI 99-01 CA6Page 194 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:H -Hazards and Other Conditions Affecting Plant Safety5 -Hazardous GasesGaseous release impeding access to equipment necessary fornormal plant operations, cooldown or shutdownEAL:HA5.1 AlertRelease of a toxic, corrosive, asphyxiant or flammable gas into any Table H-3 areaANDEntry into the area is prohibited or impeded (Note 6)Note 6: If the equipment in the listed area was already inoperable or out-of-service before the event occurred, then noemergency classification is warranted.Table H-3 Safe Operation & Shutdown AreasArea Mode ApplicabilityAuxiliary Building 374' 3Auxiliary Building 388' 3, 4, 5Auxiliary Building 400' 4, 5Auxiliary Building 412 3, 4, 5Auxiliary Building 436' 1, 2, 3, 4, 5Auxiliary Building 463' 3, 4, 5Intermediate Building 412' 3Intermediate Building 436' 4, 5Intermediate Building 463' 3, 4, 5Control Building 412' 2, 3Control Building 436' 3, 4, 5Turbine Building (All levels) 1,2Mode Applicability:AllDefinition(s):NonePage 195 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Basis:Plant-SpecificThe Table H-3 safe operation and shutdown areas (with entry-related mode applicability)are those plant areas that contain equipment which require a manual/local action asspecified in general operating procedures (and procedures referenced by them) used fornormal plant operation, cooldown and shutdown. The list specifies the plant operatingmodes during which entry would be required for each area and thus specifying when a lossof access or impeded access is applicable to this EAL (ref. 1).Plant areas where actions of a contingent or emergency nature might be needed to beperformed. (e.g., an action to address an off-normal or emergency condition such asemergency repairs, corrective measures or emergency operations) were not consideredfor inclusion. Additionally, areas for which entry is required solely to perform actions of anadministrative or record keeping nature (e.g., normal rounds or routine inspections) werenot considered for inclusion. Refer to Attachment 4 "Safe Operation & Shutdown AreasTables R-2 & H-3 Bases.".If the equipment in the listed room or area was already inoperable, or out-of-service,before the event occurred, then no emergency should be declared since the event willhave no adverse impact beyond that already allowed by Technical Specifications at thetime of the event.GenericThis IC addresses an event involving a release of a hazardous gas that precludes orimpedes access to equipment necessary to maintain normal plant operation, or requiredfor a normal plant cooldown and shutdown. This condition represents an actual orpotential substantial degradation of the level of safety of the plant.An Alert declaration is warranted if entry into the affected room/area is, or may be,procedurally required during the plant operating mode in effect at the time of the gaseousrelease. The emergency classification is not contingent upon whether entry is actuallynecessary at the time of the release.Page 196 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Evaluation of the IC and EAL do not require atmospheric sampling; it only requires theEmergency Director's judgment that the gas concentration in the affected room/area issufficient to preclude or significantly impede procedurally required access. This judgmentmay be based on a variety of factors including an existing job hazard analysis, report of illeffects on personnel, advice from a subject matter expert or operating experience with thesame or similar hazards. Access should be considered as impeded if extraordinarymeasures are necessary to facilitate entry of personnel into the affected room/area (e.g.,requiring use of protective equipment, such as SCBAs, that is not routinely employed).An emergency declaration is not warranted if any of the following conditions apply." The plant is in an operating mode different than the mode specified for the affectedroom/area (i.e., entry is not required during the operating mode in effect at the time ofthe gaseous release). For example, the plant is in Mode 1 when the gaseous releaseoccurs, and the procedures used for normal operation, cooldown and shutdown do notrequire entry into the affected room until Mode 4." The gas release is a planned activity that includes compensatory measures whichaddress the temporary inaccessibility of a room or area (e.g., fire suppression systemtesting)." The action for which room/area entry is required is of an administrative or recordkeeping nature (e.g., normal rounds or routine inspections)." The access control measures are of a conservative or precautionary nature, and wouldnot actually prevent or impede a required action." If the equipment in the listed room or area was already inoperable, or out-of-service,before the event occurred, then no emergency should be declared since the event willhave no adverse impact beyond that already allowed by Technical Specifications at thetime of the event.An asphyxiant is a gas capable of reducing the level of oxygen in the body to dangerouslevels. Most commonly, asphyxiants work by merely displacing air in an enclosedPage 197 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]environment. This reduces the concentration of oxygen below the normal level of around19%, which can lead to breathing difficulties, unconsciousness or even death.This EAL does not apply to firefighting activities that automatically or manually activate afire suppression system in an area, Or to intentional ine;-i-g of containmeRt (BWR only).Escalation of the emergency classification levelECL would be via Recognition CategoryAR, C or F ICs.VCSNS Basis Reference(s):1. EPP-108 Emergency Action Level Technical Bases Attachment 4 "Safe Operation &Shutdown Areas Tables R-2 & H-3 Bases."2. NEI 99-01 HA5Page 198 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:EAL:H -Hazards and Other Conditions Affecting Plant Safety6 -Control Room EvacuationControl Room evacuation resulting in transfer of plant control toalternate locationsHA6.1 AlertAn event has resulted in plant control being transferred from the Control Room to theControl Room Evacuation Panels (CREP)Mode Applicability:AllDefinition(s):NoneBasis:Plant-SpecificPer AOP-600.1 Control Room Evacuation (ref. 1) plant control is established at the CREPwhen:" Emergency boration capability exists, if required* Charging and letdown flow can be controled to maintain Pressurizer level." EFW flow can be controlled to maintain SG levels.* RCS natural circulation can be established.GenericThis IC addresses an evacuation of the Control Room that results in transfer of plantcontrol to alternate locations outside the Control Room. The loss of the ability to controlthe plant from the Control Room is considered to be a potential substantial degradation inthe level of plant safety.Page 199 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Following a Control Room evacuation, control of the plant will be transferred to alternateshutdown locations. The necessity to control a plant shutdown from outside the ControlRoom, in addition to responding to the event that required the evacuation of the ControlRoom, will present challenges to plant operators and other on-shift personnel. Activationof the ERO and emergency response facilities will assist in responding to thesechallenges.Escalation of the emergency cla6sification 1evelECL would be via IC HS6.VCSNS Basis Reference(s):1. AOP-600.1 Control Room Evacuation2. FEP-4.0 Control Room Evacuation Due To Fire.3. FSAR Section 7.4.1.34. NEI 99-01 HA6Page 200 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:H -Hazards and Other Conditions Affecting Plant Safety6 -Control Room EvacuationInability to control a key safety function from outside the ControlRoomEAL:HS6.1 Site Area EmergencyAn event has resulted in plant control being transferred from the Control Room to theControl Room Evacuation Panels (CREP)ANDControl of any of the following key safety functions is not reestablished within 15 min.(Note 1):" Reactivity control* Core cooling" RCS heat removalNote 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Mode Applicability:AllDefinition(s):NoneBasis:Plant-SpecificPer AOP-600.1 Control Room Evacuation (ref. 1) plant control is established at the CREPwhen:" Emergency boration capability exists, if required" Charging and letdown flow can be controled to maintain Pressurizer level.* EFW flow can be controlled to maintain SG levels." RCS natural circulation can be established.Page 201 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]GenericThis IC addresses an evacuation of the Control Room that results in transfer of plantcontrol to alternate locations, and the control of a key safety function cannot bereestablished in a timely manner. The failure to gain control of a key safety functionfollowing a transfer of plant control to alternate locations is a precursor to a challenge toone or more fission product barriers within a relatively short period of time.The determination of whether or not "control" is established at the remote safe shutdownlocation(s) is based on Emergency Director judgment. The Emergency Director isexpected to make a reasonable, informed judgment within (the Site c" time minutes whether or not the operating staff has control of key safety functionsfrom the remote safe shutdown location(s).Escalation of the emergenGcy classification le-elECL would be via IC FG1 or CG1VCSNS Basis Reference(s):1. AOP-600.1 Control Room Evacuation2. FEP-4.0 Control Room Evacuation Due To Fire.3. FSAR Section 7.4.1.34. NEI 99-01 HS6Page 202 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:H -Hazards and Other Conditions Affecting Plant SafetySubcategory: 7 -JudgmentInitiating Condition: Other conditions existing that in the judgment of the EmergencyDirector warrant declaration of a UEEAL:HU7.1 Unusual EventOther conditions exist which in the judgment of the Emergency Director indicate thatevents are in progress or have occurred which indicate a potential degradation of the levelof safety of the plant or indicate a security threat to facility protection has been initiated.No releases of radioactive material requiring off site response or monitoring are expectedunless further degradation of SAFETY SYSTEMS occurs.Mode Applicability:AllDefinition(s):NoneBasis:Plant-SpecificNoneGenericThis IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrantdeclaration of an emergency because conditions exist which are believed by the EmergencyDirector to fall under the eMorgoncy Gla66ificati.. l-ce!ECL description for a NOW EUnusual Event.VCSNS Basis Reference(s):1. NEI 99-01 HU7Page 203 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:EAL:H -Hazards and Other Conditions Affecting Plant Safety7 -JudgmentOther conditions exist that in the judgment of the EmergencyDirector warrant declaration of an AlertHA7.1 AlertOther conditions exist which, in the judgment of the Emergency Director, indicate thatevents are in progress or have occurred which involve an actual or potential substantialdegradation of the level of safety of the plant or a security event that involves probable lifethreatening risk to site personnel or damage to site equipment because of HOSTILEACTION. Any releases are expected to be limited to small fractions of the EPA ProtectiveAction Guideline exposure levels.Mode Applicability:AllDefinition(s):HOSTILE ACTION- An act toward VCSNS or its personnel that includes the use of violentforce to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve anend. This includes attack by air, land, or water using guns, explosives, PROJECTILES,vehicles, or other devices used to deliver destructive force. Other acts that satisfy theoverall intent may be included. Hostile action should not be construed to include acts ofcivil disobedience or felonious acts that are not part of a concerted attack on VCSNS. Non-terrorism-based EALs should be used to address such activities (i.e., this may includeviolent acts between individuals in the OWNER CONTROLLED AREA).Basis:Plant-SpecificNonePage 204 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT ElGenericThis IC addresses unanticipated conditions not addressed explicitly elsewhere but thatwarrant declaration of an emergency because conditions exist which are believed by theEmergency Director to fall under the cmenrgccY .la66ification lev,-E" L description for anAlert.VCSNS Basis Reference(s):1. NEI 99-01 HA7Page 205 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:EAL:H -Hazards and Other Conditions Affecting Plant Safety7 -JudgmentOther conditions existing that in the judgment of the EmergencyDirector warrant declaration of a Site Area EmergencyHS7.1 Site Area EmergencyOther conditions exist which in the judgment of the Emergency Director indicate thatevents are in progress or have occurred which involve actual or likely major failures ofplant functions needed for protection of the public or HOSTILE ACTION that results inintentional damage or malicious acts, (1) toward site personnel or equipment that could leadto the likely failure of or, (2) that prevent effective access to equipment needed for theprotection of the public. Any releases are not expected to result in exposure levels whichexceed EPA Protective Action Guideline exposure levels beyond the SITE BOUNDARY.Mode Applicability:AllDefinition(s):HOSTILE ACTION -An act toward VCSNS or its personnel that includes the use of violentforce to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve anend. This includes attack by air, land, or water using guns, explosives, PROJECTILES,vehicles, or other devices used to deliver destructive force. Other acts that satisfy theoverall intent may be included. Hostile action should not be construed to include acts ofcivil disobedience or felonious acts that are not part of a concerted attack on VCSNS. Non-terrorism-based EALs should be used to address such activities (i.e., this may includeviolent acts between individuals in the OWNER CONTROLLED AREA)Basis:Plant-SpecificNonePage 206 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]GenericThis EAL addresses unanticipated conditions not addressed explicitly elsewhere but thatwarrant declaration of an emergency because conditions exist which are believed by theDirectorEmergency Director to fall under the clasificationIevelECL description for Site Area Emergency.VCSNS Basis Reference(s):1. NEI 99-01 HS7Page 207 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:EAL:H -Hazards and Other Conditions Affecting Plant Safety7 -JudgmentOther conditions exist which in the judgment of the EmergencyDirector warrant declaration of a General EmergencyHG7.1 General EmergencyOther conditions exist which in the judgment of the Emergency Director indicate thatevents are in progress or have occurred which involve actual or IMMINENT substantialcore degradation or melting with potential for loss of containment integrity or HOSTILEACTION that results in an actual loss of physical control of the facility. Releases can bereasonably expected to exceed EPA Protective Action Guideline exposure levels offsite formore than the immediate site area.Mode Applicability:AllDefinition(s):HOSTILE ACTION -An act toward VCSNS or its personnel that includes the use of violentforce to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve anend. This includes attack by air, land, or water using guns, explosives, PROJECTILES,vehicles, or other devices used to deliver destructive force. Other acts that satisfy theoverall intent may be included. Hostile action should not be construed to include acts ofcivil disobedience or felonious acts that are not part of a concerted attack on VCSNS. Non-terrorism-based EALs should be used to address such activities (i.e., this may includeviolent acts between individuals in the OWNER CONTROLLED AREA).IMMINENT- The trajectory of events or conditions is such that an EAL will be met within arelatively short period of time regardless of mitigation or corrective actions.Basis:Plant-SpecificNonePage 208 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]GenericThis IC addresses unanticipated conditions not addressed explicitly elsewhere but thatwarrant declaration of an emergency because conditions exist which are believed by theEmergency Director to fall under the emergency classification levclECL description for aGeneral Emergency.VCSNS Basis Reference(s):1. NEI 99-01 HG7Page 209 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category S -System MalfunctionEAL Group: Hot Conditions (RCS temperature > 2000F);EALs in this category are applicable only inone or more hot operating modes.Numerous system-related equipment failure events that warrant emergency classificationhave been identified in this category. They may pose actual or potential threats to plantsafety.The events of this category pertain to the following subcategories:1. Loss of Engineered Safeguards Features (ESF) AC PowerLoss of ESF plant electrical power can compromise plant SAFETY SYSTEM operabilityincluding decay heat removal and emergency core cooling systems which may benecessary to ensure fission product barrier integrity. This category includes loss ofonsite and offsite power sources for 7.2 KV safeguards buses 1 DA and 1 DB.2. Loss of Vital DC PowerLoss of emergency plant electrical power can compromise plant SAFETY SYSTEMoperability including decay heat removal and emergency core cooling systems whichmay be necessary to ensure fission product barrier integrity. This category includesloss of power to or degraded voltage on the 125VDC safeguards buses.3. Loss of Control Room IndicationsCertain events that degrade plant operator ability to effectively assess plant conditionswithin the plant warrant emergency classification. Losses of indicators are in thissubcategory.4. RCS ActivityDuring normal operation, reactor coolant fission product activity is very low. Smallconcentrations of fission products in the coolant are primarily from the fission of trampuranium in the fuel clad or minor perforations in the clad itself. Any significant increasefrom these base-line levels (2% -5% clad failures) is indicative of fuel failures and isPage 210 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]covered under Category F, Fission Product Barrier Degradation. However, lesseramounts of clad damage may result in coolant activity exceeding TechnicalSpecification limits. These fission products will be circulated with the reactor coolantand can be detected by coolant sampling.5. RCS LeakageThe reactor vessel provides a volume for the coolant that covers the reactor core. Thereactor vessel and associated pressure piping (reactor coolant system) togetherprovide a barrier to limit the release of radioactive material should the reactor fuel cladintegrity fail. Excessive RCS leakage greater than Technical Specification limitsindicates potential pipe cracks that may propagate to an extent threatening fuel clad,RCS and Containment integrity.6. RTS FailureThis subcategory includes events related to failure of the Reactor Trip System (RTS) toinitiate and complete reactor trips. In the plant licensing basis, postulated failures of theRTS to complete a reactor trip comprise a specific set of analyzed events referred to asAnticipated Transient Without Trip (ATWS) events. For EAL classification however,ATWS is intended to mean any trip failure event that does not achieve reactorshutdown. If RTS actuation fails to assure reactor shutdown, positive control ofreactivity is at risk and could cause a threat to fuel clad, RCS and Containmentintegrity.7. Loss of CommunicationsCertain events that degrade plant operator ability to effectively communicate withessential personnel within or external to the plant warrant emergency classification.8. Containment Isolation FailureFailure of containment isolation capability (under conditions in which the containment isnot currently challenged) warrants emergency classification.9. Hazardous Event Affectinq Safety SystemsPage 211 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT ElVarious natural and technological events that result in degraded plant SAFETYSYSTEM performance or significant VISIBLE DAMAGE warrant emergencyclassification under the sub-category.Page 212 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category: S -System MalfunctionSubcategory: 1 -Loss of ESF AC PowerInitiating Condition: Loss of all offsite AC power capability to ESF buses for 15 minutesor longer.EAL:SU1.1 Unusual EventLoss of all offsite AC power (Table S-1) capability to 7.2 KV ESF buses 1 DA and 1 DB for 2-15 min. (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Table S-1 AC Power SuppliesOffsite:* 115 KV power to XTF-4 and XTF-5* 230 KV power to XTF-31* Parr Hydro Plant 13.8 KV power to ESFbus 1DAor 1DBOnsite:* Diesel Generator A0 Diesel Generator BMode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown,Definition(s):NoneBasis:Plant-SpecificAs used in this EAL the term "capability" means an AC power source is either currentlypowering essential loads on one or more 7.2 KV ESF buses or is capable of energizingand powering essential loads on at least one 7.2 KV ESF bus within 15 min.Page 213 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Table S-1 lists AC sources capable of powering ESF buses. Safeguards power originatesoffsite from two independent sources (ref. 1):* The Parr Generating Complex supplies 115 KV power to the two Engineered SafetyFeature (ESF) transformers (XTF-4 and XTF-5). The transformer outputs arecombined at 7.2 KV bus 1 DX and then supplied to 7.2 KV ESF bus 1 DA (Train A).This is the preferred or normal power source to Train A and the alternate powersource for Train B.* 7.2 KV ESF bus 1 DB (Train B) is supplied from the emergency auxiliary transformer(XTF-31). The emergency auxiliary transformer receives 230 KV power from theVirgil C. Summer substation (switchyard) bus 3. This transformer is the preferredpower source for Train B and the alternate power source for Train A.The Parr Hydro Plant provides a 13.8 KV AC line to the 7.2 KV ESF buses. This AlternateAC Power Supply has the capacity to supply only one fully loaded ESF bus (ref. 4).The AAC is designed to provide back-up power to either ESF bus whenever one of theDiesel Generators is out of service, particularly in Modes 1 through 4. The AAC is verifiedavailable and an operational readiness status check is performed when it is anticipatedthat one of the Diesel Generators will be inoperable for longer than the allowed outagetime of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The design of the AAC is capable of providing the required safety andnon-safety related loads in the event of a total loss of offsite power and if both DieselGenerators fail to start and load. During these events it is assumed that there is no seismicevent or an event that requires safeguards actuation (e.g., safety injection, containmentspray, etc.) Although the AAC is not designed for DBA loads, it is capable of supplyingsufficient power to mitigate the effects of an accident. The AAC is not credited in the safetyanalysis. The AAC is, however, capable of mitigating the dominant core damagesequences and provides a significant overall risk reduction for station operation. The AACalone is adequate to supply electrical power to affect a safe shutdown of the plant (ref. 7).The two trains of 7.2 KV safeguards power are also provided with an onsite standbysource of power for supplying power when the ESF and emergency auxiliary transformersPage 214 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]are not available. The Diesel Generators A and B are capable of supplying all loads on thedistribution network of their respective train (ref. 1, 2, 3, 4, 5).GenericThis IC addresses a prolonged loss of offsite power. The loss of offsite power sourcesrenders the plant more vulnerable to a complete loss of power to AC eie~eRYengineered safequard features (ESF) buses. This condition represents a potentialreduction in the level of safety of the plant.For emergency classification purposes, "capability" means that an offsite AC powersource(s) is available to the emeFqeGy-ESF buses, whether or not the buses are poweredfrom it.Fifteen minutes was selected as a threshold to exclude transient or momentary losses ofoffsite power.Escalation of the emcrgency classification lcvclECL would be via IC SAI.VCSNS Basis Reference(s):1. FSAR Section 82. EOP-6.0 Loss of All ESF AC Power3. EOP-1.0 Reactor Trip/Safety Injection Actuation4. SOP-304 115KV/7.2KV Operations5. SOP-306 Emergency Diesel Generator6. AOP-304.1 Loss of Bus 1 DA(1 DB) with the Diesel not Available7. Technical Specifications Bases 3/4.88. NEI 99-01 SU1Page 215 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:S -System Malfunction1 -Loss of ESF AC PowerLoss of all but one AC power source to ESF buses for 15 minutesor longer.EAL:SA1.1 AlertAC power capability to 7.2 KV ESF buses 1 DA and 1 DB reduced to a single power source(Table S-1) for > 15 min. (Note 1)ANDAny additional single power source failure will result in loss of all AC power to SAFETYSYSTEMSNote 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Table S-1 AC Power SuppliesOffsite:* 115 KV power to XTF-4 and XTF-5* 230 KV power to XTF-310 Parr Hydro Plant 13.8 KV power to ESFbus 1DA or 1DBOnsite:* Diesel Generator A* Diesel Generator BMode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown,Definition(s):SAFETY SYSTEM -A system required for safe plant operation, cooling down the plantand/or placing it in the cold shutdown condition, including the ECCS. These are typicallysystems classified as safety-related (as defined in 10CFR50.2):Those structures, systems and components that are relied upon to remain functionalduring and following design basis events to assure:Page 216 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E](1) The integrity of the reactor coolant pressure boundary;(2) The capability to shut down the reactor and maintain it in a safe shutdowncondition;(3) The capability to prevent or mitigate the consequences of accidents which couldresult in potential offsite exposures.Basis:Plant-SpecificAs used in this EAL the term "capability" means an AC power source is either currentlypowering essential loads on one or more 7.2 KV ESF buses or is capable of energizingand powering essential loads on at least one 7.2 KV ESF bus within 15 min.Table S-1 lists AC sources capable of powering ESF buses. Safeguards power originatesoffsite from two independent sources (ref. 1):* The Parr Generating Complex supplies 115 KV power to the two Engineered SafetyFeature (ESF) transformers (XTF-4 and XTF-5). The transformer outputs arecombined at 7.2 KV bus 1 DX and then supplied to 7.2 KV ESF bus 1 DA (Train A).This is the preferred or normal power source to Train A and the alternate powersource for Train B.* 7.2 KV ESF bus 1 DB (Train B) is supplied from the emergency auxiliary transformer(XTF-31). The emergency auxiliary transformer receives 230 KV power from theVirgil C. Summer substation (switchyard) bus 3. This transformer is the preferredpower source for Train B and the alternate power source for Train A.The Parr Hydro Plant provides a 13.8 KV AC line to the 7.2 KV ESF buses. This AlternateAC Power Supply has the capacity to supply only one fully loaded ESF bus (ref. 4).The AAC is designed to provide back-up power to either ESF bus whenever one of theDiesel Generators is out of service, particularly in Modes 1 through 4. The AAC is verifiedavailable and an operational readiness status check is performed when it is anticipatedthat one of the Diesel Generators will be inoperable for longer than the allowed outagePage 217 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The design of the AAC is capable of providing the required safety andnon-safety related loads in the event of a total loss of offsite power and if both DieselGenerators fail to start and load. During these events it is assumed that there is no seismicevent or an event that requires safeguards actuation (e.g., safety injection, containmentspray, etc.) Although the AAC is not designed for DBA loads, it is capable of supplyingsufficient power to mitigate the effects of an accident. The AAC is not credited in the safetyanalysis. The AAC is, however, capable of mitigating the dominant core damagesequences and provides a significant overall risk reduction for station operation. The AACalone is adequate to supply electrical power to affect a safe shutdown of the plant (ref. 7).The two trains of 7.2 KV safeguards power are also provided with an onsite standbysource of power for supplying power when the ESF and emergency auxiliary transformersare not available. The Diesel Generators A and B are capable of supplying all loads on thedistribution network of their respective train (ref. 1, 2, 3, 4, 5).The 15-minute interval was selected as a threshold to exclude transient or momentarypower losses. If the capability of a second source of ESF bus power is not restored within15 minutes, an Alert is declared under this EAL.GenericThis IC describes a significant degradation of offsite and onsite AC power sources suchthat any additional single failure would result in a loss of all AC power to SAFETYSYSTEMS. In this condition, the sole AC power source may be powering one, or morethan one, train of safety-related equipment. This IC provides an escalation path from ICSul.An "AC power source" is a source recognized in AOPs and EOPs, and capable ofsupplying required power to an emergeniy-Engineered Safeguard Features (ESF) bus.Some examples of this condition are presented below.* A loss of all offsite power with a concurrent failure of all but one eMergeRCyESFpower source (e.g., an onsite diesel generator).Page 218 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]" A loss of all offsite power and loss of all power sources (e.g., onsitediesel generators) with a single train of emegeRGY-ESF buses being back-fed fromthe unit main generator." A loss of emefgeR~yESF power sources (e.g., onsite diesel generators) with asingle train of eme Gy.ESF buses being back-fed from an offsite power source.Fifteen minutes was selected as a threshold to exclude transient or momentary losses ofpower.Escalation of the emergency cl~asification lcveIECL would be via IC SS1.VCSNS Basis Reference(s):1. FSAR Section 82. EOP-6.0 Loss of All ESF AC Power3. EOP-1.0 Reactor Trip/Safety Injection Actuation4. SOP-304 115KV/7.2KV Operations5. SOP-306 Emergency Diesel Generator6. AOP-304.1 Loss of Bus 1 DA(1 DB) with the Diesel not Available7. Technical Specifications Bases 3/4.88. NEI 99-01 SA1Page 219 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:S -System Malfunction1 -Loss of ESF AC PowerLoss of all offsite and all onsite AC power to ESF buses for 15minutes or longer.EAL:SS1.1 Site Area EmergencyLoss of all offsite and all onsite AC power (Table S-1) capability to 7.2 KV ESF buses 1 DAand 1DB for > 15 min. (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Table S-1AC Power SuppliesOffsite:* 115 KV power to XTF-4 and XTF-5* 230 KV power to XTF-31* Parr Hydro Plant 13.8 KV power to ESFbus 1DA or 1DBOnsite:* Diesel Generator A* Diesel Generator BMode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):NoneBasis:Plant-SpecificAs used in this EAL the term "capability" means an AC power source is either currentlypowering essential loads on one or more 7.2 KV ESF buses or is capable of energizingand powering essential loads on at least one 7.2 KV ESF bus within 15 min.Page 220 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Table S-1 lists AC sources capable of powering ESF buses. Safeguards power originatesoffsite from two independent sources (ref. 1):* The Parr Generating Complex supplies 115 KV power to the two Engineered SafetyFeature (ESF) transformers (XTF-4 and XTF-5). The transformer outputs arecombined at 7.2 KV bus 1 DX and then supplied to 7.2 KV ESF bus 1 DA (Train A).This is the preferred or normal power source to Train A and the alternate powersource for Train B.* 7.2 KV ESF bus 1 DB (Train B) is supplied from the emergency auxiliary transformer(XTF-31). The emergency auxiliary transformer receives 230 KV power from theVirgil C. Summer substation (switchyard) bus 3. This transformer is the preferredpower source for Train B and the alternate power source for Train A.The Parr Hydro Plant provides a 13.8 KV AC line to the 7.2 KV ESF buses. This AlternateAC Power Supply has the capacity to supply only one fully loaded ESF bus (ref. 4).The AAC is designed to provide back-up power to either ESF bus whenever one of theDiesel Generators is out of service, particularly in Modes 1 through 4. The AAC is verifiedavailable and an operational readiness status check is performed when it is anticipatedthat one of the Diesel Generators will be inoperable for longer than the allowed outagetime of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The design of the AAC is capable of providing the required safety andnon-safety related loads in the event of a total loss of offsite power and if both DieselGenerators fail to start and load. During these events it is assumed that there is no seismicevent or an event that requires safeguards actuation (e.g., safety injection, containmentspray, etc.) Although the AAC is not designed for DBA loads, it is capable of supplyingsufficient power to mitigate the effects of an accident. The AAC is not credited in the safetyanalysis. The AAC is, however, capable of mitigating the dominant core damagesequences and provides a significant overall risk reduction for station operation. The AACalone is adequate to supply electrical power to affect a safe shutdown of the plant (ref. 7).The two trains of 7.2 KV safeguards power are also provided with an onsite standbysource of power for supplying power when the ESF and emergency auxiliary transformersPage 221 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT Elare not available. The Diesel Generators A and B are capable of supplying all loads on thedistribution network of their respective train (ref. 1, 2, 3, 4, 5).This EAL is the hot condition equivalent of the cold condition loss of all AC power EALCA1.1. When in Cold Shutdown, Refueling, or Defueled mode, the event can be classifiedas an Alert because of the significantly reduced decay heat, lower temperature andpressure, increasing the time to restore one of the ESF buses, relative to that existingwhen in hot conditions.GenericThis IC addresses a total loss of AC power that compromises the performance of allSAFETY SYSTEMS requiring electric power including those necessary for emergencycore cooling, containment heat removal/pressure control, spent fuel heat removal and theultimate heat sink. In addition, fission product barrier monitoring capabilities may bedegraded under these conditions. This IC represents a condition that involves actual orlikely major failures of plant functions needed for the protection of the public.Fifteen minutes was selected as a threshold to exclude transient or momentary powerlosses.Escalation of the ,mAegrcncy cGlasification lcv.eECL would be via ICs AG-1-RG1, FG1 orSG1.VCSNS Basis Reference(s):1. FSAR Section 82. EOP-6.0 Loss of All ESF AC Power3. EOP-1.0 Reactor Trip/Safety Injection Actuation4. SOP-304 115KV/7.2KV Operations5. SOP-306 Emergency Diesel Generator6. AOP-304.1 Loss of Bus 1 DA(1 DB) with the Diesel not Available7. Technical Specifications Bases 3/4.88. NEI 99-01 SS1Page 222 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category: S -System MalfunctionSubcategory: 1 -Loss of ESF AC PowerInitiating Condition: Prolonged loss of all off site and all onsite AC power to ESF busesor loss of all AC and vital DC power sources for 15 minutes orlonger.EAL:SG1.1 General EmergencyLoss of all offsite and all onsite AC power capability to 7.2 KV ESF buses 1 DA and 1 DB(Table S-1)ANDEITHER of the following:" Restoration of at least one ESF bus within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is not likely (Note 1)" CSFST Core Cooling-RED path conditions metNote 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Table S-1 AC Power SuppliesOffsite:* 115 KV power to XTF-4 and XTF-5* 230 KV power to XTF-31* Parr Hydro Plant 13.8 KV power to ESFbus 1DA or 1DBOnsite:" Diesel Generator A" Diesel Generator BMode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):NoneBasis:Page 223 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Plant-SpecificAs used in this EAL the term "capability" means an AC power source is either currentlypowering essential loads on one or more 7.2 KV ESF buses or is capable of energizingand powering essential loads on at least one 7.2 KV ESF bus within 15 min.Table S-1 lists AC sources capable of powering ESF buses. Safeguards power originatesoffsite from two independent sources (ref. 3):0 The Parr Generating Complex supplies 115 KV power to the two Engineered SafetyFeature (ESF) transformers (XTF-4 and XTF-5). The transformer outputs arecombined at 7.2 KV bus 1 DX and then supplied to 7.2 KV ESF bus 1 DA (Train A).This is the preferred or normal power source to Train A and the alternate powersource for Train B.* 7.2 KV ESF bus 1 DB (Train B) is supplied from the emergency auxiliary transformer(XTF-31). The emergency auxiliary transformer receives 230 KV power from theVirgil C. Summer substation (switchyard) bus 3. This transformer is the preferredpower source for Train B and the alternate power source for Train A.The Parr Hydro Plant provides a 13.8 KV AC line to the 7.2 KV ESF buses. This AlternateAC Power Supply has the capacity to supply only one fully loaded ESF bus (ref. 4).The AAC is designed to provide back-up power to either ESF bus whenever one of theDiesel Generators is out of service, particularly in Modes 1 through 4. The AAC is verifiedavailable and an operational readiness status check is performed when it is anticipatedthat one of the Diesel Generators will be inoperable for longer than the allowed outagetime of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The design of the AAC is capable of providing the required safety andnon-safety related loads in the event of a total loss of offsite power and if both DieselGenerators fail to start and load. During these events it is assumed that there is no seismicevent or an event that requires safeguards actuation (e.g., safety injection, containmentspray, etc.) Although the AAC is not designed for DBA loads, it is capable of supplyingsufficient power to mitigate the effects of an accident. The AAC is not credited in the safetyanalysis. The AAC is, however, capable of mitigating the dominant core damagePage 224 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]sequences and provides a significant overall risk reduction for station operation. The AACalone is adequate to supply electrical power to affect a safe shutdown of the plant (ref. 7).The two trains of 7.2 KV safeguards power are also provided with an onsite standbysource of power for supplying power when the ESF and emergency auxiliary transformersare not available. The Diesel Generators A and B are capable of supplying all loads on thedistribution network of their respective train (ref. 3, 4, 5, 6, 7).Indication of continuing core cooling degradation is manifested by entry to Critical SafetyFunction Status Tree (CSFST) Core Cooling-RED or ORANGE path (ref. 8).Critical Safety Function Status Tree (CSFST) Core Cooling-RED or ORANGE path is givenin Figure 5 and indicates significant core exit superheating and core uncovery.GenericThis IC addresses a prolonged loss of all power sources to AC emergenfy-engineeredsafeguard (ES) buses. A loss of all AC power compromises the performance of allSAFETY SYSTEMS requiring electric power including those necessary for emergencycore cooling, containment heat removal/pressure control, spent fuel heat removal and theultimate heat sink. A prolonged loss of these buses will lead to a loss of one or morefission product barriers. In addition, fission product barrier monitoring capabilities may bedegraded under these conditions.The EAL should require declaration of a General Emergency prior to meeting thethresholds for IC FG1. This will allow additional time for implementation of offsiteprotective actions.Escalation of the emergency classification from Site Area Emergency will occur if it isprojected that power cannot be restored to at least one A, ermnegenio7.2KV ES bus bythe end of the analyzed station blackout coping period. Beyond this time, plant responsesand event trajectory are subject to greater uncertainty, and there is an increased likelihoodof challenges to multiple fission product barriers.The estimate for restoring at least one ES bus should be based on arealistic appraisal of the situation. Mitigation actions with a low probability of successPage 225 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]should not be used as a basis for delaying a classification upgrade. The goal is tomaximize the time available to prepare for, and implement, protective actions for thepublic.The EAL will also require a General Emergency declaration if the loss of AC power resultsin parameters that indicate an inability to adequately remove decay heat from the core.VCSNS Basis Reference(s):1. FSAR Section 8.3.2.1.22. FSAR Section 8.4.13. FSAR Section 84. EOP-6.0 Loss of All ESF AC Power5. EOP-1.0 Reactor Trip/Safety Injection Actuation6. SOP-304 115KV/7.2KV Operations7. SOP-306 Emergency Diesel Generator8. EOP-12.0 Monitoring of Critical Safety Functions9. AOP-304.1 Loss of Bus 1 DA(1 DB) with the Diesel not Available10. NEI 99-01 SG1Page 226 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:S -System Malfunction1 -Loss of ESF AC PowerProlonged loss of all offsite and all onsite AC power to ESF busesor loss of all AC and vital DC power sources for 15 minutes orlonger.EAL:SG1.2 General EmergencyLoss of all offsite and all onsite AC power (Table S-1) capability to 7.2 KV ESF buses 1 DAand 1DB for ->15 min.AND< 108 VDC on both Train A and Train B vital 125 VDC systems for >- 15 min.(Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Table S-1AC Power SuppliesOffsite:* 115 KV power to XTF-4 and XTF-50 230 KV power to XTF-310 Parr Hydro Plant 13.8 KV power to ESFbus 1DA or 1DBOnsite:" Diesel Generator A* Diesel Generator BMode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):NoneBasis:Plant-SpecificPage 227 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]ESF AC PowerAs used in this EAL the term "capability" means an AC power source is either currentlypowering essential loads on one or more 7.2 KV ESF buses or is capable of energizingand powering essential loads on at least one 7.2 KV ESF bus within 15 min.Table S-1 lists AC sources capable of powering ESF buses. Safeguards power originatesoffsite from two independent sources (ref. 5):* The Parr Generating Complex supplies 115 KV power to the two Engineered SafetyFeature (ESF) transformers (XTF-4 and XTF-5). The transformer outputs arecombined at 7.2 KV bus 1 DX and then supplied to 7.2 KV ESF bus 1 DA (Train A).This is the preferred or normal power source to Train A and the alternate powersource for Train B.* 7.2 KV ESF bus 1 DB (Train B) is supplied from the emergency auxiliary transformer(XTF-31). The emergency auxiliary transformer receives 230 KV power from theVirgil C. Summer substation (switchyard) bus 3. This transformer is the preferredpower source for Train B and the alternate power source for Train A.The Parr Hydro Plant provides a 13.8 KV AC line to the 7.2 KV ESF buses. This AlternateAC Power Supply has the capacity to supply only one fully loaded ESF bus (ref. 4).The AAC is designed to provide back-up power to either ESF bus whenever one of theDiesel Generators is out of service, particularly in Modes 1 through 4. The AAC is verifiedavailable and an operational readiness status check is performed when it is anticipatedthat one of the Diesel Generators will be inoperable for longer than the allowed outagetime of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The design of the AAC is capable of providing the required safety andnon-safety related loads in the event of a total loss of offsite power and if both DieselGenerators fail to start and load. During these events it is assumed that there is no seismicevent or an event that requires safeguards actuation (e.g., safety injection, containmentspray, etc.) Although the AAC is not designed for DBA loads, it is capable of supplyingsufficient power to mitigate the effects of an accident. The AAC is not credited in the safetyanalysis. The AAC is, however, capable of mitigating the dominant core damagePage 228 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]sequences and provides a significant overall risk reduction for station operation. The AACalone is adequate to supply electrical power to affect a safe shutdown of the plant (ref. 7).The two trains of 7.2 KV safeguards power are also provided with an onsite standbysource of power for supplying power when the ESF and emergency auxiliary transformersare not available. The Diesel Generators A and B are capable of supplying all loads on thedistribution network of their respective train (ref. 1, 2, 3, 4, 5).DC Vital PowerClass 1 E 125 VDC power consists of two separate main distribution panels. These panelsare DPN-1 HA and DPN-1 HB for the Train A and Train B vital 125 VDC systems (ref. 8).They are both located on the 412' level of the Intermediate Building. Each main panel issupplied DC power through a battery charger (XBC-1 A and XBC-1 B) and is backed up bya 60 cell, lead-acid storage battery (ref. 9).Minimum DC bus voltage is 108 VDC (ref. 10, 11). MCB annunciators XCP-636 4-6 andXCP-637 4-6 (DC SYS OVRVOLT/UNDRVOLT) signal low Train A and Train B voltage at126 VDC (ref. 12, 13). Train A and Train B voltage may be monitored on MCB Panel XCP-6116 voltmeters (ref. 14).GenericThis IC addresses a concurrent and prolonged loss of both AC and Vital DC power. A lossof all AC power compromises the performance of all SAFETY SYSTEMS requiring electricpower including those necessary for emergency core cooling, containment heatremoval/pressure control, spent fuel heat removal and the ultimate heat sink. A loss ofVital DC power compromises the ability to monitor and control SAFETY SYSTEMS. Asustained loss of both AC and DC power will lead to multiple challenges to fission productbarriers.Fifteen minutes was selected as a threshold to exclude transient or momentary powerlosses. The 15-minute emergency declaration clock begins at the point when both EALthresholds are met.VCSNS Basis Reference(s):Page 229 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]1. FSAR Section 82. EOP-6.0 Loss of All ESF AC Power3. EOP-1.0 Reactor Trip/Safety Injection Actuation4. SOP-304 115KV/7.2KV Operations5. SOP-306 Emergency Diesel Generator6. AOP-304.1 Loss of Bus 1 DA(1 DB) with the Diesel not Available7. Technical Specifications Bases 3/4.88. FSAR Figure 8.3-2aa9. FSAR Section 8.3.2.110. EOP-6.0 Loss of All ESF AC Power11. FSAR Section 8.3.2.1.312. ARP-001 -XCP-636 Annunciator Point 4-613. ARP-001 -XCP-637 Annunciator Point 4-614.201-332 Main Control Board Instrumentation Control Panel XCP-611615. NEI 99-01 SG8Page 230 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT ElCategory: S -System MalfunctionSubcategory: 2 -Loss of Vital DC PowerInitiating Condition: Loss of all vital DC power for 15 minutes or longer.EAL:SS2.1 Site Area Emergency< 108 VDC on both Train A and Train B vital 125 VDC systems for -> 15 min. (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Mode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):NoneBasis:Plant-SpecificClass 1 E 125 VDC power consists of two separate main distribution panels. These panelsare DPN-1HA and DPN-1HB for the Train A and Train B vital 125 VDC systems (ref. 1).They are both located on the 412' level of the Intermediate Building. Each main panel issupplied DC power through a battery charger (XBC-1A and XBC-1 B) and is backed up bya 60 cell, lead-acid storage battery (ref. 2).Minimum DC bus voltage is 108 VDC (ref. 3, 4). MCB annunciators XCP-636 4-6 andXCP-637 4-6 (DC SYS OVRVOLT/UNDRVOLT) signal low Train A and Train B voltage at126 VDC (ref. 5, 6). Train A and Train B voltage may be monitored on MCB Panel XCP-6116 voltmeters (ref. 7).GenericThis IC addresses a loss of Vital DC power which compromises the ability to monitor andcontrol SAFETY SYSTEMS. In modes above Cold Shutdown, this condition involves amajor failure of plant functions needed for the protection of the public.Page 231 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Fifteen minutes was selected as a threshold to exclude transient or momentary powerlosses.Escalation of the emergency classification levelECL would be via ICs AG-1-RG1, FG1 orSG8SG1.VCSNS Basis Reference(s):1. FSAR Figure 8.3-2aa2. FSAR Section 8.3.2.13. EOP-6.0 Loss of All ESF AC Power4. FSAR Section 8.3.2.1.35. ARP-001 -XCP-636 Annunciator Point 4-66. ARP-001 -XCP-637 Annunciator Point 4-67. 201-332 Main Control Board Instrumentation Control Panel XCP-61168. NEI 99-01 SS8Page 232 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:S -System Malfunction3 -Loss of Control Room IndicationsUNPLANNED loss of Control Room indications for 15 minutes orlonger.EAL:SU3.1 Unusual EventAn UNPLANNED event results in the inability to monitor one or more Table S-2parameters from within the Control Room for -> 15 min. (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Table S-2 Safety System Parameters" Reactor power" Reactor vessel/pressurizer level* RCS pressure" Core Exit TCs" Level in at least one SG" EFW/AFW flowMode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):UNPLANNED -A parameter change or an event that is not 1) the result of an intendedevolution or 2) an expected plant response to a transient. The cause of the parameterchange or event may be known or unknown.Basis:Plant-SpecificDisplay information important in evaluating the performance of a safeguards system duringperiodic test, continuous normal operation, or post-accident operation is provided on theMain Control Board (MCB) panels XCP-6101 through XCP-6117. Sufficient processindicators, alarms, and recorders are provided to enable the operator to determine whetherPage 233 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT Ela system is performing normally or if there is some unanticipated failure within a system(ref. 1, 2). The Integrated Plant Computer System (IPCS) monitors selected instrumentchannels to supplement the display information (ref. 3).CSFST paramters are normally monitored using the SPDS display on the Integrated PlantComputer System (IPCS) (ref. 4).GenericThis IC addresses the difficulty associated with monitoring normal plant conditions withoutthe ability to obtain SAFETY SYSTEM parameters from within the Control Room. Thiscondition is a precursor to a more significant event and represents a potential degradationin the level of safety of the plant.As used in this EAL, an "inability to monitor" means that values for one or more of thelisted parameters cannot be determined from within the Control Room. This situationwould require a loss of all of the Control Room sources for the given parameter(s). Forexample, the reactor power level cannot be determined from any analog, digital andrecorder source within the Control Room.An event involving a loss of plant indications, annunciators and/or display systems isevaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1 022) todetermine if an NRC event report is required. The event would be reported if it significantlyimpaired the capability to perform emergency assessments. In particular, emergencyassessments necessary to implement abnormal operating procedures, emergencyoperating procedures, and emergency plan implementing procedures addressingemergency classification, accident assessment, or protective action decision-making.This EAL is focused on a selected subset of plant parameters associated with the keysafety functions of reactivity control, core cooling [PW] / RPV level [Br4] and RCS heatremoval. The loss of the ability to determine one or more of these parameters from withinthe Control Room is considered to be more significant than simply a reportable condition.In addition, if all indication sources for one or more of the listed parameters are lost, thenthe ability to determine the values of other SAFETY SYSTEM parameters may beimpacted as well. For example, if the value for reactor vessel level [PWR] ! RPV waterPage 234 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]level4WW-cannot be determined from the indications and recorders on a main controlboard, the SPDS or the plant computer, the availability of other parameter values may becompromised as well.Fifteen minutes was selected as a threshold to exclude transient or momentary losses ofindication.Escalation of the emergency classification IcvelECL would be via IC SA2SA3.VCSNS Basis Reference(s):1. FSAR Section 7.52. FSAR Section 7.63. OAP-107.1 Control of IPCS Functions4. EOP-12.0 Monitoring of Critical Safety Functions5. NEI 99-01 SU2Page 235 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:S -System Malfunction3 -Loss of Control Room IndicationsUNPLANNED loss of Control Room indications for 15 minutes orlonger with a significant transient in progress.EAL:SA3.1 AlertAn UNPLANNED event results in the inability to monitor one or more Table S-2parameters from within the Control Room for > 15 min. (Note 1)ANDAny of the following transient events in progress:" Automatic or manual runback greater than 25% thermal reactor power" Electrical load rejection greater than 25% full electrical load" Reactor trip* ECCS actuationNote 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Table S-2 Safety System Parameters" Reactor power* Reactor vessel/pressurizer level" RCS pressure" Core Exit TCs" Level in at least one SG" EFW/AFW flowMode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):UNPLANNED -A parameter change or an event that is not 1) the result of an intendedevolution or 2) an expected plant response to a transient. The cause of the parameterchange or event may be known or unknown.Basis:Page 236 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT ElPlant-SpecificDisplay information important in evaluating the performance of a safeguards system duringperiodic test, continuous normal operation, or post-accident operation is provided on theMain Control Board (MCB) panels XCP-6101 through XCP-6117. Sufficient processindicators, alarms, and recorders are provided to enable the operator to determine whethera system is performing normally or if there is some unanticipated failure within a system(ref. 1, 2). The Integrated Plant Computer System (IPCS) monitors selected instrumentchannels to supplement the display information (ref. 3).CSFST paramters are normally monitored using the SPDS display on the Integrated PlantComputer System (IPCS) (ref. 4).GenericThis IC addresses the difficulty associated with monitoring rapidly changing plantconditions during a transient without the ability to obtain SAFETY SYSTEM parametersfrom within the Control Room. During this condition, the margin to a potential fissionproduct barrier challenge is reduced. It thus represents a potential substantial degradationin the level of safety of the plant.As used in this EAL, an "inability to monitor" means that values for one or more of thelisted parameters cannot be determined from within the Control Room. This situationwould require a loss of all of the Control Room sources for the given parameter(s). Forexample, the reactor power level cannot be determined from any analog, digital andrecorder source within the Control Room.An event involving a loss of plant indications, annunciators and/or display systems isevaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1 022) todetermine if an NRC event report is required. The event would be reported if it significantlyimpaired the capability to perform emergency assessments. In particular, emergencyassessments necessary to implement abnormal operating procedures, emergencyoperating procedures, and emergency plan implementing procedures addressingemergency classification, accident assessment, or protective action decision-making.Page 237 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]This EAL is focused on a selected subset of plant parameters associated with the keysafety functions of reactivity control, core cooling [PW.] / RPV level [BWRJ and RCS heatremoval. The loss of the ability to determine one or more of these parameters from withinthe Control Room is considered to be more significant than simply a reportable condition.In addition, if all indication sources for one or more of the listed parameters are lost, thenthe ability to determine the values of other SAFETY SYSTEM parameters may beimpacted as well. For example, if the value for reactor vessel level [PWH, / RPV waterlveI-[8WRsteam qenerator level cannot be determined from the indications and recorderson a main control board, the SPDS or the plant computer, the availability of otherparameter values may be compromised as well.Fifteen minutes was selected as a threshold to exclude transient or momentary losses ofindication.Escalation of the mern.gency leveECL would be via ICs FS1 or IC AS4-1RS1.VCSNS Basis Reference(s):1. FSAR Section 7.52. FSAR Section 7.63. OAP-107.1 Control of IPCS Functions4. EOP-1 2.0 Monitoring of Critical Safety Functions5. NEI 99-01 SA2Page 238 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category: S -System MalfunctionSubcategory: 4 -RCS ActivityInitiating Condition: Reactor coolant activity greater than Technical Specificationallowable limits.EAL:SU4.1 Unusual EventWith letdown in service, RM-L1 high range monitor > 39,000 cpmMode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):NoneBasis:Plant-SpecificThe status of coolant activity and radiation levels is routinely monitored to detect the onsetof fuel failure (ref. 1). This EAL addresses reactor coolant letdown line radiation levelssensed by RM-L1 in excess of Technical Specification allowable limits. Primary coolantletdown line radiation monitor RM-L1 provides a means of detecting the presence of failedfuel by indication of an increase in letdown activity which is then verified by analysis ofsamples. Two detectors with overlapping range are provided. The low range is designedfor the monitor to be on range with the radioactivity resulting from tramp uranium and thecorrosion products. The range of overlap between the low and high range detectors issuch that two detectors would be operational in the range of concentrations relating toplant operation with failed fuel (ref. 2). Alarms are received on the MCB panel from the lowand high range detectors (ref. 3). The high range alarm is _ 5 X EQUIL, where EQUIL isthe normal or expected reading of the monitor when radioactivity is normally present in thesample stream. The low range alarm is _ 2 X EQUIL (ref. 4).Page 239 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]The specified EAL threshold setpoint was calculated using RCS activities given in Table11.1-2 of the FSAR and included all activities in the table scaled to 1.0 i.Ci/gm doseequivalent iodine (ref. 5, 6).GenericThis IC addresses a reactor coolant activity value that exceeds an allowable limit specifiedin Technical Specifications. This condition is a precursor to a more significant event andrepresents a potential degradation of the level of safety of the plant.Escalation of the emergen.y leveECL would be via ICs FA1 or theRecognition Category A-R_ICs.VCSNS Basis Reference(s):1. SAP-154 Failed Fuel Action Plan2. VCSNS Design Bases Document -Radiation Monitoring System (RM)3. ARP-019-XCP-6424. HPP-904 Use of the Radiation Monitoring System (RMS)5. TWR 11.0/6.2-07-013 RM-L1 Calculations for New EAL's6. FSAR Table 11.1-27. NEI 99-01 SU3Page 240 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT ElCategory: S -System MalfunctionSubcategory: 4 -RCS ActivityInitiating Condition: Reactor coolant activity greater than Technical Specificationallowable limits.EAL:SU4.2 Unusual EventSample analysis indicates that a primary coolant activity value is > an allowable limitspecified in Technical Specifications 3/4.4.8Mode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):NoneBasis:Plant-SpecificThis EAL addresses primary coolant samples exceeding Technical Specification LCOs3/4.4.8, which are applicable in Modes 1, 2 and 3 with RCS average temperature (Tavg)> 500°F (ref. 1). The Technical Specification limits accommodate an iodine spikephenomenon that may occur following changes in thermal power. The TechnicalSpecification LCO limits are established to minimize the offsite radioactivity doseconsequences in the event of a steam generator tube rupture (SGTR) accident (ref. 2).GenericThis IC addresses a reactor coolant activity value that exceeds an allowable limit specifiedin Technical Specifications. This condition is a precursor to a more significant event andrepresents a potential degradation of the level of safety of the plant.Escalation of the emergency classification leveIECL would be via ICs FA1 or theRecognition Category A-R ICs.VCSNS Basis Reference(s):Page 241 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]1. Technical Specifications 3/4.4.82. Technical Specifications Bases 3/4.4.83. NEI 99-01 SU3Page 242 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:EAL:S -System Malfunction5- RCS LeakageRCS leakage for 15 minutes or longer.SU5.1 Unusual EventRCS unidentified or pressure boundary leakage > 10 gpm for 2 15 min.ORRCS identified leakage > 25 gpm for > 15 min.ORLeakage from the RCS to a location outside containment > 25 gpm for > 15 min.(Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Mode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):NoneBasis:Plant-SpecificUnidentified leakage and identified leakage are determined by performance of the RCSwater inventory balance (IPCS CHGNET, LRATE). Pressure boundary leakage would firstappear as unidentified leakage and can only be positively identified by inspection (ref. 1).STP-1 14.002 is used to ensure RCS leakage is within Technical Specification limits (ref.2). MCB annunciator XCP-615 3-6 (RCS LEAK DET >1 GPM) signals RCS leakage intothe Reactor Building sump that challenges Technical Specifications LCO limits (ref. 1, 4).The rate of primary-to-secondary leakage is determined by comparing the ratio of theactivity of a given isotope measured in the secondary plant (i.e., steam generators,condensate or condenser off-gas) to that same isotope in the Reactor Coolant System (ref.5).Page 243 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Technical Specifications (ref. 6) defines RCS leakage as follows:" Controlled Leakage: Seal water flow supplied to the reactor coolant pump seals." Identified Leakage:o Leakage (except Controlled Leakage) into closed systems, such as pumpseal or valve packing leaks that are captured and conducted to a sump orcollecting tank, oro Leakage into the containment atmosphere from sources that are bothspecifically located and unknown either not to interfere with the operation ofleakage detection systems or not to be Pressure Boundary Leakage, oro Reactor coolant system leakage through a steam generator to the secondarysystem." Unidentified Leakage: All leakage (except Controlled Leakage) that is not identifiedleakage." Pressure Boundary Leakage: Leakage (except steam generator tube leakage)through a non-isolable fault in a Reactor Coolant System component body, pipe wallor vessel wall.RCS leakage outside of the containment that is not considered identified or unidentifiedleakage per Technical Specifications includes leakage via CVCS/Letdown and interfacingsystem leakage such as RCS to the Component Cooling Water (CCW system) and RCSsampling system (ref. 7).General symptoms of RCS leakage include the following (ref. 7):" Decreasing Pressurizer level with increased charging flow and normal letdown flow" Increasing radiation level in Containment or the Auxiliary Building indicated by anyof the following:o RM-G5, RB PERSONNEL ACCESS AREA GAMMAo RM-G6, RB REFUEL BRIDGE AREA GAMMAPage 244 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT Elo RM-A2, RB SAMPLE LINE PARTICULATE (IODINE)(GAS) ATMOSMONITORo RM-A3, MAIN PLANT VENT EXH PARTICULATE(IODINE)(GAS) ATMOSMONITORo RM-A1 1, AB VENT GAS ATMOS MONITOR" Increasing sump level in Containment or the Auxiliary Building" Increased VCT makeup frequency* Increasing radiation level in the CCW System as indicated on RM-L2A(B),COMPONENT COOLING LIQUID MONITOR" Any of the following Main Control Board annunciators in alarm:o RBCU 1A/2A DRN FLO HI (XCP-606 2-2)o RBCU 1B/2B DRN FLO HI (XCP-607 2-2)o RCS LEAK DET >1GPM (XCP-615 3-6)GenericThis IC addresses RCS leakage which may be a precursor to a more significant event. Inthis case, RCS leakage has been detected and operators, following applicable procedures,have been unable to promptly isolate the leak. This condition is considered to be apotential degradation of the level of safety of the plant.EAL #1 and EAL #2The first and second EAL conditions are focused on a loss of massfrom the RCS due to "unidentified leakage", "pressure boundary leakage" or "identifiedleakage" (as these leakage types are defined in the plant Technical Specifications). EAL#3The third condition addresses an RCS mass loss caused by an UNISOLABLE leakthrough an interfacing system. These EALs-conditions thus apply to leakage into thecontainment, a secondary-side system (e.g., steam generator tube leakage in a PWR) or alocation outside of containment.The leak rate values for each EAL-condition were selected because they are usuallyobservable with normal Control Room indications. Lesser values typically require time-Page 245 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT Elconsuming calculations to determine (e.g., a mass balance calculation). E-AL-#-1The firstcondition uses a lower value that reflects the greater significance of unidentified orpressure boundary leakage.The release of mass from the RCS due to the as-designed/expected operation of a reliefvalve does not warrant an emergency classification. Per -PWR&,-aAn emergencyclassification would be required if a mass loss is caused by a relief valve that is notfunctioning as designed/expected (e.g., a relief valve sticks open and the line flow cannotbe isolated). For BWE s, a opcn Safety Relief Valve (SRV) or SRV leakage is notconsidered either identified or unidentified leakage by Technical SpecificatioRs and,therefore, is not applieable to this =AL=.The 15-minute threshold duration allows sufficient time for prompt operator actions toisolate the leakage, if possible.Escalation of the emergeny clas.sification would be via ICs of RecognitionCategory A-Ror F.VCSNS Basis Reference(s):1. ARP-001 -XCP-615 Annunciator Point 3-62. STP-1 14.002 Operational Leakage Calculation3. STP-1 14.003 RCS Leak Detection Setpoint Determination4. Technical Specification 3.4.6.25. CP-307 Primary-to-Secondary Leakage Rate Determination6. Technical Specifications, Definitions7. AOP-1 01.1 Loss of Reactor Coolant Not Requiring SI8. ES-1 61 RCS Leakage Management Program9. FSAR Section 5.2.710. FSAR Section 7.6.511. NEI 99-01 SU4Page 246 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category: S -System MalfunctionSubcategory: 6 -RTS FailureInitiating Condition: Automatic or manual trip fails to shut down the reactorEAL:SU6.1 Unusual EventAn automatic trip did not shut down the reactor after any RTS setpoint is exceededANDA subsequent manual action taken at the reactor control consoles is successful in shuttingdown the reactor as indicated by reactor power < 5% (Note 8).Note 8: A manual action is any operator action, or set of actions, which causes the control rods to berapidly inserted into the core, and does not include manually driving in control rods orimplementation of boron injection strategies.Mode Applicability:1 -Power OperationDefinition(s):NoneBasis:Plant-SpecificA reactor trip is automatically initiated by the Reactor Trip System (RTS) when certaincontinuously monitored parameters exceed predetermined setpoints (ref. 1):Following a successful reactor trip, rapid insertion of the control rods occurs. Nuclearpower promptly drops to a few percent of the original power level and then decays to alevel some 8 decades less at a startup rate of about -1/3 DPM. The reactor power dropcontinues until reactor power reaches the point at which the influence of source neutronson reactor power starts to be observable. A predictable post-trip response from anautomatic reactor trip signal should therefore consist of a prompt drop in reactor power assensed by the nuclear instrumentation and a negative startup rate as nuclear power dropsinto the source range (ref. 1).The operator recognizes that the reactor has tripped by observing (ref. 1):Page 247 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]" Any red first-out Reactor Trip annunciator lit* Rapid decrease in neutron flux level as indicated by the NI System" Shutdown and Control Rods fully inserted" Rod Bottom Lights litIf these responses cannot be verified, operators perform contingency actions that manuallyinsert control rods, open the reactor trip and bypass breakers in the Reactor TripSwitchgear (IB-463), and tripping the Rod Drive MG sets in the Rod Drive MG ControlCabinet (IB-463). Local opening of these breakers requires actions outside of the ControlRoom; rapid control rod insertion by these methods is therefore not considered a"successful" manual reactor trip. For purposes of emergency classification, a "successful"manual reactor trip, therefore, includes only those immediate actions taken by the reactoroperator in the Control Room on the control consoles. Manual reactor trip switches CS-CR01 and CS-CR01A are located on MCB panels XCP-61 10 and XCP-61114, respectively(ref. 3, 4). These switches and controls can be rapidly manipulated from the specified MCBpanels.In the event that the operator identifies a reactor trip is imminent and successfully initiatesa manual reactor trip before the automatic trip setpoint is reached, no declaration isrequired. The successful manual trip of the reactor before it reaches its automatic tripsetpoint or reactor trip signals caused by instrumentation channel failures do not lead to apotential fission product barrier loss. If manual reactor trip actions in the Control Room failto reduce reactor power below the power associated with the SAFETY SYSTEM design (<5%) (ref. 2), the event escalates to an Alert under EAL SA6.1.GenericThis IC addresses a failure of the RP-S-RTS to initiate or complete an automatic or manualreactor (trip [PK] / -cram [BW,,) that results in a reactor shutdown, and either asubsequent operator manual action taken at the reactor control consoles or an automatic(trip [PWr-] / scram, is successful in shutting down the reactor. This event is aprecursor to a more significant condition and thus represents a potential degradation of thelevel of safety of the plant.Page 248 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Following the failure on an automatic reactor (trip [PWR1 / scram, operators willpromptly initiate manual actions at the reactor control consoles to shutdown the reactor(e.g., initiate a manual reactor (tri [PLr] / cram [,.rA/')). If these manual actions aresuccessful in shutting down the reactor, core heat generation will quickly fall to a levelwithin the capabilities of the plant's decay heat removal systems.If an initial manual reactor (trip [Pr,- / cram -is unsuccessful, operators willpromptly take manual action at another location(s) on the reactor control consoles toshutdown the reactor (e.g., initiate a manual reactor (trip [PWR] / ScrFam using adifferent switch). Depending upon several factors, the initial or subsequent effort tomanually (trip [PW'R1] / .cram [BR.]) the reactor, or a concurrent plant condition, may leadto the generation of an automatic reactor (trip [PWR] / Sc..ra [B.L] signal. If asubsequent manual or automatic (trip [PWR] /- ,cram ...--R) is successful in shutting downthe reactor, core heat generation will quickly fall to a level within the capabilities of theplant's decay heat removal systems.A manual action at the reactor control consoles is any operator action, or set of actions,which causes the control rods to be rapidly inserted into the core (e.g., initiating a manualreactor (trip-[PW,4 /" scram [9144R])). This action does not include manually driving incontrol rods or implementation of boron injection strategies. Actions taken at back-panelsor other locations within the Control Room, or any location outside the Control Room, arenot considered to be "at the reactor control consoles".Taking the Reactor Mode SWitch to SHUTDOW.AN is considered to bc a mnanual scramnThe plant response to the failure of an automatic or manual reactor (trip [PWR34/sGramrBWR]) will vary based upon several factors including the reactor power level prior to theevent, availability of the condenser, performance of mitigation equipment and actions,other concurrent plant conditions, etc. If subsequent operator manual actions taken at thereactor control consoles are also unsuccessful in shutting down the reactor, then theem.er-gency classification levIe..L will escalate to an Alert via IC SA-SA6. Dependingupon the plant response, escalation is also possible via IC FA1. Absent the plantPage 249 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]conditions needed to meet either IC SA5-SA6 or FA1, an Unusual Event declaration isappropriate for this event.A reactor shutdown is determined in accordance with applicable Emergency OperatingProcedure criteria.Should a reactor (trip [PrD^R] / s.ram signal be generated as a result of plant work(e.g., RPS setpoint testing), the following classification guidance should be applied." If the signal causes a plant transient that should have included an automatic reactor(trip [PWRI / sc-aram [9WR]) and the PPS-RTS fails to automatically shutdown thereactor, then this IC and the EALs are applicable, and should be evaluated." If the signal does not cause a plant transient and the (trip [PWR] / -cram [B. ' RI)failure is determined through other means (e.g., assessment of test results), thenthis IC and the EALs are not applicable and no classification is warranted.VCSNS Basis Reference(s):1. EOP-1.0 Reactor Trip/Safety Injection Actuation2. EOP-13.0 Response to Abnormal Nuclear Power Generation3. 201-326 Main Control Board Instrumentation Control Panel XCP-61 104. 201-330 Main Control Board Instrumentation Control Panel XCP-61145. NEI 99-01 SU5Page 250 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category: S -System MalfunctionSubcategory: 6 -RTS FailureInitiating Condition: Automatic or manual trip fails to shut down the reactorEAL:SU6.2 Unusual EventA manual trip did not shut down the reactor after any manual trip action was initiatedANDA subsequent automatic trip or manual trip action taken at the reactor control consoles issuccessful in shutting down the reactor as indicated by reactor power < 5% (Note 8).Note 8: A manual action is any operator action, or set of actions, which causes the control rods to berapidly inserted into the core, and does not include manually driving in control rods orimplementation of boron injection strategies.Mode Applicability:1 -Power OperationDefinition(s):NoneBasis:Plant-SpecificThis EAL addresses a failure of a manually initiated trip in the absence of having exceededan automatic RTS trip setpoint and a subsequent automatic or manual trip is successful inshutting down the reactor (reactor power < 5%).A reactor trip is automatically initiated by the Reactor Trip System (RTS) when certaincontinuously monitored parameters exceed predetermined setpoints (ref. 1):Following a successful reactor trip, rapid insertion of the control rods occurs. Nuclearpower promptly drops to a few percent of the original power level and then decays to alevel some 8 decades less at a startup rate of about -1/3 DPM. The reactor power dropcontinues until reactor power reaches the point at which the influence of source neutronson reactor power starts to be observable. A predictable post-trip response from anautomatic reactor trip signal should therefore consist of a prompt drop in reactor power asPage 251 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]sensed by the nuclear instrumentation and a negative startup rate as nuclear power dropsinto the source range (ref. 1).The operator recognizes that the reactor has tripped by observing (ref. 1):" Any red first-out Reactor Trip annunciator lit* Rapid decrease in neutron flux level as indicated by the NI System" Shutdown and Control Rods fully inserted* Rod Bottom Lights litIf these responses cannot be verified, operators perform contingency actions that manuallyinsert control rods, open the reactor trip and bypass breakers in the Reactor TripSwitchgear (IB-463), and tripping the Rod Drive MG sets in the Rod Drive MG ControlCabinet (IB-463). Local opening of these breakers requires actions outside of the ControlRoom; rapid control rod insertion by these methods is therefore not considered a"successful" manual reactor trip. For purposes of emergency classification, a "successful"manual reactor trip, therefore, includes only those immediate actions taken by the reactoroperator in the Control Room on the control consoles. Manual reactor trip switches CS-CR01 and CS-CR01A are located on MCB panels XCP-61 10 and XCP-6114, respectively(ref. 3, 4). These switches and controls can be rapidly manipulated from the specified MCBpanels.GenericThis IC addresses a failure of the RPS to initiate or complete an automatic or manualreactor (trip [PWRJ / scram [BWRJ) that results in a reactor shutdown, and either asubsequent operator manual action taken at the reactor control consoles or an automatic(trip [P,449 / scram, [B. r)A is successful in shutting down the reactor. This event is aprecursor to a more significant condition and thus represents a potential degradation of thelevel of safety of the plant.Following the failure on an automatic reactor (trip [PWRI /.cram .. , operators willpromptly initiate manual actions at the reactor control consoles to shutdown the reactor(e.g., initiate a manual reactor (trip [PW4R9 /s afir~m [BVWV)). If these manual actions arePage 252 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]successful in shutting down the reactor, core heat generation will quickly fall to a levelwithin the capabilities of the plant's decay heat removal systems.If an initial manual reactor (trip [PWRI / scram [BKR,) is unsuccessful, operators willpromptly take manual action at another location(s) on the reactor control consoles toshutdown the reactor (e.g., initiate a manual reactor (trip [PWA/ / scram [94,4%) using adifferent switch). Depending upon several factors, the initial or subsequent effort tomanually (trip / cram, [B..-.R) the reactor, or a concurrent plant condition, may leadto the generation of an automatic reactor (trip oPeW, ] / .cram signal. If asubsequent manual or automatic (trip [P'VW] / [-,r,, is successful in shutting downthe reactor, core heat generation will quickly fall to a level within the capabilities of theplant's decay heat removal systems.A manual action at the reactor control consoles is any operator action, or set of actions,which causes the control rods to be rapidly inserted into the core (e.g., initiating a manualreactor (trip [PVWRI / .cram [rR]). This action does not include manually driving incontrol rods or implementation of boron injection strategies. Actions taken at back-panelsor other locations within the Control Room, or any location outside the Control Room, arenot considered to be "at the reactor control consoles".Taking the ReacGto Mode Switch to SHLuTDOW is co.nsidere to be a m.anual ,G.ramaetGR. BWThe plant response to the failure of an automatic or manual reactor (trip fPWR]-/-sGraM-BWR]^ will vary based upon several factors including the reactor power level prior to theevent, availability of the condenser, performance of mitigation equipment and actions,other concurrent plant conditions, etc. If subsequent operator manual actions taken at thereactor control consoles are also unsuccessful in shutting down the reactor, then theem-ergecY leveE. L will escalate to an Alert via IC SA-SA6. Dependingupon the plant response, escalation is also possible via IC FAl. Absent the plantconditions needed to meet either IC SA-5-SA6 or FA1, an Unusual Event declaration isappropriate for this event.Page 253 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]A reactor shutdown is determined in accordance with applicable Emergency OperatingProcedure criteria.Should a reactor (trip [PWR] i/ ..ram [BWR])A signal be generated as a result of plant work(e.g., RPS setpoint testing), the following classification guidance should be applied..If the signal causes a plant transient that should have included an automatic reactor(trip / .cram [B^WR]) and the RPS fails to automatically shutdown the reactor,then this IC and the EALs are applicable, and should be evaluated.e If the signal does not cause a plant transient and the (trip [PrWRI 6cram failure is determined through other means (e.g., assessment of test results), thenthis IC and the EALs are not applicable and no classification is warranted.VCSNS Basis Reference(s):1. EOP-1.0 Reactor Trip/Safety Injection Actuation2. EOP-13.0 Response to Abnormal Nuclear Power Generation3. 201-326 Main Control Board Instrumentation Control Panel XCP-61 104. 201-330 Main Control Board Instrumentation Control Panel XCP-61145. NEI 99-01 SU5Page 254 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:S -System Malfunction6- RTS FailureAutomatic or manual trip fails to shut down the reactor andsubsequent manual actions taken at the reactor control consolesare not successful in shutting down the reactor.EAL:SA6.1 AlertAn automatic or manual trip fails to shut down the reactorANDManual actions taken at the reactor control console are not successful in shutting down thereactor as indicated by reactor power -> 5% (Note 8)Note 8: A manual action is any operator action, or set of actions, which causes the control rods to berapidly inserted into the core, and does not include manually driving in control rods orimplementation of boron injection strategies.Mode Applicability:1 -Power OperationDefinition(s):NoneBasis:Plant-SpecificThis EAL addresses any automatic or manual reactor trip signal that fails to shut down thereactor followed by a subsequent manual trip that fails to shut down the reactor to anextent the reactor is producing energy in excess of the heat load for which the SAFETYSYSTEMS were designed (> 5%) (ref. 1). For purposes of emergency classification, a"successful" manual reactor trip, therefore, includes only those immediate actions taken bythe reactor operator in the Control Room to actuate manual reactor trip switches CS-CR01and CS-CR01A (located on MCB panels XCP-61 10 and XCP-6114, respectively) (ref. 2,3). Although the reactor can be manually tripped using controls on MCB panel XCP-6115(e.g., depressing MASTER TRIP/EMERGENCY TRIP pushbuttons) (ref. 4), thePage 255 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]turbine/generator trip is not considered a "successful" manual reactor trip when evaluatingthis EAL.Automatic and manual trips are not considered successful if action away from the ControlRoom is required to trip the reactor. Local operator actions to open the reactor trip andbypass breakers in the Reactor Trip Switchgear (IB-463), and tripping the Rod Drive MGsets in the Rod Drive MG Control Cabinet (IB-463) are not considered "successful" manualreactor trips. If any of the alternate recovery actions for emergency boration of the RCSlisted in EOPs are required to reduce reactor power below the power associated with theSAFETY SYSTEM design (< 5%), the reactor trips have been unsuccessful. Negativeintermediate range startup rate (SUR) is used as an indicator of decreasing power andshould be observed following any reactor trip from power (ref. 1).GenericThis IC addresses a failure of the RPS-RTS to initiate or complete an automatic or manualreactor (trip-[P14', / Gcram ['WRI) that results in a reactor shutdown, and subsequentoperator manual actions taken at the reactor control consoles to shutdown the reactor arealso unsuccessful. This condition represents an actual or potential substantial degradationof the level of safety of the plant. An emergency declaration is required even if the reactoris subsequently shutdown by an action taken away from the reactor control consoles sincethis event entails a significant failure of the RP-SRTS.A manual action at the reactor control consoles is any operator action, or set of actions,which causes the control rods to be rapidly inserted into the core (e.g., initiating a manualreactor (tri [PD4V-] / scram [BW-R),. This action does not include manually driving incontrol rods or implementation of boron injection strategies. If this action(s) isunsuccessful, operators would immediately pursue additional manual actions at locationsaway from the reactor control consoles (e.g., locally opening breakers). Actions taken atback-panels or other locations within the Control Room, or any location outside the ControlRoom, are not considered to be "at the reactor control consoles".Taking the Reactor Mode Switch to SHUTDOWN is considered to be a mnanual scramnatin. [BW49Page 256 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]The plant response to the failure of an automatic or manual reactor (trip f/J-1-sýa6*will vary based upon several factors including the reactor power level prior to theevent, availability of the condenser, performance of mitigation equipment and actions,other concurrent plant conditions, etc. If the failure to shut-down the reactor is prolongedenough to cause a challenge to the core cooling [PWR] / RPV wat/ ..,v, or RCSheat removal safety functions, the eme.gc.. Y classification leve!ECL will escalate to a SiteArea Emergency via IC SS6_. Depending upon plant responses and symptoms,escalation is also possible via IC FSl. Absent the plant conditions needed to meet eitherIC SS65 or FSl, an Alert declaration is appropriate for this event.It is recognized that plant responses or symptoms may also require an Alert declaration inaccordance with the Recognition Category F ICs; however, this IC and EAL are included toensure a timely emergency declaration.A reactor shutdown is determined in accordance with applicable Emergency OperatingProcedure criteria.VCSNS Basis Reference(s):1. EOP-13.0 Response to Abnormal Nuclear Power Generation2. 201-326 Main Control Board Instrumentation Control Panel XCP-61 103. 201-330 Main Control Board Instrumentation Control Panel XCP-61144. 201-331 Main Control Board Instrumentation Control Panel XCP-61155. NEI 99-01 SA5Page 257 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Category: S -System MalfunctionSubcategory: 6- RTS FailureInitiating Condition: Inability to shut down the reactor causing a challenge to corecooling or RCS heat removal.EAL:SS6.1 Site Area EmergencyAn automatic or manual trip fails to shutdown the reactorANDAll manual actions to shut down the reactor are not successful in shutting down the reactoras indicated by reactor power > 5%ANDEITHER of the following conditions exist:" CSFST Core Cooling-RED path conditions met" CSFST Heat Sink-RED path conditions metMode Applicability:1 -Power OperationDefinition(s):NoneBasis:Plant-SpecificThis EAL addresses the following:" Any automatic or manual reactor trip signal followed by a manual trip that fails toshut down the reactor to an extent the reactor is producing energy in excess of theheat load for which the SAFETY SYSTEMS were designed (> 5%, ref. 1) (EALSA6.1), and* Indications that either core cooling is extremely challenged (CSFST Core Cooling-RED path) or heat removal is extremely challenged (CSFST Heat Sink-Red path)(ref. 2.)Page 258 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Manual reactor trip switches CS-CR01 and CS-CR01A are located on MCB panels XCP-6110 and XCP-6114, respectively (ref. 3, 4). These controls can be rapidly manipulatedfrom the specified MCB panels and constitute the normal methods of initiating a manualtrip. These are the only manual trip methods applicable to evaluation of EAL SA6.1.At the Site Area Emergency classification level, however, additional capabilities away fromthe Control Room may be considered such as opening the reactor trip and bypassbreakers in the Reactor Trip Switchgear (IB-463) and tripping the Rod Drive MG sets in theRod Drive MG Control Cabinet (IB-463).Indication that core cooling is extremely challenged is manifested by entry to Critical SafetyFunction Status Tree (CSFST) Core Cooling-RED path (Figure 5) (ref. 2). Indication thatheat removal is extremely challenged is manifested by entry to CSFST Heat Sink-REDpath (Figure 6) (ref. 2).The setpoint values provided in brackets following the normal setpoint values in theCSFSTs are used under adverse containment conditions. Adverse containment conditionsare defined as either (ref. 6):" Hi-1 RB pressure (> 3.6 psig), or" Containment Hi-radiation (> 100,000 Rads integrated dose)The IPCS monitors these parameters and indicates when adverse containment valuesshould be used. The instruments available to monitor these containment parameters areContainment pressure on PI-950, PI-951, PI-952 or PI-953, and Containment radiation onRM-G7 or RM-G18. When no adverse values are provided, the given setpoint is used forany containment condition, as the parameter measurement is independent of containmentatmosphere. If containment pressure decreases below the adverse pressure setpoint afterit has been exceeded, the normal values are again used. Once the adverse radiation levelsetpoint is exceeded, the adverse containment values must be utilized through eventrecovery and establishment of normal operating procedures. Engineering should then berequested to evaluate instrumentation inaccuracies.GenericPage 259 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]This IC addresses a failure of the RPS to initiate or complete an automatic or manualreactor (trip [PW14 / ..ram [VVR) that results in a reactor shutdown, all subsequentoperator actions to manually shutdown the reactor are unsuccessful, and continued powergeneration is challenging the capability to adequately remove heat from the core and/orthe RCS. This condition will lead to fuel damage if additional mitigation actions areunsuccessful and thus warrants the declaration of a Site Area Emergency.In some instances, the emergency classification resulting from this IC/EAL may be higherthan that resulting from an assessment of the plant responses and symptoms against theRecognition Category F ICs/EALs. This is appropriate in that the Recognition Category FICs/EALs do not address the additional threat posed by a failure to shut-down the reactor.The inclusion of this IC and EAL ensures the timely declaration of a Site Area Emergencyin response to prolonged failure to shutdown the reactor.A reactor shutdown is determined in accordance with applicable Emergency OperatingProcedure criteria.Escalation of the emergency classification !evc!ECL would be via IC AG-1-RG1 or FGI.VCSNS Basis Reference(s):1. EOP-13.0 Response to Abnormal Nuclear Power Generation2. EOP-12.0 Monitoring of Critical Safety Functions3. 201-326 Main Control Board Instrumentation Control Panel XCP-61 104. 201-330 Main Control Board Instrumentation Control Panel XCP-61145. 201-331 Main Control Board Instrumentation Control Panel XCP-61156. OAP-103.4 EOP/AOP User's Guide7. NEI 99-01 SS5Page 260 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:EAL:S -System Malfunction7 -Loss of CommunicationsLoss of all onsite or offsite communications capabilities.SU7.1 Unusual EventLoss of all Table S-3 onsite communication methodsORLoss of all Table S-3 ORO/NRC communication methodsMode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):NoneBasis:Plant-SpecificPage 261 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]The Table S-3 list for onsite communications loss encompasses the loss of all means ofroutine communications (e.g., commercial and intemal telephones, page party system(Gai-Tronics) and radios) (ref. 1, 2, 3).The Table S-3 list for offsite (ORO/NRC) communications loss encompasses the loss of allmeans of communications with offsite authorities. This includes the FTS (ENS),commercial telephone lines and dedicated phone systems (fiberoptic and satellite) (ref. 1,2,3).This EAL is the hot condition equivalent of the cold condition EAL CU5.1.GenericThis IC addresses a significant loss of on-site or offsite communications capabilities.While not a direct challenge to plant or personnel safety, this event warrants promptnotifications to OROs and the NRC.This IC should be assessed only when extraordinary means are being utilized to makecommunications possible (e.g., use of non-plant, privately owned equipment, relaying ofon-site information via individuals or multiple radio transmission points, individuals beingsent to offsite locations, etc.).EWAL-#The first EAL condition addresses a total loss of the communications methods usedin support of routine plant operations.EAL-#2The second EAL condition addresses a total loss of the communications methodsused to notify all OROs or NRC of an emergency declaration. The OROs referred to hereare (see Dev.lope. Notes) the State, Fairfield, Newberry, Lexington and Richland CountyEOCs as well as the NRC.EAL #3 add rcsses a total loss of the communications methods used to notify the NRof an emergency decl-aration.VCSNS Basis Reference(s):1. FSAR 9.5.22. EP-100 Radiation Emergency Plan, Section 7.53. EP-100 Radiation Emergency Plan, Figure 7-2Page 262 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT El4. NEI 99-01 SU6Page 263 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category: S -System MalfunctionSubcategory: 8 -Containment Isolation FailureInitiating Condition: Failure to isolate containment or loss of containment pressurecontrolEAL:SU8.1 Unusual EventContainment isolation actuatedANDAt least one isolation valve in each penetration is not closed within 15 min. of theactuation (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Mode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):NoneBasis:Plant-SpecificNoneGenericThis IC addresses a failure of one or mor ontainment penetrations to automaticallyisolate (close) when required by an actuation signal. it also addresse. an event thatreul~ts in high ,ontainment pressure with a failure Of containment pressure."ntrol systems. Absent challenges to another fission product barrier, eite-r-this conditionrepresents potential degradation of the level of safety of the plant.Fer EAL #-,4ltThe containment isolation signal must be generated as the result on an off-normal/accident condition (e.g., a safety injection or high containment pressure); a failureresulting from testing or maintenance does not warrant classification. The determination ofPage 264 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]containment and penetration status -isolated or not isolated -should be made inaccordance with the appropriate criteria contained in the plant AOPs and EOPs. The 15-minute criterion is included to allow operators time to manually isolate the requiredpenetrations, if possible.E1t7=AL#2 addrcsscs a GcGond*ito where cRontaiRmet pre-6ure i6 greator than the6netp-ont atWhich containment energy (heat) removal systems6 are designed to autematically actuate.,and less than one full train of equipment i6 capable of operating per design. The 15-minute criterion is included to allow operators, time to m~anually Start equipment that Ma"not have automatically started, if possible. The inability to satal the required equipmentindicates thatGcontainment heat removal/depressurizatiOn systems (e.g., containmen~tsprys r ie condenser fans) are either lost or perforFming in a degraded mannr.This event would escalate to a Site Area Emergency in accordance with IC FS1 if therewere a concurrent loss or potential loss of either the Fuel Clad or RCS fission productbarriers and a direct release pathway to the environment as a result of the failed isolation.VCSNS Basis Reference(s):1. EOP-2.5 LOCA Outside Containment2. EOP-1.0 Attachment 3 SI Equipment Verification2. NEI 99-01 SU7Page 265 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:S -System Malfunction8 -Containment Isolation FailureFailure to isolate containment or loss of containment pressurecontrol.EAL:SU8.2 Unusual EventContainment pressure > 12 psigAND< one full train of depressurization equipment (Table S-4) is operating per designfor> 15 min.(Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Table S-4 Full Train Depressurization EquipmentRBCU Groups Containment SpraysOperating Operating2 01 10 2Mode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):NoneBasis:Plant-SpecificThe Containment pressure setpoint (12 psig, ref. 2, 3) is the pressure at which theContainment Spray System should actuate and begin performing its function. The designPage 266 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT Elbasis accident analyses and evaluations assume the loss of one Containment SpraySystem train (ref. 2, 3).Each spray subsystem is started by separate ESF containment isolation Phase A andspray actuation signals. Normally, both subsystems operate; however, they areindependent and can operate individually. Although the design basis for Reactor Buildingheat removal is one spray subsystem operating in conjunction with one Reactor BuildingCooling Unit (with one RHR pump and one charging pump providing emergency corecooling water), two Reactor Building Cooling Units (RBCUs) with no spray pumps or twospray pumps with no RBCUs can handle all required heat loads Technical Specificationsdefined equipment that comprises one full train of depressurization equipment is given inthe note (ref. 1, 2, 4, 5).RBCU operation verification is performed in accordance with EOP-1.0 Attachment 3 SIEquipment Verification. In order to take credit for a RBCU operating per design, eachRBCU must meet minimum Service Water flow requirements (ref. 6).GenericThis IC addr.ssc. a failure Of one Or more containm.ent penetration- to automaticallyiso-late (cIoe) when required by an actuatin signal. it also addresses an event thatresults in high containment pressure with a concurrent failure of containment pressurecontrol systems. Absent challenges to another fission product barrier, either-this conditionrepresents potential degradation of the level of safety of the plant.For EAL #1, the containment isolation signal must be generated as the result On an offýnormnal/accident conditionR (e.g., a safety injectionR or high GGntainment pressure); a fai!urresulting frM testing or m.aintenance does not warrant classification. The d-tef ,,iat, , ofcontainment anld penetration status6 isolated or not isolated should be madeiaccordance with the appropriate Griteria contained in the plant AQPs and F=01s. The 15penetratiGRG- it pessible-EAL-#2This EAL addresses a condition where containment pressure is greater than thesetpoint at which containment energy (heat) removal systems are designed toautomatically actuate, and less than one full train of equipment is capable of operating perdesign. The 15-minute criterion is included to allow operators time to manually startPage 267 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]equipment that may not have automatically started, if possible. The inability to start therequired equipment indicates that containment heat removal/depressurization systems(e.g., containment sprays Or ice condenser fans) are either lost or performing in adegraded manner.This event would escalate to a Site Area Emergency in accordance with IC FS1 if therewere a concurrent loss or potential loss of either the Fuel Clad or RCS fission productbarriers.VCSNS Basis Reference(s):1. FSAR Section 6.2.2.2.1.22. OAP-103.2 Emergency Operating Procedure Setpoint Document3. EOP-12.0 Monitoring of Critical Safety Functions4. Technical Specifications 3/4-6.2.15. Technical Specifications 3/4-6.2.36. EOP-1.0 Reactor Trip/Safety Injection Actuation Attachmen 3 SI Equipment Verification7. NEI 99-01 SU7Page 268 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:EAL:S -System Malfunction9 -Hazardous Event Affecting Safety SystemHazardous event affecting a SAFETY SYSTEM needed for thecurrent operating mode.SA9.1 AlertThe occurrence of any Table S-5 hazardous eventANDEITHER of the following:" Event damage has caused indications of degraded performance in at least one trainof a SAFETY SYSTEM needed for the current operating mode" The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component orstructure needed for the current operating modeTable S-5 Hazardous Events* Seismic event (earthquake)* Internal or external FLOODING event* High winds or tornado strike* FIRE* EXPLOSION* Other events with similar hazard characteristicsas determined by the Shift SupervisorMode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):EXPLOSION -A rapid, violent and catastrophic failure of a piece of equipment due tocombustion, chemical reaction or overpressurization. A release of steam (from highenergy lines or components) or an electrical component failure (caused by short circuits,grounding, arcing, etc.) should not automatically be considered an EXPLOSION. SuchPage 269 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]events require a post-event inspection to determine if the attributes of an EXPLOSION arepresent.FIRE- Combustion characterized by heat and light. Sources of smoke such as slippingdrive belts or overheated electrical equipment do not constitute FIRES. Observation offlame is preferred but is NOT required if large quantities of smoke and heat are observed.FLOODING -A condition where water is entering a room or area faster than installedequipment is capable of removal, resulting in a rise of water level within the room or area.SAFETY SYSTEM -A system required for safe plant operation, cooling down the plantand/or placing it in the cold shutdown condition, including the ECCS. These are typicallysystems classified as safety-related (as defined in 10CFR50.2):Those structures, systems and components that are relied upon to remain functionalduring and following design basis events to assure:(1) The integrity of the reactor coolant pressure boundary;(2) The capability to shut down the reactor and maintain it in a safe shutdowncondition;(3) The capability to prevent or mitigate the consequences of accidents which couldresult in potential offsite exposures.VISIBLE DAMAGE -Damage to a component or structure that is readily observablewithout measurements, testing, or analysis. The visual impact of the damage is sufficientto cause concern regarding the operability or reliability of the affected component orstructure.Basis:Plant-Specific* The significance of seismic events are discussed under EAL HU2.1 (ref. 1).* Internal FLOODING may be caused by events such as component failures, equipmentmisalignment, or outage activity mishaps (ref. 2).Page 270 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT El* Seismic Category I structures are analyzed to withstand a sustained, design windvelocity of at least 100 mph (sustained). (ref. 3).* Refer to VCSNS Fire Protection Evaluation Report, Section 4.0 "Hazards Analysis" toidentify areas containing functions and systems required for safe shutdown of the plant(ref. 4)" An EXPLOSION (including a steam line explosion) that degrades the performance of aSAFETY SYSTEM train or visibly damages a SAFETY SYSTEM component orstructure would be classified under this EAL. The need to classify a steam line breaknot considered an explosion itself is considered in fission product barrier degradationmonitoring (EAL Category F).GenericThis IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or astructure containing SAFETY SYSTEM components, needed for the current operatingmode. This condition significantly reduces the margin to a loss or potential loss of a fissionproduct barrier, and therefore represents an actual or potential substantial degradation ofthe level of safety of the plant.EAL !.b.!The first condition addresses damage to a SAFETY SYSTEM train that is inservice/operation since indications for it will be readily available. The indications ofdegraded performance should be significant enough to cause concern regarding theoperability or reliability of the SAFETY SYSTEM train.EAL-1-.b2The second condition addresses damage to a SAFETY SYSTEM componentthat is not in service/operation or readily apparent through indications alone, or to astructure containing SAFETY SYSTEM components. Operators will make thisdetermination based on the totality of available event and damage report information. Thisis intended to be a brief assessment not requiring lengthy analysis or quantification of thedamage.Escalation of the emergency classification 1evelECL would be via IC FS1 or AS1-RS1.VCSNS Basis Reference(s):Page 271 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]1. ES-426 Earthquake Response Procedure2. VCSNS IPE Internal Flooding Analysis Workbook3. FSAR Section 3.3.14. VCSNS Fire Protection Evaluation Report5. NEI 99-01 SA9Page 272 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category F -Fission Product Barrier DegradationEAL Group: Hot Conditions (RCS temperature > 200'F);EALs in this category are applicable only inone or more hot operating modes.EALs in this category represent threats to the defense in depth design concept thatprecludes the release of highly radioactive fission products to the environment. Thisconcept relies on multiple physical barriers any one of which, if maintained intact,precludes the release of significant amounts of radioactive fission products to theenvironment. The primary fission product barriers are:A. Fuel Clad (FC): The Fuel Clad Barrier consists of the cladding material that containsthe fuel pellets.B. Reactor Coolant System (RCS): The RCS Barrier includes the RCS primary sideand its connections up to and including the pressurizer safety and relief valves, andother connections up to and including the primary isolation valves.C. Containment (CMT): The Containment Barrier includes the containment buildingand connections up to and including the outermost containment isolation valves.This barrier also includes the main steam, feedwater, and blowdown line extensionsoutside the containment building up to and including the outermost secondary sideisolation valve. Containment Barrier thresholds are used as criteria for escalation ofthe ECL from Alert to a Site Area Emergency or a General Emergency.The EALs in this category require evaluation of the loss and potential loss thresholds listedin the fission product barrier matrix of Table F-1 (Attachment 2). "Loss" and "PotentialLoss" signify the relative damage and threat of damage to the barrier. "Loss" means thebarrier no longer assures containment of radioactive materials. "Potential Loss" meansintegrity of the barrier is threatened and could be lost if conditions continue to degrade.The number of barriers that are lost or potentially lost and the following criteria determinethe appropriate emeregncy classification 1eveECL:Alert:Any loss or any potential loss of either Fuel Clad or RCSPage 273 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Site Area Emergency:Loss or potential loss of any two barriersGeneral Emergency:Loss of any two barriers and loss or potential loss of the third barrierThe logic used for Category F EALs reflects the following considerations:" The Fuel Clad Barrier and the RCS Barrier are weighted more heavily than theContainment Barrier." Unusual Event ICs associated with fission product barriers are addressed inRecognition Category S.For accident conditions involving a radiological release, evaluation of the fission productbarrier thresholds will need to be performed in conjunction with dose assessments toensure correct and timely escalation of the emergency classification. For example, anevaluation of the fission product barrier thresholds may result in a Site Area Emergencyclassification while a dose assessment may indicate that an EAL for General EmergencyIC RG1 has been exceeded.The fission product barrier thresholds specified within a scheme reflect plant-specificVCSNS Unit 1 design and operating characteristics.As used in this category, the term RCS leakage encompasses not just those types definedin Technical Specifications but also includes the loss of RCS mass to any location- insidethe containment, a secondary-side system (i.e., steam generator tube leakage), aninterfacing system, or outside of the containment building. The release of liquid or steammass from the RCS due to the as-designed/expected operation of a relief valve is notconsidered to be RCS leakage.At the Site Area Emergency level, classification decision-makers should maintaincognizance of how far present conditions are from meeting a threshold that would requirea General Emergency declaration. For example, if the Fuel Clad and RCS fission productbarriers were both lost, then there should be frequent assessments of containmentPage 274 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]radioactive inventory and integrity. Alternatively, if both the Fuel Clad and RCS fissionproduct barriers were potentially lost, the Emergency Director would have more assurancethat there was no immediate need to escalate to a General Emergency.Page 275 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category: Fission Product Barrier DegradationSubcategory: N/AInitiating Condition: Any loss or any potential loss of either Fuel Clad or RCSEAL:FAI.1 AlertAny loss or any potential loss of either Fuel Clad or RCS (Table F-i)Mode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):NoneBasis:Plant-SpecificFuel Clad, RCS and Containment comprise the fission product barriers. Table F-1(Attachment 2) lists the fission product barrier thresholds, bases and references.At the Alert classification level, Fuel Clad and RCS barriers are weighted more heavilythan the Containment barrier. Unlike the Containment barrier, loss or potential loss ofeither the Fuel Clad or RCS barrier may result in the relocation of radioactive materials ordegradation of core cooling capability. Note that the loss or potential loss of Containmentbarrier in combination with loss or potential loss of either Fuel Clad or RCS barrier resultsin declaration of a Site Area Emergency under EAL FS1.1.GenericNoneVCSNS Basis Reference(s):1. NEI 99-01 FA1Page 276 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category: Fission Product Barrier DegradationSubcategory: N/AInitiating Condition: Loss or potential loss of any two barriersEAL:FS1.1 Site Area EmergencyLoss or potential loss of any two barriers (Table F-i)Mode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot ShutdownDefinition(s):NoneBasis:Plant-SpecificFuel Clad, RCS and Containment comprise the fission product barriers. Table F-1(Attachment 2) lists the fission product barrier thresholds, bases and references.At the Site Area Emergency classification level, each barrier is weighted equally. A SiteArea Emergency is therefore appropriate for any combination of the following conditions:" One barrier loss and a second barrier loss (i.e., loss -loss)" One barrier loss and a second barrier potential loss (i.e., loss -potential loss)" One barrier potential loss and a second barrier potential loss (i.e., potential loss -potential loss)At the Site Area Emergency classification level, the ability to dynamically assess theproximity of present conditions with respect to the threshold for a General Emergency isimportant. For example, the existence of Fuel Clad and RCS Barrier loss thresholds inaddition to offsite dose assessments would require continual assessments of radioactiveinventory and Containment integrity in anticipation of reaching a General Emergencyclassification. Alternatively, if both Fuel Clad and RCS potential loss thresholds existed,Page 277 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]the Emergency Director would have greater assurance that escalation to a GeneralEmergency is less imminent.GenericNoneVCSNS Basis Reference(s):1. NEI 99-01 FS1Page 278 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:EAL:Fission Product Barrier DegradationN/ALoss of any two barriers and loss or potential loss of the thirdbarrierFG1.1 General EmergencyLoss of any two barriersANDLoss or potential loss of the third barrier (Table F-i)Mode Applicability:1 -Power Operation, 2 -Startup, 3 -Hot Shutdown, 4 -Hot StandbyDefinition(s):NoneBasis:Plant-SpecificFuel Clad, RCS and Containment comprise the fission product barriers. Table F-1(Attachment 2) lists the fission product barrier thresholds, bases and references.At the General Emergency classification level each barrier is weighted equally. A GeneralEmergency is therefore appropriate for any combination of the following conditions:" Loss of Fuel Clad, RCS and Containment barriers" Loss of Fuel Clad and RCS barriers with potential loss of Containment barrier" Loss of RCS and Containment barriers with potential loss of Fuel Clad barrier" Loss of Fuel Clad and Containment barriers with potential loss of RCS barrierGenericNoneVCSNS Basis Reference(s):1. NEI 99-01 FG1Page 279 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category I -Independent Spent Fuel Storage Installation (ISFSI)EAL Group: ANY (EALs in this category are applicable toany plant condition, hot or cold.)An independent spent fuel storage installation (ISFSI) is a complex that is designed andconstructed for the interim storage of spent nuclear fuel and other radioactive materialsassociated with spent fuel storage. A significant amount of the radioactive materialcontained within a canister must escape its packaging and enter the biosphere for there tobe a significant environmental effect resulting from an accident involving the dry storage ofspent nuclear fuel. Formal offsite planning is not required because the postulated worst-case accident involving an ISFSI has insignificant consequences to the public health andsafety.A Notification of Unusual Event is declared on the basis of the occurrence of an event ofsufficient magnitude that a loaded cask confinement boundary is damaged or violated.Page 280 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Category:Subcategory:Initiating Condition:EAL:ISFSIConfinement BoundaryDamage to a loaded cask CONFINEMENT BOUNDARYIU1.1 Unusual EventDamage to a loaded cask CONFINEMENT BOUNDARY as indicated by an on-contactradiation reading greater than the following on the surface of the spent fuel cask(overpack):* 60 mrem/hr (T + rn) on the top of the overpack* 600 mrem/hr (T + rn) on the side of the overpackMode Applicability:AllDefinition(s):CONFINEMENT BOUNDARY-. The barrier(s) between spent fuel and the environmentonce the spent fuel is processed for dry storage. As applied to the VCS ISFSI, theCONFINEMENT BOUNDARY is defined to be the HI-STORM Multi-Purpose Canister(MPC).Basis:Plant-SpecificOverpacks are the casks which receive and contain the sealed MPCs for interim storageon the ISFSI. They provide gamma and neutron shielding, and provide for ventilated airflow to promote heat transfer from the MPC to the environs. The term overpack does notinclude the transfer cask (ref. 1).The values shown represent 2 times the limits specified in the ISFSI Certificate ofCompliance Technical Specification section 5.3.4 for radiation external to a loaded MPCoverpack (ref. 1).GenericPage 281 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]This IC addresses an event that results in damage to the CONFINEMENT BOUNDARY ofa sterage Ga MPC containing spent fuel. It applies to irradiated fuel that is licensed fordry storage beginning at the point that the sealed MPC is loaded into the storage cask(overpack)-i4 sealed. The issues of concern are the creation of a potential or actualrelease path to the environment, degradation of one or more fuel assemblies due toenvironmental factors, and configuration changes which could cause challenges inremoving the cask or fuel from storage.The existence of "damage" is determined by radiological survey. The technicalspecification multiple of "2 times", which is also used in Recognition Category A-R ICRAU1, is used here to distinguish between non-emergency and emergency conditions.The emphasis for this classification is the degradation in the level of safety of the spentfuel cask and not the magnitude of the associated dose or dose rate. It is recognized thatin the case of extreme damage to a loaded cask, the fact that the "on-contact" dose ratelimit is exceeded may be determined based on measurement of a dose rate at somedistance from the cask.Security-related events for ISFSIs are covered under ICs HU1 and HAl.VCSNS Basis Reference(s):1. Certificate of Compliance No. 1032 Appendix A Technical Specifications for the HI-STORM FW MPC Storage System2. NEI 99-01 E-HU1Page 282 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]ATTACHMENT 2FISSION PRODUCT BARRIERMATRIX AND BASESPage 283 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]IntroductionTable F-1 lists the threshold conditions that define the Loss and Potential Loss of the threefission product barriers (Fuel Clad, Reactor Coolant System, and Containment). The tableis structured so that the three barriers occupy adjacent columns. Each fission productbarrier column is further divided into two columns; one for Loss thresholds and one forPotential Loss thresholds.The first column of the table (to the left of the Fuel Clad Barrier Loss column) lists thecategories (types) of fission product barrier thresholds. The fission product barriercategories are:1. RCS or SG Tube Leakage2. Inadequate Heat Removal3. CMT Radiation / RCS Activity4. CMT Integrity or Bypass5. Emergency Director JudgmentEach category occupies a row in Table F-1 thus forming a matrix defined by the categoryrows and the Loss/Potential Loss columns. The intersection of each category row witheach Loss/Potential Loss column forms a cell in which one or more fission product barrierthresholds appear. If NEI 99-01 does not define a threshold for a barrier Loss/PotentialLoss, the word "None" is entered in the cell.Thresholds are assigned letters within each Loss and Potential Loss column beginningwith "A." In this manner, a threshold can be identified by its category number and thresholdletter. For example, the first Fuel Clad barrier Loss in Category 2 is "FC Loss 2.A," the thirdContainment barrier Potential Loss in Category 4 is "CMT P-Loss 4.C," etc.If a cell in Table F-1 contains more than one threshold, each of the thresholds, ifexceeded, signifies a Loss or Potential Loss of the barrier. It is not necessary to exceed allof the thresholds in a category before declaring a barrier Loss/Potential Loss.Page 284 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Subdivision of Table F-1 by category facilitates association of plant conditions to theapplicable fission product barrier Loss and Potential Loss thresholds. This structurepromotes a systematic approach to assessing the classification status of the fissionproduct barriers.When equipped with knowledge of plant conditions related to the fission product barriers,the EAL-user first scans down the category column of Table F-1, locates the likelycategory and then reads across the row of fission product barrier Loss and Potential Lossthresholds in that category to determine if any threshold has been exceeded. If a thresholdhas not been exceeded in that category row, the EAL-user proceeds to the next likelycategory and continues review of the row of thresholds in the new categoryThe EAL-user must examine each of the three fission product barriers to determine if otherbarrier thresholds in the category are lost or potentially lost. For example, if ReactorBuilding radiation is sufficiently high (i.e., > 20,000 R/hr), a Loss of the Fuel Clad and RCSbarriers and a Potential Loss of the Containment barrier exist. Barrier Losses and PotentialLosses are then applied to the algorithms given in EALs FG1.1, FS1.1 and FA1.1 todetermine the appropriate emergency classification.In the remainder of this Attachment, the Fuel Clad barrier threshold bases appear first,followed by the RCS barrier and finally the Containment barrier threshold bases. In eachbarrier, the bases are given according to category Loss followed by category PotentialLoss beginning with Category 1, then 2.. .5.Page 285 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Table F-1 Fission Product Barrier Threshold MatrixFuel Clad Barrier Reactor Coolant System Barrier Containment BarrierCategory Loss Potential Loss Loss Potential Loss Loss Potential LossA. An automatic or manual ECCS A. Operation of a standby charging1 (SI) actuation required by pump is required by EITHER.RCS or None None EITHER: -UNISOLABLE RCS leakage A. A leaking or RUPTURED SG is NoneRCS Tue Ne- UNISOLABLE RCS
- SG tube RUPTURE FAULTED outside of containmentLoeasG leakage B. CSFST Integrity-RED pathgo -SG tube RUPTURE conditions metA. CSFST Core Cooling- RANGF A. CSFST Core Cooling-RED path2 path conditions met A. CSFST Heat Sink-RED path conditions metcondndiionssmetInadequate A. CSFST Core Cooling-RED B. CSFST Heat Sink-RED path conditions metHeat path conditions met conditions met None AND None ANDRestoration procedures notRemoval AND Heat sink is required effective within 15 mi. (Note 1)Heat sink is required3 A3A. RM-G7orRM-G18 CNTMT HICMT RNG Gamma > 2,000 R/hr None A. RM-G7 or RM-G18 CNTMT HI None None A. RM-G7 or RM-G18 CNTMT HI RNGRadiation B. Dose equivalent 1-131 coolant nRNG Gamma > 100 R/hr Gamma > 20,000 R/hr/ RCS activity > 300 pCigmActivityA. Containment isolation isrequired A. CSFST Containment-RED pathAND EITHER: conditions met4 .Containment integrity has B. Containment hydrogen concentratiorbeen lost based on ED > 4%CMT None None None None judgment C. Containment pressure > 12 psigIntegrity
- UNISOLABLE pathway from ANDor Bypass containment to the environment < one full train of depressurizationexists equipment (Table F-2) is operatingB. Indications of RCS leakage per design for a 15 min. (Note 1)outside of containment5 A. Any condition in the opinion of A. Any condition in the opinion of A. Any condition in the opinion of A. Any condition in the opinion of the A. Any condition in the opinion of A. Any condition in the opinion of thethe ED that indicates loss of the the ED that indicates potential the ED that indicates loss of the ED that indicates potential loss of the ED that indicates loss of the ED that indicates potential loss ofED fuel clad barrier loss of the fuel clad barrier RCS barrier the RCS barrier containment barrier the containment barrierJudgmentTable F-2 Full Train Deprsaaurizmtion EquipmentRBCU Groups Containment SpraysOperng Operating2 01 10 2Page 286 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier:Category:Degradation Threat:Threshold:Fuel Clad1. RCS or SG Tube LeakageLossNoneDefinition(s):N/ABasis:Plant-SpecificN/AGenericN/AVCSNS Basis Reference(s):N/APage 287 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier:Category:Degradation Threat:Threshold:Fuel Clad1. RCS or SG Tube LeakagePotential LossNoneDefinition(s):N/ABasis:Plant-SpecificN/AGenericN/AVCSNS Basis Reference(s):N/APage 288 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT ElBarrier: Fuel CladCategory: 2. Inadequate Heat RemovalDegradation Threat: LossThreshold:A. CSFST Core Cooling-RED path conditions metDefinition(s):NoneBasis:Plant-SpecificCritical Safety Function Status Tree (CSFST) Core Cooling-RED path is given in Figure 5and indicates significant core exit superheating and core uncovery. The CSFSTs arenormally monitored using the SPDS display on the Integrated Plant Computer System(IPCS). (ref. 1)The setpoint values provided in brackets following the normal setpoint values in theCSFSTs are used under adverse containment conditions. Adverse containment conditionsare defined as either (ref. 4):" Hi-1 RB pressure (_> 3.6 psig), or" Containment Hi-radiation (> 100,000 Rads integrated dose)The IPCS monitors these parameters and indicates when adverse containment valuesshould be used. The instruments available to monitor these containment parameters areContainment pressure on PI-950, PI-951, PI-952 or PI-953, and Containment radiation onRM-G7 or RM-G18. When no adverse values are provided, the given setpoint is used forany containment condition, as the parameter measurement is independent of containmentatmosphere. If containment pressure decreases below the adverse pressure setpoint afterit has been exceeded, the normal values are again used. Once the adverse radiation levelsetpoint is exceeded, the adverse containment values must be utilized through eventPage 289 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT Elrecovery and establishment of normal operating procedures. Engineering should then berequested to evaluate instrumentation inaccuracies (ref. 3).GenericThis reading indicates temperatures within the core are sufficient to cause significantsuperheating of reactor coolant.VCSNS Basis Reference(s):1. EOP-12.0 Monitoring of Critical Safety Functions2. EOP-14.0 Response to Inadequate Core Cooling3. EOP-14.1 Response to Degraded Core Cooling4. OAP-103.4 EOP/AOP User's Guide5. NEI 99-01 Inadequate Heat Removal Fuel Clad Loss 2.APage 290 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Fuel CladCategory: 2. Inadequate Heat RemovalDegradation Threat: Potential LossThreshold:A. CSFST Core Cooling-ORANGE path conditions metDefinition(s):NoneBasis:Plant-SpecificCritical Safety Function Status Tree (CSFST) Core Cooling-ORANGE path is given inFigure 5 and indicates subcooling has been lost and that some fuel clad damage maypotentially occur (ref. 1).The CSFSTs are normally monitored using the SPDS display on the Integrated PlantComputer System (IPCS) (ref. 1).The setpoint values provided in brackets following the normal setpoint values in theCSFSTs are used under adverse containment conditions. Adverse containment conditionsare defined as either (ref. 4):" Hi-1 RB pressure (> 3.6 psig), or" Containment Hi-radiation (> 100,000 Rads integrated dose)The IPCS monitors these parameters and indicates when adverse containment valuesshould be used. The instruments available to monitor these containment parameters areContainment pressure on PI-950, PI-951, PI-952 or PI-953, and Containment radiation onRM-G7 or RM-G18. When no adverse values are provided, the given setpoint is used forany containment condition, as the parameter measurement is independent of containmentatmosphere. If containment pressure decreases below the adverse pressure setpoint afterit has been exceeded, the normal values are again used. Once the adverse radiation levelsetpoint is exceeded, the adverse containment values must be utilized through eventPage 291 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]recovery and establishment of normal operating procedures. Engineering should then berequested to evaluate instrumentation inaccuracies (ref. 3).GenericThis reading indicates a reduction in reactor vessel water level sufficient to allow the onsetof heat-induced cladding damage.VCSNS Basis Reference(s):1. EOP-12.0 Monitoring of Critical Safety Functions2. EOP-14.0 Response to Inadequate Core Cooling3. EOP-14.1 Response to Degraded Core Cooling4. OAP-103.4 EOP/AOP User's Guide5. NEI 99-01 RCS or SG Tube Leakage Potential Loss 1.APage 292 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Fuel CladCategory: 2. Inadequate Heat RemovalDegradation Threat: Potential LossThreshold:B. CSFST Heat Sink-RED path conditions metANDHeat sink is requiredDefinition(s):NoneBasis:Plant-SpecificIn combination with RCS Potential Loss 2.A, meeting this threshold results in a Site AreaEmergency.Critical Safety Function Status Tree (CSFST) Heat Sink-RED path is given in Figure 6 andindicates the ultimate heat sink function is under extreme challenge and that some fuelclad damage may potentially occur (ref. 1).The CSFSTs are normally monitored using the SPDS display on the Integrated PlantComputer System (IPCS) (ref. 1).The phrase "and heat sink required" precludes the need for classification for conditions inwhich RCS pressure is less than SG pressure or Heat Sink-RED path entry was createdthrough operator action directed by an EOP. For example, EOP-1 5.0 is entered fromCSFST Heat Sink-Red. Step 1 tells the operator to determine if heat sink is required bychecking that RCS pressure is greater than any non-faulted SG pressure and RCS Thot isgreater than 3500F. If these conditions exist, Heat Sink is required. Otherwise, the operatoris to either return to the procedure and step in effect or place RHR in service for heatremoval. For large LOCA events inside the Containment, the SGs are moot because heatremoval through the containment heat removal systems takes place. Therefore, Heat SinkPage 293 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Red should not be required and, should not be assessed for EAL classification because aLOCA event alone should not require higher than an Alert classification. (ref. 2)The setpoint values provided in brackets following the normal setpoint values in theCSFSTs are used under adverse containment conditions. Adverse containment conditionsare defined as either (ref. 3):" Hi-1 RB pressure (> 3.6 psig), or" Containment Hi-radiation (> 100,000 Rads integrated dose)The IPCS monitors these parameters and indicates when adverse containment valuesshould be used. The instruments available to monitor these containment parameters areContainment pressure on PI-950, PI-951, PI-952 or PI-953, and Containment radiation onRM-G7 or RM-G 18. When no adverse values are provided, the given setpoint is used forany containment condition, as the parameter measurement is independent of containmentatmosphere. If containment pressure decreases below the adverse pressure setpoint afterit has been exceeded, the normal values are again used. Once the adverse radiation levelsetpoint is exceeded, the adverse containment values must be utilized through eventrecovery and establishment of normal operating procedures. Engineering should then berequested to evaluate instrumentation inaccuracies.GenericThis condition indicates an extreme challenge to the ability to remove RCS heat using thesteam generators (i.e., loss of an effective secondary-side heat sink). This conditionrepresents a potential loss of the Fuel Clad Barrier. In accordance with EOPs, there maybe unusual accident conditions during which operators intentionally reduce the heatremoval capability of the steam generators; during these conditions, classification usingthreshold is not warranted.VCSNS Basis Reference(s):1. EOP-12.0 Monitoring of Critical Safety Functions2. EOP-15.0 Response to Loss of Secondary Heat Sink3. OAP-103.4 EOP/AOP User's Guide4. NEI 99-01 Inadequate Heat Removal Fuel Clad Potential Loss 2.BPage 294 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Fuel CladCategory: 3. CMT Radiation / RCS ActivityDegradation Threat: LossThreshold:A. RM-G7 or RM-G18 CNTMT HI RNG Gamma > 2,000 R/hrDefinition(s):NoneBasis:Plant-SpecificThe gamma dose rate resulting from a postulated loss of coolant accident (LOCA) ismonitored by the high range Reactor Building monitors, RM-G7 and -G18. RM-G18 andRM-G7 are located inside containment outside the A and B Steam Generator cubicles,respectively, on the 469' elevation. The detector range is approximately 1 to 1 E7 R/hr(logarithmic scale). Radiation Monitors RM-G18 and RM-G7 provide a diverse means ofmeasuring the containment for high level gamma radiation. The detectors for RM-G18 andRM-G7 are a stainless steel gamma sensitive ion-chambers (ref. 1).The value specified represents, based on Microshield calculations, the expectedcontainment high range radiation monitor (RM-G7 and RM-G18) response (2.1E3 R/hrrounded down to nearest whole number for readability) based on a LOCA (Reg. Guide 1.4Case LOCA with fuel failure), one hour after shutdown with -2% fuel failure (ref. 2).GenericThe radiation monitor reading corresponds to an instantaneous release of all reactorcoolant mass into the containment, assuming that reactor coolant activity equals 300pCi/gm dose equivalent 1-131. Reactor coolant activity above this level is greater than thatexpected for iodine spikes and corresponds to an approximate range of 2% to 5% fuel claddamage. Since this condition indicates that a significant amount of fuel clad damage hasoccurred, it represents a loss of the Fuel Clad Barrier.Page 295 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]The radiation monitor reading in this threshold is higher than that specified for RCS BarrierLoss threshold 3.A since it indicates a loss of both the Fuel Clad Barrier and the RCSBarrier. Note that a combination of the two monitor readings appropriately escalates the.mergency classification !eveoECL to a Site Area Emergency.VCSNS Basis Reference(s):1. VCSNS Design Bases Document -Radiation Monitoring System (RM)2. TWR 11.5-91-027 Accident Severity Estimates from RM-G7 and G18 Response3. NEI 99-01 CMT Radiation / RCS Activity Fuel Clad Loss 3.APage 296 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Fuel CladCategory: 3. CMT Radiation / RCS ActivityDegradation Threat: LossThreshold:B. Dose equivalent 1-131 coolant activity > 300 pCi/gmDefinition(s):NoneBasis:Plant-SpecificElevated reactor coolant activity represents a potential degradation in the level of safety ofthe plant and a potential precursor of more serious problems. The threshold doseequivalent 1-131 concentration is well above that expected for iodine spikes andcorresponds to about 5% fuel clad damage. When reactor coolant activity reaches thislevel the Fuel Clad barrier is considered lost. (ref. 1)GenericThis threshold indicates that RCS radioactivity concentration is greater than 300 PCi/gmdose equivalent 1-131. Reactor coolant activity above this level is greater than thatexpected for iodine spikes and corresponds to an approximate range of 2% to 5% fuel claddamage. Since this condition indicates that a significant amount of fuel clad damage hasoccurred, it represents a loss of the Fuel Clad Barrier.There is no Potential Loss threshold associated with RCS Activity / Containment Radiation.VCSNS Basis Reference(s):1. NEI 99-01 CMT Radiation / RCS Activity Fuel Clad Loss 3.BPage 297 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Barrier:Category:Degradation Threat:Threshold:Fuel Clad3. CMT Radiation / RCS ActivityPotential LossNoneDefinition(s):N/ABasis:Plant-SpecificN/AGenericN/AVCSNS Basis Reference(s):N/APage 298 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier:Category:Degradation Threat:Threshold:Fuel Clad4. CMT Integrity or BypassLossNoneDefinition(s):N/ABasis:Plant-SpecificN/AGenericN/AVCSNS Basis Reference(s):N/APage 299 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier:Category:Degradation Threat:Threshold:Fuel Clad4. CMT Integrity or BypassPotential LossNoneDefinition(s):N/ABasis:Plant-SpecificN/AGenericN/AVCSNS Basis Reference(s):N/APage 300 of 359
.EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Fuel CladCategory: 5. ED JudgmentDegradation Threat: LossThreshold:A. Any condition in the opinion of the ED that indicates loss of the fuel clad barrierDefinition(s):NoneBasis:Plant-SpecificNoneGenericThis threshold addresses any other factors that may be used by the Emergency Director indetermining whether the Fuel Clad Barrier is lost.VCSNS Basis Reference(s):1. NEI 99-01 Emergency Director Judgment Fuel Clad Loss 6.APage 301 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Fuel CladCategory: 5. ED JudgmentDegradation Threat: Potential LossThreshold:A. Any condition in the opinion of the ED that indicates potential loss of the fuel cladbarrierDefinition(s):NoneBasis:Plant-SpecificNoneGenericThis threshold addresses any other factors that may be used by the Emergency Director indetermining whether the Fuel Clad Barrier is potentially lost. The Emergency Directorshould also consider whether or not to declare the barrier potentially lost in the event thatbarrier status cannot be monitored.VCSNS Basis Reference(s):1. NEI 99-01 Emergency Director Judgment Potential Fuel Clad Loss 6.APage 302 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Reactor Coolant SystemCategory: 1. RCS or SG Tube LeakageDegradation Threat: LossThreshold:A. An automatic or manual ECCS (SI) actuation required by EITHER:* UNISOLABLE RCS leakage" SGtube RUPTUREDefinition(s):UNISOLABLE -An open or breached system line that cannot be isolated, remotely orlocally.RUPTURE -The condition of a steam generator in which primary-to-secondary leakage isof sufficient magnitude to require a safety injection.Basis:Plant-SpecificECCS (SI) actuation is caused by (ref. 1):" Pressurizer pressure < 1850 psig" Steamline pressure < 675 psig" Steamline differential pressure __ 97 psid" Reactor Building (Containment) pressure _> 3.6 psigGenericThis threshold is based on an UNISOLABLE RCS leak of sufficient size to require anautomatic or manual actuation of the Emergency Core Cooling System (ECCS). Thiscondition clearly represents a loss of the RCS Barrier.This threshold is applicable to unidentified and pressure boundary leakage, as well asidentified leakage. It is also applicable to UNISOLABLE RCS leakage through anPage 303 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]interfacing system. The mass loss may be into any location -inside containment, to thesecondary-side (i.e., steam generator tube leakage) or outside of containment.A steam generator with primary-to-secondary leakage of sufficient magnitude to require ansafety injection is considered to be RUPTURED. If a RUPTURED steam generator is alsoFAULTED outside of containment, the declaration escalates to a Site Area Emergencysince the Containment Barrier Loss threshold 1 .A will also be met.VCSNS Basis Reference(s):1. EOP-1.0 Reactor Trip/Safety Injection Actuation2. EOP-4.0 Steam Generator Tube Rupture3. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Loss 1.APage 304 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Reactor Coolant SystemCategory: 1. RCS or SG Tube LeakageDegradation Threat: Potential LossThreshold:A. Operation of a standby charging pump is required by EITHER:* UNISOLABLE RCS leakage" SG tube RUPTUREDefinition(s):UNISOLABLE -An open or breached system line that cannot be isolated, remotely orlocally.RUPTURE -The condition of a steam generator in which primary-to-secondary leakage isof sufficient magnitude to require a safety injection.Basis:Plant-SpecificThe Chemical and Volume Control System (CVCS) includes three charging pumps whichtake suction from the Volume Control Tank and return cooled, purified reactor coolant tothe RCS. Normal charging flow is handled by one of the three charging pumps. Eachcharging pump is designed for a flow rate of 150 gpm at 2520 psid and a maximum flowrate of 650 gpm at 1040 psid. A second charging pump being required is indicative of asubstantial RCS leak. (ref. 1, 2, 3, 4)GenericThis threshold is based on an UNISOLABLE RCS leak that results in the inability tomaintain pressurizer level within specified limits by operation of a normally used charging(makeup) pump, but an ECCS (SI) actuation has not occurred. The threshold is met whenan operating procedure, or operating crew supervision, directs that a standby charging(makeup) pump be placed in service to restore and maintain pressurizer level.Page 305 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]This threshold is applicable to unidentified and pressure boundary leakage, as well asidentified leakage. It is also applicable to UNISOLABLE RCS leakage through aninterfacing system. The mass loss may be into any location -inside containment, to thesecondary-side (i.e., steam generator tube leakage) or outside of containment.If a leaking steam generator is also FAULTED outside of containment, the declarationescalates to a Site Area Emergency since the Containment Barrier Loss threshold 1 .A willalso be met.VCSNS Basis Reference(s):1. SOP-1 02 Chemical and Volume Control System2. FSAR Section 9.3.4.1.63. FSAR Section 9.3.4.2.14. FSAR Table 9.3-45. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Potential Loss 1.APage 306 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Reactor Coolant SystemCategory: 1. RCS or SG Tube LeakageDegradation Threat: Potential LossThreshold:B. CSFST Integrity-RED path conditions metDefinition(s):NoneBasis:Plant-SpecificThe "Potential Loss" threshold is defined by the CSFST RCS Integrity -RED path (Figure7). The values in this EAL are consistent with the CSFST value (ref. 1). CSFST RCSIntegrity -Red Path plant and associated Operational Curve Limit A is given in Figures 7and 8 and indicates an extreme challenge to the safety function when plant parameters areto the right of the limit curve following excessive RCS cooldown under pressure (ref. 1).The CSFSTs are normally monitored using the SPDS display on the Integrated PlantComputer System (IPCS) (ref. 1).GenericThis condition indicates an extreme challenge to the integrity of the RCS pressureboundary due to pressurized thermal shock -a transient that causes rapid RCS cooldownwhile the RCS is in Mode 3 or higher (i.e., hot and pressurized).VCSNS Basis Reference(s):1. EOP-12.0 Monitoring of Critical Safety Functions2. OAP-103.4 EOP/AOP User's Guide3. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Potential Loss 1..BPage 307 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier:Category:Degradation Threat:Threshold:Reactor Coolant System2. Inadequate Heat RemovalLossNoneDefinition(s):N/ABasis:Plant-SpecificN/AGenericN/AVCSNS Basis Reference(s):N/APage 308 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Reactor Coolant SystemCategory: 2. Inadequate Heat RemovalDegradation Threat: Potential LossThreshold:A. CSFST Heat Sink-RED path conditions metANDHeat sink is requiredDefinition(s):NoneBasis:Plant-SpecificIn combination with Fuel Clad Potential Loss 2.B, meeting this threshold results in a SiteArea Emergency.Critical Safety Function Status Tree (CSFST) Heat Sink-RED path is given in Figure 6 andindicates the ultimate heat sink function is under extreme challenge and that some fuelclad damage may potentially occur (ref. 1).The CSFSTs are normally monitored using the SPDS display on the Integrated PlantComputer System (IPCS) (ref. 1).The phrase "and heat sink required" precludes the need for classification for conditions inwhich RCS pressure is less-than SG pressure or Heat Sink-RED path entry was createdthrough operator action directed by an EOP. For example, EOP-1 5.0 is entered fromCSFST Heat Sink-Red. Step 1 tells the operator to determine if heat sink is required bychecking that RCS pressure is greater than any non-faulted SG pressure and RCS Thot isgreater than 3500F. If these conditions exist, Heat Sink is required. Otherwise, the operatoris to either return to the procedure and step in effect or place RHR in service for heatremoval. For large LOCA events inside the Containment, the SGs are moot because heatremoval through the containment heat removal systems takes place. Therefore, Heat SinkPage 309 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Red should not be required and, should not be assessed for EAL classification because aLOCA event alone should not require higher than an Alert classification. (ref. 2)The setpoint values provided in brackets following the normal setpoint values in theCSFSTs are used under adverse containment conditions. Adverse containment conditionsare defined as either (ref. 3):" Hi-1 RB pressure (> 3.6 psig), or* Containment Hi-radiation (> 100,000 Rads integrated dose)The IPCS monitors these parameters and indicates when adverse containment valuesshould be used. The instruments available to monitor these containment parameters areContainment pressure on PI-950, PI-951, PI-952 or PI-953, and Containment radiation onRM-G7 or RM-G18. When no adverse values are provided, the given setpoint is used forany containment condition, as the parameter measurement is independent of containmentatmosphere. If containment pressure decreases below the adverse pressure setpoint afterit has been exceeded, the normal values are again used. Once the adverse radiation levelsetpoint is exceeded, the adverse containment values must be utilized through eventrecovery and establishment of normal operating procedures. Engineering should then berequested to evaluate instrumentation inaccuracies.GenericThis condition indicates an extreme challenge to the ability to remove RCS heat using thesteam generators (i.e., loss of an effective secondary-side heat sink). This conditionrepresents a potential loss of the RCS Barrier. In accordance with EOPs, there may beunusual accident conditions during which operators intentionally reduce the heat removalcapability of the steam generators; during these conditions, classification using threshold isnot warranted.Meeting this threshold results in a Site Area Emergency because this threshold is identicalto Fuel Clad Barrier Potential Loss threshold 2.B; both will be met. This condition warrantsa Site Area Emergency declaration because inadequate RCS heat removal may result infuel heat-up sufficient to damage the cladding and increase RCS pressure to the pointwhere mass will be lost from the system.Page 310 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]VCSNS Basis Reference(s):1. EOP-12.0 Monitoring of Critical Safety Functions2. EOP-15.0 Response to Loss of Secondary Heat Sink3. OAP-103.4 EOP/AOP User's Guide4. NEI 99-01 Inadequate Heat Removal Potential Reactor Coolant System Loss 2.APage 311 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Reactor Coolant SystemCategory: 3. CMT Radiation / RCS ActivityDegradation Threat: LossThreshold:A. RM-G7 or RM-G18 CNTMT HI RNG Gamma > 100 R/hrDefinition(s):NoneBasis:Plant-SpecificThe gamma dose rate resulting from a postulated loss of coolant accident (LOCA) ismonitored by the high range Reactor Building monitors, RM-G7 and -G18. RM-G18 andRM-G7 are located inside containment outside the A and B Steam Generator cubicles,respectively, on the 469' elevation. The detector range is approximately 1 to 1 E7 R/hr(logarithmic scale). Radiation Monitors RM-G18 and RM-G7 provide a diverse means ofmeasuring the containment for high level gamma radiation. The detectors for RM-G18 andRM-G7 are a stainless steel gamma sensitive ion-chambers (ref. 1).The value specified represents, based on Microshield calculations, the expectedcontainment high range radiation monitor (RM-G7 and RM-G18) response (Reg. Guide 1.4Case LOCA with fuel failure) (1.05E2 R/hr rounded down to nearest whole number forreadability) based on a LOCA, one hour after shutdown with -0.1% fuel failure (ref. 2).GenericThe radiation monitor reading corresponds to an instantaneous release of all reactorcoolant mass into the containment, assuming that reactor coolant activity equals TechnicalSpecification allowable limits. This value is lower than that specified for Fuel Clad BarrierLoss threshold 3.A since it indicates a loss of the RCS Barrier only.There is no Potential Loss threshold associated with RCS Activity / Containment Radiation.Page 312 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]VCSNS Basis Reference(s):1. VCSNS Design Bases Document -Radiation Monitoring System (RM)2. TWR 11.5-91-027 Accident Severity Estimates from RM-G7 and G18 Response3. NEI 99-01 CMT Radiation / RCS Activity Reactor Coolant System Loss 2.APage 313 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier:Category:Degradation Threat:Threshold:Reactor Coolant System3. CMT Radiation / RCS ActivityPotential LossNoneDefinition(s):N/ABasis:Plant-SpecificN/AGenericN/AVCSNS Basis Reference(s):N/APage 314 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Barrier:Category:Degradation Threat:Threshold:Reactor Coolant System4. CMT Integrity or BypassLossNoneDefinition(s):N/ABasis:Plant-SpecificN/AGenericN/AVCSNS Basis Reference(s):N/APage 315 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier:Category:Degradation Threat:Threshold:Reactor Coolant System4. CMT Integrity or BypassPotential LossNoneDefinition(s):N/ABasis:Plant-SpecificN/AGenericN/AVCSNS Basis Reference(s):N/APage 316 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Reactor Coolant SystemCategory: 5. ED JudgmentDegradation Threat: LossThreshold:A. Any condition in the opinion of the ED that indicates loss of the RCS barrierDefinition(s):NoneBasis:Plant-SpecificNoneGenericThis threshold addresses any other factors that may be used by the Emergency Director indetermining whether the RCS Barrier is lost.VCSNS Basis Reference(s):1. NEI 99-01 Emergency Director Judgment Reactor Coolant System Loss 6.APage 317 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: Reactor Coolant SystemCategory: 5. ED JudgmentDegradation Threat: Potential LossThreshold:A. Any condition in the opinion of the ED that indicates potential loss of the RCS barrierDefinition(s):NoneBasis:Plant-SpecificNoneGenericThis threshold addresses any other factors that may be used by the Emergency Director indetermining whether the RCS Barrier is potentially lost. The Emergency Director shouldalso consider whether or not to declare the barrier potentially lost in the event that barrierstatus cannot be monitored.VCSNS Basis Reference(s):1. NEI 99-01 Emergency Director Judgment Reactor Coolant System Potential Loss 6.APage 318 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: ContainmentCategory: 1. RCS or SG Tube LeakageDegradation Threat: LossThreshold:A. A leaking or RUPTURED SG is FAULTED outside of containmentDefinition(s):FAULTED -The term applied to a steam generator that has a steam leak on the secondaryside of sufficient size to cause an uncontrolled drop in steam generator pressure or thesteam generator to become completely depressurized.RUPTURED -The condition of a steam generator in which primary-to-secondary leakageis of sufficient magnitude to require a safety injection.Basis:Plant-SpecificNoneGenericThis threshold addresses a leaking or RUPTURED Steam Generator (SG) that is alsoFAULTED outside of containment. The condition of the SG, whether leaking orRUPTURED, is determined in accordance with the thresholds for RCS Barrier PotentialLoss 1 .A and Loss 1 .A, respectively. This condition represents a bypass of thecontainment barrier.FAULTED is a defined term within the NEI 99-01 methodology; this determination is notnecessarily dependent upon entry into, or diagnostic steps within, an EOP. For example, ifthe pressure in a steam generator is decreasing uncontrollably .(part of the FAULTEDdefinition)] and the FAULTED steam generator isolation procedure is not entered becauseEOP user rules are dictating implementation of another procedure to address a higherPage 319 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]priority condition, the steam generator is still considered FAULTED for emergencyclassification purposes.The FAULTED criterion establishes an appropriate lower bound on the size of a steamrelease that may require an emergency classification. Steam releases of this size arereadily observable with normal Control Room indications. The lower bound for this aspectof the containment barrier is analogous to the lower bound criteria specified in IC SU4 forthe fuel clad barrier (i.e., RCS activity values) and IC SU5 for the RCS barrier (i.e., RCSleak rate values).This threshold also applies to prolonged steam releases necessitated by operationalconsiderations such as the forced steaming of a leaking or RUPTURED steam generatordirectly to atmosphere to cooldown the plant, or to drive an auxiliary (emergency) feedwater pump. These types of conditions will result in a significant and sustained release ofradioactive steam to the environment (and are thus similar to a FAULTED condition). Theinability to isolate the steam flow without an adverse effect on plant cooldown meets theintent of a loss of containment.Steam releases associated with the expected operation of a SG power operated reliefvalve or safety relief valve do not meet the intent of this threshold. Such releases mayoccur intermittently for a short period of time following a reactor trip as operators processthrough emergency operating procedures to bring the plant to a stable condition andprepare to initiate a plant cooldown. Steam releases associated with the unexpectedoperation of a valve (e.g., a stuck-open safety valve) do meet this threshold.Following an SG tube leak or rupture, there may be minor radiological releases through asecondary-side system component (e.g., air ejectors, glad seal exhausters, valve packing,etc.). These types of releases do not constitute a loss or potential loss of containment butshould be evaluated using the Recognition Category A-RICs.The ermergencY -lasifiation ,eveECLs resulting from primary-to-secondary leakage, withor without a steam release from the FAULTED SG, are summarized below.Page 320 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Affected SG is FAULTEDOutside of Containment?P-to-S Leak RateYesNoILess than or equal to 25 gpmGreater than 25 gpmRequires operation of a standbycharging (makeup) pump (RCSBarrier Potential Loss)Requires an automatic or manualECCS (SI) actuation (RCS BarrierLoss)No classificationUnusual Event perSU4SU5Site Area Emergency perFS1Site Area Emergency perFS1No classificationUnusual Event perSU4SU5Alert per FA1Alert per FA1There is no Potential Loss threshold associated with RCS or SG Tube Leakage.VCSNS Basis Reference(s):1. EOP-3.0 Faulted Steam Generator Isolation2. EOP-4.0 Steam Generator Tube Rupture3. NEI 99-01 RCS or SG Tube Leakage Containment Loss 1.APage 321 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Barrier:Category:Degradation Threat:Threshold:Containment1. RCS or SG Tube LeakagePotential LossNoneDefinition(s):N/ABasis:Plant-SpecificN/AGenericN/AVCSNS Basis Reference(s):N/APage 322 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Barrier:Category:Degradation Threat:Threshold:Containment2. Inadequate Heat RemovalLossNoneDefinition(s):N/ABasis:Plant-SpecificN/AGenericN/AVCSNS Basis Reference(s):N/APage 323 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: ContainmentCategory: 2. Inadequate Heat RemovalDegradation Threat: Potential LossThreshold:A. CSFST Core Cooling-RED path conditions metANDRestoration procedures not effective within 15 min. (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Definition(s):NoneBasis:Plant-SpecificCritical Safety Function Status Tree (CSFST) Core Cooling-RED path is given in Figure 5and indicates significant core exit superheating and core uncovery. The CSFSTs arenormally monitored using the SPDS display on the Integrated Plant Computer System(IPCS). (ref. 1)The function restoration procedures are those emergency operating procedures thataddress the recovery of the core cooling critical safety functions. The procedure isconsidered effective if the temperature is decreasing or if the vessel water level isincreasing (ref. 1, 2, 3).A direct correlation to status trees can be made if the effectiveness of the restorationprocedures is also evaluated.The setpoint values provided in brackets following the normal setpoint values in theCSFSTs are used under adverse containment conditions. Adverse containment conditionsare defined as either (ref. 4):0 Hi-1 RB pressure (> 3.6 psig), orPage 324 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]a Containment Hi-radiation (> 100,000 Rads integrated dose)The IPCS monitors these parameters and indicates when adverse containment valuesshould be used. The instruments available to monitor these containment parameters areContainment pressure on PI-950, PI-951, PI-952 or PI-953, and Containment radiation onRM-G7 or RM-G18. When no adverse values are provided, the given setpoint is used forany containment condition, as the parameter measurement is independent of containmentatmosphere. If containment pressure decreases below the adverse pressure setpoint afterit has been exceeded, the normal values are again used. Once the adverse radiation levelsetpoint is exceeded, the adverse containment values must be utilized through eventrecovery and establishment of normal operating procedures. Engineering should then berequested to evaluate instrumentation inaccuracies (ref. 3, 4).This threshold indicates significant core exit superheating and core uncovery. If core exitthermocouple (TC) readings are greater than 1,200°F (ref. 1), Fuel Clad barrier is also lost.GenericThis condition represents an IMMINENT core melt sequence which, if not corrected, couldlead to vessel failure and an increased potential for containment failure. For this conditionto occur, there must already have been a loss of the RCS Barrier and the Fuel CladBarrier. If implementation of a procedure(s) to restore adequate core cooling is noteffective (successful) within 15 minutes, it is assumed that the event trajectory will likelylead to core melting and a subsequent challenge of the Containment Barrier.The restoration procedure is considered "effective" if core exit thermocouple readings aredecreasing and/or if reactor vessel level is increasing. Whether or not the procedure(s) willbe effective should be apparent within 15 minutes. The Emergency Director shouldescalate the .m.rg.ncy .lasifiation l.ve..CL as soon as it is determined that theprocedure(s) will not be effective.Severe accident analyses (e.g., NUREG-1 150) have concluded that function restorationprocedures can arrest core degradation in a significant fraction of core damage scenarios,and that the likelihood of containment failure is very small in these events. Given this, it isPage 325 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]appropriate to provide 15 minutes beyond the required entry point to determine ifprocedural actions can reverse the core melt sequence.VCSNS Basis Reference(s):1. EOP-12.0 Monitoring of Critical Safety Functions2. EOP-14.0 Response to Inadequate Core Cooling3. EOP-14.1 Response to Degraded Core Cooling4. OAP-103.4 EOP/AOP User's Guide54. NEI 99-01 Inadequate Heat Removal Containment Potential Loss 2.APage 326 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Barrier:Category:Degradation Threat:Threshold:Containment3. CMT Radiation / RCS ActivityLossNoneDefinition(s):N/ABasis:Plant-SpecificN/AGenericN/AVCSNS Basis Reference(s):N/APage 327 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Barrier: ContainmentCategory: 3. CMT Radiation / RCS ActivityDegradation Threat: Potential LossThreshold:A. RM-G7 or RM-G18 CNTMT HI RNG Gamma > 20,000 R/hrDefinition(s):NoneBasis:Plant-SpecificThe gamma dose rate resulting from a postulated loss of coolant accident (LOCA) ismonitored by the high range Reactor Building monitors, RM-G7 and -G18. RM-G18 andRM-G7 are located inside containment outside the A and B Steam Generator cubicles,respectively, on the 469' elevation. The detector range is approximately 1 to 1 E7 R/hr(logarithmic scale). Radiation Monitors RM-G18 and RM-G7 provide a diverse means ofmeasuring the containment for high level gamma radiation. The detectors for RM-G18 andRM-G7 are a stainless steel gamma sensitive ion-chambers (ref. 1).The value specified represents, based on Microshield calculations, the expectedcontainment high range radiation monitor (RM-G7 and RM-G18) response (Reg. Guide 1.4Case LOCA with fuel failure) based on a LOCA, one hour after shutdown with -20% fuelfailure (ref. 2).2.1 x 104 R/hr (rounded down the the nearest whole number) is a value which indicatessignificant fuel damage well in excess of the thresholds associated with both loss of FuelClad and loss of RCS barriers. A major release of radioactivity requiring off-site protectiveactions from core damage is not possible unless a major failure of fuel cladding allowsradioactive material to be released from the core into the reactor coolant (ref. 1, 2).GenericPage 328 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]The radiation monitor reading corresponds to an instantaneous release of all reactorcoolant mass into the containment, assuming that 20% of the fuel cladding has failed. Thislevel of fuel clad failure is well above that used to determine the analogous Fuel CladBarrier Loss and RCS Barrier Loss thresholds.NUREG-1228, Source Estimations During Incident Response to Severe Nuclear PowerPlant Accidents, indicates the fuel clad failure must be greater than approximately 20% inorder for there to be a major release of radioactivity requiring offsite protective actions. Forthis condition to exist, there must already have been a loss of the RCS Barrier and theFuel Clad Barrier. It is therefore prudent to treat this condition as a potential loss ofcontainment which would then escalate the emergency classification le-eIECL to aGeneral Emergency.VCSNS Basis Reference(s):1. VCSNS Design Bases Document -Radiation Monitoring System (RM)2. TWR 11.5-91-027 Accident Severity Estimates from RM-G7 and G18 Response3. NEI 99-01 CMT Radiation / RCS Activity Containment Potential Loss 3.APage 329 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT ElBarrier: ContainmentCategory: 4. CMT Integrity or BypassDegradation Threat: LossThreshold:A. Containment isolation is requiredAND EITHER:" Containment integrity has been lost based on ED judgment* UNISOLABLE pathway from containment to the environment existsDefinition(s):UNISOLABLE -An open or breached system line that cannot be isolated, remotely orlocally.Basis:Plant-SpecificNoneGenericThese thresholds address a situation where containment isolation is required and one oftwo conditions exists as discussed below. Users are reminded that there may be accidentand release conditions that simultaneously meet both bulleted thresholds 4.A.1 and 4.A.2.47A.4First Threshold -Containment integrity has been lost, i.e., the actual containmentatmospheric leak rate likely exceeds that associated with allowable leakage (or sometimesreferred to as design leakage). Following the release of RCS mass into containment,containment pressure will fluctuate based on a variety of factors; a loss of containmentintegrity condition may (or may not) be accompanied by a noticeable drop in containmentpressure. Recognizing the inherent difficulties in determining a containment leak rateduring accident conditions, it is expected that the Emergency Director will assess thisthreshold using judgment, and with due consideration given to current plant conditions,and available operational and radiological data (e.g., containment pressure, readings onPage 330 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]radiation monitors outside containment, operating status of containment pressure controlequipment, etc.).Refer to the middle piping run of Figure 9-F--1 04. Two simplified examples are provided.One is leakage from a penetration and the other is leakage from an in-service systemvalve. Depending upon radiation monitor locations and sensitivities, the leakage could bedetected by any of the four monitors depicted in the figure.Another example would be a loss or potential loss of the RCS barrier, and thesimultaneous occurrence of two FAULTED locations on a steam generator where one faultis located inside containment (e.g., on a steam or feedwater line) and the other outside ofcontainment. In this case, the associated steam line provides a pathway for thecontainment atmosphere to escape to an area outside the containment.Following the leakage of RCS mass into containment and a rise in containment pressure,there may be minor radiological releases associated with allowable (design) containmentleakage through various penetrations or system components. These releases do notconstitute a loss or potential loss of containment but should be evaluated using theRecognition Category A-R lCs.4,A-2Second Threshold -Conditions are such that there is an UNISOLABLE pathway forthe migration of radioactive material from the containment atmosphere to the environment.As used here, the term "environment" includes the atmosphere of a room or area, outsidethe containment, that may, in tum, communicate with the outside-the-plant atmosphere(e.g., through discharge of a ventilation system or atmospheric leakage). Depending upona variety of factors, this condition may or may not be accompanied by a noticeable drop incontainment pressure.Refer to the top piping run of Figure 9-F--1 04. In this simplified example, the inboard andoutboard isolation valves remained open after a containment isolation was required (i.e.,containment isolation was not successful). There is now an UNISOLABLE pathway fromthe containment to the environment.The existence of a filter is not considered in the threshold assessment. Filters do notremove fission product noble gases. In addition, a filter could become ineffective due toPage 331 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]iodine and/or particulate loading beyond design limits (i.e., retention ability has beenexceeded) or water saturation from steam/high humidity in the release stream.Leakage between two interfacing liquid systems, by itself, does not meet this threshold.Refer to the bottom piping run of Figure 9-F-10_ 04. In this simplified example, leakage in anRCP seal cooler is allowing radioactive material to enter the Auxiliary Building. Theradioactivity would be detected by the Process Monitor. If there is no leakage from theclosed water cooling system to the Auxiliary Building, then no threshold has been met. Ifthe pump developed a leak that allowed steam/water to enter the Auxiliary Building, thensecond threshold-489 would be met. Depending upon radiation monitor locations andsensitivities, this leakage could be detected by any of the four monitors depicted in thefigure and cause the first threshold 4.A.1to be met as well.Following the leakage of RCS mass into containment and a rise in containment pressure,there may be minor radiological releases associated with allowable containment leakagethrough various penetrations or system components. Minor releases may also occur if acontainment isolation valve(s) fails to close but the containment atmosphere escapes to anenclosed system. These releases do not constitute a loss or potential loss of containmentbut should be evaluated using the Recognition Category A-R__ICs.The status of the containment barrier during an event involving steam generator tubeleakage is assessed using Loss Threshold 1.A.VCSNS Basis Reference(s):1. EOP-2.5 LOCA Outside Containment2. NEI 99-01 CMT Integrity or Bypass Containment Loss 4.APage 332 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: ContainmentCategory: 4. CMT Integrity or BypassDegradation Threat: LossThreshold:B. Indications of RCS leakage outside of containmentDefinition(s):NoneBasis:Plant-SpecificEOP-2.5 LOCA Outside Containment (ref. 1) provides instructions to identify and isolate aLOCA outside of the containment. Potential RCS leak pathways outside containmentinclude:" RHR" CVCS/Letdown" RCP seals" PZR/RCS Loop sample linesGenericContainment sump, temperature, pressure and/or radiation levels will increase if reactorcoolant mass is leaking into the containment. If these parameters have not increased,then the reactor coolant mass may be leaking outside of containment (i.e., a containmentbypass sequence). Increases in sump, temperature, pressure, flow and/or radiation levelreadings outside of the containment may indicate that the RCS mass is being lost outsideof containment.Unexpected elevated readings and alarms on radiation monitors with detectors outsidecontainment should be corroborated with other available indications to confirm that thesource is a loss of RCS mass outside of containment. If the fuel clad barrier has not beenPage 333 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]lost, radiation monitor readings outside of containment may not increase significantly;however, other unexpected changes in sump levels, area temperatures or pressures, flowrates, etc. should be sufficient to determine if RCS mass is being lost outside of thecontainment.Refer to the middle piping run of Figure 9- Y-1 04. In this simplified example, a leak hasoccurred at a reducer on a pipe carrying reactor coolant in the Auxiliary Building.Depending upon radiation monitor locations and sensitivities, the leakage could bedetected by any of the four monitors depicted in the figure and cause threshold 4.A. to bemet as well.To ensure proper escalation of the emergency classification, the RCS leakage outside ofcontainment must be related to the mass loss that is causing the RCS Loss and/orPotential Loss threshold 1 .A to be met.VCSNS Basis Reference(s):1. EOP-2.5 LOCA Outside Containment2. NEI 99-01 CMT Integrity or Bypass Containment Loss 4.BPage 334 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: ContainmentCategory: 4. CMT Integrity or BypassDegradation Threat: Potential LossThreshold:A. CSFST Containment-RED path conditions metDefinition(s):NoneBasis:Plant-SpecificCritical Safety Function Status Tree (CSFST) Containment-RED path (Figure 9) is enteredif Containment pressure is greater than or equal to 55 psig and represents an extremechallenge to safety function (ref. 1).55 psig is based on the containment design pressure (ref. 2).GenericIf containment pressure exceeds the design pressure, there exists a potential to lose theContainment Barrier. To reach this level, there must be an inadequate core coolingcondition for an extended period of time; therefore, the RCS and Fuel Clad barriers wouldalready be lost. Thus, this threshold is a discriminator between a Site Area Emergencyand General Emergency since there is now a potential to lose the third barrier.VCSNS Basis Reference(s):1. EOP-12.0 Monitoring of Critical Safety Functions2. OAP-103.2 Emergency Operating Procedure Setpoint Document3. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.APage 335 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: ContainmentCategory: 4. CMT Integrity or BypassDegradation Threat: Potential LossThreshold:B. Containment hydrogen concentration > 4%Definition(s):NoneBasis:Plant-SpecificThe lower limit of flammability of hydrogen in air is approximately 4% (ref. 1).In the early stages of a core uncovery event, it is unlikely that hydrogen buildup due to acore uncovery could result in an explosive mixture of dissolved gases in Containment.However, Containment monitoring and/or sampling should be performed to verify thisassumption and a General Emergency declared if it is determined that an explosivemixture exists. A combustible mixture can be formed when hydrogen gas concentration inthe Containment atmosphere is greater than 4% by volume (ref. 1, 2). All hydrogenmeasurements are referenced to concentrations in dry air even though the actualContainment environment may contain significant steam concentrations. The plant has twohydrogen monitoring systems. Sample points are located near each recombiner and nearthe RBCUs on the 530' Level. Manual action is required to start the redundant hydrogenanalyzers. The analyzers [CI-8257 (8258)] have a range of 0-10% and 0-20% of H2 in air(by volume) and an accuracy of +/- 2% of range. Hydrogen concentration in the ReactorBuilding is indicated in the control room (ref. 3, 4).To generate such levels of combustible gas, loss of the Fuel Clad and RCS barriers musthave occurred. With the Potential Loss of the Containment barrier, the threshold hydrogenconcentration, therefore, will likely warrant declaration of a General Emergency.GenericPage 336 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]The existence of an explosive mixture means, at a minimum, that the containmentatmospheric hydrogen concentration is sufficient to support a hydrogen burn (i.e., at thelower deflagration limit). A hydrogen burn will raise containment pressure and could resultin collateral equipment damage leading to a loss of containment integrity. It thereforerepresents a potential loss of the Containment Barrier.VCSNS Basis Reference(s):1. FSAR Section 6.2.3.5.12. SOP-1 22 Post Accident Hydrogen Removal System3. FSAR Section 6.2.5.5.34. SOP-122 Post Accident Hydrogen Removal System5. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.BPage 337 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT ElBarrier:ContainmentCategory:4. CMT Integrity or BypassDegradation Threat: Potential LossThreshold:C. Containment pressure > 12 psigAND< one full train of depressurization equipment (Table F-2) operating per designfor > 15 min. (Note 1Note 1: The Emergency Director should declare the event promptly upon determining that time limit hasbeen exceeded, or will likely be exceeded.Table F-2 Full Train Depressurization EquipmentRBCU Groups Containment SpraysOperating Operating2 01 10 2Definition(s):NoneBasis:Plant-SpecificThe Containment pressure setpoint (12 psig, ref. 2, 3) is the pressure at which theContainment Spray System should actuate and begin performing its function. The designbasis accident analyses and evaluations assume the loss of one Containment SpraySystem train (ref. 2, 3).Each spray subsystem is started by separate ESF containment isolation Phase A andspray actuation signals. Normally, both subsystems operate; however, they areindependent and can operate individually. Although the design basis for Reactor BuildingPage 338 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]heat removal is one spray subsystem operating in conjunction with one Reactor BuildingCooling Unit (with one RHR pump and one charging pump providing emergency corecooling water), two Reactor Building Cooling Units (RBCUs) with no spray pumps or twospray pumps with no RBCUs can handle all required heat loads Technical Specificationsdefined equipment that comprises one full train of depressurization equipment is given inTable F-3 (ref. 1, 2, 4, 5).RBCU operation verification is performed in accordance with EOP-1.0 Attachment 3 SIEquipment Verification. In order to take credit for a RBCU operating per design, eachRBCU must meet minimum Service Water flow requirements (ref. 6).GenericThis threshold describes a condition where containment pressure is greater than thesetpoint at which containment energy (heat) removal systems are designed toautomatically actuate, and less than one full train of equipment is capable of operating perdesign. The 15-minute criterion is included to allow operators time to manually startequipment that may not have automatically started, if possible. This threshold representsa potential loss of containment in that containment heat removal/depressurization systems(e.g., containment sprays, ice condenser etc., but not including containment ventingstrategies) are either lost or performing in a degraded manner.VCSNS Basis Reference(s):1. FSAR Section 6.2.2.2.1.22. OAP-1 03.2 Emergency Operating Procedure Setpoint Document3. EOP-12.0 Monitoring of Critical Safety Functions4. Technical Specifications 3/4-6.2.15. Technical Specifications 3/4-6.2.36. EOP-1.0 Reactor Trip/Safety Injection Actuation Attachmen 3 SI Equipment Verification7. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.CPage 339 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]Barrier: ContainmentCategory: 5. ED JudgmentDegradation Threat: LossThreshold:A. Any condition in the opinion of the ED that indicates loss of the containment barrierDefinition(s):NoneBasis:Plant-SpecificNoneGenericThis threshold addresses any other factors that may be used by the Emergency Director indetermining whether the Containment Barrier is lost.VCSNS Basis Reference(s):1. NEI 99-01 Emergency Director Judgment Containment Loss 6.APage 340 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Barrier: ContainmentCategory: 5. ED JudgmentDegradation Threat: Potential LossThreshold:A. Any condition in the opinion of the ED that indicates potential loss of the containmentbarrierDefinition(s):NoneBasis:Plant-SpecificNoneGenericThis threshold addresses any other factors that may be used by the Emergency Director indetermining whether the Containment Barrier is potentially lost. The Emergency Directorshould also consider whether or not to declare the barrier potentially lost in the event thatbarrier status cannot be monitored.VCSNS Basis Reference(s):1. NEI 99-01 Emergency Director Judgment Containment Potential Loss 6.APage 341 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]ATTACHMENT 3FiguresPage 342 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Figure 1: Fuel Assembly Uncovery ElevationsTransfer slotty-' -"-461'-6" Normal WLityISFPJ439' top of fuel in SFP-' and upenders-431'Transfer tube-- * ' L 427' TOAFPage 343 of 359 (Dto(00mz02mz0t-Cmm-D-u0 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Figure 3: RCS ElevationsMANSELUMIDLOOP MONITOR RVLISNARROWELEVATION RANGE(FT) (%)Top of Active Fuel 427' 57.9Bottom of Hot Leg 429' 6" 64.2RV FLANGE 437' 7.4" 84.3Page 345 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Figure 4: Response of the TMI-2 Source Range MeasurementDuring the First Six Hours of the Accidentw\0C'jI)-0.I--c~) I-(0Lfl(sapeoap 6ol) puooaS jed slunooPage 346 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Figure 5: CSFST Core CoolingGOTOEOP-14.0GOTOEOP-14-0mmmm Comn~m NOYESTOEOP-14.1YES GO TOEOP-14.10NOo GO TOAT LO UKI 000r",'.,,,.,, EOP-14-2,,,,am,, cps,00M 'r ,o& EOP-14.1WTIMt 711,lawv s.* YES~fGO TOgoo EOP-14-2CSF SATPage 347 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Figure 6: CSFST Heat SinkSf GOTOEOP-15.0L~NOTO0000000000000000000000000 GO TO0 ~EOP-15-10T0NOYE, S 8000000GO TO0,Soo EOP-15.4o00oLEM I AU a GO TOUMHoo0000 EOP-15.4CSF SATPage 348 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Figure 7: CSFST RCS Integrity,IOGOTOEOP-16.0ALmAMsomsuws NOI1°-OF U GO TOEOP-16.0" CSF SATNoSGOTOIn , EOP-16.1P" FM NO1=0 CSF SATcSF SATPage 349 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Figure 8: Plant Operational Limits CurvePLANT OPERATIONAL LIMITS CURVERCS PRESSURE (PSIG)3000 -rI2500200015001000100 150 200 250 300 350 400RCS Tcold (-F)Page 350 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Figure 9: CSFST ContainmentO GOTOEOP-17.0GO TOMMMM*OWANW MEM NOEOP-17-0P O TOLin1mw4 p"YES coomfsawr SPRAYU2pin 4 ATLEAlWr00000000000000 GO TOEOP-17.1I IINOOUmn"a p"GO TOo EOP-17.2CSF SATPage 351 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]Figure 10: Containment Integrity or Bypass ExamplesRCPSealCoolinqPage 352 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]ATTACHMENT 4Safe Operation & Shutdown AreasTables R-2 & H-3 BasesPage 353 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]BackgroundNEI 99-01 Revision 6 ICs AA3 and HA5 prescribe declaration of an Alert based onimpeded access to rooms or areas (due to either area radiation levels or hazardous gasconcentrations) where equipment necessary for normal plant operations, cooldown orshutdown is located. These areas are intended to be plant operating mode dependent.Specifically the Developers Notes For AA3 and HA5 states:The "site-specific list of plant rooms or areas with entry-related mode applicabilityidentified" should specify those rooms or areas that contain equipment which require amanual/local action as specified in operating procedures used for normal plantoperation, cooldown and shutdown. Do not include rooms or areas in which actions of acontingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, corrective measures oremergency operations). In addition, the list should specify the plant mode(s) duringwhich entry would be required for each room or area.The list should not include rooms or areas for which entry is required solely to performactions of an administrative or record keeping nature (e.g., normal rounds or routineinspections).Further, as specified in IC HA5:The list need not include the Control Room if adequate engineered safety/designfeatures are in place to preclude a Control Room evacuation due to the release of ahazardous gas. Such features may include, but are not limited to, capability to draw airfrom multiple air intakes at different and separate locations, inner and outeratmospheric boundaries, or the capability to acquire and maintain positive pressurewithin the Control Room envelope.VCS1 Table R-2 and H-3 BasesA review of station operating procedures identified the following mode dependent in-plantactions and associated areas that are required for normal plant operation, cooldown orshutdown:MODE 1 (Power Operation)" FWP and FWBP's per SOP-210 (TB all levels)" PTP-1 02.001 Extraction System check valves (TB-436)" XVG02074 &2075 (TB-412)" XVG02210 (TB-463)" XVT02072A/B (TB-412)* 3062's Blow down temperature control (AB-436)MODE 2 (Startup)" FWP and FWBP's per SOP-210 (TB all levels)" XVT01663 (TB-412)* Primary Chemistry Lab (CB-412)Page 354 of 359 EPP-1 08ENCLOSURE IREVISION 01 [DRAFT E]MODE 3 (Hot Standby)" Primary Chemistry Lab (CB-412)" PZR heater disconnects (AB-436)" RCP seal injection adjustments (AB-412 west pen/IB-412 east pen)* SI Accumulator isolation valves (IB-463/AB-463)" P-12 interlocks (CB-436 relay room)" RHR samples (AB-374)" CCW pump start (IB-412)* CHG/Sl pump cycle (AB-388/IB-436/IB-463)MODE 4 (Hot Shutdown)/Mode 5 (Cold Shutdown" CHG/SI Bkr alignment (IB-436/IB463)" RHR bkr alignment (AB-412/AB-463/IB-463)* ASI disable (AB-388/AB-400/AB-436)* P-12 interlocks (CB-436 relay room)" Steam Generator Shell Temp monitoring for MODE 5 (RB-412/RB-436)Table R-2 & H-3 ResultsTable R-2 & H-3 Safe Operation & Shutdown AreasArea Mode ApplicabilityAuxiliary Building 374' 3Auxiliary Building 388' 3, 4, 5Auxiliary Building 400' 4, 5Auxiliary Building 412 3, 4, 5Auxiliary Building 436' 1,2, 3, 4, 5Auxiliary Building 463' 3, 4, 5Intermediate Building 412' 3Intermediate Building 436' 4, 5Intermediate Building 463' 3, 4, 5Control Building 412' 2, 3Control Building 436' 3, 4, 5Turbine Building (All levels) 1,2Plant Operating Procedures Reviewed1. GOP-4B Power Operation Mode 1 Descending2. GOP-5 Reactor Shutdown From Startup to Hot Standby Mode 2 to Mode 3Page 355 of 359 EPP-108ENCLOSURE IREVISION 01 [DRAFT E]3. GOP-6 Plant Shutdown From Hot Standby to Cold Shutdown Mode 3 to Mode 54. SOP-210 Feedwater System5. PTP-102.001 Main Turbine Tests6. "Rooms Needed for Normal Plant Shutdown from Mode 1 to Mode 5" AnAssessment performed by Doug Edwards 5/24/13Page 356 of 359