ML16061A073

Millstone, Units 2 and 3 - Changes to Technical Specification Bases

ML16061A073
Person / Time
Site:	Millstone
Issue date:	02/23/2016
From:	Stanley B L Dominion Nuclear Connecticut
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
16-078
Download: ML16061A073 (390)

Text

{{#Wiki_filter:Dominion Nuclea Connecticut, Inc.Rope Ferry Rd., Waterford, CT 06385omn nMailing Address: P.O. Box 128"Waterford, CT 06385dom. com FEB 2 32016U. S. Nuclear Regulatory Commission Serial No. 16-078Attention: Document Control Desk NSS&LIWEB R0Washington, DC 20555 Docket No. 50-33650-423License No. DPR-65,NPF-49 ':DOMINION NUCLEAR CONNECTICUT. INC.MILLSTONE POWER STATION UNITS 2 AND 3CHANGES TO TECHNICAL SPECIFICATION BASESIn accordance with the requirements of Millstone Power Station Unit 2 (MPS2)Technical Specification (TS) 6.23.d and Millstone Power Station Unit 3 (MPS3)TS 6.18.d, Dominion Nuclear Connecticut, Inc. (DNC) is providing the NuclearRegulatory Commission (NRC) with changes to the MPS2 and MPS3 TS Bases.DNC is submitting a complete copy of the TS Bases for both MPS2 and MPS3.These TS Bases are provided for information only. Any changes to the Basessections were made in accordance with the provisions of 10 CFR 50.59. Thesechanges have been reviewed and approved by the Facility Safety ReviewCommittee.Attachments 1 and 2 provide the TS Bases in their entirety for MPS2 and MPS3,respectively.If you have any questions or require additional information, please contact Mr.Thomas G. Cleary at (860) 444-4377.Sincerely, .-B. L. StanleyDirector -Nuclear Station and Licensing Serial No. 16-078Docket Nos. 50-336 and 50-423Changes to MPS2 and MPS3 TS BasesPage 2 of 2Attachments:1. Bases Pages for Millstone Power Station Unit 22. Bases Pages for Millstone Power Station Unit 3Commitments made in this letter: None.cc: U.S. Nuclear Regulatory CommissionRegion I2100 Renaissance Blvd. Suite 100King of Prussia, PA 19406-2713Richard V. GuzmanNRC Senior Project ManagerU.S. Nuclear Regulatory CommissionOne White Flint North, Mail Stop 08 C211555 Rockville PikeRockville, MD 20852-2738NRC Senior Resident InspectorMillstone Power Station Serial No. 16-078Docket No. 50-336ATTACHMENT IBASES PAGES FOR MILLSTONE POWER STATION UNIT 2DOMINION NUCLEAR CONNECTICUT, INC.MILLSTONE POWER STATION UNIT 2 August 1, 1975BASESFORSECTION 2.0SAFETY LIMITSANDLIMITING SAFETY SYSTEM SETTINGSY 2.1 SAFETY LIMITS May 1, 2002BASES2.1.1 REACTOR COREThe restrictions of this safety ]imit prevent overheating of the fuelcladding and possible cladding perforation which would result in the release Qffission products to the reactor coolant. Overheating of the fuel is preventedby maintaining the steady state peak linear heat rate at or less than the fuelcenterline melt linear heat rate limit. Centerline fuel melting will not occurfor this peak linear heat rate. Overheating of the fuel cladding is preventedby restricting fuel operation to within the nucleate boiling regime where theheat transfer coefficient is large and the cladding surface temperature isslightly above the coolant saturation temperature.Operation above the upper boundary of the nucleate boI-lIing regime couldresult in excessive cladding temperatures because of the onset of departurefrom nucleate boiling (DNB) and the resultant sharp reduction in heat transfercoefficient. DNB is not a directly measurable parameter during operation andtherefore THERMAL POWER and Reactor Coolant Temperature and Pressure have beenrelated to DNB through the HIP correlation. The HIP DNB correlation has beendeveloped to predict the DNB flux and the location of DNB for axially uniformand non-uniform heat flux distributions. The local DNB heat flux ratio, DNBR,defined as the ratio of the heat flux that would cause DNB at a particularcore location to the local heat flux, is indicative of the margin to DNB.The value of the DNBR during steady state operation, normal operationaltransients, and anticipated transients is limited to be no less than the DNBcorrelation limit. The correlation limit corresponds to a 95 percentprobability at a 95 percent confidence level (i.e., 95/95 limit),that DNB willnot occur and is chosen as an appropriate margin to DNB for all operatingconditions.The curves of Figure 2.1-1 show the loci of points of THERMAL POWER,Reactor Coolant System pressure and maximum cold leg temperature with fourReactor Coolant Pumps operating for which the minimum DNBR is no less than the95/95 limit for the DNB correlation. The limits in Figure 2.1-1 werecalculated for reactor coolant inlet temperatures less than or equal to 580°F.The dashed line at 580°F coolant inlet temperatures is not a safety limit;however, operation above 580°F is not possible because of the actuation of themain steam line safety valves which limit the maximum value of reactor inlettemperature. Reactor operation at THERMAL POWER levels higher than 111.6% ofRATED THERMAL POWER is prohibited by the high power level trip setpointspecified in Table 2.2-1. The area of saf~e operation is below and to the leftof these lines.Revised by NRC Letter A15689MILLSTONE -UNIT 2 B 2-1 Amendment No. 7, Jfl, 0803 October 6, 1980THIS PAGE INTENTIONALLY LEFT BLANKMILLSTONE UNIT 2B 2-2MILLTONE- UNT 2 2-2Amendment No. 61 LBDCR 04-MP2-016February 24, 2005SAFETY LIMITSBASES:The conditions for the Thermal Margin Safety Limit curves in figure 2.1-i to be valid areshown on the figure.The reactor protective system in combination with the Limiting Conditi~ons for Operation,is designed to prevent any anticipated combination of transient conditions for reactor coolantsystem temperature, pressure, and THERMAL POWER level that would result in a DNBR belowthe 95/95 limit for DNB correlation, and preclude the existence of flow instabilities.2.1.2 REACTOR COOLANT SYSTEM PRESSUREThe restriction of this Safety Limit protects~the integrity of the Reactor Coolant Systemfrom overpressurization and thereby prevents the release of radionuclides contained in the reactor.coolant fr-om reaching the containment atmosphere.The reactor pressure vessel and pressurizer are designled to Section III of the ASME Codefor Nuclear Power Plant Components which permits a maximum transient pressure of 110%(2750 psia) of design pressure. The Reactor Coolant System piping, valves and fittings, aredesigned to ANSI B3 1.7, Class I which permits a maximum transient pressure of 110% (2750psia) of component design pressure. The Safety Limit of 2750 psia is therefore consistent withthe design criteria and associated code requirements.The entire Reactor Coolant System is hydrotested at 3125 psia to demonstrate integrityprior to initial operation.MILLSTONE -UNIT 2B 2-3Amendment No. :g, gg, 64-, l-39, 26,Acknowledged by NRC letter dated 6/28/05 October 4, 20012.2 LIMITING SAFETY SYSTEM SETTINGSBASES:2.2.1t REACTOR TRIP SET POINTSThe Reactor Trip Setpoints specified in Table 2.2-il are the values at which the ReactorTrips are set for each parameter. The Trip Values have been selected to ensure that the reactorcore and reactor coolant system are prevented from exceeding their safety limits. Operation witha Trip Setpoint less conservative than its setpoint but within its specified Allowable 'Value isacceptable on the basis that each Allowable Value is equal to or less than the drift allowanceassumed to occur for each trip used in the accident analyses.Manual Reactor TripThe Manual Reactor Trip is a redundant channel to the automatic protectiveinstrumentation channels and provides manual reactor trip capability.Power Level-Hig~hThe Power Level-High trip provides reactor core protection against reactivity excursionswhich are too rapid to be protected by a Pressurizer Pressure-High or Thermal Margin/LowPressure trip.The Power Level-High trip setpoint is operator adjustable and can be set no higher than9.6% above the indicated THERMAL POWER level. Operator action is required to increase thetrip set'point as THERMvAL POWER is increased. The trip setpoint is automatically decreased asTHERMAL POWER decreases. The trip setpoint has a maximum value of 106.6% of RATEDTHERMAL POWER and a minimum setpoint of 14.6% of RATED THERMAL POWER.Adding to this maximum value the possible variation in trip point due to calibration andinstrument errors, the maximum actual steady-state THERMAL POWER level at which a tripwould be actuated is 111.6% of RATED THERMAL POWER, which is the value used in theaccident analyses.Reactor Coolant Flow-LowThe Reactor Coolant Flow-Low trip provides core protection to prevent DNB in the eventof a sudden significant decrease in reactor coolant flow.MILLSTONE -UNIT 2 B 2-4 kAmendment No. 6t-, 226,Revised by NRC Letter datedOctober 4, 2001 May 1, 2002LIMIINGSAFT YTMSTIGBASESReactor Coolant Flow-Low (Continued)The low-flow trip setpoint and Allowable Value have been derived in consideration of instrumenterrors and response times of equipment involved to maintain the DNBR above the 95/95 limit forthe DNB correlation under normal operation and expected transients."Pressurizer Pressure-HighThe pressurizer Pressure-High trip, backed up by the pressurizer code safety valves andmain steam line safety valves, provides reactor coolant system protection againstoverpressurization in the event of loss of load without reactor trip. This trip's setpoint isapproximately 100 psi below the nominal lift setting (2500 psia) of the pressurizer code safetyvalves and it~s concurrent operation with the power-operated relief valves avoids the undesirableoperation of the pressurizer code safety valves.Containment Pressure-HighThe Containment Pressure-High trip provides assurance that a reactor trip is initiatedconcurrently with a safety injection. The setpont for this trip is identical to the safety injectionsetpoint.Steam Generator Pressure-LowThe Steam Generator Pressure-Low trip provides protection against an excessive rate ofheat extraction from the steam generators and subsequent cooldown of the reactor coolant. Thetrip setting is sufficiently below the full-load operating point so as not to interfere with normaloperation, but still high enough to provide the required protection in the event of excessively highsteam flow.MILLSTONE -UNIT 2B 2-5Revised by NRC letter A15689Amendment No. 5-2, 641, 4-3-9, 2-2-6, February 20, 2003LBDCR 2-21-02LIMITING SAFETY SYSTEM SETTINGSBASES:Steam Generator Water Level -LowThe Steam Generator Water Level-Low Trip provides core protection by preventingoperation with the steam generator water level below the minimum volume required for adequateheat removal capacity and assures that the design pressure of the reactor coolant system will notbe exceeded.Local Power Density-HighThe Local Power Density-High trip, functioning from AXIAL SHAPE INDEXmonitoring, is provided to ensure that the peak local power density in the fuel which correspondsto fuel centerline melting will not occur as a consequence of axial power maldistributions. Areactor trip is initiated whenever the AXIAL SHAPE INDEX exceeds the allowable limits ofFigure 2.2-2. The AXIAL SHAPE INDEX is calculated from the upper and lower ex-coreneutron detector channels. The calculated setpoints are generated as a function of THERMALPOWER level. The trip is automatically bypassed below 15 percent power as sensed by thepower range nuclear instrument Level 1 bistable.The maximum AZIMUTHAL POWER TILT and maximum CEA misalignmentpermitted for continuous operation are assumed in generation of the setpoints. In addition, CEAgroup sequencing in accordance with the Specifications 3.1.3.5 and 3.1.3.6 is assumed. Finally,the maximum insertion of CEA banks which can occur during any anticipated operationaloccurrence prior to a Power Level-High trip is assumed.Thermal Margin/Low PressureThe Thermal Margin/Low Pressure trip is provided to prevent operation when the DNBRis below the 95/95 limit for the DNB correlation.MILLSTONE -UNIT 2B 2-6Amendment No. 3-s, 4t-, g-, 6-1-, 4-3-3,Corrected by letter dated 11/26/2003. LBDCR 14-MP2-009May 8, 2014LIMITING SAFETY SYSTEM SETTINGSBASES:Thermal Margin/Low Pressure (Continued)The trip is initiated whenever the reactor coolant system pressure signal drops beloweither 1865 psia or a computed value as described below, whichever is higher. The computedvalue is a function of the higher of AT power or neutron power, reactor inlet temperature, thenumber of reactor coolant pumps operating and the AXIAL SHAPE INDEX. The minimum valueof reactor coolant flow rate, the maximum AZIMUTHAL POWER TILT and the maximum CEAdeviation permitted for continuous operation are assumed in the generation of this trip function. Inaddition, CEA group sequencing in accordance with Specifications 3.1.3.5 and 3.1.3.6 isassumed. Finally, the maximum insertion of CEA banks which can occur during any anticipatedoperational~occurrence prior to a Power Level-High trip is assumed.Thermal Margin/Low Pressure trip setpoints are derived from the core safety limits. Asafety margin is provided which includes allowances for equipment response times, core power,RCS tempeiature, and pressurizer pressure measurement uncertainties, processing errors, and afurther allowance to compensate for the time delay associated with providing effectivetermination of the occurrence that exhibits the most rapid decrease in margin to the safety limit.Loss of TurbineA Loss of Turbine trip causes a direct reactor trip when operating above 15% of RATEDTHERMAL POWER as sensed by the power range nuclear instrument Level 1 bistable. This tripprovides turbine protection, reduces the severity of the ensuing transient and helps avoid thelifting of the main steam line safety valves during the ensuing transient, thus extending the servicelife of these valves. No credit was taken in the accident analyses for operation of this trip. Itsfunctional capability at the specified trip setting is required to enhancethe overall reliability of theReactor Protection System.The Wide Range Logarithmic Neutron Flux Monitor -Shutdown, Reactor ProtectionSystem Logic Matrices, Reactor Protection System Logic Matrix Relays, and Reactor TripBreakers flmctional units are components of the Reactor Protective System for whichOPERABILITY requirements are provided within the Technical Specifications (see TechnicalSpecification 3.3.1.1, "Reactor Protective Instrumentation). These functional units do not havespecific trip set-points or allowable values, similar to the manual reactor trip functional unit.However, these functional units are provided here for completeness and consistency with the RPSInstrumentation identified in Technical Specification 3.3.1.1.MILLSTONE -UNMT 2 B 2-7 Amendment No. 5-2, 4-39, -I-5-3, 22-6,.... , ..... September 25, 2003LIMITING SAFETY SYSTEM SETTINGSBASES:DELETED0)MILLSTONE -UNIT 2 -" ...... ....... -........ B 2-8......... ..... ............. ..... ............ -......E- KI2 B -_ ._ -A 64-2,--t ----.... " August 1, *1975...SECTIONS 3.0 AND 4.03LIMITING CONDITIONS FOR ORPEATION* ANDSURVEILLANCE REQUIREMENTS February 26, 19913/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS3/4.0 APPLICABILITYBASESSpecification 3.0.1 through 3.0.4 establish the general requirements applicable to LimitingConditions for Operation. These requirements are based on the requirements fdr LimitingConditions for Operation stated in the Code of Federal Regulations, 10OCFR5O.36(c)(2):"Limiting conditions for oper'ation are the lowest functional capability or performancelevels of equipment required for safe operation of the facility. 'When a limiting condition foroperation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow anyremedial action permitted by the technical specification until the condition can be met."Specification 3.0.1 establishes the Applicability statement within each individual specification asthe requirement for when (i.e., in which OPERATIONAL MODES or other specified conditions)conformance to the Limiting Conditions for Operation is required for safe operation of thefacility. The ACTION requirements establish those remedial measure that must be taken withinspecified time limits when the requirements of a Limiting Condition for Operation are not met.There are two basic types of ACTION requirements. The first specifies the remedial measuresthat permit continued operation of the facility which is not further restricted by the time limits ofthe ACTION requirements. In this case, conformance to the ACTION requirements provides anacceptable level of safety for unlimited continued operation as long as the ACTION requirementscontinue to be met. The second type of ACTION requirement specifies a time limit in whichconformance to the conditions of the Limiting Condition for Operation must be met. This timelimit is the allowable outage time to restore an inoperable system or component to OPERABLEstatus or for restoring parameters within specified limits. If these actions are not completedwithin the allowable outage time limits, a shutdown is required to place the facility in a MODE orcondition in which the specification no longer applies. It is not intended that the shutdownACTION requirements be used as an operational convenience which permits (routine) voluntaryremoval of a system(s) or component(s) from service in lieu of other alternatives that would notresult in redundrant systems or components being inoperable.The specific time limits of the ACTION requirements are applicable from the point in time it isidentified that a Limiting Condition for Operation is not met. The time limits of the ACTIONrequirements are also applicable when a system or component is removed from service forsurveillance testing or investigation of operational problems. Individual specifications may.include a specified time limit for the completion of a Surveillance Requirement when equipmentis removed from service. In this case, the allowable outage timeMILLSTONE -UNIT 2B 3/40-1MILLTONE- UIT 2B 3/0-IAmendment Nos. 61, 151 LBDCR 04-MP2-016February 24, 20053/4.0 APPLICABILITYBASES (Con't) 0 )limits of ACTION requirements are applicable when this limit expires if the surveillance has notbeen completed. When a shutdown is required to comply with ACTION requirements, the plantmay have entered a MODE in which a new specification becomes applicable. In this case, thetime limits of the ACTION requirements would apply from the point in time that~the newspecification becomes applicable if the requirements of the Limiting Condition for Operation arenot met.Specification 3.0.2 establishes that noncompliance with a specification exists when therequirements of the Limiting Condition for Operation are not met and the associated ACTIONrequirements have not been implemented within the specified time interval. The purpose of thisspecification is to clarify that (1) implementation of the ACTION requirements within thespecified time interval constitutes compliance with a specification and (2) completion of theremedial measures of the ACTION requirements is not required when compliance with a LimitingCondition of Operation is restored within the time interval specified in the associated ACTIONrequirements.Specification 3.0.3 establishes the shutdown ACTION requirements that must be implementedwhen a Limiting Condition for Operation is not met and the condition is not specificallyaddressed by the associated ACTION requirements. The purpose of thlis specification is to delineate the time limits for placing the unit in a safe operation defined by the LimitingConditions for Operation and its ACTION requirements. It is not intended to be used as anoperational convenience which permits (routing) voluntary removal of .redundant systems orcomponents from service in lieu of other alternatives that would not result in redundant systemsor components being inoperable. This time permits the operator to coordinate the reduction inelectrical generation with the load dispatcher to ensure the stability and availability of theelectrical grid. The time limits specified to reach lower MODES of operation permit the shutdownto proceed in a controlled and orderly manner that is well within the specified maximumcooldown rate and within the cooldown capa~bilities of the facility assuming only the minimumrequired equipment is OPERABLE. This reduces thermal stresses on components of the primarYcoolant system and the potential for a plant upset that could challenge safety systems underconditions for which this specification applies.If remedial measure permitting limited continued operation of the facility under the provisions ofthe ACTION requirements are completed, the shutdown may be terminated. The time limits ofthe ACTION requirements are applicable from the point in time it is identified that a LimitingCondition for Operation is not met. Therefore, the shutdown may be terminated if the ACT[ONrequirements have been met or the time limits of the ACTION requirements have not expired,thus providing an allowance for the completion of the required ACTIONS.0 "MILLSTONE -UNIT 2 B 3/4 0-2 Amendment Nos. 6-2, 4-5--,Acknowledged by NRC letter dated 6/28/05 February 26, 1991APPLICABILITYBASES (Con't)The time limits of Specification 3.0.3 allow 37 hours for the plant to be in the COLDSHUTDOWN MODE when a shutdown is required duiing the POWER MODE of operation. Ifthe plant is in a lower MODE of operation when a shutdown is required, the time limit forreaching the next lower MODE of operation applies. However, if a lower MODSE of operation isreached in less time than allowed, the total allowance time to reach COLD SHUTDOWN, orother applicable MODE, is not reduced. For example, if HOT STANDBY is reached in 2 hours,the time allowed to reach HOT SHUTDOWN is the next 11 hours because the total time to reachHOT SHUTDOWN is not reduced from the allowable limit of 13 hours. Therefore, if remedialmeasures are completed that would permit a return to POWER operation, a penalty is not incurredby having to reach a lower MODE of operation in less than the total time allowed.The same principle applies with regard to the allowable outage time limits of the ACTIONrequirements, if compliance with the ACTION requirements for one specification results in entlyinto a MODE or condition of operation for another specification in which the requirements of theLimiting Condition for Operation are not met. If the new specification becomes applicable in lesstime than specified, the difference may be added to the allowable outage time limits of the secondspecification. However, the allowable outage time limits of ACTION requirements for a higherMODE of operation may not be used to extend the allowable outage time that is applicable whena Limiting Condition for 'Operation is not met in a lower MODE of operation.The shutdown requirements of Specification 3.0.3 do not apply in MODES 5 and 6, because theACTION requirements of individual specifications define the remedial measures to be taken.Specification 3.0.4 establishes limitations on MODE changes when a Limiting Condition forOperation is not met. It precludes placing the facility in a higher MODE of operation when therequirements for a Limiting Condition for Operation are not met and continued noncompliance tothese conditions would result in a shutdown to comply with the ACTION requirements if achange in MODES were permitted. The purpose of this specification is to ensure that facilityoperation is not initiated or that higher MODES of operation are not entered wheni correctiveaction is being traken to obtain compliance with a specification by restoring equipment toOPERABLE status or parameters to specified limits. Compliance with ACTION requirementsthat permit continued operation of the facility for an unlimited period of time provides anacceptable level of safety for continued operation without regard to the status of the plant before.or after a MODE change. Therefore, in this case, entry into an OPERATIONAL MODE or otherspecified condition may be made in accordance 'with the provision of the ACTION requirements.The provisions of this specification should not, however, be interpreted as endorsing the failure toexercise good practice in restoring systems or components to OPERABLE status before plantstartup.MILLSTONE -UNIT 2B 3/4 0-3MILLTON -NIT2 B3/40-3Amendment Nos. 62, 15 l LBDCR 04-MP2-016February 24, 2005APPLICABILITYBASES (Con't) 0 :When a shutdown is required to comply with ACTION requirements, the provisions ofSpecification 3.0.4 do not apply because they would delay placing the facility in a lower MODEof operation.Specification 3.0.5 delineates what additional conditions must be satisfied to permit operation tocontinue, consistent with the ACTION statements for power sources, when a normal oremergency power source in not OPERABLE. It specifically prohibits operation when onedivision is inoperable because its normal or emergency power source is inoperable and a system,subsystem, train, component or device in another division is inoperable for another reason.The provisions of this specification permit the ACTION statements associated withindividual systems, subsystems, trains, components, or devices to be consistent with the ACTIONstatements of the associated electrical power source. It allows operation to be governed by thetime limits of the ACTION statement associated with the Limiting Condition for Operation forthe normal or emergency power source, not the individual ACTION statements for each system,subsystem, train, component or device that is determined to be inoperable solely because of theinoperability of its normal emergency power source.For example, Specification 3.8.1.1 requires in part that two emergency diesel generators be OPERABLE. The ACTION statement provides for a 72-hour out-of-service time when oneemergency diesel generator is not OPERABLE. If the definition of OPERABLE were appliedwithout consideration of Specification 3.0.5, all systems, subsystems, trains, components anddevices supplied by the inoperable emergency power source would also be inoperable. Thiswould dictate invoking the applicable ACTION statement for each of the applicable LimitingConditions for Operation. However, the provisions of Specification 3.0.5 permit the time limitsfor continued operation to be consistent with the ACTION statement for the inoperableemergency diesel generator instead, provided the other specified conditions are satisfied. In thiscase, this would mean that the corresponding normal power source must be OPERABLE, and allredundant systems, subsystems, trains, components, and devices must be OPERABLE, orotherwise satisfy.Specification 3.0.5 (i.e., be capable of performing their design function and haveat least one normal or one emergency power source OPERABLE). If they, are not satisfied,ACTION is required in accordance with this specification.As a further example, Specification 3.8.1.1 requires in part that two physicallyindependent circuits between the offsite transmission network and the onsite Class 1 E distributionsystem be OPERABLE. The ACTION statement provides a 24-hour out-of-service time whenboth required offsite circuits are not OPERABLE. If the definition of OPERABLE were appliedwithout consideration of Specification 3.0.5, all systems, subsystems, trains, components anddevices supplied by the inoperable normal power sources, both of the offsite circuits, would alsobe inoperable. This would dictate invoking the applicable ACTION statements for each of theapplicable LCOs. However, the provisions of Specification 3.0.5 permit the time limits forcontinued operation toVMILLSTONE -UNIT 2 B 3/4 0-4 Amendment Nos. 7:4, 4-54-,Acknowledged by NRC letter dated 6/28/05 LB DCR 04-MP2-016February 24, 2005BASES (Can't)be consistent with the ACTION statement for the inoperable normal power sources instead,provided the other specified conditions are satisfied. In this case, this would mean that for onedivision the emergency power source must be OPERABLE (as must be the components suppliedby the emergency power source) and all redundant systemas, subsystems, trains, components anddevices in the other divisions must be OPERABLE, or likewise satisfy Specification 3.0.5 (i.e., belcapable of performing their design functions and have an emergency power source OPERABLE).In other words, both emergency power sources must be OPERABLE and all redundant systems,subsystems, trains, components and devices in both divisions must also be OPERABLE. If theseconditions are not satisfied, ACTION is required in accordance with this specification.In MODES 5 and 6 Specification 3.0.5 is not applicable, and thus 'the individual ACTIONstatements for each applicable Limiting Condition for Operation in these MODES must beadhered to.Specification 3.0.6 establishes the allowance for restoring equipment to service underadministrative controls when it has been removed from service or declared inoperable to complywith ACTIONS. The sole purpose of this Specification is to' provide an exception to LCO 3.0.2(e.g., to not comply with the applicable Required ACTION(s)) to allow the performance ofsurveillance requirements to demonstrate:a. The OPERABILITY of the equipment being returned to service; orb. The OPERABILITY of other equipment.The administrative controls ensure the time the equipment is returned to service in conflict withthe requirements of the ACTIONS is limited to the time absolutely necessary to perform theallo~ved surveillance requirements. The Specification does not provide time to perform any otherpreventive or corrective maintenance.An example of demonstrating the OPERABILITY of equipment being returned to service isreopening a containment isolation valve that has been closed to comply with the RequiredACTIONS andTnust be reopened to perform the surveillance requirements.An example of demonstrating the OPERABILITY of other equipment is taking an inoperablechannel or trip system out of the tripped condition to prevent the trip function from occurringduring the performance of a surveillance requirement on another channel in the other trip system.A similar example of demonstrating the OPERABILITY of other equipment is taking an-inoperable channel or trip system out of the tripped condition to permit the logic to function andindicate the appropriate response during the performance of a surveillance requirement on anotherchannel in the same trip system.MILLSTONE -UNIT 2 B 3/4 0-5 Amendment No. 4-54, 4-52, 30,Acknowledged by NRC letter dated 6/28/05 October 15, 2002BASES (Con't).9OSpecification 4.0.1l through 4.0.5 establish the general requirements applicable to SurveillanceRequirements. These requirements are based on the Surveillance Requirements stated in theCode of Federal Regulations, 10OCFR50.3 6(c)(3):"Surveillance requirements are requirements relating to test, calibration, or inspection toensure that the necessary quality of systems and components is maintained, that facility operationwill be within safety limits, and that the limiting conditions of operation will be met.".Specification 4.0.1 establishes the requirement that surveillances must be met during theOPERATIONAL MODES or other conditions for which the requirements of the LimitingConditions for Operation apply unless otherwise stated in an individual SurveillanceRequirements. The purpose of this specification is to ensure that surveillances are performed toverify the OPERABILITY of systems and components and that parameters are within specifiedlimits to ensure safe operation of the facility when the plant is in a MODE or other specifiedcondition for which the associated Limiting Conditions for Operation are applicable. Failure tomeet a Surveillance within the specified surveillance interval, in accordance with Specification4.0.2 constitutes a. failure to meet a Limiting Condition for Operation.Systems and components are assumed to be OPERABLE when the associated SurveillanceRequirements have been met. Nothing in this Specification, however, is to be construed asimplying that systems or components are OPERABLE when either:a. The system or components are known to be inoperable, although still meeting theSurveillance Requirements or 9.b. The requirements of the Surveillance(s) are known to be not met between requiredSurveillance performances.Surveillance Requirements do not have to be performaed when the facility is in an OperationalMode or other specified conditions for which the requirements of the associated LimitingCondition for Operation do not apply unless otherwise specified. The Surveillance Requirementsassociated with a Special Test Exception are only applicable when the Special Test Exception isused as an allowable exception to the requirements of a specification.Unplanned events may satisfy the requirements (including applicable acceptance criteria) for agiven Surveillaiice Requirement. In this case, the unplanned event may be credited as fulfillingthe performance of the Surveillance Requirement. This allowance includes those SurveillanceRequirements whose performance is normally precluded in a given Mode or other specifiedcondition.Surveillance Requirements, including Surveillances invoked by ACTION requirements, do nothave to be performed on inoperable equipment because the ACTIONS define the remedialmeasures that apply. Surveillances have to be met and performed in accordance with Specification4.0.2, prior to returning equipment to Operable status.Upon completion of maintenance, appropriate post maintenance testing is required to declareequipment OPERABLE. This includes ensuring applicable Surveillances are not failed and theirmost recent performance is in accordance with Specification 4.0.2. Post maintenance testing maynot beMILLSTONE -UNIT 2B 3/4 0-5aAmendment No. 30, 271 LBDCR No. 04-MP2-016February 24, 2005BASES (Can't)possible in the current MODE or other specified conditions in the Applicability due to thenecessary unit parameters not having been established. In these situations, the equipment may beconsidered OPERABLE provided testing has been satisfactorily completed to the extent possibleand the equipment is not otherwise believed to be incapable of performing its function. This willallow operation to proceed to a MODE or other specified condition where other necessary postmaintenance tests can be completed. -..Some examples of this process are:a. Auxiliary feedwater (AFW) pump turbine maintenance during refueling thatrequires testing at steam pressure > 800 psi. However, if other appropriate testing.is satisfactorily completed, the AFW System can be considered OPERABLE. Thisallows startup and other necessary testing to proceed until the plant reaches the..steam pressure required to perform the testing.b. High pressure safety injection (HPSI) maintenance during shutdown that requiressystem functional tests at a specified pressure. Provided other appropriate testing issatisfactorily completed, startup can proceed with HPSI considered OPERABLE.This allows operation to reach the specified pressure to complete the necessary"post maintenance testing.Specification 4.0.2 This specification establishes the limit for which the specified time interval forSurveillance Requirements may be extended. It permits an allowable extension of the formal.surveillance interval to facilitate surveillance scheduling and consideration of plant operatingconditions that may not be suitable for conducting the surveillance; e.g., transient conditions or .other ongoing surveillance or maintenance activities. It also provides flexibility to accommodatethe length of a fuel cycle for surveillances that are performed at each refueling outage and arespecified with an 18-month surveillance interval. It is not intended that this provision be usedrepeatedly as a convenience to extend surveillance intervals beyond that specified forsurveillances that are not performed during refueling outages. The limitation of Specification4.0.2 is based on engineering judgment and the recognition that the most probable result of anyparticular surveillance being performed is the verification of conformance with the Surveillance;Requirements. This provision is sufficient to ensure that the reliability ensured throughsurveillance activities is not significantly degraded beyond that obtained from the specified.surveillance interval.Specification 4.0.3 establishes the flexibility to defer declaring affected equipment inoperable oran affected variable outside the specified limits when a Surveillance has not been completedwithin the specified surveillance interval. A delay period of up to 24 hours or up to the limit of thespecified siurveillance interval, whichever is greater, applies from the point in time that it isdiscovered that the Surveillance has not been performed in accordance with Specification 4.0.2,and not at the time that the specified surveillance interval was not met.This delay period provides adequate time to complete Surveillances that have been missed. Thisdelay period permits the completion of a Surveillance before complying with ACTIONrequirements or other remedial measures that mnight preclude completion of the Surveillance.MILLSTONE -UNIT 2 B 3/4 0-Sb Amendment No. 23-0, 2-7-1-,Acknowledged by NRC letter dated 6/28/05 LBDCR 04-MP2-016February 24, 2005BASES (Con't)0:The basis for this delay period includes consideration of unit conditions, adequate planning,availability of personnel, the time required to perform the Surveillance, the safety significance ofthe delay in completing the required Surveillance, and the recognition that the most probableresult of any particular Surveillance being performed is the verification of conformance with therequirements.When a Surveillance. with a surveillance interval based not on time intervals, but upon specifiedunit conditions, operating situations, or requirements of regulations, (e.g., prioft0 enteringMODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified byapproved exemptions, etc.) is discovered to not have been performed when specified,Specification 4.0.3 allows for the full delay period of up to the specified surveillance interval toperform the Surveillance. However, since there is not a time interval specified, the missedSurveillance should be performed at the first reasonable opportunity.Specification 4.0.3 provides a time limit for, and allowances for the performance of, Surveillancesthat become applicable as a consequence of MODE changes imposed by ACTION requirements.Failure to comply with specified surveillance intervals for the Surveillance Requirements isexpected to be an infrequent occurrence. Use of the delay period established by Specification4.0.3 is a flexibility which is not intended to be used as an operational convenience to extendSurveillance intervals. While up to 24 hours or the limit of the specified surveillance interval isprovided to perform the missed Surveillance, it is expected that the missed Surveillance will beperformed at the first reasonable opportunity. The determination of the first reasonableopportunity should include consideration of the impact on plant risk (from delaying theSurveillance as well as any plant configuration changes required or shutting the plant down to d :perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, *planning, availability of personnel, and the time required to perform the Surveillance. This riskimpact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and itsimplementation guidance, NRC Regulatory Guide 1. 182, "Assessing and Managing Risk BeforeMaintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses consideration*of temporary and aggregate risk impacts, determination of risk management action thresholds,and risk management action up to and including plant shutdown. The missed Surveillance shouldbe treated as an emergent cofidition as discussed in the Regulatory Guide. The risk evaluationmay use quantitative, qualitative, or blended methods. The degree of depth and rigor of theevaluation should be commensurate with the importance of the component. Missed Surveillancesfor important components should be analyzed quantitatively. If the results of the risk evaluationdetermine the risk increase is significant, this evaluation should be used to determine the safestcourse of action- All missed Surveillances will be placed in the licensee's Corrective ActionProgram.If a Surveillance is not completed within the allowed delay period, then the equipment isconsidered inoperable or the variable is considered outside the specified limits and the entry intothe ACTION requirements for the applicable Limiting Condition for Operation beginsimmediately upon expiration of the delay period. If a Surveillance is failed within the delayperiod, then the equipment is inoperable, or the variable is outside the specified limits and entryinto the ACTION requirements for the applicable Limiting Condition for Operation beginsimmediately upon the failure of the Surveillance.Completion of the Surveillance within the delay period allowed by this Specification, or withinthe Allowed Outage Time of the applicable ACTIONS, restores compliance with Specification4.0. l. 0:MILLSTONE -UNIT 2 B 3/4 0 -6 Amendment No. 2-7-1-,Acknowledged by NRC letter dated 6/28/05 -June 19, 2007LBDCR 07-MP2-0143/4.0 APPLICABILITYBASES (Con't)Specification 4.0.4 establishes the requirement that all applicable surveillances must be metbefore entr}, into and OPERATIONAL MODE or other condition of operation specified in theApplicability statement. The purpose of this specification is to ensure that system and componentOPERABILITY requirements or parameter limits are met before entry into a MODE or conditionfor which these systems and components ensure safe operation of the facility. This provisionapplies to changes in OPERATIONAL MODES or other specified conditions associated withplant shutdown as well as startup.Under the provisions of this specification, the applicable Surveillance Requirements must beperformed within the specified surveillance interval to ensure that the Limiting Conditions forOperation are met during initial plant startup or following a plant outage.When a shutdown is required to comply with ACTION requirements, the provisions ofSpecification 4.0.4 do not apply because this would delay placing the facility in a lower MODE ofoperation.Specification 4.0.5 establishes the requirement that inservice testing of ASME Code Class 1, 2,and 3 pumps and valves shall be performed in accordance with a periodically updated version ofthe ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OM Code) andapplicable Addenda as required by 10 CFR 50.55a(f). These requirements apply except whenrelief has been provided in writing by the Commission.This specification includes a clarification of the frequencies for performing the inservice testingactivities required by the ASME OM Code and applicable Addenda. This clarification isprovided to ensure consistency in surveillance intervals throughout the Technical Specificationsand to remove any ambiguities relative to the frequencies for performing the required inservicetesting activities.Under the terms of this specification, the more restrictive requirements of the TechnicalSpecifications take precedence over the ASME OM Code and applicable Addenda. Therequirements of Specification 4.0.4 to perform surveillance activities before entry into anOPERATIONAL MODE or other specified condition takes precedence over the ASME OM Codeprovision which allows pumps and valves to be tested up to one week after return to normaloperation.MILLSTONE -UNIT 2B3/0-AmnetNo---IB 3/4 0-7Amendment No. 4-54 REVERSE OF PAGE B 3/4 0-7INTENTI.ONALLY LEFT BLANK September 25, 20033/4.1 REACTIVITY CONTROL SYSTEMSBASES3/4.1.1 REACTIVITY CONTROL SYSTEMS3/4.1.1.1 SHUTDOWN MARGINA sufficient SHUTDOWN MARGIN ensures that 1) the reactor can be made subcritical from alloperating conditions, 2) the reactivity transients associated with postulated accident conditionsare controllable within acceptable limits, and 3) the reactor will be maintained sufficientlysubcritical to preclude inadvertent criticality in the shutdown condition.SHUTDOWN MARGIN requirements vary throughout core life as a function of fuel depletion,RCS boron concentration, and RCS Tavg The most restrictive conditiori occurs at EOL, with Tavat no load operating temperature, and is associated with a postulated steam line break accident andresulting uncontrolled RCS cooldown. In the analysis of this accident, the minimumSHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT is initiallyrequired to control the reactivity transient. Accordingly, the SHUTDOWN MARGIN required bySpecification 3.1.1.1 is based upon this limiting condition and is consistent with FSAR accidentanalysis assumptions. For earlier periods during the fuel cycle, this value is conservative. TheSHUTDOWN MARGIN is verified by performing a reactivity balance calculation, consideringthe listed reactivity effects:a. RCS boron concentration;b. CEA positions;c. RCS average temperature;d. Fuel burnup based on gross thermal energy generation;e. Xenon concentration;f. Samarium concentration; andg. Isothermal temperature coefficient (ITC).Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcriticaland the fuel temperature will be changing at the same rate as the RCS temperature.3/4.1.1.2 REACTIVITY BALANCEReactivity balance is used as a measure of the predicted versus measured core reactivity duringpower operation. The periodic confirmation of core reactivity is necessary to ensure that DesignBasis Accident (DBA) and transient safety analyses remain valid. A large reactivity differencecould be the result of unanticipated changes in fuel, control element assembly (CEA) worth, oroperation at conditions not consistent with those assumed in the predictions of core reactivity, andcould potentially result in a loss of SHUTDOWN MARGIN (SDM) or violation of acceptablefuel design limits. Comparing predicted versus measured core reactivity validates the nuclearmethods used in the safety analy sis and supports the SDM demonstrations (LCO 3.1.1.1,"SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought safely to cold,subcritical conditions.The normalization of predicted RCS boron concentration to the measured value is typicallyperformed after reaching RATED THERMAL POWER following startup from a refuelingoutage, with the CEAs in their normal positions for power operation. The normalization isperformed at BOC conditions, so that coreMILLSTONE -UNIT 2B3/4 1-1MILLTON -NIT2 B3/41-1Amendment No. 39, 4-48, 8-, 280 September 9, 20043/4.1 REACTIVITY CONTROL SYSTEMSBASES3/4.1.1 REACTIVITY CONTROL SYSTEMS (Continued)3/4.1.1.2 REACTIVITY BALANCE (Continued)reactivity relative to predicted values can be continually monitored and evaluated as coreconditions change during the cycle.When measured core reactivity is within +1% Ak/k of the predicted value at steady state thermalconditions, the core is considered to be operating within acceptable design limits.The limits on core reactivity must be maintained during MODES 1 and 2 because a reactivitybalance must exist when the reactor is critical or producing THERMAL POWER. ThisSpecification does not apply in MODES 3 ,4 and 5 because the reactor is shut down and thereactivity balance is not changing.In MODE 6, fuel loading results in a continually changing core reactivity. Boron concentrationrequirements (LCO 3.9.1, "Boron Concentration") ensure that fuel movements are performedwithin the bounds of the safety analysis.3/4.1.1.3 BORON DILUTIONA minimum flow rate of at least 1000 GPM provides adequate mixing, prevents stratification andensures that reactivity changes will be gradual during reductions in Reactor Coolant Systemboron concentration. The 1000 GPM limit is the minimum required shutdown cooling flow tosatisfy the boron dilution accident analysis. This 1000 GPM flow is an analytical limit. Plantoperating procedures maintain the minimum shutdown cooling flow at a higher value toaccommodate flow measurement uncertainties. While the plant is operating in reduced inventoryoperations, plant operating procedures also specify an upper flow limit to prevent vortexing in theshutdown cooling system. A flow rate of at least 1000 GPM will circulate the full ReactorCoolant System volume in approximately 90 minutes. With the RCS in mid-loop operation, theReactor Coolant System volume will circulate in approximately 25 minutes. The reactivitychange rate associated with reductions in Reactor Coolant System boron concentration will bewithin the capability for operator recognition and control.A maximum of two charging pumps capable of injecting into the RCS when RCS cold legtemperature is < 300°F ensures that the maximum inadvertent dilution flow rate assumed in theboron dilution analysis is not exceeded.MILLSTONE -UNIT 2 B 3/4 1-la Amendment No. 4-39, 4.4&, 8-5, 2,80,283 LBDCR 09-MP2-017September 15, 2009REACTIVITY CONTROL SYSTEMSBASES3/4.1.1.3 BORON DILUTION (Continued~)A charging pump can be considered to be not capable of injecting into the RCS by use of any ofthe following methods and the appropriate administrative controls.1. Placing the motor circuit breaker in the open position.2. Removing the charging pump motor overload heaters from the charging pump circuit.3. Removing the charging pump motor controller from the motor control center.4. Placing a charging pump control switch in the Pull-To-Lock (PTL) position.3/4.1.1.4 MODERATOR TEMPERATURE COEFFICIENT (MTC)The limitations on MTC are provided to ensure that the assumptions used in the accident andtransient analyses remain valid through each fuel cycle. The surveillance requirements formeasurement of the MTC during each fuel cycle are adequate to confirm the MTC value sincethis coefficient changes slowly due principally to the reduction in RCS boron concentrationassociated with fuel burnup. The confirmation that the measured MTC value is within its limitprovides assurance that the coefficient will be maintained within acceptable values throughouteach fuel cycle.3/4.1.1.5 MINIMUM TEMPERATURE FOR CRITICALITYThe MTC is expected to be slightly negative at operating conditions. However, at thebeginning of the fuel cycle, the MTC may be slightly positive at operating conditions and since itwill become more positive at lower temperatures, this specification is provided to restrict reactoroperation when Tav is significantly below the normal operating temperature..3/4.1.2 DELETED3/4.1.3 MOVEABLE CONTROL ASSEMBLIESThe specifications of this section ensure that (1) acceptable power distribution limits aremaintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effectsof a CEA ejection accident are limited to acceptable levels.The ACTION statements which permit limited variations from the basic requirements areaccompanied by additional restrictions which ensure that the original criteria are met.MILLSTONE -UNIT 2 B 3/4 1-2 Amendment No. -3~, 3g, 3-39, 4&,2N-l-, 28-, Page B 3/4 1-3 has been removed from Technical Specifications September 25, 2003BASES3/4.1.3 MOVEABLE CONTROL ASSEMBLIES (Continued)A CEBA may become misaligned, yet remain trippable. In this condition, the CEA can stillperform its required function of adding negative reactivity should a reactor trip be necessary. Ifone or more CEAs (regulating or shutdown) are misaligned by > 10 steps and < 20 steps buttrippable, or one CEA is misaligned by >20 steps but trippable, continued operation in MODES 1and 2 may continue, provided, within 1 hour, the power is reduced to < 70% RATED THERMALPOWER, and within 2 hours CEA alignment is restored. If negative reactivity insertion isrequired to reduce THERMAL POWER, boration shall be used. Regulating CEA alignment canbe restored by either aligning the misaligned CEA(s) to within 10 steps of all other CEAs in itsgroup or aligning the misaligned CEA's group to within 10 steps of the misaligned CIBA. ARegulating CEA is considered fully inserted when either the Dropped Rod indication or lowerElectrical Limit indication lights on the core mimic display are illuminated. A Regulating CEA isconsidered to be fully withdrawn when withdrawn > 176 steps. Shutdown CIBA alignment canonly be restored by aligning the misaligned CIBA(s) to within 10 steps of its group.Xenon redistribution in the core starts to occur as soon as a CIBA becomes misaligned. ReducingTHERMAL POWER ensures acceptable power distributions are maintained. For smallmisalignments (< 20 steps) of the CEAs, there is:a. A small effect on the time dependent long term power distributions relative tothose used in generating LCOs and limiting safety system settings (LSSS)set-points;b. A negligible effect on the available SHUTDOWN MARGIN; andc. A small effect on the ejected CIBA worth used in the accident analysis.With a large CIBA misalignment ( > 20 steps), however, this misalignment would cause distortionof the core power distribution. This distortion may, in turn, have a significant effect on the timedependent, long term power distributions relative to those used in generating LCOs and LSSSsetpoints. The effect on the available SHUTDOWIN MARGIN and the ejected CEA worth usedin the accident analysis remain small. Therefore, this condition is limited to a single CEBAmisalignment, while still allowing 2 hours for recovery.In both cases, a 2 hour time period is sufficient to:a. Identifyr cause of a misaligned CIBA;b. Take appropriate corrective action to realign the CEAs; andc. Minimize the effects of xenon redistribution.If a CIBA is untrippable, it is not available for reactivity insertion during a reactor trip. With anuntrippable CIBA, meeting the insertion limits of LCO 3.1.3.5 and LCO 3.1.3.6 does not ensurethat adequate SHUTDOWN MARGIN exists. With one or more CIBAs untrippable the plant istransitioned to MODE 3 within 6 hours.MILLSTONE -UNIT 2B 3/4 1-4MILLTONE- UNT 2 3/41-4Amendment No. 3-8, 4-t-9,280 LBDCR 14-MP2-016September 4, 2014BASES3/4.1.3 MOVEABLE CONTROL ASSEMBLIES (Continued),The CEA motion inhibit permits CEA motion within the requirements. of LCO 3.1.3.6,"Regulating Control Element Assembly (CEA) Insertion Limits," and the CEA deviation circuitprevents regulating CEAs from being misaligned from other CEAs in the group. With the CEAmotion inhibit inoperable, a time of 6 hours is allowed for restoring the CEA motion inhibit toOPERABLE status, or placing and maintaining the CEA drive switch in either the "off' or"manual" position, fully withdrawing all CEAs in group 7 to < 5% insertion. Placing the CEAdrive switch in the "off' or "manual" position ensures the CEAs will not move in response toReactor Regulating System automatic motion commands. Withdrawal of the CEAs to thepositions required in the Required ACTION B.2 ensures that core perturbations in local bumup,peaking factors, and SHUTDOWN MARGIN will not be more adverse than the Conditionsassumed in the safety analyses and LCO setpoint determination. Required ACTION B.2 ismodified by a Note indicating that performing this Required ACTION is not required when inconflict with Required ACTIONS A.1 or C. 1.Continued operation is not allowed in the case of more than one CEA misaligned fromany other CEA in its group by >20 steps, or one or more CEAs untr-ippable. This is because thesecases are indicative of a loss of SHUTDOWN MARGIN and power distribution changes, and aloss of safety function, respectively.OPERABILITY of the CEA position indicators (Specification 3.1.3.3) is required todetermine CEA positions and thereby ensure compliance with the CEA alignmaent and insertionlimits and ensures proper operation of the CEA Motion Inhibit and CEA deviation block circuit.The CEA "Full In" and "Full Out" limit Position Indicator channels provide an additionalindependent means for determining the CEA positions when the CEAs are at either their fullyinserted or fully withdrawn positions. Therefore, the ACTION statements applicable toinoperable CEA position indicators permit continued operations when the positions of CEAs withinoperable position indicators can be verified by the "Full In" or "Full Out" limit PositionIndicator channels.CEA positions and OPERABILITY of the CEA position indicators are required to beverified at the frequency specified in the Surveillance Frequency Control Program with morefrequent verifications required if ani automatic monitoring channel is inoperable. The surveillancefrequency is controlled under the Surveillance Frequency Control Program.The maximum CEA drop time permitted by Specification 3.1.3.4 is the assumed CEAdrop time used in the accident analyses. Measurement with Tavg > 51 5°F and with all reactorcoolant pumps operating ensures that the measured drop times will be representative of insertiontimes experienced during a reactor trip at operating conditions.MILLSTONE -UNIT 2 B 3/4 1-4a Amendment No. -t-33, 24-6, 29-g, September 25, 2003REACTIVITY CONTROL SYSTEMSBASES3/4.1.3 MOVEABLE CONTROL ASSEMBLIES (Continued)The LSSS setpoints and the power distribution LCOs were generated based upon a coreburnup which would be achieved with the core operating in an essentially unroddedconfiguration. Therefore, the CEA insertion limit specifications require that during MODES 1and 2, the CEAs be nearly fully withdrawn. The amount of CEA insertion permitted by the LongTerm Steady State Insertion Limits of Specification 3.1.3.6 will not hav~e a significant effect uponthe unrodded burnup assumption but will still provide sufficient reactivity control. The TransientInsertion Limits of Specification 3.1.3.6 are provided to ensure that (1) acceptable powerdistribution limits are maintained, (2) the minimum SHUTDOWN MARGIN is maintained, and(3) the potential effects of a CEA ejection accident are limited to acceptable levels; however, longterm operation at these insertion limits could have adverse effects on core power distributionduring subsequent operation in an unrodded configuration. The PDIL alarm, CEA Motion Inhibitand CEA deviation circuit are provided by the CEAPDS computer.The control rod drive mechanism requirement of specification 3.1.3.7 is provided toassure that the consequences of an uncontrolled CEA withdrawal from subcritical transient willstay within acceptable levels. This specification assures that reactor coolant system conditionsexist which are consistent with the plant safety analysis prior to energizing the control rod drivemechanisms. The accident is precluded when conditions exist which are inconsistent with thesafety analysis since deenergized drive-mechanisms cannot withdraw a CEA. The drivemechanisms may be energized with the boron concentration greater than or equal to the refuelingconcentration since, under these conditions, adequate SHUTDOWN MARGIN is maintained,even if all CEAs are fully withdrawn from the core.MILLSTONE -UNIT 2B 3/4 1-5MILLTONE- UNT 2 3/41-5Amendment No. 3-&, 446, 24-6, 280 REVERSE OF PAGE B 3/4 1-5INTENTIONALLY LEFT BLANK LBDCR 04-MP2-016February 24, 20053/4.2 POWER DISTRIBUTION LIMvITSBASES3/4.2.1 LINEAR HEAT RATEThe limitation on linear heat rate ensures that in the event of a LOCA, the peaktemperature of the fuel cladding will not exceed 2200°F.Either of the two core power distribution monitoring systems, the Excore DetectorMonitoring System and the Incore Detector Monitoring System, provide adequate monitoring ofthe core power distribution and are capable of verifying that the linear heat rate does not exceedits limits. The Excore Detector Monitoring System perfonus this function by continuouslymonitoring the AXIAL SHAPE INDEX with two OPERABLE excore neutron flux detectors andverifying that the AXIAL SHAPE INDEX is maintained within the allowable limits specified inthe CORE OPERATING LIMITS REPORT using the Power Ratio Recorder. The power[dependent limits of the Power Ratio Recorder are less than or equal to the limits specified in theCORE OPERATING LIMITS REPORT. In conjunction with the use of the excore monitoring [system and in establishing the AXIAL SHAPE INDEX limits, the following assumptions aremade: 1) the CEA insertion limits of Specifications 3.1.3.5 arid 3.1.3.6 are satisfied, 2) theAZIIMUTHAL POWER TILT restrictions of Specification 3.2.4 are satisfied, and 3) the TOTALTINRODDED INTEGRATED RADIAL PEAKING FACTOR does not exceed the limits ofSpecification 3.2.3.The Incore Detector Monitoring System continuously provides a direct measure of thepeaking factors and the alarms which have been established for the individual incore detectorsegments ensure that the peak linear heat rates will be maintained within the allowable limitsspecified in the CORE OPERATING LIMITS REPORT. The setpoints for these alarms includeallowances, set in the conservative direction. The Incore Detector Monitoring System is not usedto monitor linear heat rate below 20% of RATED THERMAL POWER.. The accuracy of theneutron flux infonnation from the incore detectors is not reliable at THERMAL POWER < 20%RATED THERMAL POWER.3/4.2.3 ANT) 3/4.2.4 TOTAL UNIRODDED INTEGRATED RADIAL PEAKING FACTORS FTrANT) AZIMUTHAL POWER TILT -T~qThe limitations on Far and Tq are provided to 1) ensure that the assumptions used in theanalysis for establishing the Linear Heat Rate and Local power Density -High LCOs and LSSSsetpoints remain valid during operation at the various allowable CEA group insertion limits, and,2) ensure that the assumptions used in the analysis establishing the DNB Margin LCO, andThermal Margin/Low Pressure LSSS setpoints remain valid during operation at thevarious allowable CEA group insertion limits. If F'r or Tq exceed their basic limitations,operation may continue under the additional restrictions imposedMILLSTONE -UNIT 2 B 3/4 2-1 Amendment No. g3g, 5-2,4-2-2,1439, 448, 4-5-5~,-1-94,-2-30,220g,Acknowledged by NRC letter dated 6/28/05 LBDCR 14-MP2-016September 4, 2014POWER DISTRIBUTION LIMITSBASESby the ACTION statements since these additional restrictions provide adequate provisions toassure that the assumptions used in establishing the Linear Heat Rate, Thermal Margin!LowPressure and Local Power Density -High LCOs and LSSS setpoints remain valid. AnAZIMUTHAL POWER TILT > 0.10 is not expected and i~fit should occur, subsequent operationwould be restricted to only those operations required to identify the cause of this unexpected tilt.Core power distribution is a concern any time the reactor is critical. The Total IntegratedRadial Peaking Factor -FTr LCO, however, is only applicable in MODE 1 above 20% of RATEDTHERMAL POWER. The reasons that this LCO is not applicable below 20% of RATEDTHERMAL POWER are:a. Data from the incore detectors are used for determining the measured radialpeaking factors. Technical Specification 3.2.3 is not applicable below 20% ofRATED THERMAL POWER because the accuracy of the neutron fluxinformation from the incore detectors is not reliable at THERMAL POWER< 20% RATED THERMAL POWER.b. When core power is below 20% of RATED THERMAL POWER, the core isoperating well below its th~ermal limits, and the Local Power Density (fuel pellet.melting) and Thermal Margin/Low Pressure (DN-B) trips are highly conservative.The surveillance requirements for verifying that FTr and Tq are within their limits provideassurance that the actual values ofFTr and Tq do not exceed the assumed values. Thesesurveillance frequencies are controlled under the Surveillance Frequency Control Program.Verifying FTr after each fuel loading prior to exceeding 70% of RATED THERMAL POWERprovides additional assurance that the core was properly loaded. '"3/4.2.6 DNB MARGINThe limitations provided in this specification ensure that the assumed margins to DNB aremaintained. The limiting values of the parameters in this specification are those assumed as theinitial conditions in the accident and transient analyses; therefore, operation must be maintainedwithin the specified limits for the accident and transient analyses to remain valid.MILLSTONE -UNIT 2 B 3/4 2-2 Amendment No. , 4-,--22, -3~9, 55,-2--0, O LBDCR 14-MP2-016September 4, 20143/4.3 INSTRUMENTATIONBASES3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES(ESF' INSTRUMENTATIONThe OPERABILITY of the protective and ESF instrumentation systems and bypassesensure that 1) the associated ESF action and/or reactor trip will be initiated when the parametermonitored by each channel or combination thereof exceeds its setpoint, 2) the specifiedcoincidence logic is maintained, 3) sufficient redundancy is maintained to permit a channel to beout of service for testing or maintenance, and 4) sufficient system functional capability isavailable for protective and ESE purposes from diverse parameters.The OPERABILITY of these systems is required to provide the overall reliability,redundance and diversity assumed available in the facility design for the protection and mitigationof accident and transient conditions. The integrated operation of each of these systems isconsistent with the assumptions used in the accident analyses.ACTION Statement 2 of Tables 3.3-1 and 3.3-3 requires an inoperable Reactor ProtectionSystem (RPS) or Engineered Safety Feature Actuation System (ESFAS) channel to be placed inthe bypassed or tripped condition within 1 hour. The inoperable channel may remain in thebypassed condition for a maximum of 48 hours. While in the bypassed condition, the affectedfunctional unit trip coincidence will be 2 out of 3. After 48 hours, the channel must either bedeclared OPERABLE, or placed in the tripped condition. If the channel is placed in the trippedcondition, the affected functional unit trip coincidence will become 1 out of 3. One additionalchannel may be removed from service for up to 48 hours, provided one of the inoperable channesis placed in the tripped condition.Plant operation with an inoperable pressurizer high pressure reactor protection channel inthe tripped condition is restricted because of the potential inadvertent opening of both pressurizerpower operated relief valves (PORVs) if a second pressurizer high pressure reactor protectionchannel failed while the first channel was in the tripped condition. This plant operating restrictionis contained in the Technical Requirements Manual.The reactor trip switchgear consists of eight reactor trip circuit breakers, which areoperated in four sets of two breakers (four channels). Each of the four trip legs consists of tworeactor trip circuit breakers in series. The two reactor trip circuit breakers within a trip leg areactuated by separate initiation circuits. For example, if a breaker receives an open signal in tripleg A, an identical breaker in trip leg B will also receive an open signal. This arrangement ensuresthat power is intenrupted to both Control Element Drive Mechanism buses, thus preventing a tripof only half of the control element assemblies (a half trip). Any one inoperable breaker in achannel will make the entire channel inoperable.The surveillance requirements specified for these systems ensure that the overall systemfunctional capability is maintained comparable to the original design standards. TheseJsurveillance frequencies are controlled under the Surveillance Frequency Control Program.The surveillance testing verifies OPERABILITY of the RPS by overlap testing of the fourinterconnected modules: measurement channels, bistable trip units, RPS logic, and reactor tripcircuit breakers. When testing the measurement channels or bistable trip units that provide anautomatic reactor trip function, the associated RPS channel will be removed from service,MILLSTONE -UNIT 2 B 3/4 3-1 Amendment No.4-67-, 4-1-gg 4-98, 2-2-5, 2-82,Azkncl ...... N.., C lcttDz" 1 at- d 6/28,-f/'05I LBDCR 06-MP2-036October 12, 20063/4.3 INSTRUMENTATIONBASES3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES(ESF) INSTRUMENTATION (continued')declared inoperable, and ACTION Statement 2 of Technical Specification 3.3.1.1 entered. Whentesting the RPS logic (matrix testing), the individual RPS channels will not be affected. Each ofthe parameters within each RPS channel supplies three contacts to make up the 6 different logicladders/matrices (AB, AC, AD, BC, BD, and CD). During matrix testing, only one logic matrix istested at a time. Since each RPS channel supplies 3 different logic ladders, testing one laddermatrix at a time will not remove an RPS channel from the overall logic matrix. Therefore, matrixtesting will not remove an RPS channel from service or make the RPS channel inoperable. It isnot necessary to enter an ACTION Statement for any of the parameters associated with each RPSchannel while performling matrix testing. This also applies when testing the reactor trip circuitbreakers since this test will not remove an RPS channel from service or make the RPS channelinoperable.ACTION Statements for the RP'S logic matrices and RIPS logic matrix relays are required to beentered during matrix testing as these functional units become inoperable when the "HOLD"button is depressed during testing.The RIPS bypasses and their allowable values are addressed in footnotes to Table 3.3-1. They are Inot otherwise addressed as specific table entries.0The RPS automatic bypass removal features must function as a backup to manual actions for allsafety related trips to ensure the trip functions are not operationally bypassed when the safetyanalysis assumes the functions are available.The RPS automatic bypass removal feature of all four operating bypass channels must beOPERABLE for each RIPS function with an operating bypass in the MODES addressed in thespecific LCO for each function. All four bypass removal channels must be OPERABLE to ensurethat none of the four RP'S channels are inadvertently bypassed.ACTION Statements 7 and 8 apply to the RPS bypass removal feature only. If the bypass enablefunction is failed so as to prevent entering a bypass condition, operation may continue.ACTION Statement 7 applies to one automatic bypass removal channel inoperable. If the bypassremoval channel for any operating bypass cannot be restored to OPERABLE status, theassociated RIPS channel may be considered OPERABLE only if the bypass is not in effect.Otherwise, the affected RP'S channel must be declared inoperable, as in ACTION Statement 2,and the bypass either removed or the bypass removal channel repaired. The allowed outage timesare the same as for ACTION Statement 2.MILLSTONIE.-UNIIT2 B 3/4 3-la Amendment No. 2-2--, 3, 245-, 2-82, LBDCR 14-MiP2-016September 4, 20143/4.3 INSTRUMENTATIONBASES3/4.3.1 AND 3/4.3.2 PROTECTIVE ANT) ENGINEERED SAFETY FEATUIRES(ESE) INSTRUMENTATION (continued)ACTION Statement 8 applies to two inoperable automatic bypass removal channels. If the bypassremoval channels cannot be restored to OPERABLE status, the associated RPS channel may beconsidered OPERABLE only if the bypass is not in effect. Otherwise, the affected RPS channelsmust be declared inoperable, and the bypass either removed or the bypass removal channelrepaired. Also, ACTION Statement 8 provides for the restoration of the one affected automatictrip channel to OPERABLE status within the allowed outage time specified under ACTIONStatement 2.ACTION Statements 7 and 8 contain the term "disable the bypass channel." Compliance withACTION Statements 7 or 8 is met by placing or verifying the Zero Mode Bypass Switch(es) in"Off." No further action (i.e., key removal, periodic verification, etc.) is required. These switchesare administratively controlled via station procedures; therefore the requirements of ACTIONStatements 7 and 8 are continuously met.SR 4.3.1.1.2 and SR 4.3 .2.1.2 specify a CHANNEL FUNCTIONAL TEST of the bypass functionand automatic bypass removal once within 92 days prior to each reactor startup. The total bypassfunction shall be demonstrated OPERABLE periodically during CHANNEL CALIBRATIONtesting of each channel affected by bypass operation. The surveillance frequency is controlledunder the Surveillance Frequency Control Program. The CHANNEL FUNCTIONAL TEST issimilar to the CHANNEL FUNCTIONAL TESTS already required by SR 4.3.1.1.1 and SR4.3.2.1.1, except the CHANNEL FUNCTIONAL TEST is applicable only to bypass functionsand is performed once within 92 days prior to each startup. The MPS2 RPS is an analog systemwhile the design of the MIPS2 ESFAS includes both an analog portion and a digital portion. Withrespect to the analog portion of the systems, a successful test of the required contact(s) of achannel relay may be perfonnted by the verification of the change of state of a single contact of therelay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This isacceptable because all of the other required contacts of the relay are verified by other TS tests atleast once per refueling interval with applicable extensions. Proper operation of bypasspermissives is critical during plant startup because the bypasses must be in place to allow startupoperation and must be removed at the appropriate points during power ascent to enable certainreactor trips. Consequently, the appropriate time to verify bypass removal functionOPERABILITY is just prior to start-up. The allowance to conduct this test within 92 days ofstartup is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFASExtended Test Interval Evaluation," which is referenced in NUREG-1432 and is applicable toMIPS2. Once the operating bypasses are removed, the bypasses must not fail in such a way that theassociated trip function gets inadvertently bypassed. This feature is verified by the trip functionCHANNEL FUNCTIONAL TESTS SR 4.3.1.1.1 and SR 4.3.2.1.1. Therefore, further testing ofthe bypass function after startup is unnecessary.MILLSTONE -UNIT 2 B343l mnmn oB 3/4 3-1bAmendment No. LBDCR 14-MIP2-016September 4, 20143/4.3 TINSTRUMENTATIONBASES3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES(ESF) INSTRUMENTATION (continued)The ESFAS includes four sensor subsystems and two actuation subsystems for each of thefunctional units identified in Table 3.3-3. Each sensor subsystem includes measurement channelsand bistable trip units. Each of the four sensor subsystem channels monitors redundant andindependent process measurement channels. Each sensor is monitored by at least one bistable.The bistable associated with each ESFAS Function will trip when the monitored variable exceedsthe trip setpoint. When tripped, the sensor subsystems provide outputs to the two actuationsubsystems.The two independent actuation subsystems each compare the four associated sensor, subsystemoutputs. If a trip occurs in two or more sensor subsystem channels, the two-out-of-four automaticactuation logic will initiate one train of ESFAS. An Automatic Test Inserter (ATI), for which theautomatic actuation logic OPERABILITY requirements of this specification do not apply,provides automatic test capability for both the sensor subsystems and the actuation subsystems.The provisions of Specification 4.0.4 are not applicable for the CI-ANNEL FUNCTIONALTEST of the Engineered Safety Feature Actuation System automatic actuation logic associatedwith Pressurizer Pressure Safety Injection, Pressurizer Pressure Containment Isolation, SteamGenerator Pressure Main Steam Line Isolation, and Pressurizer Pressure Enclosure BuildingFiltration for entry into MODE 3 or other specified conditions. After entering MODE 3,pressurizer pressure and steam generator pressure will be increased and the blocks of the ESFactuations on low pressurizer pressure and low steam generator pressure will be automaticallyremoved. After the blocks have been removed, the CHANNEL FUNCTIONAL TEST of the ESFautomatic actuation logic can be performed. The CHANNEL FUNCTIONAL TEST of the ESFautomatic actuation logic must be perfonrned within 12 hours after establishing the appropriateplant conditions, and prior to entry into MODE 2.The periodic measurement of response time provides assurance that the protective and ESF actionfunction associated with each channel is completed within the time limit assumed in the accidentanalyses. These surveillance frequencies are controlled under the Surveillance Frequency ControlProgram. No credit was taken in the analyses for those channels with response times indicated asnot applicable. The Reactor Protective and Engineered Safety Feature response times arecontained in the Millstone Unit No. 2 Technical Requirements Manual. Changes to the TechnicalRequirements Manual require a 10OCFR5O.59 review as well as a review by the Site OperationsReview Cormnittee.MILLSTONE -UNIT 2 B343i mnmn oB 3/4 3-1eAmendment No. LBDCR 04-MP2-016February 24, 2005INSTRUMENTATIONBASES3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESF)INSTRUMENTATION (Continued)SRAS LOGIC MODIFICATIONACTION Statement 4 of Table 3.3-3, which applies only to the SRAS logic, specifies thatduring surveillance testing the second inoperable channel must also be placed in the bypassedcondition. For the SRAS logic, placing the second inoperable channel in the tripped condition (asin ACTION Statement 2) could result in the false generation of a SRAS signal due to anadditional failure which causes a trip signal in either of the remaining channels at the onset of aLOCA. The false generation of the SRAS signal leads to unacceptable consequences for LOCAmitigation.With ACTION Statement 4, during the two-hour period when two channels are bypassed,no additional failure can result in the false generation of the SRAS signal. However, an additionalfailure that prevents a trip of either of the two remaining channels may prevent the generation of atrue SRAS signal while in this ACTION Statement. If no SRAS is generated at the appropriatetime, operating procedures instruct the operator to ensure that the SRAS actuation occurs whenthe refueling water storage tank level decreases. Due to the limited period of vulnerability, andthe existence of operator requirements to manually initiate an SPAS if an automatic initiationdoes not occur, this risk is considered acceptable.STEAM GENERATOR BLOWDOWN ISOLATIONAutomatic isolation of steam generator blowdown will occur on low steam generatorwater level. An auxiliary feedwater actuation signal will also be generated at this steam generatorwater level. Isolation of steam generator blowdown will conserve steam generator waterinventory following a loss of main feedwater.SENSOR CABINET POWER SUPPLY AUCTIONEERINGThe auctioneering circuit of the ESFAS sensor cabinets ensures that two sensor cabinetsdo not de-energize upon loss of a D.C. bus, thereby resulting in the false generation of an SRAS.Power source VA-10 provides normal power to sensor cabinet A and backup power to sensorcabinet D. VA-40 provides normal power to sensor cabinet D and backup power to cabinet A.Power sources VA-20 and VA-30 and sensor cabinets B and C are similarly arranged.If the normal or backup power source for an ESFAS Sensor Cabinet is lost, two sensorcabinets would be supplied from the same power source, but would still be operating with nosubsequent trip signals present. However, any additional failure associated with this powersource would result in the loss of the two sensor cabinets, consequently generating a false SPAS.The 48-hour ACTION Statement ensures that the probability of a ACTION Statement and anadditional failure of the remaining power source, while in this ACTION Statement is sufficientlysmall.MILLSTONE -UNIT 2 B 3/4 3-2 Amendment No. 4-5-7, 4-7-9, -226, 5,Acknowledged by NRC letter dated 6128105 LBDCR 09-MP2-013July 7, 2009BASES(Continued)3/4.3.3 MONITORING INSTRUMENTATION3/4.3.3.1 RADIATION MONITORING INSTRUMENTATIONThe OPERABILITY of the radiation monitoring channels ensures that 1) the radiationlevels are continually measured in the areas served by the individual channels and 2) the alarm orautomatic action is initiated when the radiation level trip setpoint is exceeded.The analyses for a Steam Generator Tube Rupture, Waste Gas System Failure, Cask Tipand Fuel Handling Accident credit the control room ventilation inlet duct radiation monitors withclosure of the Unit 2 control room isolation dampers. In the event of a single failure in eitherchannel (1 per train), the control room isolation dampers automatically close. The response timetest for the control room isolation dampers includes signal generation time and damper closure.The response time for the control room isolation dampers is maintained within the applicablefacility surveillance procedure.The containment airborne radiation monitors (gaseous and particulate) provide earlyindication of leakage from the Reactor Coolant System as specified in Technical Specification3.4.6.1.MILLSTONE -UNIT 2B 3/4 3-2aAmendment No. 4-5-7-, 4-7-9, -2~--, 30, 2-28-, 284, LBDCR 14-MP2-016September 4, 2014REACTOR COOLANT SYSTEMBASES3/4.4.3 RELIEF VALVES (Continued)discovered to be inoperable, or if both block valves are discovered to be inoperable at the sametime. In the event of a loss of feedwater, the PORVs would be used to remove core heat. In orderto minimize the consequences of a loss of feedwater while two block valves are inoperable,Required Action e. 1 requires that LCO 3.7.1.2, "Auxiliary Feedwater Pumps," be verified to bemet within 1 hour. The inoperability of two block valves during the 8 hour allowed outage timehas been shown to be acceptable based on the infrequent use of the Required Actions and thesmall incremental effect on plant risk (Ref. 1).SURVEILLANCE REQUIREMENT 4.4.3.1 .C requires operating each PORV through onecomplete cycle of full travel at conditions representative of MODES 3 or 4. This is nonnallyperfonned in MODE 3 or 4 as the unit is descending in power to commence a refueling outage.This test will normally be a static test, whereby a P0RV will be exposed to MODE 3 or 4temperatures, the block valve closed, and the PORV tested to verifyr it strokes through onecomplete cycle of full travel. PORV cycling demonstrates its function. SURVEILLANCEREQUIREMENT 4.4.3.1 .C is consistent with the NRC staff position outlined in Generic Letter90-06, which requires that the PORV stroke test be performed at conditions representative ofMODE 3 or 4. The surveillance frequency is controlled under the Surveillance Frequency ControlProgram. Testing in the manner described is also consistent with the guidance in NI-REG 1482,"Guidelines for Inservice Testing at Nuclear Power Plants," Section 4.2.10, that describes thePORVs function during reactor startup and shutdown to protect the reactor vessel and coolantsystem from low-temperature overpressurization conditions, and indicates they should beexercised before system conditions warrant vessel protection. If post maintenance retest iswarranted, the affected valve(s) will be stroked under amabient conditions while in Mode 5, 6, ordefueled. A Hot Functional Test is required to be performed in MODE 4 prior to entry intoMODE 3. The actual stroke time in the open? and close direction will be measured, recorded andcompared to the test results obtained during pre-installation testing to assess acceptability of theaffected valve(s).SURVEILLANCE REQUIREMENT 4.4.3.2 verifies that a block valve(s) can be closed ifnecessary. This SURVEILLANCE REQUIREMENT is not required to be performed with theblock valve(s) closed in accordance with the ACTIONS of TS 3.4.3. Opening the block valve(s)in this condition increases the risk of an unisolable leak from the RCS since the PORV(s) isalready inoperable.REFERENCE1. WCAP-16 125-NP-A, "Justification for Risk-Infonned Modifications to Selected TechnicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2 B 3/4 4-2b Amendment No. 2a2, 3-7-, 5, 66, 8-,444,1---2-1-, 4-3g, 94 LBDCR 14-MVP2-001May 20, 2014REACTOR COOLANT SYSTEMBASES3/4.4.4 PRESSURIZERAn OPERABLE pressurizer provides pressure control for the reactor coolant systemduring operations with both forced reactor coolant flow and with natural circulation flow. Theminimum water level in the pressurizer assures the pressurizer heaters, which are required toachieve and maintain pressure control, remain covered with water to prevent failure, which occurs*if the heaters are energized uncovered. The maximum water level in the pressurizer ensures thatthis parameter is maintained within the envelope of operation assumed in the safety analysis. Themaxfimum water level also ensures that the RCS is not a hydraulically solid system and that asteam bubble will be provided to accommodate pressure surges during operation. The steambubble also protects the pressurizer code safety valves and power operated relief valve againstwater relief. With pressurizer water level not within the limit, action must be taken to restore theplant to operation within the bounds of the safety analyses. To achieve this status, the unit must bebrought to at least HOT STANDBY with the reactor trip breakers open within 6 hours and inHOT SHUTDOWN within the following 6 hours. This takes the plant out of the applicableMODES and restores the plant to operation within the bounds of the safety analyses. Therequirement that a minimum number of pressurizer heaters be OPERABLE enhances thecapability of the plant to control Reactor Coolant System pressure and establish and maintainnatural circulation.If two required groups of pressurizer heaters are inoperable, restoring at least one group ofpressurizer heaters to OPERABLE status is required within 24 hours. The Condition is modifiedby a Note stating it is not applicable if the second group of required pressurized heaters isintentionally declared inoperable. The Condition is not intended for voluntary removal ofredundant systems or components from service. The Condition is only applicable if one group ofrequired pressurized heaters is inoperable for any reason and the second group of requiredpressurized heaters is discovered to be inoperable, or if both groups of required pressurizedheaters are discovered to be inoperable at the same time. If both required groups of pressurizerheaters are inoperable, the pressurizer heaters may not be available td help maintain subcooling inthe RCS loops during a natural circulation cooldown following a loss of offsite power. Theinoperability of two groups of required pressurizer heaters during the 24 hour allowed outage timehas been shown to be acceptable based on the infrequent use of the Required Action and the smallincremental effect on plant risk (Ref. 1).The requirement for two groups of pressurizer heaters, each having a capacity of 130 kW,is met by verifying the capacity of the pressurizer proporlional heater groups 1 and 2. Since thepressurizer proportional heater groups 1 and 2 are supplied from the emergency 480V electricalbuses, there is reasonable assurance that these heaters can be energized during a loss of off'sitepower to maintain natural circulation at HOT STANDBY.REFERENCE1. WCAP- 161 25-NP-A, "Justification for Risk-Infonrmed Modifications to Selected TechnicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2 B3442 mnmn oB 3/4 4-2cAmendment No. I NSTRUMENTAT IONJuly 13, 1g99BASES3/4.3.3.2 -DELETED3/4.3.3.3 -DELETED3/4.3.3.4 -DELETED3/4.3,3.5 REMOTE SHUTDOWN INSTRUMENTATIONThe OPERABILITY of the remote shutdown instrumentation ensures thatsufficient -capability is available to permit shutdown and maintenance of HOTSHUTDOWN of the facility from locations outside of the control room. Thiscapability is required in the event control room habitability is lost and isconsistent with General Design Criteria 19 of 10 CFR 50.MILLSTONE -UNIT 2e 3/4 3-3MILLTON -NIT2 B3/43-3Amendment N~o XF, 237 November 3, 1995INSTRUMENTATI ONBASES3/4.3.3.6 DELETED3_/4.3.3.7 DELETED3L/4.3.3,8 Accident Monitoring InstrumentationThe OPERABILITY of the accident monitoring instrumentation ensures thatsufficient information is available on selected plant parameters to monitor andassess these variables during and following an accident. This capability isconsistent with the recommnendations of NUREG-0578, "TMI-2 Lessons LearnedTask Force Status Report and Short-Term Reconvnendations".0:IMILLSTONE -UNIT 201 .B 3/4 3-4191 November 28, 2000THIS PAGE INTENTIONALLY LEFT BLANKOMILLSTONE -UNIT 2B 3/4 3-5MILLTON -N~t2 B3/43-5Amendment No. 4-04, 5, 250 LBDCR 04-MP2-0 11December 8, 2005INSTRUMENTATIONBASES3/4.3.3.9 -DELETED3/4.3.3.10 -DELETED3/4.3.4 -DELETEDMILLSTONE- UNIT 2B 3/4 3-6MILSTOE -UXIT B /4 -6Amendment No. 4-04, 24-5, 5, 84, May 1, 20023/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATIONThe plant is designed to operate with both Reactor Coolant System (RCS) loops andassociated reactor coolant pumps (RCPs) in operation, and maintain the DNBR above the 95/95limit for the DN-B correlation during all normal operations and anticipated transients. In MODES1 and 2, both RCS loops and associated RCPs are required to be OPERABLE and in operation.In MODE 3 , a single RCS loop with one RCP and adequate steam generator secondarywater inventory provides sufficient heat removal capability. However, both RCS loops with atleast one RCP per loop are required to be OPERABLE to provide redundant paths for decay heatremoval. In addition, as a minimum, one RCS loop must be in operation. Any exceptions to theserequirements are contained in the LCO Notes.In MODE 4, one RCS loop with onae RCP and adequate steam generator secondary waterinventory, or one shutdown cooling. (SDC) train provides sufficient heat removal capability.However, two loops or trains, consisting of any combination of RCS loops or SDC trains, arerequired to be OPERABLE to provide redundant paths for decay heat removal. In addition, as aminimum, one RCS loop or SDC train must be in operation. Any exceptions to these requirementsare contained in the LCO Notes.In MODES 3 and 4 , an OPERABLE RCS loop consists of the RCS loop, associatedsteam generator, and at least one RCP. The steam generator must have sufficient secondary waterinventory for heat removal.In MODE 5, with the RCS loops filled, the SDC trains are the primary means of heatremoval. One SDC train provides sufficient heat removal capability. However, to provideredundantpaths for decay heat removal either two SDC trains are required to be OPERABLE, orone SDC train is required to be OPERABLE and both steam generators are reqtiired to haveadequate steam generator secondary water inventory. In addition, as a minimum, one SDC trainmust be in operation. Any exceptions to these requirements are contained in the LCO Notes.By maintaining adequate secondary water inventory and makeup capability, the steamgenerators will be able to support natural circulation in the RCS loops. In addition, the ability topressurize and control RCS pressure is necessary to support RCS natural circulation. If thepressurizer steam bubble has been collapsed and the RCS has been depressurized or drainedsufficiently that voiding of the steam generator U-tubes may have occurred, the RCS loops shouldbe considered not filled unless ana evaluation is performed to verify the ability of the RCS tosuppornt natural circulation. If the RCS loops are considered not filled, the RCS must be refilled,pressurized, and the RCPs bumped (unless a vacuum fill of the RCS was performed) before theRCS loops can be considered filled.In MODE 5, with the RCS loops not filled, the SDC trains are the only means of heatremoval. One SDC train provides sufficient heat removal capability. However, to provideredundant paths for decay heat removal, two SDC trains are required to be OPERABLE. Inaddition, as a mininmumn, one SDCMILLSTONE -UNIT 2 B 3/4 4-1 Revised by NRC Letter A15689Amendment No. &O, 6-6, 69, 9, 24--I8,2n19, LBDCR 15-MP2-003March 26, 20153/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued')train must be in operation. Any exceptions to these requirements are contained in the LCO Notes.An OPERABLE SDC train, for plant operation in MODES 4 and 5, includes a pump, heatexchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path and todetermine RCS temperature. The flow path starts at the RCS hot leg and is returned to the RCScold legs.In MODE 4, an OPERABLE SDC train consists of the following equipment:1. An OPERABLE SDC pump (low pressure safety injection pump);2. The associated SDC heat exchanger from the same facility as the SDC pump;3. The associated reactor building closed cooling water loop from the same facility asthe SDC pump;4. The associated service water loop from the same facility as the SDC pump; and5. All valves required to support SDC System operation are in the required positionor are capable of being placed in the required position.In MODE 4, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchangers,2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headersand 2 SW headers are required to support the SDC heat exchangers, consistent wvith therequirements of Technical Specifications 3.7.3.1 and 3.7.4.1.In MODE 5, an OPERABLE SDC ti-ain consists of the following equipment:1. An OPERABLE SDC pump (low pi'essure safety injection pump);2. The associated SDC heat exchanger fr'om the same facility as the SDC pump;3. An: RBCCW pump, powered from the same facility as the SDC pump, andRBCCW heat exchanger capable of cooling the associated SDC heat exchanger;4. A SW pump, powered from the same facility as the SDC pump, capable ofsupplying cooling water to the associated RBCCW heat exchanger; and5. All valves required to support SDC System operation are in the required positionor are capable of being placed in the required positionMILLSTONE -UNIT 2 B 3/4 4-la Rovisod. ,by1:rr NR Lot. ^tcrM5GSAmendment No. 5-0, 66, 69-9, 4--, 2-i-s, LBDCR 06-MP2-030September 14, 20063/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued)In MODE 5, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchangers,2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCWheaders are required to provide cooling to the SDC heat exchangers, but only 1 SW header isrequired to support the SDC trains. The equipment specified is sufficient to address a singleactive failure of the SDC System and associated support systems.In addition, twvo SDC trains can be considered OPERABLE, with only one 125-volt D.C.bus train OPERABLE, in accordance with Limiting Condition for Operation (LCO) 3.8.2.4. 2-SI-306 and 2-SI-657 are b~oth p.ow..r~ed:. from.the~same 125.-volt D.C. bus, on Facility I. Should.these.~e~ikndr~&i w~P~oidnkneb lge to c o ol thf RCS:.-:ttowever~a ldesignated': operator.isqas~signed~ toTeposi~ti~orrth~e al~e as ness'ary in thd: &v~rit*125-volt D.C. power is lost. Consistent with the bases for LCO 3.8.2.4, the 125-volt D.C. supportsystem operability requirements for both trains of SDC are satisfied in MODE 5 with at least one125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied.The operation of one Reactor Coolant Pump or one shutdown cooling pump providesadequate..flow t stratificati~on _anproduce~graduat reacti~v4iy changes.....during boron concentration reductions in the Reactor Coolant System. The reactivity change rateassociated with boron reductions will, therefore, be within the capability of operator recognitionand control. :The restrictions on starting a Reactor Coolant Pump in MODE 4 with one or more RCScold legs < 275°F and in MODE 5 are provided to prevent RCS pressure transients, caused byenergy additions from the secondary system, which could exceed the limits of Appendix G to10 CFR Part 50. The RCS will be protected against overpressure transients and will not exceedthe limits of Appendix G by:1. Restricting pressuriz'er water volume to ensure sufficient steam volume is available toaccommodate the insurge;:2. Restricting pressurizer pressure to establish an initial pressure that will ensure systempressure does not exceed the limit; and3. Restricting primary-to secondary system delta-T to reduce the energy addition from thesecondary system.If these restrictions are met, the steam bubble in the pressurizer is sufficient to ensure theAppendix G limits will not be exceeded. No credit has been taken for PORV actuation to limitRCS pressure in the analysis of the energy addition transient.MILLSTONE -UNIT 2 B 3/4 4-lb Amendment No. -50, 66, 69, 41-39, 2---8, :28Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-030September 14, 20063/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued)The limitations on pressurizer water level, pressurizer pressure, and primary to secondary delta-T.are necessary to ensure the validity of the analysis of the energy addition due to starting an RCP.The values for pressurizer water level and pressure can be obtained from control roomindications. The. primary to secondary system delta-T can be obtained from Shutdown Cooling(SDC) System outlet temperature and the saturation temperature for indicated steam generatorpressure. If there is no indicated steam generator pressure, the steam generator shell temperatureindicators can be used. If these indications are not available, other appropriate instrumentationcan be used.Th~e ROP starting:gi--riiriavalu~s for pressui'izer water level; pressurizer-pressure, and primairy toadjusted for instrument uncertainty. The values for these parameters contained in the proceduresthat will be used to start an RCP have been adjusted to compensate for instrument uncertainty.The value of RCS cold leg temperature (_< 2750F ) used to determine if the RCP start criteriaapplies, will be obtained from SDC return temperature if SDC is in service. If SDC is not inservdc~e,_oranatural..cireculation~is.nccurrng, .RCS~cold ieg.temp eraturewiUlbenuse~cL .................Average Coolant Temperature (Tavg) values are derived under the following 3 plantconditions, using the designated formula as appropriate for use in Unit 2 operating procedures.* RCP Operation: (Tcold1 + Tcold2 + ThotI + Thot2) / 4 = TvNatural circulation only flow: (Tcodld + Tcold2 + Thotl + Thot2) / 4 =Tv*SDC flow greater than 1000 gpm: (SDCoutiet +/- SDC1inlt) / 2 =Tavg(exception: Tavg is not expected to be calculated by this definition during the initialportion of the initiation phase of SDC. The transition point from loop temperatureaverage to SDC system average during cooldowns is when T3 51 Y decreases belowLoop Tcold) ...During operation with one or more Reactor Coolant Pumps (RCPs) providing forced flowand during natural circulation conditions, the, loop Resistance Temperature Detectors (RTDs)represent the inlet and outlet temperatures of the reactor and hence the average temperature of thewater that the reactor is exposed to. This holds during concurrent RCP/SDC operation also.MILLSTONE -UNIT 2 B 3/4 4-1c Amendment No. 50, 66, 69, 4-3~9, l-, 248,249,Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-030September 14, 20063/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued)During Shutdown Cooling (SDC) only operation, there is no significant flow past the loo1pRTDs. Core inlet and outlet termperatures are accurately measured during those conditions byusing T351lY, SDC return to RCS temperature indication, and T351 X, RCS to SDC temperatureindication. The average of these two indicators provides a temperature that is equivalent to theaverage RCS temperature in the core.During the transition from Steam Generator (SG) and SDC heat removal to SDC only heatremoval, actual core average temperature results from a mixture of both SDC flow and loop flow"from T~his ,m.ch~e t!ime co~oling :is .in iti~ated.u~ntil!.$S.Gcalculatedck However, the .average o~f t~he ,stil;toappropriate, fo r use."Thi-s; .'provides a straightforward process for determining Tavg.During some transient conditions, such as heatups on SDC, the value calculated by thisaverage definition will be slightly higher than the actual core aiverage. During other transients,such as cooldowns where SG heat removal~is Still taking place causing some natural circulationconditions. For the purpose of determining MODE changes and technical specificationapplicability, these transient condition results are conservative.The Notes in LCOs 3.4.1.2, 3.4.1.3, 3.4.1.4, and 3.4.1.5 permit a limited period of operationwithout RCPs and shutdown cooling pumps. All RCPs and shuitdown cooling pumps may beremoved from operation for _< 1 hour per 8 hour period. This means thatnatural circulation hasbeen established. When in natural circulation,-a reduction in boron concentration with coolant atboron concentrations less than required to assure the SDM of LCO 3.1.1.1t is maintained isprohibited because an even concentration distribution throughout the RCS cannot be ensured.Core outlet temperature is to be maintained at least 10°F below the saturation temperature so thatno vapor bubble may form and possibly cause a natural circulation flow obstruction.Concerning TS 3.4.1.2, ACTION b.; 3.4.1.3, ACTION c.; 3.4.1.4, ACTION b.; and 3.4.1.5,ACTION b., if two required loops or trains are inoperable or a required loop or train is not inoperation except during conditions permitted by the note in the LCO section, all operationsinvolving introduction of coolant into the RCS with boron concentration less than requiredtomeet the minimum SDM of LCO 3.1.1.1 must be suspended and action to restore one RCS loop orSDC train to OPERABLE status and operation must be initiated. The required margin tocriticality must not be reduced in this type of operation. Suspending the introduction of coolantinto the RCS of coolant with boron concentration less than required to meet the minimum SDMo~fLCO 3.1. 1.1 is required to assure continued safe operation. With coolant added without forcedcirculation, unmixed coolant could be introduced to the core, however coolant added with boronMILLSTONE -UNIT 2 B 3/4 4-1d Amendment No. gO, 66, 69, 4-3-9, 8,248, 249, ,Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-030September 14, 20063/44SEACOSOLATSSEBASES3/4A. 1 COOLANT LOOPS AND COOLANT CIRCULATION (continued)concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.The immnediate completion time~s reflect the, importance of decay heat removal. The ACTION torestore must continue until one ioop or train is restored to operation.*Technical Specification 3.4.1.6 limits the number of reactor co~olant pumps that may be*operational during MODE 5. This will limit the pressure drop across the core when the pumps areoperated during low-temperature conditions. Controlling the pressure drop across the core. willmaintain maximum RCS pressure within the maximum allowable pressure as calculated in CodeCase.No.,,,N-I14. ..Limi~ting two rea~cto~r-..coo1!ptrp~!s. .Qpop..r~tatw~h~e.n.theiRC.S cold-..{.e.. "not exce~eded. .'.Surveillanee, 4,;#:4A 6-.supportw:this-requirement. ... .. ..3/4.4.2 SAFETY VALVESThe pressurizer code safety valves operate toprevent the RCS from being, pressurized.above its Safety Limit of 2750 psia. Each safety valve is designed to relieve 296,000 lbs per hourof saturated steam at the valve setpoint. The relief capapcty of a ingles.~fety valve is adequate to_relieve any overpressure condition which could occur during shutdown. If any pressurizer codesafety valve is inoperable, and cannot be restored to OPERABLE status, the ACTION statementrequires the plant to be shut down and cooled down such that Technical Specification 3.4.9.3 willbecome applicable and require the Low Temperature Overpressure Protection System to be placedin service to provide overpressure protectionMILLSTONE -UNIT 2B 3/4 4-1eAmendment No. 93-,Acknowledged By NRC July 5, 2007 LBDCR 04-MP2-016February 24, 20053/4.4 REACTOR COOLANT SYSTEMBASESDuring operation, all pressurizer code safety valves must be OPERABLE to prevent theRCS from being pressurized above its safety limit of 2750 psia. The combined relief capacity ofthese valves is sufficient to limit the Reactor Coolant System pressure to within its Safety Limit of2750 psia following a complete loss of turbine generator load while operating at RATEDTHIERMAL POWER and assuming no reactor trip until the first Reactor Protective System tripsetpoint (§Pressurizer Pressure-High) is reached (i.e., no credit is taken for a direct reactor trip onthe loss of turbine) and also assuming no operation of the pressurizer power operated relief valveor steam dumrp valves.3/4.4.3 RELIEF VALVESThe power operated relief valves (PORVs) operate to relieve RCS pressure below thesetting of the pressurizer code safety valves. These relief valves have remotely operated blockvalves to provide a positive shutoff capability should a relief valve become inoperable. Theelectrical power for both the relief valves and the block valves is capable of being supplied froman emergency power source to ensure the ability to seal this possible RCS leakage path.The PORVs are also used for low temperature overpressure protection when the RCS iscooled down to or below 2750F. This is covered by Technical Specification 3.4.9.3 and discussedin the respective Bases section. The discussion below only addresses the PORVs in MODES 1, 2and 3.With the PORV inoperable and capable of being manually cycled, either the PORV mustbe restored, or the flow path isolated within 1 hour. The block valve should be closed, but thepower must be maintained to the associated block valve, since removal of power would render theblock valve inoperable. Although the PORV mnay be designated inoperable, it may be able to bemanually opened and closed and in this manner can be used to perform its function. PORVinoperability may be due to seat leakage, instrumentation problems, aiutomatic control problems,or other causes that do not prevent manual use and do not create a possibility for a small breakLOCA. Operation of the plant may continue with the PORV in this inoperable condition for alimited period of time not to exceed the next refueling outage, so that maintenance can beperfolrmed on the PORVs to eliminate the degraded condition. The PORVs should normally beavailable for automatic mitigation of overpressure events when the plant is at power.Quick access to the PORV for pressure control can be made when power remaints on the closedblock valve.If one block valve is inoperable, then it must be restored to OPERABLE status, or the associatedPORV prevented from opening automatically. The prime irnportance for the capability tomaintain closed the block valve is to isolate a stuck open PORV. Therefore, if the block valvecannot be restored to OPERABLE status within 1 hour, the required ACTION is to prevent theassociated PORV from automatically opening for an overpressure event and to avoid the potentialfor a stuck open PORV at a time that the block valve is inoperable. This may be accomplished byMILLSTONE -UNIT 2 B 3/4 4-2 Amendment No. O, 46,469., 9, 2---8,Acknowledged by NRC letter dated 6128105 LBDCR 14-MP2-001May 20, 20143/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.3 RELIEF VALVES (Continued)various methods. These methods include, but are not limited to, placing the NORMVAL/ISOLATEswitch at the associated Bottle Up Panel in the "ISOLATE" position or pulling the control powerfuses for the associated PORV control circuit.Although the block valve may be designated inoperable, it may be able to be manually openedand closed and in this manner can be used to perform its function. B lock valve inoperability maybe due to seat leakage, instrumentation problems, or other causes that do not prevent manual useand do not create a possibility for a small break LOCA. This condition is only intended to permitoperation of the plant for a limited pei'iod of time. The block valve should normally be availableto allow PORV operation for automatic mitigation of overpressure events. The block valves mustbe returned to OPERABLE status prior to entering MODE 3 after a refueling outage.If two PORVs are inoperable and not capable of being manually cycled, it is necessary to isolatethe flow path by closing and removing the power to the associated block valves within 1 hour andto restore at least one PORV within 8 hours. The Condition is modified by a Note stating it is notapplicable if the second PORV train is intentionally declared inoperable. The Condition does notapply to voluntamy¢ removal of redundant systems or components from service. The Condition isapplicable if one PORV is inoperable for any reason and the second PORV is discovered to beinoperable, or if both PORVs are discovered to be inoperable at the same time.In the event of a loss of feedwater, the PORVs would be used to remove core heat. In order tominimize the consequences of a loss of feedwater while two PORVs are inoperable, RequiredAction c.3 requires that LCO 3.7.1.2, "Auxiliary Feedwater Pumps," be met to ensure AFEW isavailable. The inoperability of two PORVs during the 8 hour allowed outage time has been shownto be acceptable based on the infrequent use of the Required Action and the Small incrementaleffect on plant risk (Ref. 1). If one PORV is restored and one PORV remains inoperable, then theplant will be in Condition b. with the time clock started at the original declaration of having twoP ORVs inoperable.If two block valves are inoperable, it is necessary to .restore at least one block valve toOPERABLE status within 8 hours. The Condition is modified by a Note stating it is notapplicable if the second block valve is intentionally declared inoperable. The Condition does notapply to voluntary removal of redundant systems or components fr'Qm service. The Condition isonly applicable if one block valve is inoperable for any reason and the second block valve isMILLSTONE -UNIT 2 B 3/4 4-2a Amendment No. 2, 3-, 66, 9-7,I-8-, 2-l8, 2461-LBDCR 14-MP2-001May 20, 2014REACTOR COOLANT SYSTEMBASES.3/4.4.3 RELIEF VALVES (Continued)discovered to be inoperable, or if both block valves are discovered to be inoperable at the sametime. In the event of a loss of feedwater, the PORVs would be used to remove core heat. In orderto minimize th~e consequences of a loss of feedwater while two block valves are inoperable,Required Action e. 1 requires that LCO 3.7.1.2, "Auxilia1iy Feedwater Pumps," be verified to bemet within 1 hour. The inoperability of two block valves during the 8 hour allowed outage timehas been shown to be acceptable based on the infrequent use of the Required Actions and thesmall incremental effect on plant risk (Ref. 1).SURVEILLANCE REQUIREMENT 4.4.3.l.c requires operating each PQRV through onecomplete cycle of full travel at conditions representative of MODES 3 or 4. This is normnallyperformed in MODE 3 or 4 as the unit is descending in power to colmmence a refueling outage.This test will normally be a static test, whereby a PORV will be exposed to MODE 3 or 4temperatures, the block valve closed, and the PORV tested to verify it strokes through onecomplete cycle of full travel. PORV cycling demonstrates its function. The Frequency of18 months is based on a typical refueling cycle and industry accepted practice. SURVEILLANCEREQUIREMENT 4.4.3.1 .c is consistent with the NRC staff position outlined in Generic Letter90-06, which requires that the 18-month PORV stroke test be performed at conditionsrepresentative of MODE 3 or 4. Testing in the manner described is also consistent with theguidance in NUREG 1482, "Guidelines for Inservice Testing at Nuclear Power Plants," Section4.2.10, that describes the PORVs function during reactor startup and shutdown to protect thereactor vessel and coolant system from low-temperature overpressurization conditions, andindicates they should be exercised before system conditions warrant vessel protection. If postmaintenance retest is warranted, the affected valve(s) will be stroked under amabient conditionswhile in Mode 5, 6, or defueled. A Hot Functional Test is required to .be performed in MODE 4prior to entry into MODE 3. The actual stroke time in the open and close direction will bemeasured, recorded and compared to the test results obtained during pre-installation testing toassess acceptability of the affected valve(s).SURVEILLANCE REQUIREMENT 4.4.3.2 verifies that a block valve(s) can be closed ifnecessary. This SURVEILLANCE REQUIREMENT is not required to be perform~ed with theblock valve(s) closed in accordance with the ACTIONS of TS 3.4.3. Opening the block valve(s)in this condition increases the risk of an unisolable leak fr'om the RCS since the PORV(s) isalready inoperable.REFERENCE1. WCAP-16 125-NP-A, "Justification for Risk-Informed Modifications to Selected TechnicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -U/NIT 2 B 3/4 4-2b Amendment No. -22, .3-7, g-2, 66, 89,-14-1, -t2-1, 3-, -t94 LBDCR 14-MiP2-001Mlay 20, 2014REACTOR COOLANT SYSTEMBASES3/4.4.4 PRESSURIZERAn OPERABLE pressurizer provides pressure control for the reactor coolant systemduring operations with both forced reactor coolant flow and with natural circulation flow. Theminimum water level in the pressurizer assures the pressurizer heaters, which are required toachieve and maintain pressure control, remain covered with water to prevent failure, which occursif the heaters are energized uncovered. The maximum water level in the pressurizer ensures thatthis parameter is maintained within the envelope of operation assumed in the safety analysis. Themaximum water level also ensures that the RCS is not a hydraulically solid system and that asteam bubble will be provided to accommodate pressure surges during operation. The steambubble also protects the pressurizer code safety valves and power operated relief valve againstwater relief. With pressurizer water level not within the limit, action must be taken to restore theplant to operation within the bounds of the safety analyses. To achieve this status, the unit must bebrought to at least HOT STANDBY with the reactor trip breakers open within 6 hours and inHOT S1{UTDOWN within the following 6 hours. This takes the plant out of the applicableMODES and restores the plant to operation within the bounds of the safety analyses. Therequirement that a minimum number of pressurizer heaters be OPERABLE enhances thecapability of the plant to control Reactor Coolant System pressure and establish and maintainnatural circulation.If two required groups of pressurizer heaters are inoperable, restoring at least one group ofpressurizer heaters to OPERABLE status is required within 24 hours. The Condition is modifiedby a Note stating it is not applicable if the second grohp of requi-ed pressurized heaters isintentionally declared inoperable. The Condition is not intended for voluntary removal ofredundant systems or components from service. The Condition is only applicable if one group ofrequired pressurized heaters is inoperable for any reason and the second group of requiredpressurized heaters is discovered to be inoperable, or if both groups of required pressurizedheaters are discovered to be inoperable at the same time. If both required groups of pressurizerheaters are inoperable, the pressurizer heaters may not be available to help maintain subcooling inthe RCS loops during a natural circulation c ooldown following a loss of' offsite power. Theinoperability of two groups of required pressurizer heaters during the 24 hour" allowed outage timaehas been shown to be acceptable based on the infrequent use of the Required Action and the smallincremental effect on plant risk (Ref. 1).The requirement for two groups of pressurizer heaters, each having a capacity of 130 kW,is met by verifying the capacity of the pressurizer proportional heater groups 1 and 2. Since thepressurizer proportional heater groups 1 and 2 are supplied fr'om the emergency 480V electricalbuses, there is reasonable assurance that these heaters can be energized during a loss of offsitepower to maintain natural circulation at HOT STANDBY.REFERENCE1. WCAP-1 6125-NP-A, "Justification for Risk-Informed Modifications to Selected TechnicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2B /42AmnetNoB 3/4 4-2cAmendment No. LBDCR 14-MP2-001May 20, 2014REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITYLCOThe LCO requires that steam generator (SG) tube integrity be maintained. The LCO alsorequires that all SG tubes that satisfy the plugging criteria be plugged in accordance with theSteam Generator Program.During a SG inspection, any inspected tube that satisfies the Steam Generator Programplugging criteria is removed from service by plugging. If a tube was determined to satisfy theplugging criteria but was not plugged, the tube may still have tube integrity.In the context of this Specification, a SG tube is defined as the entire length of the tube,including the tube wall between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.A SG tube has tube integrity when it satisfies the SG performance criteria. The SGperformance criteria are defined in Specification 6.26, "Steam Generator Program," anddescribe acceptable SG tube performance. The Steam Generator Program also provides theevaluation process for determining conformance with the SG performance criteria. There arethree SG perfolniance criteria: structural integrity, accident induced leakage, and operationalLEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.The structural integrity performance criterion provides a mar'gin of safety against tubeburst or collapse under nonanal and accident conditions, and ensures structural integrity of the SGtubes under all anticipated transients included in the design specification. Tube burst is defined as,"The gross structural failure of the tube wall. The condition typically corresponds to an unstableopening displacement (e.g., opening area inc~reased in response to constant pressure) accompaniedby ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse isdefined as, "For the load displacement curve for a given structure, collapse occurs at the top of theload versus displacement curve where the slope of the curve becomes zero." The structuralintegrity performance criterion provides guidance onassessing loads that have a significant effecton burst or collapse. In that context, the term "significant" is defined as "An accident loadingcondition other than differential pressure is considered significant when the addition of such loadsin the assessment of the structural integrity performance criterion could cause a lower structurallimit or limiting burst/collapse condition to be established." For tube integrity evaluations, exceptfor circumnferential degradation, axial thermaal loads are classified as secondary loads. Forcircumferential degradation, the classification of axial thermal loads as primalmy or secondaryloads will be evaluated on a case-by-case basis. The division between primary and secondaryclassifications will be based on detailed analysis and/or testing.MILLSTONE -UNIT 2 B3442 mnmn oB 3/4 4-2dAmendment No. LBDCR 14-MVP2-001May 20, 2014REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)LCO (Continued)Structural integrity requires that the primary membrane stress intensity in a tube notexceed the yield strength for all ASME Code, Section III, Service Level A (normal operatingconditions) and Service Level B (upset or abnormaal conditions) transients included in the designspecification. This includes safety factors and applicable design basis loads based on ASMECode, Section III, Subsection NB (Reference 4) and Draft Regulatory Guide 1.121 (Reference 5).The accident induced leakage performance criterion ensures that the primary to secondaiy'LEAKAGE caused by a design basis accident, other than a SGTR, is within the accident analysisassumptions. The accident analysis assumes that accident induced leakage does not exceed 150GPD per SG. The accident induced leakage rate includes any primary to secondary LEAKAGEexisting prior to the accident in addition to primary to secondary LEAKAGE induced during theaccident.The operational LEAKAGE performance criterion provides an observable indication ofSG tube conditions during plant operation. The limit on operational LEAKAGE is contained inLCO 3.4.6.2, "Reactor Coolant System Operational LEAKAGE," and limits primary' to secondaryLEAKAGE through any one SG to 75 gallons per day. This limit is based on the assumption thata single crack leaking this amount would not propagate to a SGTR under the stress conditions of aLOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, thecracks are very small, and the above assumption is conservative.APPLICABILITYSteam generator tube integrity is challenged when the pressure differential across thetubes is large. Large differential pressures across SG tubes can only be experienced duringMODES 1, 2, 3, and 4.RCS conditions are far less challenging during MODES 5 and 6 than during MODES 1, 2,3, and 4. During MODES 5 and 6, primary to secondary differential pressure is low, resulting inlower stresses and reduced potential for LEAKAGE.ACTIONSThe ACTIONS are modified by a NOTE clarifying that the ACTIONS may be enteredindependently for each SG tube. This is acceptable because the ACTIONS provide appropriateconmpensatory actions for each affected SG tube. Complying with the ACTIONS may allow forcontinued operation, and subsequent affected SG tubes are governed by subsequent ACTIONentry and application of associated ACTIONS.MILLSTONE -UNIT 2B 3/4 4-2eAmendment No. LBDCR 14-MP2-001May 20, 2014REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)ACTIONS (Continued)a.1 and a.2ACTION a. applies if it is discovered that one or more SG tubes examined in an inserviceinspection satisfy the tube plugging criteria but were not plugged in accordance with the SteamGenerator Program as required by TS 4.4.5.2. An evaluation of SG tube integrity of the affectedtube(s) must be made. Steam generator tube integrity is based on meeting the SG perfonmancecriteria described in the Steam Generator Progr'am. The SG plugging criteria define limits on SGtube degradation that allow for flaw growth between inspections while still providing assurancethat the SG performance criteria will continue to be met. In order to determine if a SG tube thatshould have been plugged has tube integrity, an evaluation must be completed that demonstratesthat the SG performance criteria will continue to be met until the next refueling outage or SG tubeinspection. The tube integrity determination is based on the estimated condition of the tube at thethne the situation is discovered and the estimated growth of the degradation prior to the next SGtube inspection. If it is determined that tube integrity is not being maintained, ACTION b. applies.A Completion Time of 7 days is sufficient to complete the evaluation while minimizingthe risk of plant operation with a SG tube that may not have tube integrity.If the evaluation determines that the affected tube(s) have tube integrity, ACTION a.2allows plant operation to continue until the next refueling outage or SG inspection provided theinspection intearval continues to be supported by an operational assessment that reflects theaffected tube(s). However, the affected tube(s) must be plugged prior to entering HOTSHUTDOWN following the next refueling outage or SG inspection. This Completion Time is,acceptable since operation until the next inspection is supported by the operational assessment.b.1 and b.2If the ACTIONS and associated Completion Times of ACTION a. are not met or if SGtube integrity is not being maintained, the reactor must be brought to HOT STANDBY within6 hours and COLD SHUTDOWN within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reachthe desired plant conditions from full power conditions in an orderly manner and withoutchallenging plant systems.MIILLSTOKE -UITh2 B/4 mnmn oB 3/4 4-2f LBDCR 14-MIP2-001May 20, 2014REACTOR. COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)SURVEILLANCE REQUIREMENTSTS 4.4.5.1During shutdown periods the SGs are inspected as required by this SR and the SteamGenerator Program. NEI 97-06, Steam Generator Progr'am Guidelines (Ref. 1), and its referencedEPRI Guidelines, establish the content of the Steam Generator Program. Use of the SteamGenerator Program ensures that the inspection is appropriate and consistent with acceptedindustry practices.During S G inspections a condition monitoring assessment of the S G tubes is performed.The condition monitoring assessment determines the "as found" condition of the SG tubes. Thepurpose of the. condition monitoring assessment is to ensure that the SG performance criteria havebeen met for the previous operating period.The Steam Generator Program determnines the scope of the inspection and the methodsused to determine whether the tubes contain flaws satisfying the tube plugging criteria. Inspectionscope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a fuanction ofexisting and potential degradation locations. The Steam Generator Program also specifies theinspection methods to be used to find potential degradation. Inspection methods are a function ofdegradation morphology, non-destructive examination (NDE) technique capabilities, andinspection locations.The Steam Generator Program defines the Frequency of TS 4.4.5.1. The Frequency isdetermined by the operational assessment and other limits in the SG examination guidelines(Reference 6). The Steam Generator Program uses infonnation on existing degradations andgrowth rates to determine an inspection Frequency that provides reasonable assurance that thetubing will meet the SG performance criteria at the next scheduled inspection. In addition,Specification 6.26 contains prescriptive requirements concerning inspection intervals to provide.added assurance that the SG performance criteria will be met between scheduled inspections. Ifcrack indications are found in any SG tube, the maximum inspection interval for all affectedand potentially affected SGs is restricted by Specification 6.26 until subsequent inspectionssupport extending the inspection interval.Tx/ArT T VTC'NTTP _ T ThTTT ) D1 "21A AO,-r A nnchln~pij 1'J 0 O ~IIJ. -- J.£ .L LBDCR 14-MiP2.-001May 20, 2014REACTOR COOLANT SYSTEMBASES314.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)SURVEILLANCE REQUIREMENTS (Continued)TS 4.4.5.2During a SG inspection, any inspected tube that satisfies the Steam Generator Programplugging criteria is removed fr'om service by plugging. The tube plugging criteria delineated inSpecification 6.26 are intended to ensure that tubes accepted for continued service satisfy the SGperfonnmace criteria with allowance for error in the flaw size measurement and for future flawgrowth. In additioni, the tube plugging criteria, in conjunction with other elements of the SteamGenerator Program, ensure that the SG performance criteria will continue to be met until the nextinspection of the subject tube(s). Reference 1 provides guidance for performing operationalassessments to verify that the tubes remaining in service will continue to meet the SGperformance criteria.The Frequency of prior to entering MODE 4 following a SG inspection ensures that theSurveillance has been completed and all tubes meeting the plugging criteria are plugged prior tosubjecting the SG tubes to significant primary to secondary pressure differential.BACKGROUNDSG tubes are small diameter, thin walled tubes that carry primary coolantt thr-ough theprimary to secondary heat exchangers. The SG tubes have a number of imnportant safety functions.SG tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, arerelied on to maintain the primary system's pressure and inventory. The SG tubes isolate theradioactive fission products in the primary coolant from the secondary system. In addition, as partof the RCPB, the SG tubes are unique in that they act as the heat transfer surface between theprimnaly and secondary systems to remove heat from the system. Thtis Specificationaddresses only the RCPB integrity function of the SG. The SG heat removal function is addressedby LCO. 3.4.1.1, "RCS STARTUP AND POWER OPERATION," LCO 3.4.1.2, "RCS HOTSTANDBY," LCO 3.4.1.3, "RCS HOT SHUTDOWN," and LCO 3.4.1.4, "RCS COLDSHUTDOWN-LOOPS FILLED."SG tube integrity means that the tubes are capable of performing their intended RCPBsafety function consistent with the licensing basis, including applicable regulatory requirements.SG tubing is subject to a variety of degradation mechanisms. Steam generator tubes mayexperience tube degradation related to corrosion phenomena, such as wastage, pitting,intergranular attack, and stress corrosion cracking, along with other mechanically inducedphenomena such as denting and wear. These degradation mechanisms can impair tube integrity ifthey are not managed effectively. The SG performance criteria are used to manage SG tubedegradation.MILLSTONE -UNIT 2 B3442 mnmn oB 3/4 4-2hAmendment No. LBDCR 14-MP2-001May 20, 2014REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GEN~ERATOR TUBE INTIEGRITY (Continued)BACKGROUND (Continued)Specification 6.26, "Steam Generator (SG) Program," requires that a program beestablished and implemented to ensure that SG tube integrity is maintained. Pursuant toSpecification 6.26, tube integrity is maintained when the SG performance criteria are met. Thereare three SG performance criteria: structural integrity, accident induced leakage, and operationalLEAKAGE. The SG performance criteria are described in Specification 6.26. Meeting the SGperformance criteria provides reasonable assurance of maintaining tube integrity at normal andaccident conditions.The processes used to meet the SG performance criteria are defined by the SteamGenerator Program Guidelines (Reference 1).APPLICABLE SAFETY ANALYSESThe steam generator tube rupture (SGTR) accident is the limiting design basis event forSG tubes and avoiding an SGTR is the basis for this Specification. The analysis of a SGTR eventassumes a bounding primary to secondary LEAKAGE rate equal to the operational LEAKAGErate limits in LCO 3.4.6.2, "'RCS Operational LEAKAGE," plus the leakage rate associated witha double-ended rupture of a single tube. The accident analysis for a SGTR assumies thecontaminated secondary fluid is released to the atmosphere via safety valves or atmospheric dumpvalves.The analysis for design basis accidents and transients other than a SGTR assume the SGtubes retain their structural integrity (i.e., they are assumed not to rupture). In these analyses, thesteam discharge to the atmosphere is based on the total primary to secondary LEAKAGE fromany one SG of 150 gpd or from all SGs of 300 gpd as a result of accident induced conditions. Foraccidents that do not involve fuel damage, the primamy coolant activity level of DOSEEQUIVALENT 1-131 is assumed to be equal to the LCO 3.4.8, "RCS Specific Activity" limits.For accidents that assume fuel damage, the primary coolant activity is a function of the amount ofactivity released from the damaged fuel. The dose consequences of these events are within thelimits of GDC 19 (Reference 2), 10 CFR 50.67 (Reference 3) or the NRC approved licensingbasis (e.g., a small fraction of these limits).Steam Generator tube integrity satisfies Criterion 2 of 10 CER 50.36(c)(2)(ii).MILLSTONE -UNIT 2B3442AmnetNoB 3/4 4-2iAmendment No. LBDCR 14-.MP2-01lMay 20, 2014REACTOR COOLANT SYSTEMBASES3/14.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)REFERENCES1. NEI 97-06, "Steam Generator Program Guidelines."2. 10 CFR 50 Appendix A, GDC 19.3. 10 CER 50.67.4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.5. Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam Generator Tubes,"August 1976.6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines."MILLSTONE -UNIT 2B3/42AmnetNoB 3/4 4-2jAmendment No. August 08, 200707-MP2-0 12REACTOR COOLANT SYSTEMIBASES3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.1 LEAKCAGE DETECTION SYSTEMSThe RCS leakage detection systems requir~ed by this specification are provided to monitorand detect leakage fr~om the Reactor Coolant Pressure Boundary. These detection systems areconsistent with the recommendations of Regulatory Guide 1.45, "Reactor Coolant PressureBoundaiyz Leakage Detection Systems."Action c provides a 72 hour allowed outage time (AOT) when both the containment atmosphereparticulate radioactivity mnonitoring channels are inoperable and containment sump levelmonitoring system is inoperable. The 72 hour AOT is appropriate since additional actions will betaken during this limited time period to ensure RCS leakage, in excess of the unidentified leakageTS limit of 1 gpm (TS 3.4.6.2), will be readily detectable. This will provide reasonable assurancethat any significant reactor coolant pressure boundaiy* degradation is detected soon afteroccurrence to minimize the potential for propagation to a gross failure. This is consistent with therequirements of General Design Criteria (GDC) 30 and also Criterion 1 of 10 CFR 50.36(d)(2)(ii)which requires installed instrumentation to detect, and indicate in the control room, a significantabnormal degradation of the reactor coolant pressure boundary. The RCS water inventorybalance calculation determines the magnitude of RCS unidentified leakage by use of0instrumentation readily available to the control room operators.. However, the proposedadditional actions will not restore the continuous monitoring capability nonnally provided by theinoperable equipment.The RCS water inventory balance is capable of identifying a one gpmnRCS leak rate. Thecontainment grab samples will also indicate an increase in RCS leak rate which would then bequantified by the RCS water inventory balance. Since these additional actions are sufficient toensure RCS leakage is within TS limits, it is appropr'iate to provide a limited time period to restoreat least one of the TS-required leakage monitoring systems.MILLSTONE -UNIT 2 B 3/4 4-3 Amendment No. t, 38,-22-8, August 08, 200707-MP2-0 12REACTOR COOLANT SYSTEMBASES3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGELCORCS operational LEAKAGE shall be limited to:a PRESSURE BOUNDARY LEAKAGENo PRESSURE BOUNDARY LEAKAGE is allowed, being indicative of materialdeterioration. LEAKAGE of this type is unacceptable as the leak itself could cause furtherdeterioration, resulting in higher LEAKAGE. Violation of this LCO could result incontinued degradation of the RCPB. LEAKAGE past seals and gaskets is notPRESSUREBOUNDARY LEAKAGE.b UNIDENTIFIED LEAKAGEOne gallon per minute (gpm) of UNIDENTIFIED LEAKAGE is allowed as a reasonableminimum detectable amount that the containment air monitoring and containment sumplevel monitoring equipment can detect within a reasonable time period. Violation of thisLCO could result in continued degradation of the RCPB, if the LEAKAGE is from thepressure boundary.c Primary to Secondary_ LEAKAGE through-Any-One Steam GeneratorThe limit of 75 gallons per day per Steam Generator (SG) is based on the operationalLEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines(Reference 4) and the accident analysis described in the FSAR (Reference 3). The SteamGenerator Program operational LEAKAGE performance criterion in NEI 97-06 states,"The RCS operational primary to secondary leakage through any one SG shall be limitedto 150 gallons per day." The limit is based on operating experience with SG tubedegradation mechanisms that result in tube leakage. The operational leakage rate criterionin conjunction with the implementation of the Steam Generator Program is an effectivemeasure for minimizing the frequency of steam generator tube ruptures. The main steamline break (MSLB) accident analysis assumes a primary to secondary leakage of 150gallons per day per 8G.MILLSTONE -UNIT 2 B3443 mnmn oB 3/4 4-3aAmendment No. LBDCR 09-MP2-004May 28, 2009 .::.REACTOR. COOLANT SYSTEMBASES3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGELCO (Continued)d IDENTIFIED LEAKAGEUp to 10 gpm of IDENTIFIED LEAKAGE is considered allowable because LEAKAGEis from known sources that do not interfere with detection of UNIDENTIFIEDLEAKAGE and is well within the capability of the RCS makeup system. IDENTIFIEDLEAKAGE includes LEAKAGE to the containment from specifically known and locatedsources, but does not include PRESSURE BOUNDARY LEAKAGE or CONTROLLEDLEAKAGE. Violation of this LCO could result in continued degradation of a componentor system.The IDENTIFIED LEAKAGE and UNIDENTIFIED LEAKAGE limits listed in LCO 3.4.6.2only apply to the RCPB within the containment. Leakage outside of the second isolation valve forcontainment,, which is included in the RCS Leak Rate Calculation, is not considered RCSLEAKAGE and can be subtracted from RCS UNIDENTIFIED LEAKAGE. The definitions forIDENTIFIED LEAKAGE and UNIDENTIFIED LEAKAGE are provided in the technical .specifications definitions section, Definition 1.14.APPLICABILITY -...In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS ispressurized.'In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is farlower, resulting in lower stresses and reduced potentials for LEAKAGE.ACTIONSa UNIDENTIFIED LEAKAGE or IDENTIFIED LEAKAGE in excess of the LCO limitsmust be reduced to within limits within 4 hours. This Completion Time allows time toverify leakage rates and either identify UNIDENTIFIED LEAKAGE or reduceLEAKAGE to within limits before the reactor must be shut down. This action is necessaryto prevent further deterioration of the RCPB.MILLSTONE -UNIT 2 B 3/4 4-3b Amendment No. ,l Auagust 08, 200707-MP2-0 12REACTOR COOLANT SYSTEMBASES3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGEACTIONS (Continued)b If any PRESSURE BOUNDARY LEAKAGE exists, or primary to secondary LEAKAGEis not within limits, or if UNIDENTIFIED or IDENTIFIED LEAKAGE cannot bereduced to within limits within 4 hours, the reactor must be brought to lower pressureconditions to reduce the severity of the LEAKAGE and its potential consequences. Itshould be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARYLEAKAGE. The reactor must be brought to HOT STANDBY within 6 hours and COLDSHUTDOWN within 36 hours. This action reduces the LEAKAGE and also reduces thefactors that tend to degrade the pressure boundary.The allowed Completion Times are reasonable, based on operating experience, to reachthe required plant conditions from full power conditions in an orderly manner and withoutchallenging plant systems. In COLD SHUTDOWN, the pressure stresses acting on thereactor coolant pressure boundary are much lower, and further deterioration is much lesslikely.SURVEILLANCE REQUIREMENTS4.4.6.2.1Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the RCPB ismaintained. PRESSURE BOUNDARY LEAKAGE would at first .appear as UNIDENTIFIEDLEAKAGE and can only be positively identified by inspection. UNIDENTIFIED LEAKAGEand IDENTIFIED LEAKAGE are determined by performance of an RCS water inventorybalance.The RCS water inventory balance must be performed with the reactor at steady state operatingconditions (stable temperature, power level, pressurizer and makeup tank levels, makeup andletdown, and RCP seal leakoff flows). The Surveillance is modified by two Notes. Note 1 statesthat this SR is not required to be performed until 12 hours after establishing steady stateOperation. The 12 hour allowance provides sufficient time to collect and process all necessarydata after stable plant conditions are established.MILLSTONE -UNIT 2 B3443 mnmn oB 3/4 4-3cAmendment No. August 08, 200707-MP2-0 12REACTOR COOLANT SYSTEMBASES03/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGESURVEILLANCE REOUIREMENTS (Continued)Steady state operation is required to perform a proper water inventory balance since calculationsduring maneuvering are not useful. For RCS operational LEAKAGE determination by waterinventory balance, steady state is defined as stable RCS pressure, temperature, power level,pressurizer and makeup tank levels, makeup and letdown, and RCP seal leakoff flows.An early warning of PRESSURE BOUNDARY LEAKAGE or UNIDENTIFIED LEAKAGE isprovided by the automatic systems that monitor the containment atmosphere radioactivity and thecontainment sump level. These leakage detection systems are specified inl LCO 3.4.6.1, "LeakageDetection Systems."Note 2 states that this SR is not applicable to primary to secondary LEAKAGE becauseLEAKAGE of 75 gallons per day cannot be measured accurately by an RCS water inventorybalance.The 72 hour Frequency is a reasonable interval to trend LEAKAGE and recognizes theimportance of early leakage detection in the prevention of accidents.4.4.6.2.2/This SR verifies that primary to secondary LEAKAGE is less than or equal to 75 gallons per daythrough any one SG. Satisfying the primary to secondary LEAKAGE limit ensures that theoperational LEAKAGE performance criterion in the Steam Generator Program is met. If this SRis not met, compliance with LCO* 3.4.5, "Steam Generator Tube Integrity," should be evaluated.*The 75 gallons per day limit is measured at room temperature as described in Reference 5. TheOperational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practicalto assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should beconservatively assumed to be from one SG.The Surveillance is modified by a Note which states that the Surveillance is not required to beperformed until 12 hours after establishment of steady state operation. For RCS primary tosecondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature,power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal leakoffflows.MILLSTONE -UNIT 2 B 3/4 4-3d Amendment No. LBDCR 14-MP2-016September 4, 2014REACTOR COOLANT SYSTEMBASES3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGESUIRVEILLANCE REOUIREMENTS (Continued)The frequency specified in the Surveillance Frequency Control Program is a reasonable intervalto trend primary to secondary LEAKAGE and recognizes the importance of early leakagedetection in the prevention of accidents. The primary to secondary LEAKAGE is determinedusing continuous process radiation monitors or radiochemical grab sampling in accordance withthe EPR[ guidelines (Reference 5).BACKGROUNhDComponents that contain or transport the coolant to or from the reactor core make up the reactorcoolant system (RCS). Component joints are made by welding, bolting, rolling, or pressureloading, and valves isolate connecting systems from the RCS.During plant life, the joint and valve interfaces can produce varying amounts of reactor coolantLEAKAGE, through either nonnal operational wear or mechanical deterioration. The purpose ofthe RCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGEfrom these sources to amounts that do not compromise safety. This LCO specifies the types andamounts of LEAKAGE.10 CFR 50, Appendix A, GDC 30 (Reference 1), requires mneans for detecting and, to the extentpractical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Reference2) describes acceptable methods for selecting leakage detection systems.The safety significance of RCS LEAKAGE varies widely depending on its source, rate, andduration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containmentarea is necessary. Quickly separating the IDENTIFIED LEAKAGE from the UNIIDENTIFIEDLEAKAGE is necessary to provide quantitative information to the. operators, allowing them totake colTective action should a leak occur detrimental to the safety of the facility and the public.A limited amount of leakage inside containment is expected from auxiliary systems that cannot bemade 100% leaktight. Leakage fronl these systems should be detected, located, and isolated from~.the containment atmosphere, if possible, to not interfere with RCS LEAKAGE detection.This LCO deals with protection of the reactor coolant pressure boundary (RCPB) fromdegradation and the core from inadequate cooling, in addition to preventing the accident analysisradiation release assumptions from being exceeded. The consequences of violating this LCOinclude the possibility of a loss of coolant accident (LOCA).MILLSTONE -UNIT 2 B/43 mnmn oB 3/4 4-3eAmendment No. August 08, 200707-MP2-012REACTOR COOLANT SYSTEMBASES3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGEAPPLICABLE SAFETY ANALYSES -OPERATIONAL LEAKAGEExcept for primary to secondary LEAKAGE, the safety analyses do not address operationalLEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA;the amount of leakage can affect the probability of such an event. The safety analysis for an eventresulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGEfrom any one steam generator (SG) of 150 gpd or from all SGs of 300 gpd as a result of accidentinduced conditions. The LCO requirement to limit primary to secondary LEAKAGE through anyone SG to less than or equal to 75 gallons per day is significantly less than the conditions assumedin the safety analysis.Primary to secondary LEAKAGE is a factor in the dose releases outside containment resultingfrom a main steam line break (MSLB) accident. To a lesser extent, other accidents or transientsinvolve secondary steam release to the atmosphere, such as a steam generator tube rupture(SGTR). The leakage contaminates the secondary fluid. The FSAR (Reference 3) analysis for SGTR assumes the contaminated secondary fluid is onlybriefly released via safety valves or atmospheric dump valves.The MSLB is the more limiting accident for MPS2 control room dose. The safety analysis for theMSLB accident assumes 150 gpd primary to secondary.LEAKAGE is through~the affectedgenerator and 150 gpd from the intact SG as an initial condition. The dose consequences resultingfrom the MSLB accident are well within the limits defined in 10 CER 50.67 or the staff approvedlicensing basis (i.e., a small fraction of these limits).The RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).MILLSTONE -UNIT 2 B 3/4 4-3f Amendment No. l March 18, 2008" LBDCR 08-MP2-013REACTOR COOLANT SYSTEMBASES3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGEREFERENCES110 CFR 50, Appendix A, GDC 30.2 Regulatory Guide 1.45, May 1973.3 ESAR, Section 144 NEI 97-06, "Steam Generator Program Guidelines."5 EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."3/4.4.7 DELETE3/4.4.8 SPECIFIC ACTIVITYBACKGROUNDThe maximum dose that an individual at the exclu~sion .a~reaboundary can receive for 2 hoursfollowing an accident, or at the low population zone outer boundary for the radiological releaseduration, is specified in 10 CFR 50.67 (Ref. 1). Doses to control room occupants must be limitedper GDC 19. The limits on specific activity ensure that the offsite and Control Room Envelope(CRE) doses are appropriately limited during :analyzed transients and accidents.The RCS specific activity LCO limits the allowable concentration of radionuclides in the reactorcoolant. The LCO limits are established to minimize the dose consequences in the event of asteam line break (SLB) or steam generator tube rupture (SGTR) accident.The LCO contains specific activity limits for both DOSE EQUIVALENT 1-131 and DOSEEQUIVALENT XE-133. The allowable levels are intended to ensure that offsite and CRE dosesmeet the appropriate acceptance criteria in the Standard Review Plan (Ref. 2).MILLSTONE -UNIT 2B 3/4 4-4MILLTON -NIT2 B3/44-4Amendment No. 44--5, -194, 2-66, March 18, 2008LBDCR 08-MP2-013REACTOR COOLANT SYSTEMBASES3/4.4.8 SPECIFIC ACTIVITY (continued)APPLICABLE SAFETY ANALYSESThe LCO limits on the specific activity of the reactor coolant ensure the resulting offsite and CREdoses meet the appropriate SRP acceptance criteria following a SLB or SGTR accident. Thesafety analyses (Refs. 3 and 4) assume the specific activity of the reactor coolant is at the LCOlimits, and an existing reactor coolant steam generator (SG) tube leakage rate of 150 gpd exists.The~safety analyses assume the specific activity of the secondary coolant is at its limit of 0.1 igCi/gm DOSE EQUIVALENT I- 131 from LCO 3.7.1.4, "Activity."The analyses for the SLB and SGTR accidents establish the acceptance limits for RCS specificactivity. Reference to these analyses is used to assess changes to the unit that could affect RCSspecific activity, as they relate to the acceptance limits.The safety analyses consider two cases of reactor coolant iodine specific activity. One caseassumes specific activity at 1.0 jiCi/gm DOSE EQUIVALENT 1- 131 with a concurrent largeiodine spike that increases the rate of release of iodine from the fuel rods containing claddingdefects to the primary coolant immediately after a SLB (by a factor of 500), or SGTR (by a factorof 335), respectively. The second case assumes the initial reactor coolant iodine activity at 60.0pCi/gm DOSE EQUIVALENT I- 131 due to an iodine spike caused by a reactor or an RCStransient prijor to the accident. In both cases, the noble gas specific activity is assumed to be 1100p.tCi/gm DOSE EQUIVALENT XE-133....The SGTR analysis assumes a rise in pressure in the ruptured SG causes radioactivelycontaminated steam to discharge to the atmosphere through the atmospheric dump valves or the.main steam safety valves. The atmospheric discharge stops when the turbine bypass to thecondenser removes the excess energy to rapidly reduce the RCS pressure and close the valves.The unaffected SG removes core decay heat by venting steam until the cooldown ends and theShutdown Cooling (SDC) system is placed in service.The SLB radiological analysis assumes that offsite power is lost at the same time as the pipe breakoccurs outside containment. The affected SG blows down completely and steam is venteddirectly to the atmosphere. The unaffected SG removes core decay heat by venting steam to theatmosphere until the cooldown ends and the SDC system is placed in service.Operation with iodine specific activity levels greater than 1 giCi/gm but less than or equal to 60.0pCi/gm is permissible for up to 48 hours while efforts are made to restore DOSE EQUIVALENT1-131 to within the 1 [iCi/gm LCO limit. Operation with iodine specific activity levels greaterthan 60 jiCi/gm is not permissible.MILLSTONE -UNIT 2 B3444B 3/4 4-4a March 18, 2008LBDCR 08-MP2-013REACTOR COOLANT SYSTEMBASES3/4.4.8 SPECIFIC ACTIVITY (continued)APPLICABLE SAFETY ANALYSES (continued)The RCS specific activity limits are also used for establishing standardization in radiationshielding and plant personnel radiation protection practices.RCS spedific activity satisfies Criterion 2 of 10 CFR 50.3 6(c)(2)(ii).LCOThe iodine specific activity in the reactor coolant is limited to 1.0 pCi/gm DOSE EQUIVALENTI-131, and the noble gas specific activity in the reactor coolant is limited to 1 100 pCi/gm DOSEEQUIVALENT XE-133. The limits on specific activity ensure that offsite and CRE doses willmeet the appropriate SRP acceptance criteria (Ref. 2).The SLB and SGTR accident analyses (Refs. 3 and 4) show that the calculated doses are withinacceptable limits. Operation with activities in excess of the LCO may result in reactor coolantradioactivity levels that could, in the event of an SLB or SGTR, lead to doses that exceed the SRPacceptance criteria (Ref. 2).APPLICABILITYIn MODES 1, 2, 3, and 4, operation within the LCO limits for DOSE EQUIVALENT 1-13 1 andDOSE EQUIVALENT XE- 133 is necessary to limit the potential consequences of a SLB orSGTR to within the SRP acceptance criteria (Ref. 2).In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS andsteam generators are depressurized, and primary to secondary leakage is minimal. Therefore, themonitoring of RCS specific activity is not required.MILLSTONE -UNIT 2 B3444B 3/4 4-4b March 18, 2008LBDCR 08-MP2-013REACTOR COOLANT SYSTEMBASES3/4.4.8 SPECIFIC ACTIVITY (continued)ACTIONSa. and b.With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples at intervals of fourhours must be taken to demonstrate that the specific activity is _< 60 jiCi/gm. Four hours isrequired to obtain and analyze a sample. Sampling is continued every four hours to provide atrend.The DOSE EQUIVALENT I-131 must be restored to within limit within 48 hours. Thecompletion time of 48 hours is acceptable since it is expected that, if there were an iodine spike,the normal coolant iodine concentration would be restored within this time period. Also, there isa low probability of a SLB or SGTR occurring during this time period.A statement in ACTION b. indicates the provisions of LCO 3.0.4 are not applicable. Thisexception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTIONS a. andb- while the DOSE EQUIVALENT I-131 LCO is not met. This exception is acceptable due to thesignificant conservatism incorporated into the RCS specific activity limit, the low probability ofan event which is limiting due to exceeding this limit, and the ability to restore transient-specificactivity excursions while the plant remains at, or proceeds to, power operation.c..__If the required action and completion time of ACTION b. is not met, or if the DOSEEQUIVALENT 1-131 is > 60 jpCi/gm, the reactor must be brought to HoT STANDBY (MODE 3)within 6 hours and COLD SHUTDOWN (MODE 5) within 36 hours. The allowed completiontimes are reasonable, based on operating experience, to reach the required plant conditions fromfull power conditions in an orderly manner and without challenging plant systems.MILLSTONE -UNIT 2 B3444B 3/4 4-4c LBDCR 14-MP2-016September 4, 2014REACTOR COOLANT SYSTEMBASES3/4.4.8 SPECIFIC ACTIVTY (continued)ACTIONS (continued)d__.With the RCS DOSE EQUIVALENT XE-133 greater than the LCO limit, DOSE EQUIVALENTXE-133 must be restored to within limit within 48 hours. The allowed completion time of 48hours is acceptable since it is expected that, if there were a noble gas spike, the normal coolantnoble gas concentration would be restored within this time period. Also, there is a low probabilityof a SLB or SGTR occurring during this time period.A statement in ACTION d. indicates the provisions of LCO 3.0.4 are not applicable. Thisexception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTION d. whilethe DOSE EQUIVALENT XE-133 LCO is not met. This exception is acceptable due to thesignificant conservatism incorporated into the RCS specific activity limit, the low probability ofan event which is limiting due to exceeding this limit, and the ability to restore transient-specificactivity excursions while the plant remains at, or proceeds to, POWER OPERATION.e_.If the required action and completion time of ACTION d. is not met, the reactor must be, broughtto HOT STANDBY (MODE 3) within 6 hours and COLD SHUTDOWN (MODE 5) within 36hours. The allowed completion times are reasonable, based on operating experience, to reach therequired plant conditions from full power conditions in an orderly manner and withoutchallenging plant systems.*SURVEILLANCE REQUIREMENTS4.4.8.1Surveillance Requirement 4.4.8.1 requires performing a gamma isotopic analysis as a measure ofthe noble gas specific activity of the reactor coolant. This measurement is the sum of the degassedgamma activities and the gaseous gamma activities in the sample taken. This SurveillanceRequirement provides an indication of any increase in the noble gas specific activity. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.Trending the results of this Surveillance Requirement allows proper remedial action to be takenbefore reaching the LCO limit under normal operating conditions.MILLSTONE -UNIT 2 B3444B 3/4 4-4d LBDCR 14-MP2-016September 4, 2014REACTOR COOLANT SYSTEMBASES3/4.4.8 SPECIFIC ACTIVITY (continued).SURVEILLANCE REQUIREMENTS (continued)4.4.8.1 (continued)Due to the inherent difficulty in detecting Kr-85 in a reactor coolant sample due to masking fromradioisotopes with similar decay energies, such as F-18 and 1-134, it is acceptable to include theminimum detectable activity for Kr-85 in the Surveillance Requirement 4.4.8.1 calculation. If aspecific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE- 133 is notdetected, it should be assumed to be present at the minimum detectable activity.A Note modifies the Surveillance Requirement to allow entry into and operation in MODE 4,MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows theSurveillance Requirement to be performed in those MODES, prior to entering MODE 1.4.4.8.2This Surveillance Requirement is performed to ensure iodine specific activity remains within theLCO limit during normal operation and following fast power changes when iodine spiking ismore apt to occur. The frequency specified in the Surveillance Frequency Control Program isadequate to trend changes in the iodine activity level. The frequency of between 2 and 6 hoursafter a power change __ 15% RTP within a 1 hour period is established because the iodine levelspeak during this time following iodine spike initiation; samples at other times would provideinaccurate results.The Note modifies this Surveillance Requirement to allow entry into and operation in MODE 4,MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows theSurveillance Requirement to be performed in those MODES, prior to entering MODE 1.REFERENCES1. 10CFR 50.67.2. Standard Review Plan (SRP) Section 15.0.1 "Radiological Consequence Analyses UsingAlternate Source Terms."3. FSAR, Section 14.1.5.4. FSAR, Section 14.6.3.MILLSTONE -UNIT 2 B3444B 3/4 4-4e March 18, 2008LBDCR 08-MP2-013REACTOR COOLANT SYSTEMBASES3/4.4.9 PRESSURE/TEMPERATURE LIMITS*All components in the Reactor Coolant System are designed to with-stand the effects ofcyclic loads due to system temperature and pressure changes. These cyclic loads are introducedby normal load transients, reactor trips, and startup and shutdown operations. The variouscategories of load cycles Used for design purposes are provided in Section 4.0 of the FSAR.During startup and shutdown, the rates of temperature and pressure changes are limited so that themaximum specified heatup and cooldown rates are consistent with the design assumptions andsatisfy the stress limits for cyclic operation. In addition, during heatup, and cooldown evolutions,the RCS ferriticmaterials transition between ductile and-brittle (non-ductile) behavior. Toprovide adequate protection, the pressure/temperature limits were developed in accordance withthe 10CFR5O Appendix G requirements to ensure the margins of safety against non-ductile failureare maintained during all normal and anticipated operational occurrences. These pressure!temperature limits are provided in Figures 3.4-2a and 3.4-2b and the heatup and cooldown ratesare contained in Table 3.4-2.During heatup, the thermal gradients in the reactor vessel wall produce thermal stresseswhichvary from compressive at the inner wall~to tensile at the outer wall. These thermallyinduced compressive stresses at the inside wall tend to alleviate the tensile stresses induced by theinternal pressure. Therefore, a pressure-temperature curve based on steady state conditions (i.e.,no thermal stresses) represents a lower bound of all similar curves for finite heatup rates when theinner wall of the vessel is treated as the governing location.The heatup analysis also covers the determination of pressure-temperature limitations forthe case in which the outer wall of the vessel *becomes the controlling location. The thermalgradients established during heatup produce tensile stresses at the outer wall of the vessel. Thesestresses are additive to the pressure induced tensile stresses which are already present. Thethermally induced* stresses at the outer wall of the vessel are tensile and are dependent on both therate of heatup and the time along the heatup ramp; therefore, a lower bound curve similar to thatdescribed for the heatup of the inner wall cannot be defined. Subsequently, for the cases in whichthe outer wall of the vessel becomes the stress controlling location, each heatup rate ofinterest must be analyzed on an individual basis.MILLSTONE -UNIT 2 B3445AedetN.2lgB 3/4 4-5Amendment No. 2-t4, July 1, 1998REACTOR COOLANT SYSTEMBASESThe heatup and cooldown limit curves (Figures 3.4-2a and 3.4-2b) are composite curveswhich were prepared by determining the most conservative case, with either the inside or outsidewall controlling, for any heatup or cooldown rates of up to the maximums described in TechnicalSpecification 3.4.9.1, Table 3.4-2. The heatup and cooldown curves were prepared based uponthe most limiting value of the predicted adjusted reference temperature at the end of the serviceperiod indicated on Figures 3.4-2a and 3.4-2b.Verification that RCS pressure and temperature conditions are within the limits of Figures3.4-2a and 3.4-2b and Table 3.4-2, at least once per 30 minutes, is required when undergoingplanned changes of___ 10°F or _> 100 psi. This frequency is considered reasonable since thielocation of interest during cooldown is over two inches (i.e. 1/4 t location) from the interface withthe reactor coolant. During heatup the location of interest is over six inches from .the interfacewith the reactor coolant. This c~ombined with the relatively large heat retention capability of thereactor vessel ensures that small temperature fluctuations such as those expected during normalheatup and cooldown evolutions do not challenge the structural integrity of the reactor vesselwhen monitored on a 30 minute frequency. The 30 minute time interval permits assessment andcorrection for minor deviations within a reasonable time.During RCS heatup and cooldown the magnitude of the stresses across the reactor vesselwall are controlled by restricting the rate of temperature change and the system pressure, TheRCS pressure/temperature limits are provided in Figures 3.4-2a and 3.4-2b, and the heatup andcooldown rates are contained in Table 3.4-2. The following guidelines should'be used tO ensurecompliance with the Technical Specification lim~its. _1. When changing RCS temperature, with any reactor coolant pumps in operation, the rateof temperature change is calculated by using RCS loop cold leg temperature indications.This also applies during parallel reactor coolant pump and shutdown cooling (SDC) pumpoperation because the RCS loop cold leg temperature is the best indication of thetemperature of the fluid in contact with the reactor vessel wall. Even though SDC returntemperature may be belowRCS cold leg temperature, the mixing of a large quantity ofRCS cold leg water and a small quantity of SDC return water will result in the temperatureof the water reaching the reactor vessel wall being very close to RCS cold legtemperature.2. When changing RCS temperature via natural circulation, the rate of temperature change iscalculated by using RCS loop cold leg temperature indications.3. When changing RCS temperature with only SDC in service, the rate of temperaturechange is calculated by using SDC return temperature indication.MILLSTONE -UNIT 2B 3/4 4-6MILLTON -NIT2 B3/44-6Amendment No. 94, 4-t--3, 4--70, 218 July 1, 1998REACTOR COOLANT SYSTEMBASES4. During the transition from natural circulation flow, to forced flow with SDC pumps, therate of temperature change is calculated by using RCS loop cold leg temperatureindications. SDC return temperature should be used to calculate the rate of temperaturechange after SDC is in service, RBCCW flow has been established to the SDC heatexchanger(s), and SDC return temperature has decreased below RCS cold legtemperature.5. During the transition from parallel reactor coolant pump and SDC pump operation, therate of temperature change is calculated by using RCS loop cold leg temperatureindications until all reactor coolant pumps are secured. SDC return temperature should beused to calculate the rate of temperature change after all reactor coolant pumps have beensecured.6. The temperature change limits are for a continuous one hour period. Verification ofoperation within the limit must compare the current RCS water temperature to the valuethat existed one hour before the current time. If the maximum temperature increase ordecrease, during this one hour period, exceeds the Technical Specification limit,appropriate action should be taken.7. When a new, more restrictive temperature change limit is approached, it will be necessaryto adjust the current temperature change rate such that as soon as the new rate applies, thetotal temperature change for the previous one hour does not exceed the new morerestrictive rate.The same principle applies when moving from one temperature change limit curve toanother. If the new curve is above the current curve (higher RCS pressure for a givenRCS temperature), the new curve will reduce the temperature change limit, it will benecessary to first ensure the new more restrictive temperature change limit will not beexceeded by looking at the total RCS temperature change for the previous one hour timeperiod. If the magnitude of the previous one hour temperature change will exceed thenew limit, RCS temperature should be stabilized to allow the thermal stresses to dissipate.This may require up to a one hour soak before RCS pressure may be raised within thelimits of the new curve.If the new curve is below the current curve (lower.RCS pressure for a given RCStemperature), the new curve will allow a higher temperature change limit. All that isnecessary is to lower RCS pressure, and then apply the new higher temperature changelimit.8. When performing evolutions that may result in rapid and significant temperature swings(e.g. placing SDC in service or shifting SDC heat exchangers), the total temperaturechange limit for the previous one hour period must not be exceeded. If a significanttemperature change is anticipated, and an RCS heatup or cooldown is in progress, theplant should be stabilized for up to one hour, before performing this type of evolution.Stabilizing the plant for up to one hour will allow the thernal stresses, from any previousRCS temperature change, to dissipate. This will allow rapid RCS temperature changes upto the applicable Technical Specification temperature change limit.MILLSTONE -UNIT 2B344.6AmnetNo21B 3/4 4-6aAmendment No. 21 8 LBDCR 05-MP2-003December 27, 2005REACTOR COOLANT SYSTEMBASESThe reactor vessel materials have been tested to determine their initial RTNDT; the resultsof these tests are shown in Table 4.6-1 of the Final Safety Analysis Report. Reactor operation andresultant fast neutron irradiation will cause an increase in the RTNDT. Therefore, an adjustedreference temperature, based upon the fluence, can be predicted using the methods described inRevision 2 to Regulatory Guide 1.99.The heatup and cooldown limit curves shown on Figures 3.4-2a and 3.4-2b includepredicted adjustments for this shift in RTNDT at the end of the applicable service period, as well asadjustments for possible uncertainties in the pressure and temperature sensing instruments. Theadjustments include the pressure and temperature instrument and loop uncertainties associatedwith the main control board displays, the pressure drop across the core (RCP operation), and theelevation differences between the location of the pressure transmitters and the vessel beltlineregion. In addition to these curve adjustments, the LTOP evaluation includes adjustments due tovalve stroke times, PORV circuitry reaction times, and valve discharge backpressure.The actual shift in RTNDT of the vessel material is established periodically duringoperation by removing and evaluating, in accordance with 1OCFR5O Appendix H, reactor vesselmaterial irradiation surveillance specimens installed near the inside wall of the reactor vessel inthe core area. Since the neutron spectra at the irradiation samples and vessel inside radius aresimilar, the measured transition shift for a sample can be correlated to the adjacent section of thereactor vessel. The heatup and cooldown curves must be recalculated when the ARTNDTdetermined from the surveillance capsule exceeds the calculated ARTNDT for the equivalentcapsule radiation exposure.The pressure-temperature limit lines shown on Figures 3.4-2a and 3.4-2b for reactorcriticality have been provided to assure compliance with the minimum temperature requirementsof Appendix G to 10 CFR 50 for reactor criticality. For inservice leak and hydrostatic testing, useof the heatup curve on Figure 3.4-2a and associated rates provide a conservative limit in lieu of acurve developed specifically for inservice leak and hydrostatic testing. Therefore, a separate leakand hydrostatic curve is not explicitly included on Figure 3.4-2a.The maximum RTNDT for all reactor coolant system pressure-retaining materials, with theexception of the reactor pressure vessel, has been determined to be 50°F. The Lowest ServiceTemperature limit is based upon this RTNDT since Article NB-2332 (Summer Addenda of 1972)of Section III of the ASME Boiler and Pressure Vessel Code requires the Lowest ServiceTemperature to be RTNDT + I1000F for piping, pumps and valves. Below this temperature, thesystem pressure must be limited to a maximum of 20% of the system's hydrostatic test pressure of3125 psia. Operation of the RCS within the limits of the heatup and cooldown curves will ensurecompliance with this requirement.MILLSTONE -UNIT 2 B 3/4 4-6b Amendment No. 2-18,Acknaowledged by NRC letter dated12/I19/06 LBDCR 06-MP2-041November 2, 2006REACTOR COOLANT SYSTEMBASESIncluded in this evaluation is consideration of flange protection in accordance with10 CFR 50, Appendix G. The requirement makes the minimum temperature RTNDT plus 90°F forhydrostatic test and RTND.T plus. 1200F fornonmal operation when the pressure .exceeds 20 percentof the preservice system hydrostatic test pressure. Since the flange region RTNDT has beencalculated to be 30°F,. the minimum flange pressurization temperature during normal operation is1 500F (163°F with instrument uncertainty) when the pressure exceeds 20% of the preservicehydrostatic pressure. Operation of the RCS Within the limits of the heatup and cooldown curveswill ensure compliance with this requirement.To establish the minimum boltup temperature, ASME Code Section XI, Appendix G,requires thet.ernperature~of the flange and-adjiacent, shell .-ad~head. reg~ion!s .shall! be. abo-ve -the.results in a minimum boltup temperature of 43°F. For additional conservatism, a minimum boltuptemperature of 70°F is specified on thie heatup and cooldown curves. The head and vessel flangeregion temperature must be greater than 700F, whenever any reactor vessel stud is tensioned.The Low Temperature Overpressure Protection (LTOP) System provides a physicalbarrier :againshtexceeding the IOC-FR50 Appendix G pressure/temaperature.-limits during, lowtemperature RCS operation either With a steam bubble in the pressurizer or during water solidconditions. This system consists of either two PORVs with a pressure setpoint 415 psia, or anRCS vent of sufficient size. Analysis has confirmed that the design basis mass addition transientdiscussed below will be mitigated by operation of the PORVs or by establishing an RCS vent ofsufficient size.The LTOP System is required to be OPERABLE when RCS cold leg temperature is at orbelow 2750F (Technical Specifidation 3.4.9.3). However, if the RCS is in MODE 6 and thereactor vessel head has been removed, a Vent of sufficient sizehas beenestablished such that RCSpressurization is not possible. Therefore, an LTOP System is not required (TechnicalSpecification 3.4.9.3 is not applicable).Adjusted Referenced Temperature (ART) is the RTNDT adjusted for radiation effects plusa margin term r-equired by Revision 2 of Regul~atory Guide 1.99. The LTOP System' is armed at atemperature which exceeds the limiting l/4t ART plus 50°F as required by ASME Section XI,Appendix G. For the operating period up to 54 EFPY, the limiting 1/4t ART is 175°F whicliresults in a minimum LTOP System enable temperature of at least 271 0F when corrected forinstrument uncertainty. The current value of 2750F will be retained.MILLSTONE.- UNIT 2 B 3/4 4-7 Amendment No. g0, :70, 94, -1-, 66,2-72,Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-041November 2, 2006REACTOR COOLANT SYSTEMBASESThe mass input analysis performed to ensure the LTOP System is capable of protecting thereactor vessel assumes that all pumps capable of injecting into the RCS start, and then one PORVfails to actuate (single active failure). Since the PORVs have limited relief capability, certain.administrative restrictions have been implemented to ensure that the mass input transient will notexceed the relief capacity of a PORV. The analysis has determinied two PORVs (assuming onePORV fails) are-sufficient if the mass addition transient is limited to the inadvertent start of onehigh pressure safety injection (HPSI) pump and two charging pumps when RCS temperature is ator below 2750F and above 190°F, and the inadvertent start of one charging pump When RCStemperature is at or below 190°F..The_ LTOP analysis assumes .oly...one PQRV open due. to. sin~gle a~civ.e:fai ue_,of the otherAppendix during owwttemperaiurecope~ation. ::'if-he-RGS i}s-;.*:-depressurized and vented through at least a 2.2 square inch vent,, the peak RCS pressure, resultingfrom the maximum mass input transient allowed by Technical specification 3.4.9.3, will notexceed 300 psig (SDC System suction side design pressure).When the RCS is at or below 190°F, additional pumping capacity can be. made capable ofin~ cingj .o ~h ..Q _b~y es~tablis~h~in!g an .R.C .S .ve~ntof _a~t.lea~s~t2.2..s~qu.a~re_.in~ches._ ._R~em ovin~g the_.pressurizer manway cover, pressurizer vent port cover or a pressurizer safety relief valve willresult in a passive vent of at least 2.2 square inches. Additionailmethods to establish the requiredRCS vent are acceptable, provided the proposed Vent has been evaluated to ensure the flowcharacteris'tics are equivalent to one of these.Establishing a pressurizer steam bubble of sufficient size will be sufficient to protect thereactor vessel from the energy addition transient associated with the start of an RCP, provided therestrictions contained in Technical Specification 3.4.1.3 are met. These restrictions limit the heatinput from. the secondary, syistem. They also ensure sufficient Steam *volume. exists in thepressurizer to accommodate thie insurge. No credit for PORV actuation Wvas assumed in the LTOPanalysis, of the energy addition transient.The restrictions apply only to the start of the first RCP. Once at least. one RCP is running,equilibrium is achieved between the primary and secondary temperatures, elimina~tipng anysignificant energy addition associated with the start of the second RCP.The LTOP restrictions are based on RCS cold leg temperature. This temperature Will bedetermined by using RCS cold leg temperature indication when RCPs are running, or naturalcirculation if it is occurring. Otherwise, SDC return temperature indication will be used.MILLSTONE -UNIT 2 B 3/4 4-7a Amendment No. S,Acknowledged By NRC July 5, 2007 LBDCR 09-MP2-017September 15, 2009REACTOR COOLANT SYSTEMBASESRestrictions on RCS makeup pumping capacity are included in Technical Specification3.4.9.3. These restrictions are based on balancing the requirements for LTOP and shutdown risk.For shutdown risk reduction, it is desirable to have maximum makeup capacity and to maintainthe RCS full (not vented). However, for LTOP it is desirable to minimize makeup capacity andvent the.RCS.. To satisfy these competing requirements, makeup pumps can be made not capableof injecting, but available at short notice.A charging~pump can be considered to be not capable of injecting into the RCS by use ofany of the following methods and the, appropriate administrative controls.1. Placing the motor circuit breaker in the open position.2. Removing the charging pump motor overload heaters from the charging pump circuit.3. Removing the charging pump motor controller from the motor control center.4. Placing a charging pump control switch in the. Pull-To-Lock (PTL) position.A HPSI pump can be considered to be not capable of injecting into the RCS by use of anyof the following methods and the appropriate administrative controls.1. Racking down the motor circuit breaker from the power supply circuit.2. Shutting and tagging the discharge valve with the key lock on the control panel(2-SI-654 or 2-SI-656).3. .Placing the pump control switch in the pull-to-lock position and removing the breakercontrol power fuses.4. Placing the pump control switch in the position and shutting the dischargevalve with the key lock on the control panel (2-SI-654 or 2-SI-656).These methods to prevent charging pumps and UPSI pumps from injecting into the RCS,when combined with the appropriate administrative controls, meet the requirement for twoindependent means to prevent pump injection as a result of a single failure or inadvertent singleaction.These methods prevent inadvertent pump injections while allowing manual actions torapidly restore the makeup capability if conditions require the use of additional charging or HPSIpumps for makeup in the event of a loss of RCS inventory or reduction in SHUTDOWNMARGIN.MILLSTONE -UNIT 2B 3/4 4-7bMILLTON -NIT B /4 -7bAmendment No. 2-28, -7-, 242-, LBDCR 05-MP2-003December 27, 2005REACTOR COOLANT SYSTEMBASESIf a loss of RCS inventory or reduction in SHUTDOWN MARGIN event occurs, theappropriate response will be to correct the situation by starting RCS makeup pumps. If the loss ofinventory or SHUTDOWN MARGIN is significant, this may necessitate the use of additionalRCS makeup pumps that are being maintained not capable of injecting into the RCS inaccordance with Technical Specification 3.4.9.3. The use of these additional pumps to restoreRCS inventory or SHUTDOWN MARGIN will require entry into the associated ACTIONstatement. The ACTION statement requires immediate action to comply with the specification.The restoration of RCS inventory or SHUTDOWN MARGIN can be. considered to be part of theimmediate actioni to restore the additional RCS makeup pumps to a not capable of injecting status.While recovering RCS inventory or SHUTDOWN MARGIN, RCS pressure will be maintainedbelow the Appendix G limits. After RCS inventory or SHUTDOWN MARGIN has beenrestored, the additional pumps should be immediately made not capable of injecting and theACTION statement exited.An exception to Technical Specification 3.0.4 is specified for Technical Specification3.4.9.3 to allow a plant cooldown to MODE 5 if one or both PORVs are inoperable. MODE 5conditions may be necessary to repair the PORV(s).3/4.4.10 DELETEDMILLSTONE -UNIT 2B 3/4 4-7cAmendment No. 248-, 3, 24-3, -264,Acknowledged by NRC letter dated12/119/06 May 8, 2002.BASES3/4.4.11 DELETEDMILLSTONE -UNIT 2B 314 4-BMILLTON -NIT2 B3/44-8 Amendment No. 266 REVERSE OF PAGE B 3/4 4-8INTENTIONALLY LEFT BLANK September 3, 19983/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES3/4.5.1 SAFETY INJECTION TANKSThe OPERABILITY of each of the RCS SITs ensures that a sufficient volume of borated waterwill be immediately forced into the reactor core through each of the cold legs in the event the RCSpressure falls below the pressure of the SITs. This initial surge of water into the core provides theinitial cooling mechanism during large RCS pipe ruptures.The limits on SIT volume, boron concentration and pressure ensure thaf the assumptions used forSIT injection in the accident analysis are met.If the boron concentration of one SIT is not within limits, it must be returned to within the limitswithin 72 hours. In this condition, ability to maintain subcriticality or minimum boronprecipitation time may be reduced, but the reduced concentration effects on core subcriticalityduring reflood are minor. Boiling of the ECCS water in the core during reflood concentrates theboron in the saturated liquid that remains in the core. In addition, the volume of the SIT is stillavailable for injection. Since the boron requirements are based on the average boronconcentration of the total volume of three SITs, the consequences are less severe than they wouldbe if a SIT were not available for injection. Thus, 72 hours is allowed to return the boronconcentration to within limits.If one SIT is inoperable, for a reason other than boron concentration or the inoperability of waterlevel or pressure channel instrumentation, the SIT must be returned to OPERABLE status within24 hours. In this condition, the required contents of three SITs cannot be assumed to reach thecore during a LOCA as is assumed in Appendix K to 1OCIFR50.Reference 1 provides a series of deterministic and probabilistic analysis findings that support 24hours as being either "risk beneficial" or "risk neutral" in comparison to shorter periods forrestoring the SIT to OPERABLE status. Reference 1 discusses recent best-estimate analysis thatconfirmed that for large-break LOCAs, core melt can be prevented by either operation of oneLPSI pump or the operation of one HPSI piunp and a single SIT. Reference 1 also discussesplant-specific probabilistic analysis that evaluated the risk-impact of the 24 hour recovery periodin comparison to shorter recovery periods.If the SIT cannot be restored to OPERABLE status within the associated completion time, theplant must be brought to a MODE in which the LCO does not apply. To achieve this' status, theplant must be brought to at least MODE 3Reference1 CE NPSD-994, "CEOG Joint Applications Report on Safety Injection Tank AOT/SITExtension," April 1995.MILLSTONE -UNIT 2B 3/4 5-1MILSTOE -UNI 2 3/4-l Amendment No. 64-, 7-2;, 59, 24--7, 220 September 9, 20043/4.5 EMERGENCY CORE COOLING SYSTEMS (EGGS)BASES3/4.5.1 SAFETY INJECTION TANKS (continued)within 6 hours and pressurizer pressure reduced to < 1750 psia within 12 hours. The allowedcompletion times are reasonable, based on operating experience, to reach the required plantcondition from full power conditions in an orderly manner and without challenging plant systems.If more than one SIT is inoperable, the unit is in a condition outside the accident analyses.Therefore, LCO 3.0.3 must be entered immediately.LCO 3.5.1 .a requires that each reactor coolant system safety injection tank shall be OPERABLEwith the isolation valve open and the power to the valve operator removed.This is to ensure that the valve is open and cannot be inadvertently closed. To meet LCO 3.5.1.arequirements, the valve operator is considered to be the valve motor and not the motor controlcircuit. Removing the closing coil while maintaining the breaker closed meets the intent of theTechnical Specification by ensuring that the valve cannot be inadvertently closed.Removing the closing coil and verifying that the closing coil is removed (Per SR 4.5.1 .e) meetsthe Technical Specification because it prevents energizing the valve operator to position the valvein the close direction.noOpeninga ialthe otnbreakersi ein lieu of removing the closing coil, to remove power to the valve operator isO i1. Millstone Unit 2 Safety Evaluation Report (SER) Docket No. 50-336, dated May 10,1974, requires two independent means of position indication.2. Surveillance Requirement 4.5.1 .a requires the control/indication circuit to be energized, toverify that the valve is open.3. Technical Specification 3/4.3.2, Engineered Safety Feature Actuation SystemInstrumentation, requires these valves to open on a SIAS signal.Opening the breaker would eliminate the ability to satisfy the above three items.3/4.5.2 and 3/4.5.3 EGGS SUBSYSTEMSThe OPERABILITY of two separate and independent EGGS subsystems ensures that sufficientemergency core cooling capability will be available in the event of a LOCA assuming the loss ofone subsystem through any single failure consideration. Either subsystem operating inconjunction with the safety injection tanks is capable of supplying sufficient core cooling to limitthe peak cladding temperatures within acceptable limits for all postulated break sizes rangingfrom the double ended break of the largest RCS cold leg pipe downward.MILLSTONE -UNIT 2 B 3/4 5-2 Amendment No. 6t1-, :h3 59, N-1-7, 20,-2-3, 283 LBDCR 04-MP2-016February 24, 20053/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued)Each Emergency Core Cooling System (ECCS) subsystem required by Technical Specification3.5.2 for design basis accident mitigation includes an OPERABLE high pressure safety injection(HIPSI) pump and a low pressure safety injection (LPSI) pump. Each of these pumps requires anOPERABLE flow path capable of taking suction from the refueling water storage tank (RWST)on a safety injection actuation signal (SIAS). Upon depletion of the inventory in the RWST, asindicated by the generation of a Sump Recirculation Actuation Signal (SPAS), the suction for theHPSI pumps will automatically be transferred to the contaimnent sump. The SRAS will alsosecure the LPSI pumps. The ECCS subsystems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) asdesign basis accident mitigation equipment.Flow from the charging pumps is no longer required for design basis accident mitigation. Theloss of coolant accident analysis has been revised and no credit is taken for charging pump flow.As a result, the charging pumps no longer meet the first three criteria of 10OCFR 50.36 (c)(2)(ii) asdesign basis accident mitigation equipment required to be controlled by Technical Specifications.In addition, risk evaluations have been performed to demonstrate that the charging system is notrisk significant as defined in 1OCFR 50.3 6(c)(2)(ii) Criterion 4. However, the charging system iscredited in the PRA model for mitigating two beyond design basis events, Anticipated TransientsWithout Scram (ATWS) and Complete Loss of Secondary Heat Sink. On this basis, therequirements for charging pump OPERABILITY will be retained in Technical Specification3.5.2. Consistent with the surveillance requirements, only the charging pump will be included indetermining ECCS subsystem OPERABILITY.As a result of the risk insight, the charging pump will be included as an Emergency Core CoolingSystem subsystem required by Technical Specification 3.5.2. That is, an. ECCS subsystem willinclude one OPERABLE charging pump. The charging pump credited for each ECCS subsystemmust meet the surveillance requirements specified in Section 4.5.2. Consistent with the riskinsights, automatic start of the charging pump is not required for compliance to TS 3.5.2. Thus,Section 4.5.2 does not specify any testing requirements for the automatic start of the creditedcharging pump. Similarly, since the ECCS flow path is not credited in the riskevaluation, thereare no charging flow path requirements included in TS 3.5.2.The requirements for automatic actuation of the charging pumps and the associated borationsystem components (boric acid pumps, gravity feed valves, boric acid flow path valves), whichalign the boric acid storage tanks to the charging pump suction on a SIAS have been relocated tothe Technical Requirements Manual. These relocated requirements do not affect theOPERABILITY of the charging pumps for Technical Specification 3.5.2MILLSTONE -UNIT 2 B 3/4 5-2a Amendment No. 6-t-, 7-2, 4-5-9, 1-, 2-, 36,Acknowledged by NRC letter dated 6/28/05 LBDCR i4-MP2-016September 4, 20143/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued)Surveillance Requirement 4.5.2.a verifies the correct alignment for manual, power operated, andautomatic valves in the ECCS flow paths to provtide assurance that the proper flow paths will existfor ECCS operation. This surveillance does not apply to valves that are locked, sealed, orotherwise secured in position; since these valves were verified to be in the correct position prior tolocking, sealing, or securing. A valve that receives an actuation signal is allowed to be in anonaccident position provided the valve automatically repositions within the proper stroke time.This surveillance does not require any testing or valve manipulation. Rather, it involvesverification that those valves capable of being mispositioned are in the correct position. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.5.2.b verifies proper valve position to ensure that the flow path fromthe ECCS pumps to the RCS is maintained. Misalignment of these valves could render bothECCS trains inoperable. Securing these valves in position by removing power to the valveoperator ensures that the valves cannot be inadvertently misalig-ned or change position as theresult of an active failure. The surveillance frequency is controlled under the SurveillanceFrequency Control Program.Surveillance Requirements 4.5.2.c and 4.5.2.d, which address periodic surveillance testing of the ECCS pumps (high pressure and low pressure safety injection pumps) to detect gross degradation 0-caused by impeller structural damage or other hydraulic component problems, is required by theASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OM Code). Thistype of testing may be accomplished by measuring the pump developed head at only one point ofthe pump characteristic curve. This verifies both that the measured performance is within anacceptable tolerance of the original pump baseline performance and that the performance at thetest flow is greater than or equal to the perfonnance assumed in the unit safety analysis. Thesurveillance requirements are specified in the Inservice Testing Program. The ASME OM Codeprovides the activities and frequencies necessary to satisfy the requirements.Surveillance Requirement 4.5 .2.e, which addresses periodic surveillance testing of the chargingpumps to detect gross degradation caused by hydraulic component problems, is required by theASMIfE OM Code. For positive displacement pumps, this type of testing may be accomplished bycomparing the measured pump flow, discharge pressure and vibration to their respectiveacceptance criteria. Acceptance criteria are verified to bound the assumptions utilized in accidentanalyses. This verifies both that the measured performance is within an acceptable tolerance ofthe original pump baseline performance and that the performance at the test point is greater thanor equal to the performance assumed for mitigation of the beyond design basis events. Thesurveillance requirements are specified in the Inservice Testing Program. The ASIME OM Codeprovides the activities and frequencies necessary to satisfy the requirements.MILLSTONE -UNIT 2 B 3/4 5-2b Amendment No. 45-, 6-1-, 7-, 4-l-9, 8-5,4-t6,24al-7, -220, 2, 2a34, 2 LBDCR 14-MP2-016September 4, 20143/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued)Surveillance Requirements 4.5.2.f, 4.5.2.g, and 4.5.2.h demonstrate that each automatic ECCSflow path valve actuates to the required position on, an actual or simulated actuation signal (SIASor SRAS), that each ECCS pump starts on receipt of an actual or simulated actuation signal(SIAS), and that the LPSI pumps stop on receipt of an actual or simulated actuation signal(SRAS). This surveillance is not required for valves that are locked, sealed, or otherwise securedin the required position under administrative controls. The surveillance frequency is controlledunder the Surveillantce Frequency Control Program. The actuation logic is tested as part of theEngineered Safety Feature Actuation System (ESFAS) testing, and equipment perfonnance ismonitored as part of the Inservice Testing Program.Surveillance Requirement 4.5.2.i verifies the high and low pressure safety injection valves listedin Table 4.5-1 will align to the required positions on an SIAS for proper. ECCS performance. Thesafety injection valves have stops to position them properly so that flow is restricted to a rupturedcold leg, ensuring that the other cold legs receive at least the required minimum flow. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.5 .2.j addresses periodic inspection of the containment sump toensure that it is unrestricted and stays in proper operating condition. The surveillance fr'equency iscontrolled under the Surveillance Frequency Control Program.Surveillance Requirement 4.5.2.k verifies that the Shutdown Cooling (SDC) System openpermissive interlock is OPERABLE to ensure the SDC suction isolation valves are preventedfrom being remotely opened when RCS pressure is at or above the SDC suction design pressureof 300 psia. The suction piping of the SDC pumps (low pressure safety injection pumps) is theSDC component with the limiting design pressure rating. The interlock provides assurance thatdouble isolation of the SDC System from the RCS is preserved whenever RCS pressure is at orabove the design pressure. The surveillance frequency is controlled under the SurveillanceFrequency Control Program.MILLSTONE -UNIT 2 B 3/4 5-2c Amendment No. 4-5, 4-59, Ig-, 2-1-5,2-46, -220, 22g, 24--6, 28g3 LBDCR 04-MP2-016February 24, 20053/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES314.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continuedOnly one EGGS subsystem is required by Technical Specification 3.5.3 for design basis accidentmitigation. This ECGS subsystem requires one OPERABLE I-PSI pump and an OPERABLEflow path capable of taking suction from the RWST on a SIAS. Upon depletion of the inventoryin the RWST, as indicated by the generation of a SRAS, the suction for the I!WSI pump willautomatically be transferred to the containment sump. This ECCS subsystem satisfies Criterion 3of 10 CFR 50.36(c)(2)(ii) as design basis accident mitigation equipment.Surveillance Requirement 4.5.3.1 specifies the surveillance requirements of TechnicalSpecification 3.5.3 that are required to demonstrate that the required EGGS subsystem ofTechnical Specification 3.5.3 is OPERABLE. The required ECCS subsystem of TechnicalSpecification 3.5.3 does not include any LPSI components. LPSI components are not requiredwhen Teclnical Specification 3.5.3 is applicable to allow the LPSI components to be used forSDC System operation.In MODE 4 the automatic safety injection signal generated by low pressurizer pressure and highcontainment pressure and the automatic sump recirculation actuation signal generation by lowrefueling water storage tank level are not required to be OPERABLE. Automatic actuation in dMODE 4 is not required because adequate time is available for plant operators to evaluate plant 0conditions and respond by manually operating engineered safety features components. Since themanual actuation (trip pushbuttons) portion of the safety injection and sump recirculationactuation signal generation is required to be OPERABLE in MODE 4, the plant operators can usethe manual trip pushbuttons to rapidly position all components to the required accident position.Therefore, the safety injection and sump recirculation actuation trip Pushbuttons satisfy therequirement for generation of safety injection and sump reciixculation a~ctuation signals inMODE 4.In MODE 4, the OPERABLE U-IPSI pump is not required to start automatically on a SIAS.Therefore, the pump control switch for this OPERABLE pump may be placed in the pull-to-lockposition without affecting the OPERABILITY of the pump. This will prevent the pump fromstarting automatically, which could result in overpressurization of the Shutdown Cooling System.Only one H-PSI pump may be OPERABLE in MODE 4 with RCS temperatures less than or equalto 275°F due to the restricted relief capacity with Low-Temperature Oveirpressure ProtectionSystem. To reduce shutdown risk by having additional pumping capacity readily available, aHPSI pump may be made inoperable but available at short notice by shutting its discharge valvewith the key lock on the control panel.MILLSTONE -UNIT 2 B 3/4 5-2d Amendment No. 4-5, 4-1-g, -,O-2-2-, -,Acknowledged by NRC letter dated 6/28/05 LBDCR 10-MP2-016May 16, 20113/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES:3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued)The provision in Specification 3.5.3 that Specifications 3.0.4 and 4.0.4 are not applicable for entryinto MODE 4 is provided to allow for connecting the HPSI pump breaker to the respective powersupply or to remove the tag and open the discharge valve, and perform~ the subsequent testingnecessary to declare the inoperable HPSI pump OPERABLE. Specification 3.4.9.3 requires allHPSI pumps to be not capable of injecting into the RCS when RCS temperature is at orbelow I90°F. Once RCS temperature is above 190°F one HPSI pump can be capable of injectinginto the RCS. However, sufficient time may not be available to ensure one HPSI pump isOPERABLE prior to entering MODE 4 as required by Specification 3.5.3. Since Specifications*3.0.4 and 4.0.4 prohibit a MODE change in this situation, this exemption will allow Millstone* Unit No. 2 to enter MODE 4, take the steps necessary to make the HPSI pump capable of"injecting into the RCS, arid then declare the pump OPERABLE. If it is necessary to use thisexemption during plant heatup, the appropriate ACTION statement of Specification 3.5.3 shouldbe entered as soon as MODE 4 is reached.3/4.5.4 REFUELING WATER STORAGE TANX (RWST)The OPERABILITY of the RWST as part of the ECCS ensures that a sufficient supply of boratedwater is available for injection by the ECCS in the event of a LOCA. A minimum usable volumeof 370,000 gallons is required for ECCS injection above the earliest or highest level of SRASinitiation accounting for indicator accuracy. The limits on RWST minimum volume and boronconcentration ensure that 1) sufficient water is available within containment to permitrecirculation cooling flow to the core, anid 2) after a LOCA the reactor will remain subcritical inthe cold condition following mixing of the RWST and the RCS water volumes. Small breakLOCAs assume that all control rods are inserted, except for the control element assembly (CEA)of highest worth, which remains withdrawn from the core. Large break LOCAs assume that allCEAs remain withdrawn from the core.MILLSTONE -UNIT 2 B 3/4 5-2e Amendment No. 28-3-,Acknowledged by NRC letter dated 6/28/05 LBDCR 05-MP2-001February 10, 2005EMERGENCY CORE COOLING SYSTEMSBASES3/45.5 TRISODIUM PHOSPHATE (TSP)BACKGROUNDTrisodium phosphate (TSP) is placed on the floor or in the sump of the containment building toensure that iodine, which may be dissolved in the recirculated reactor cooling water following aloss of coolant accident (LOCA), remains in solution. TSP also helps inhibit stress corrosioncracking (SCC) of austenitic stainless steel components in containment during the recirculationphase following an accident.Fuel that is damaged during a LOCA will release iodine in several chemical forns to the reactorcoolant and to the containment atmosphere. A portion of the iodine in the containmentatmosphere is washed to the sump by containment sprays. The emergency core cooling water isborated for reactivity control. This borated water causes the sump solution to be acidic. In a lowpH (acidic) solution, dissolved iodine will be converted to a volatile form. The yolatile iodinewill evolve out of solution into the containment atmosphere, significantly increasing the levels ofairborne iodine. The increased levels of airborne iodine in containment contribute to theradiological releases and increase the consequences from the accident due to containmentatmosphere leakage.After a LOCA, the components of the core cooling and containment spray systems will beexposed to high temperature borated water. Prolonged exposure to the core cooling watercombined with stresses imposed on the components can cause SCC. The SCC is a function ofstress, oxygen and chloride concentrations, pH, temperature, and alloy composition of thecomponents. High temperatures and low pH, which would be present after a LOCA, tend topromote SCC. This can lead to the failure of necessary safety systems or components.Adjusting the pH of the recirculation solution to levels above 7.0 prevents a significant fraction ofthe dissolved iodine from converting to a volatile form. The higher pH thus decreases the level ofairborne iodine in containment and reduces the radiological consequences from containmentatmosphere leakage following a LOCA. Maintaining the solution pH above 7.0 also reduces theoccurrence of SCC of austenitic stainless steel components in containment. Reducing SCCreduces the probability of failure of components.MILLSTONE -UNIT 2 B 3/4 5-3 Amendment No. a-!-7g,Acknowledged by NRC letter dated12/!19/06 LBDOR 05-MP2-001February 10, 2005EMvERGENCY CORE COOLING SYSTEMSBASES3/4.5.5 TRISODIUM PHOSPIHATE (TSP)BACKGROUND (continued)TSP is employed as a passive form of pHI control for post LOCA containm-ent spray and corecooling water. Baskets of TSP are placed on the floor or in the sump of the containment buildingto dissolve from released reactor coolant water and containment sprays after a LOCA.Recirculation of the water for core cooling and containment sprays then provides mixing toachieve a uniform solution pH. The hydrated form (45- 57% moisture) of TSP is used because ofthe high humidity in the containment building during normal operation. Since the TSP ishydrated, it is less likely to absorb large amounts of water from the humid atmosphere and willundergo less physical and chemical change than the anhydrous form of TSP.APPLICABLE SAFETY ANALYSESThe LOCA radiological consequences analysis takes credit for iodine retention in the sumpsolution based on the recirculation water pH being _> 7.0. The radionuclide releases from thecontainment atmosphere and the consequences of a LOCA would be increased if the pH of therecirculation water were not adjusted to 7.0 or above.LIMITING CONDITION FOR OPERATIONThe TSP is required to adjust the pH of the recirculation water to > 7.0 after a LOCA. A pH >7.0is necessary to prevent significant.amounts of iodine released from fuel failures and dissolved inthe recirculation water from converting to a volatile fonnl and evolving into the containmentatmosphere. Higher levels of airborne iodine in contaimnlent may increase the release ofradionuclides and the consequences of the accident. A pH > 7.0 is also necessary to prevent SCCof austenitic stainless steel components in containment. SeCCincreases the probability of failureof components.The required amount of TSP is based upon the extreme cases of Water volume and pH possible inthe containment sump after a large break LOCA. The minimum required volume is the volume ofTSP that will achieve a sump solution pH of > 7.0 when taking into consideration the maximumpossible sump water volume and the minimum possible pH. The amount of TSP needed in thecontainment building is based on the mass of TSP required to achieve the desired pH. However, a.required volume is specified, rather than mass, since it is not feasible to weigh the entire amountof TSP in containment. The minimum required volume is based on the manufactured density ofTSP. Since TSP can have a tendency to agglomerate from high humidity in the containmentbuilding, the density may increase and the volume decrease during normal plant operation. Dueto possible agglomeration and increase in density, estimating the minimum volume of TSP incontaimnent is conservative with respect to achieving a minimum required pH.MVILLSTONE -UNIT 2 B 3/4 5-4 Amendment No.Acknowledged by NRC letter dated12/19/06 LBDCR 14-MIP2-016September 4, 2014EMERGENCY CORE COOLING SYSTEMSBASES '3/4.5.5 TRISODIUM PHOSPHATE (TSP') (continued)APPLICABILITYIn MODES 1, 2, and 3, the RCS is at elevated temperature and pressure, providing an energypotential for a LOCA. The potential for a LOCA results in a need for the ability to control the pHof the recirculated coolant.In MODES 4, 5, and 6, the potential for a LOCA is reduced or nonexistent, and TSP is notrequired.ACTIONSIf it is discovered that the TSP in the containment building sump is not within limits, action mustbe taken to restore the TSP to within limits. During plant operation the containment sump is notaccessible and corrections may not be possible.The completion time of 72 hours is allowed for restoring the TSP within limits because 72 hoursis the same time allowed for restoration of other ECCS components. LIf the TSP cannot be restored within limits within the 72 hour completion time, the plant must bebrought to a MODE inl which the LCO does not apply. The specified completion times forreaching MODES 3 and 4 were chosen to allow reaching the specified conditions from full powerin an orderly manner without challenging plant systems.SURVEILLANCE REQUIREMENTS ..Surveillance Requirement 4.5.5.1Periodic determination of the volume of TSP in containment must be performed due to thepossibility of leaking valves and components in the containment building that could causedissolution of the TSP during normal operation. This periodic surveillance is required todetermine visually that a minimum of 282 cubic feet is contained in the TSP baskets. Thisrequirement ensures that there is an adequate volume of TSP to adjust the pH of the post LOCAsump solution to a value _> 7.0. The surveillance frequency is controlled under the SurveillanceFrequency Control Program.MILLSTONE -UNIT 2 B 3/4 5-5 Amcndmcnt,.,,, N,,y I'LR " lott.e. d..LLVI LBDCR 14-MrP2-016September 4, 2014EMERGENCY COPE COOLING SYSTEMSBASES3/4.5.5 TRISODITUM PHOSPHATE (TSP') (continued)Surveillance Requirement 4.5.5.2Testing must be performed to ensure the solubility and buffering ability of the TSP after exposureto the containment environment. Passing this test verifies the TSP is active and providesassurance that the stored TSP will dissolve in borated water at postulated post-LOCAtemperatures. This test is performed by submerging a sample of 0 .6662 +/- 0.0266 grams of TSPfrom one of the baskets in containment in 250 +/- 10 milliliters of water at a boron concentration of2482 +/- 20 ppm, and a temperature of 77+/-+ 5°F. Without agitation, the solution is allowed to standfor four hours. The liquid is then decanted, mixed, and the pH measured. The pH must be > 7.0.The TSP sample weight is based on the minimum required TSP mass of 12,042 pounds, which atthe manufactured density corresponds to the minimum volume of 223 f& (The minimumTechnical Specification requirement of 282 ft3 is based on 223 ft3 of TSP for boric acidneutralization and 59 ft3 of TSP for neutralization of hydrochloric and nitric acids.), and themaximum sump water volume (at 77°F) following a LOCA of 2,046,441 liters, normalized tobuffer a 250 +/- 10 milliliter sample. The boron concentration of the test water is representative ofthe maximum possible concentration in the sump following a LOCA. Agitation of the testsolution is prohibited during TSP dissolution since an adequate standard for the agitation intensitycannot be specified. The dissolution time of four hours is necessary to allow time for the dissolvedTSP to naturally diffuse through the sample solution. In the containmnent sump following aLOCA, rapid mixing will occur, significantly decreasing the actual amount of time before therequired pH is achieved. The solution is decanted after the four hour period to remove anyundissolved TSP prior to mixing and pH measurement. Mixing is necessary for proper operationof the pH instrument. The surveillance frequency is controlled under the Surveillance Frequency [Control Program ...MILLSTONE -UNIT 2 B 3/4 5-6 Amznmon N...÷,T.........d.e by, RC ........r dated REVERSE OF PAGE B 3/4 5-6INTENTIONALLY LEFT BLANK LBDCR 05-MP2-029December 9, 20083/4.6 CONTAINMENT SYSTEMSBASES3/4.6.1 PRIMARY CONTAINMENT3/4.6.1. 1 CONTAINMENT INTEGRITYPrimary CONTAINMENT INTEGRITY ensures that the release of radioactive materialsfrom the containment atmosphere will be restricted to those leakage paths and associated leakrates assumed in the accident analyses. Thisrestriction, in conjunction with the leakage ratelimitation, will limit the SITE BOUNDARY radiation doses to within the limits of 10 CFR 50.67during accident conditions.Primary CONTAINMENT INTEGRITY is required in MODES 1 through 4. This requiresan OPERABLE containment automatic isolation valve system. In MODES 1, 2, and 3 this issatisfied by the automatic containment isolation signals generated by low pressurizer pressure andhigh containment pressure. In MODE 4 the automatic containment isolation signals generated bylow pressurizer pressure and high containment pressure are not required to be OPERABLE.Automatic actuation of the containment isolation system in MODE 4 is not required becauseadequate time is available for plant operators to evaluate plant. conditions and respond bymanually operating engineered safety features components. Since the manual actuation (trippushbuttons) portion of the containment isolation system is required to be OPERABLE in MODE4, the plant operators can use the manual pushbuttons to rapidly position all automaticcontainment isolation valves to the required accident position. Therefore, the containmentisolation trip pushbuttons satisfy the requirement for an OPERABLE containment automaticisolation valve system in MODE 4.3/4.6.1.2 CONTAINMENT LEAKAGEThe limitations on containment leakage rates ensure that the total containment leakagevolume will not exceed the value assumed in the accident analyses at thlepeak accident pressureof Pa. As an added conservatism, the measured overall integrated leakage rate is further limited to< 0.75 La during performance of the periodic tests to account for possible degradation of thecontainment leakage barriers between leakage tests.The surveillance testing for measuring leakage rates is in accordance with theContainment Leakage Rate Testing Program.The Millstone Unit No. 2 FSAR contains a list of the containment penetrations that havebeen identified as secondary containment bypass leakage paths.3/4.6.1.3 CONTAINMENT AIR LOCKSThe limitations on closure and leak rate for the containment air locks are required to meetthe restrictions on CONTAINMENT INTEGRITY and leak rate given in Specifications 3.6.1.1andMILLSTONE -UNIT 2B3/4 6-1MILLTON -NIT2 B3/46-1Amendment No. 41-24, 34, April 14, 19993/4.6 CONTAINMENT SYSTEMSBASES3.6.1.2. The limitations on the air locks allow entry and exit into and out of the containmentduring operation and ensure through the surveillance testing that air lock leakage will not becomeexcessive through continuous usage.The ACTION requirements are modified by a Note that allows entry and exit to performrepairs on the affected air lock components. This means there may be a short time during whichthe containment boundary is not intact (e.g., during access through the OPERABLE door). Theability to open the OPERABLE door, even if it means the containment boundary is temporarilynot intact, is acceptable due to the low probability of an event that could pressurize thecontainment during the short time in which the OPERABLE door is expected to be open. Aftereach entry and exit, the OPERABLE door must be immediately closed.ACTION a. is only applicable when one air lock door is inoperable. With only one air lockdoor inoperable, the remaining OPERABLE air lock door must be verified closed within 1 hour.This ensures a leak tight containment barrier is maintained by use of the remaining OPERABLEair lock door. The 1 hour requirement is consistent with the requirements of TechnicalSpecification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, the remainingOPERABLE air lock door must be locked closed within 24 hours and' then verified periodically toensure an acceptable containment leakage boundary is maintained. Otherwise, a plant shutdown isrequired.ACTION b. is only applicable when the air lock door interlock mechanism is inoperable.With only the air lock interlock mechanism inoperable, an OPERABLE air lock door must beverified closed within 1 hour. This ensures a leak tight containment is maintained by use of anOPERABLE air lock door. The 1 hour requirement is consistent with the requirements ofTechnical Specification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, anOPERABLE air lock door must be locked closed within 24 hours and then verified periodically toensure an acceptable containment leakage boundary is maintained. Otherwise, a plant shutdown isrequired. In addition, entry into and exit from containment under the control of a dedicatedindividual stationed at the air lock to ensure that only one door is opened at a time (i.e., theindividual performs the function of the interlock) is permitted.ACTION c. is applicable when both air lock doors are inoperable, or the air lock isinoperable for any other reason excluding the door interlock mechanism. With both air lock doorsinoperable or the air lock otherwise inoperable, an evaluation of the overall containment leakagerate per Specification 3.6.1.2 shall be initiated immediately, and an air lock door must be verifiedclosed within 1 hour. An evaluation is acceptable since it is overly conservative to immediatelydeclare the containment inoperable if both doors in the air Jock have failed a seal test or if overallair lock leakage is not within limits. In many instances (e.g., only one seal per door has failed),containment remains OPERABLE, yet only 1 hour (per Specification 3.6.1.1) would be providedto restore the air lock to OPERABLE status prior to requiring a plant shutdown. In addition, evenwith both doors failing the seal test, the overall containment leakage rate can still be withinlimits.The 1 hour requirement is consistent with the requirements of Technical Specification3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, the air lock and/or at least one airlock door must be restored to OPERABLE status within 24 hours or a plant shutdown is required.MILLSTONE -UNIT 2B 3/4 6-1aMILLTON -NIT B /4 -laAmendment No. 34, 267 June 7, 2002CONTAINMENT SYSTEMSBASESContinuedSurveillance Requirement 4.6.1 .3.1 verifies leakage through the containment air lock iswithin the requirements specified in the Containment Leakage Rate Testing Program. Thecontainment air lock leakage results are accounted for in the combined Type B and C containmentleakage rate. Failure of an air lock door does not invalidate the previous satisfactory overall airlock leakage test because either air lock door is capable of providing a fission product barrier inthe event of a design basis accident.MILLSTONE -UNIT 2AmnetNo26B 3/4 6-lbAmendment No. 267 July 25, 2003CONASNENESSTMBASES3/4.6.1.4 INTERNAL PRESSUREThe limitations on containment internal pressure ensure that the containment peakpressure does not exceed the design pressure of 54 psig during MSLB or LOCA conditions.The maximum peak pressure is obtained from a MSLB event. The limit of 1.0 psig forinitial positive containment pressure will limit the total pressure to less than the design pressureand is consistent with the accident analyses.3/4.6.1.5 AIR TEMPERATUREThe limitation on containment air temperature ensures that the containment airtemperature does not exceed the worst case combined LOCA/MvSLB air temperature profile andthe liner temperature of 289°F. The containment air and liner temperature limits are consistentwith the accident analyses.The temperature detectors used to monitor primary containment air temperature arelocated on the 38 ft. 6 in. floor elevation in containment. The detectors are located approximately6 feet above the floor, on the southeast and southwest containment walls.3/4.6.1.6 DELETED%MILLSTONE -UNIT 2B 3/4 6-2Amendment No. 2-5, -3, 1-39, 204,-2-09, 9, 278 LBDCR 14-MIP2-001May 20, 2014CONTAINMENT SYSTEMSBASES314.6.2 DEPRESSURIZATION ANTD COOLING SYSTEMS3/4.6.2.1 CONTATNMENT SPRAY AND COOLING SYSTEMSThe OPERABILITY of the containment spray system ensures that contaimnentdepressurization and cooling capability will be available in the event of a LOCA. The pressurereduction and resultant lower containment leakage rate are consistent with the assumptions usedin the accident analyses.The OPERABILITY of the containment cooling system ensures that 1) the containmentair temperature will be maintained within limits during normal operation, and 2) adequate heatremoval capacity is available when operated in conjunction with the containment spray systemduring post-LOCA conditions.To be OPERABLE, the two trains of the containment spray system shall be capable oftaking a suction from the refueling water storage tank on a containmenat spray actuation signal andautomatically transferring suction to the containment surnp on a sump recirculation actuationsignal. Each containment spray train flow path fr'om the containmrent sump shall be via anOPERABLE shutdown cooling heat exchanger.'The containment cooling system consists of two containment cooling trains. Eachcontainment cooling train has two containment air recirculation and cooling units. For the purposeof applying the appropriate ACTION statement, the loss of a single containment air recirculationand cooling unit will make the respective containment cooling train inoperable.Either the containmrent spray system or the containment cooling system is sufficient tomitigate a loss of coolant accident. The containmaent spray system is nmore effective than thecontainment cooling system in reducing thetemperature of superheated steam inside containmentfollowing a mafin steam line break. Because of this, the containment spray system is required tomitigate a main steam line break accidenat inside cdntainmaent, In addition, the containment spraysystem provides a mechanism for removing iodine fr-om the containment atmosphere. Therefore,at least one train of containment spray is required to be OPERABLE when pressurizer pressure is> 1750 psia, and the allowed outage time for one train of containment spray reflects the dualfunction of containment spray for heat removal and iodine removal.With one containment spray train inoperable, the inoperable containment spray train mustbe restored to OPERABLE status within 72 hours. In this Condition, the remaining OPERABLEspray and cooling trains are adequate to perform the iodine removal and containment coolingfunctions. The 72 hours allowed outage time takes into account the redundant heat removalcapability afforded by the Contafinment Spray System and reason~able time for repairs.MILLSTONE -UNIT 2 B 3/4 6-3 Anmendment No. 2-5, 6-, o2---0, 4-l-, 2-s, -6, LBDCR 14-MIP2-001May 20, 2014CONTAINMENT SYSTEMSBASES3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued)With one required containment cooling train inoperable, the inoperable containmentcooling train must be restored to OPERABLE status within 7 days. The components in thisdegraded condition are capable of providing greater than 100% of the heat removal needs (for thecondition of one containment cooling train inoperable) after an accident.With one containmaent spray train and one containment cooling train inoperable, one*required containment spray train or one required containment cooling train must be restored toOPERABLE status within 48 hours. The components in this degraded condition provide iodineremoval capabilities and are capable of providing at least 100% of the heat removal needs after anaccident. The 48 hour allowed outage time was developed taking into account the redundant heatremoval capabilities afforded by combinations of the Containment Spray System andContainment Cooling System, the iodine removal function of the Containment Spray System, andthe low probability of a DBA occurring during this period.With two required containment spray trains inoperable, at least one of the requiredcontainment spray trains must be restored to OPERABLE status within 24 hours. Both trains ofcontainment cooling must be OPERABLE or be in H-OT SI{UTD OWN within the next 12 hours.The Condition is modified by a Note stating it is not applicable if the second containment spray train is intentionally declared inoperable. The Condition does not apply to voluntaiy removal ofredundant systems or components fr'om service. The Condition is only applicable if one train isinoperable for any reason and the second train is discovered to be inoperable, or if both trains arediscovered to be inoperable at the same time. In addition, LCO 3.7.6.1, "Control RoomEmergency Ventilation System," mnust be verified to be met within 1 hour. The components in thisdegraded condition are capable of providing :greater than 100% of the heat removral needs after anaccident. The allowed outage time is based on Reference 1 which demonstrated that the 24 hourallowed outage time is acceptable based on the redundant heat removal capabilities afforded bythe Containment Cooling System, the~iodine removal capability of the Control Room EmergencyAir Cleanup System, the infrequent use of the Required Action, and the small incremental effecton plant risk.With two required containment cooling trains inoperable, one of the required containmentcooling trains mustbe restored to OPERABLE status within 48 hours. The components in thisdegraded condition provide iodine removal capabilities and are capable of providing at least100% of the heat removal needs after an accident. The 48 hour allowed outage time wasdeveloped taking into account the redundant heat removal capabilities afforded by combinationsof the Containment Spray System and Containment Cooling System, the iodine removal functionof the Containment Spray System, and the low probability of a DBA occurring during this period.MILLSTONE -UNIT 2 B 3/4 6-3a Amendment No. -l-0, 24-&-, 293~6, 2L7-8, LBDCR 14-MvP2-016September 4, 2014CONTAINMENT SYSTEMSBASES3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued)Surveillance Requirement 4.6.2.1.1 .a verifies the correct alignment for manual, poweroperated, and automatic valves in the Contailnment Spray System flow paths to provide assurancethat the proper flow paths will exist for contaimnent spray operation. This surveillance does notapply to valves that are locked, sealed, or otherwise secured in position, since these valves wereverified to be in the correct position prior to locking, sealing, or securing. A valve that receives anactuation signal is allowed to be in a nonaccident position provided the valve automaticallyrepositions within the proper stroke time. This surveillance does not require any testing or valvemanipulation. R~ather, it involves verification that those valves capable of being mispositioned arein the correct position. The surveillance frequency is controlled under the Surveillance FrequencyControl Program.Surveillance Requirement 4.6.2.1.1 .b, which addresses periodic surveillance testing of thecontainment spray pumps to detect gross degradation caused by impeller structural damage orother hydraulic component problems, is required by the ASME OM Code. This type of testingmay be accomplished by measuring the pump developed head at only one point of the pumpcharacteristic curve. This verifies both that the measured perfonnance is within an acceptabletolerance of the original pump baseline performaance and that the performance at the test flow isgreater than or equal to the performance assumed in the unit safety analysis. The surveillancerequirements are specified in the Inservice Testing Program. The ASME~ OM Code provides theactivities and frequencies to satisfy the requirements.Surveillance Requirements 4.6.2.1.1l.c and 4.6.2.1.1.d demonstrate that each automaticcontainment spray valve actuates to the required position on an actual or simulated actuationsignal (CSAS or SRAS), and that each containmaent spray pump starts..on receipt of an actual orsimulated actuation signal (CSAS). This surveillance is not required for valves that are locked,sealed, or otherwise secured in the required position under administrative controls. Thesesurveillance frequencies are controlled under the Surveillance Frequency Control Program. Theactuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS)testing, and equipment performance is monitored as part of the Inservice Testing Program.MILLSTONE -UNIT 2 B 3/4 6-3b Amendment No. , 24g, 3, 7-S, LBDCR 14-MP2-01I6September 4, 2014CONTAINMENT SYSTEMSBASES3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued)Surveillance Requirement 4.6.2. 1.1.e requires verification that each spray nozzle isunobstructed following maintenance that could cause nozzle blockage. Normal plant operationand maintenance activities are not expected to trigger performance of this surveillancerequirement. However, activities, such as an inadvertent spray actuation that causes fluid flowthrough the nozzles, a major configuration change, or a loss of foreign material control whenworking within the respective system boundary may require surveillance performance. Anevaluation, based on the specific situation, will determnine the appropriate method (e.g., visualinspection, air or smoke flow test) to verify' no nozzle obstruction.Surveillance Requirement 4.6.2.1 .2.a demonstrates that each containment air recirculationand cooling unit can be operated in slow speed for > 15 minutes to ensure OPERABILITY andthat all associated controls are functioning properly. It also ensures fan or motor failure can bedetected and corrective action taken. The surveillance frequency is controlled under theSurveillance Frequency Control Program.Surveillance Requirement 4.6.2.1.2.b demonstrates a cooling water flow rate of> 500gpm to each containment air recirculation and cooling unit to provide assurance a cooling waterflow path through the cooling unit is available. The surveillance frequency is controlled under theSurveillance Frequency Control Program.Surveillance Requirement 4.6.2.1 .2.c demonstrates that each containment air recirculationand cooling unit starts on receipt of an actual or simulated actuation signal (SIAS). Thesurveillance frequency is controlled under the Surveillance Frequency Control Program. Theactuation logic is tested as part of the Engineered Safety~ Feature Actuation System (ESFAS)testing, and equipment perfonrmance is monitored as part of the Inservice Testing Program.REFERENCE1. WCAP- 161 25-NP-A, "Justification for Risk-Informed Modifications to Selected TechnicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UJNJIT 2 B 3/4 6-3c Amendment No. 0, 24-4, 2-36, 7-8, LBDCR 14-MP2-001May 20, 2014CONTAINMENT SYSTEMSBASES314.6.3 CONTAINMENT IS OLATION VALVESThe Technical Requirements Manual contains the list of containment isolation valves(except the containment air lock and equipment hatch). Any changes to this list will be reviewedunder 10CFR50.59 and approved by the committee(s) as described in the QAP Topical Report.The OPERABILITY of the containment isolation valves ensures that the containmentatmosphere will b~e isolated from the outside enviromnent in the event of a release of radioactivematerial to the containment atmosphere or pressurization of the containment. Containmentisolation within the time limnits specified ensures that the release of radioactive material to theenvironment will be consistent with the assumptions used in the analyses for a LOCA.The containment isolation valves are used to close all fluid (liquid and gas) penetrationsnot required for operation of the engineered safety feature systems, to prevent the leakage ofradioactive materials to the enviromnent. The fluid penetrations which may require isolation afteran accident are categorized as Type P, 0, or N. The penetration types for each containmentisolation valve are listed in PSAR Table 5.2-11, Containment Structure Isolation ValveInformation.Type P penetrations are lines that connect to the reactor coolant pressure boundary(Criterion 55 of 10OCFR5O, Appendix A). These lines are provided with two containment isolationvalves, one inside containment, and one outside containment.Type 0 penetrations are lines that are open to the containment internal atmosphere(Criterion 56 of 10CFR5O, Appendix A). These lines are provided with two containment isolationvalves, one inside containment, and one outside containment ... "Type N penetrations are lines that neither connect to the reactor coolant pressure boundarynor are open to the contaimnent internal atmospher~e, but do form a closed system within thecontainment structure (Criterion 57 of IOCFR50, Appendix A). These lines are provided withsingle containment isolation valves outside containment. These valves are either remotelyoperated or locked closed manual valves.With one or more penetration flow paths with one containment isolation valve inoperable,the inoperable valve must be restored to OPERABLE status or the affected penetration flow pathmust be isolated. The method of isolation must include the use of at least one isolation barrier thatcarmot be adversely affecte~d by a single active failure. Isolation barriers that meet this criterionare a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A checkvalve may not be used to isolate the affected penetration.MILLSTONE -UNIT 2 B 3/4 6-3d Amendment No. 2-10, , -6, 7,2g8-, LBDCRI14-MiP2-016September 4, 2014CONTAINMENT SYSTEMSBASES314.6.3 CONTAINMENT ISOLATION VALVES (Continued)If the containment isolation valve on a closed system becomes inoperable, the rem~ainingbarrier is a closed system since a closed system is an acceptable alternative to an automatic valve.However, ACTIONS must still be taken to meet Technical Specification ACTION 3.6.3.1 .d andthe valve, not normally considered as a containment isolation valve, and closest to thecontainment wall should be put into the closed position. No leak testing of the alternate valve isnecessary to satisfy the ACTION statement. Placing the manual valve in the closed positionsufficiently deactivates the penetration for Technical Specification compliance. Closed systemisolation valves applicable to Technical Specification ACTION 3.6.3.1 .d are included in FSARTable 5.2-11, and are the isolation valves for those penetrations credited as General DesignCriteria 57, (Type N penetrations). The specified time (i.e., 72 hours) of Technical SpecificationACTION 3.6.3.l.d is reasonable, considering the relative stability of the closed system (hence,reliability) to act as a penetration isolation boundary and the relative importance of supportingcontainment OPERABILITY during MODES 1, 2, 3, aind 4. In the event the affected penetrationis isolated in accordance with 3.6.3.1 .d, the affected penetration flow path must be verified to beisolated on a periodic basis, (Surveillance Requirement 4.6.1t.1 .a). This is necessary to assure leaktightness of containment and that containment penetrations requiring isolation following anaccident are isolated. The surveillance frequency is controlled under the Surveillance FrequencyControl Program.[OFor the purposes of meeting this LCO, neither the containment isolation valve, nor anyalternate valve on a closed system have a leakage limit associated with valve OPERABILITY.Containment isolation valves may be opened on an intennittent basis provided appropriateadministrative controls are established. The position of the NRC concerning acceptableadministrative controls is contained in Generic Letter 91-08, "Removal of Component Lists fromTechnical Specifications," and includes the following considerations:(1) stationing an operator, who is in constant communication with the control room, at thevalve controls,(2) instructing this operator to close these valves in an accident situation, and(3) assuring that environmental conditions will not preclude access to close the valve and thatthis action will prevent the release of radioactivity outside the containment.The appropriate administrative controls, based on the above considerations, to allowcontainment isolation valves to be opened are contained in the procedures that will be used tooperate the valves. Entries should be placed in the Shift Manager Log when these valves areopened and closed. However, it is not necessary to log into any Technical Specification ACTIONStatement for these valves, provided the appropriate administrative controls have beenestablished.MILLSTONE -UNIT 2 B 3/4 6-3e Amendment No. 21-O, 2-5~, -236, 2-g, gt LBDCR 14-MvlP2-001May 20, 2014CONTAINMENT SYSTEMSBASES3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued)If a containment isolation valve is opened while operating in accordance with Abnormalor Emergency Operating Procedures (AOPs and EOPs), it is not necessaiy to establish a dedicatedoperator. The AOPs and EOPs provide sufficient procedural control over the operation of theconatainment isolation valves.Opening a closed containment isolation valve bypasses a plant design feature thatprevents the release of radioactivity outside the containment. Therefore, this should not be donefrequently, and the time the valve is opened should be minimized. As a general guideline, a closedcontainment isolation valve should not be opened longer than the time allowed to restore thevalve to OPERABLE status, as stated in the ACTION statement for LCO 3.6.3.1 "ContainmentIsolation Valves."A discussion of the appropriate administrative controls for the containment isolationvalves, that are expected to be opened during operation in MODES 1 through 4, is presentedbelow.Manual contaimnent isolation valve 2-SI-463, safety injection tank (SIT) recirculationheader stop valve, is opened to fill or drain the SITs and for Shutdown Cooling System (SDC)boron equalization. While 2-SI-463 is open, a dedicated operator, in continuous commcrunicationwith the control room, is required.When SDC is initiated, SDC suction isolation remotely operated valves 2-SI-652 and2-SI-651 (inside containment isolation valve) and manual valve 2-SI-709 (outside containmentisolation valve) are opened. 2-SI-65 1 is normally operated from the cbnitrol room. While inMODES 1, 2 or 3, 2-SI-65 1 is closed with manual disconnect switch NSI65 1 locked open tosatisfy Appendix R requirements. It does not receive an automatic contailnment isolation closuresignal, but is interlocked to prevent opening if Reactor Coolant System (RCS) pressure is greaterthan approximately 275 psia. When 2-SI-65 1 is opened fr'om the control room, either one of thetwo required licensed (Reactor Operator) control room operators can be credited as the dedicatedoperator required for administrative control. It is not necessary to use a separate dedicatedoperator.When valve 2-SI-709 is opened locally, a separate dedicated operator is not required toremain at the valve. 2-SI-709 is opened before 2-SI-651. Therefore, opening 2-SI-709 will notestablish a connection between the RCS and the SDC System. Opening 2-SI-651 will connect theRCS and SDC System. If a problem then develops, 2-SI-651 can be closed from the control room.MILLSTONE -UNIT 2 B 3/4 6-3f Amendment No.24-0, 2-4,-2-36, 2-7-g, 2g3,......l.... by, NR ...C letter ae6//5 LBDCR 14-MP2-001May 20, 2014CONTAINMENT SYSTEMSBASES3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued)The administrative controls for valves 2-SI-651 and 2-SI-709 apply only duringpreparations for initiation of SDC, and during SDC operations. They are acceptable because RCSpressure and temperature are significantly below normal operating pressure and temperaturewhen 2-SI-651 and 2-SI-709 are opened, and these valves are not opened until shortly before SDCflow is initiated. The penetration flowpath can be isolated from the control room by closing either2-SI-652 or 2-SI-651, and the manipulation of these valves, during this evolution, is controlled byplant procedures.The pressurizer auxiliary, spray valve, 2-CH-5 17, can be used as an alternate method todecrease pressurizer pressure, or for boron precipitation control following a loss of coolantaccident. When this valve is opened from the control room, either one of the two required licensed(Reactor Operator) control room operators can be credited as the dedicated operator required foradministrative control. It is not necessary to use a separate dedicated operator.The exception for 2-CH-517 is acceptable because the fluid that passes through this valvewill be collected in the Pressurizer (reverse flow firom the Pressurizer to the charging system isprevented by check valve 2-CH-43 1), and thle penetration associated with 2-CH-5 17 is openduring accident conditions to allow flow from the charging pumaps. Also, this valve is normally 9,.:operated from the control room, under the supervision of the licensed control room operators, inaccordance with plant procedures.A dedicated operator is not required when opening remotely operated valves associatedwith Type N fluid penetrations (Criterion 57 of 10OCFR5O, Appendix A). Operating these valvesfr'om the control room is sufficient. The main steam isolation valves (2-MS-64A and 64B),atmospheric steam dump valves (2-MS-1 90A and 190B), and the containmaent air recirculationcooler RBCCW discharge valves (2-RB-28.2A-D).are examples of remotely operatedcontaim~aent isolation valves associated with Type N fluid penetrations.MSIV bypass valves 2-MS-65A and 65B are remotely operated MOVs, but while inMODE 1, they are closed with power to the valve motors removed via lockable disconnectswitches located at their respective MCC to satisfy' Appendix "R" requirements.Local operation of the atmospheric steam dump valves (2-MS-i190A and t 90B), or otherremotely operated valves associated with Type N fluid penetrations, will require a dedicatedoperator in constant communication with the control room, except when operating in accordancewith AOPs or EOPs. Even though these valves can not be classified as locked or sealed closed,the use of a dedicated operator will satisfy administrative control requirements. Local operation ofthese valves with a dedicated operator is equivalent to the operation of other manual (locked orsealed closed) containment isolation valves with a dedicated operator.MILLSTONE -UNIT 2 B 3/4 6-3g Amendment No. 21-i-, 2-6, 7-3, 2-7-8, LBDCR 14-MP2-001May 20, 2014CONTAINMENT SYSTEMSBASES3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued)The main steam supplies to the turbine driven auxiliary feedwater pump (2-MS-201 and2-MS-202) are remotely operated valves associated with Type N fluid penetrations. These valvesare maintained open during power operation. 2-MS-20 1 is maintained energized, so it can beclosed fr'om the control room, if necessary, for containment isolation. However, 2-MS-202 isdeenergized open by removing power to the valve's motor via a lockable disconnect switch tosatisfy Appendix R requirements. Therefore, 2-MS-202 cannot be closed irmmediately fr-om thecontrol room, if necessary, for containment isolation. The disconnect switch key to power for 2-MS-202 is stored in the Unit 2 control room, and can be used to re-power the valve at the MCC;this will allow the valve to be closed fr'om the control room. It is not necessary to maintain adedicated operator at 2-MS-202 because this valve is already in the required accident position.Also, the steam that passes through this valve should not contain any radioactivity. The steamgenerators provide the barrier between the containment and the atmosphere. Therefore, it wouldtake an additional structural failure for radioactivity to be released to the environment thr-ough thisvalve.Steam generator chemical addition valves, 2-F W-15A and 2-F W-15B, are opened to addchemicals to the steam generators using the Auxiliary Feedwater System (AFW). When either2-F W-15A or 2-F W-15B is opened, a dedicated operator, in continuous communication with thecontrol room, is required. Operation of these valves is expected during plant startup andshutdown.The bypasses around the main steam supplies to the turbine dr'iven auxiliary feedwaterpump (2-MS-201 and 2-MS-202), 2-MS-458 and 2-MS-459, are opened to drain water from thesteam supply lines. When either 2-MS-458 or 2-MS-459 is opened, a dedicated operator, incontinuous communication with the control room, is required. Operatlion of these valves isexpected during plant startup.The containment station air header isolatioin, 2-SA- 19, is opened to supply station air tocontainment. When 2-SA-1 9 is opened, a dedicated operator, in continuous communication withthe control room, is required. Operation of this valve is only expected for maintenance activitiesinside conatahnment.The backup air supply master stop, 2-IA-5 66, is opened to supply backup air to 2-CH-5 17,2-CH-5 18, 2-CH-5 19, 2-EB-88, and 2-EIB-89. When 2-IA-566 is opened; a dedicated operator, incontinuous communication with the control room, is required. Operation of this valve is onlyexpected in response to a loss of the normal air supply to the valves listed.MILLSTONE -UNIT 2 B 3/4 6-3h Amendment No. 4-0, 1-, 2-l-6, 7-,2-7 g 2 -83 LBDCR 14-MIP2-001May 20, 2014CONTAINMENT SYSTEMSBASES:3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued)The nitrogen header drain valve, 2-S1-045, is opened to depressurize the containment sideof the nitrogen supply header stop valve, 2-8I-312. When 2-SI-045 is opened, a dedicatedoperator, in continuous communication with the control room, is required. Operation of this valveis only expected after using the high pressure nitrogen system to raise SIT nitrogen pressure.The containment waste gas header test connection isolation valve, 2-GR-63, is opened tosample the drain tank for oxygen and nitrogen. When 2-GR-63 is opened, a dedicatedoperator, in continuous communication with the control room, is required. Operation of this valveis expected during plant startup and shutdown.The upstream vent valves for the steam generator atmospheric dump valves, 2-MS-369and 2-MS-3 71, are opened during steam generator safety valve set point testing to allow steamheader pressure instrumentation to be placed in service. When either 2-MS-3 69 or 2-MS-3 71 isopened, a dedicated operator in continuous communication with the control room is required.The detennination of the appropriate administrative controls for these containmentisolation valves included an evaluation of the expected enviromnental conditions. This evaluationhas concluded environmental conditions will not preclude access to close the valve, and thisaction will prevent the release of radioactivity outside of contaimntent through the respectivepenetration.The containment purge supply and exhaust isolation valves are required to be sealedclosed during plant operation since these valves have not been demonstr'ated capable of closingduring a LOCA or steam line break accident. Such a denmonstration would require justification ofthe mechanical OPERABILITY of the purgevyalves and consideration of the appropriateniess ofthe electrical override circuits. Maintaining these valves closed during plant operations ensuresthat excessive quantities of radioactive materials will not be released via the containment purgesystem. The containment purge supply and exhaust isolation valves are sealed closed by isolatinginstrument air and removing power from the valves, This is accomplished by closing theinstrument air isolation valves and pulling the control power fuses for. each of the valves. Theassociated instrument air isolation valves and fuse blocks are then locked. This is consistent withthe guidance contained in NUREG-0737 Item II.E.4.2 and Standard Review Plan 6.2.4,"Containment Isolation System," Item II.f.Surveillance Requirement 4.6.3.l.a verifies the isolation time of each power operatedautomatic containment isolation valve is within limits to demonstrate OPERABILITY. Theisolation time test ensures the valve will isolate in a time period less than or equal to that assumedin the safety analysis. The isolation time and surveillance frequency are in accordance with theInservice Testing Progr'am.MILLSTONE -UNIT 2 B 3/4 6-3i Amendment No. 2-3, 9 LBDCR 14-MP2-016September 4, 2014CBNASES NSSTMBASES3/4.6.4 COMBUSTIBLE GAS CONTROLSurveillance Requirement 4.6.3.1 .b demonstrate that each automatic containmentisolation valve actuates to the isolation position on an actual or simulated containment isolationsignal [containment isolation actuation signal (CIAS) or containment high radiation actuationsignal (containment purge valves only)]. This surveillance is not required for valves that arelocked, sealed, or otherwise secured in the required position under admninistrative controls. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program. Theactuation logic is tested as part of the Engineered Safety Feature Actuation System (ES FAS)testing, and equipment performance is monitored as part of the Inservice Testing Program.The OPERABILITY of the equipment and systems required for control of hydrogen gasensures that this equipment will be available to maintain the hydrogen concentration withincontaimnent below its flammable limit during post-LOCA conditions.The post-incident recirculation systems are provided to ensure adequate mixing of thecontainment atmosphere following a LOCA. This mixing action will prevent localizedaccumulations of hydrogen from exceeding the flammable limit.MILLSTONE -UNIT 2B 3/4 6-4Amendment No .-2~-3-3,Ackncw~gccl y NRC1011(31dAt REVERSE OF PAGE B 3/4 6-4INTENTIONALLY LEFT BLANK LBDCR 14-MiP2-001May 20, 2014CONTAINMENT SYSTEMSBASES3/4.6.5 SECONDARY CONTAIN~MENT3/4.6.5.1 ENCLOSURE BUILDING FILTRATION SYSTEMThe OPERABILITY of the Enclosure Building Filtration System ensures thatcontainment leakage occurring during LOCA conditions into the annulus will be filtered throughthe filters and charcoal adsorber trains prior to discharge to the atmosphere. Thisrequirement is necessary to meet the assumptions used in the accident analyses and limit the SITEBOUNDARY radiation doses to within the limits of 10 CFR 50.67 during LOCA conditions.With one Enclosure Building Filtration System Train inoperable, the inoperable train mustbe restored to OPERABLE status within 7 days. The components in this degraded condition arecapable of providing 100% of the iodine removal needs after a DBA. The 7 day allowed outagetune is based on consideration of such factors as the availability of the OPERABLE redundantEnclosure Building Filtration System Train and the low probability of a DBA occurring duringthis period.If two Enclosure Building Filtration System Trains are inoperable, at least one EnclosureBuilding Filtration System Train must be returned to OPERABLE status within 24 hours. TheCondition is modified by a Note stating it is not applicable if the second Enclosure BuildingFiltration System train is intentionally declared inoperable. The Condition does not apply tovoluntary removal of redundant systems or components from service. The Condition is onlyapplicable if one train is inoperable for any reason and the second train is discovered to beinoperable, or if both trains are discovered to be inoperable at the same time. In addition, at leastone train of containment spray must be verified to be OPERABLE within 1 hour. In the event ofan accident, containmaent spray reduces the potential radioactive release from the containment,which reduces the consequences of the inoperable Enclosure Building. Filtration System Trains.The allowed outage time is based on Reference 1 which demonstrated that the 24 hour allowedoutage time is acceptable based on the infrequent use of the Required Actions and the smallincremental effect on plant risk.The laboratory testing requirement for the charcoal sample to have a removal efficiency of> 95% is more conservative than the elemental and organic iodine removal efficiencies of 90%and 70%, respectively, assumed in the DBA analyses for the EBFS charcoal adsorbers in theMillstone Unit 2 Final Safety Analysis Report. A removal efficiency acceptance criteria of 95%will ensure the charcoal has the capability to perform its intended safety function throughout thelength of an operating cycle.MILLSTONE -UNIT 2 B3465AedetN.2~B 3/4 6-5Amendment No. gO8, LBDCR 14-MiP2-016September 4, 2014CONTAINMENT SYSTEMSBASES3/4.6.5.1 ENCLOSURE BUILDING FILTRATION SYSTEM (Continued)Surveillance Requirement 4.6.5.1 .b.l dictates the test frequency, method and acceptancecriteria for the EBFS trains (cleanup trains). These criteria all originate in the Regulatory Positionsections of Regulatory Guide 1.52, Rev. 2, March 1978 as discussed below:Section C.5 .a requires a visual inspection of the cleanup system be made before the followingtests, in accordance with the provisions of section 5 of AINSI N5 10-1975:* in-place air flow distribution test* DOP test* activated carbon adsorber section leak testSection C.5 .c requires the in-place Dioctyl phthalate (DOP) test for HiEPA filters to section 10 ofANSI N5 10-1975. The HEPA filters should be tested in place (1) initially, (2) at the frequencyspecified in the Surveillance Frequency Control Program, and (3) following painting, fire, orchemical release in any ventilation zone communicating with the system. The testing is to confirma penetration of less than or equal to 1 %* at rated flow. QSection C.5.d requires the charcoal adsorber section to be leak tested with a gaseous halogenatedhydrocarbon refrigerant, in accordance with section 12 of ANSI N5 10-1975 to ensure that bypassleakage through the adsorber section is less than or equal to 1%.** Adsorber leak testing shouldbe conducted (1) initially, (2) at the frequency specified in the Surveillance Freqluency ControlProgram, (3) following removal of an adsorber sample for laboratorytesting if the integrity of theadsorber section is affected, and (4) following painting, fire, or chemical release in any ventilationzone communicating with the system.REFERENCE1. WCAP-16 125-NP-A, "Justification for Risk-Informed Modifications to Selected TechnicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.* Means that the lIEPA filter will allow passage of less than or equal to 1% of the test concentrationinjected at the filter inlet from a standard DOP concentration injection.** Means that the charcoal adsorber sections will allow passage of less than or equal to 1% of theinjected test concentration around the charcoal adsorber sections.MILLSTONE -UNIT 2 B 3/4 6-5a Amendment No. 2Og, " LBDCR 14-MIP2-001May 20, 2014CONTAINMENT SYSTEMSBASES3/4.6.5.2 ENCLOSURE BUILDINGThe OPERABILITY of the Enclosure Building ensures that the releases of radioactivematerials fr'om the primary containment atmosphere will be restricted to those leakage paths andassociated leak rates assumed in the accident analyses. This restriction, in conjunction withoperation of the Enclosure Building Filtration System, will limit the SITE BOUNDARY radiationdoses to within the limits of 10 CFR 50.67 during accident conditions.One Enclosure Building Filtration SysteLn tr'ain is required to establish a negative pressureof 0.25 inches W.G. in the Enclosure Building Filtration Region within one minute after anEnclosure Building Filtration Actuation Signal is generated. The one minute time requirementdoes not include the time necessary for the associated emergency diesel generator to start andpower Enclosure Building Filtration System equipment.To enable the Enclosure Building Filtration System to establish the required negativepressure in the Enclosure Building, it is necessary to ensure that all Enclosure Building accessopenings are closed. For double door access openings, only one door is required to be closed andlatched, except for nornal passage. For single door access openings, that door is required to beclosed and latched, except for nonnal passage.If a required door that is designated to automatically close and latch is not capable ofautomatically closing and latching, the door shall be maintained closed and latched, or personnelshall be stationed at the door to ensure that the door is closed and latched after each trafisitthrough the door. Otherwise, the access opening (door) should be declared inoperable andappropriate technical specification ACTION statement entered.MILLSTONE -UNIT 2 B346S mnmn o 0gB 3/4 6-5bAmendment No. -a@8, [ REVERSE OF PAGE B 314 6-5bINTENTIONALLY LEFT BLANKK May 7, 20033/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVESThe OPERABILITY of the main steam line code safety valves (MSSVs) ensures that thesecondary system pressure will be limited to within 110% of the design pressure during the mostsevere anticipated system operational transient. The Loss of Electrical Load with Turbine Tripand the single main steam isolation valve (MSIV) closure event were evaluated at various powerlevels with a corresponding number of inoperable MSSVs. The limiting anticipated systemoperational transient is the closure of a single MSIV.The specified valve lift settings an~d relieving capacities are in accordance with the requirementsof Section III of the ASME Boiler and Pressure Vessel Code, 1971 Edition. The total ratedcapacity of the main steam line code safety valves is 12.7 x 106 lbs/hr. This is sufficient to relievein excess of 100% steam flow at RATED THERMAL POWER.The LCO requires all MSSVs to be OPERABLE. An alternative to restoring the inoperableMSSV(s) to OPERABLE status is to reduce power so that the available MSSV relieving capacitymeets ASME Code requirements for the power level. POWER OPERATION is allowed withinoperable MSSVs as specified within the limitations of the ACTION requirements.Less than the full number of OPERABLE MSSVs requires limitations on allowable THERMALPOWER and adjustment to the Power Level-High trip setpoint in accordance with ACTIONS a. 1and a.2. The 4 hours provided for ACTION a. 1 is a reasonable time period to reduce power leveland is based on the low probability of an event occurring during this period that would requireactivation of the MSSVs. ACTION a.2 provides for 36 hours to reduce the Power Level-High tripsetpoint. This time for ACTION a.2 is based on a reasonable time to correct the MSSVinoperability, the time required to perform the" power reduction, operating experience in resettingall channels of a protective function, and on the low probability of the occurrence of a transientthat could resulf in steam generator overpressure during this period.As described in Section 2.2.1 of the BASES, during a power reduction the Power Level-High tripsetpoint automatically tracks TI-ERMAL POWER downward so that it remains a fixed incrementabove the current power level, subject to a minimum value. Therefore, during short term reducedpower evolutions e.g., MSSV testing, it is permissible to only reduce THERMAL POWER inaccordance with ACTION a. 1 (the protective function of ACTION a.2 is automatically provideddue to the nature of the Power Level-High trip setpoint), provided that the MSSV testing can becompleted within the 36 hours provided for ACTION a.2.MILLSTONE -UNIT 2B 3/4 7-1MILLTONE- UIT 2B 3/7-IAmendment No. 5-2, 6-1-, 4-, 275 LBDCR 04-MP2.-016February 24, 20053/.7PLNS SSTM0BASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVES (Continued)The OPERABILITY of the MSSVs is defined as the ability to open within the setpointtolerances, relieve steam generator overpressure. and reseat when pressure has been reduced. Thelift setpoints for the MSSVs are listed in Table 4.7-1. This table allows a + 3% setpoint tolerance(allowable value) on the lift setting for OPERABILITY to account for drift over a cycle. EachMSSV .is demonstrated OPERABLE, with lift settings as shown in Table 4.7-1, in accordancewith Specification 4.0.5. A footnote to Table 4.7-1 requires that the lift setting be restored towithin 4- 1% of the setpoint (trip setpoint) following testing to allow for drift. While the liftsettings are being restored to a tolerance of+ 1-%, the MSSV will remain OPERABLE with liftsettings out of tolerance by as much as +- 3%.MILLSTONE -UNIT 2B 3/4 7-laAmendment No. 6-t-, 2-1-1-, 2t-5-,Acknowledged by NRC letter dated 6/28/05 LBDCR 11-MP2-013August 25, 20113/4.7 PLANT SYSTEMSBASES3/4.7.1.2 AUXILIARY FEEDWATER PUMPSThe OPERABILITY of the auxiliary feedwater pumps ensures that the Reactor CoolantSystem can be cooled down to less than 3 00°F from nornal operating conditions in the event of atotal loss of off-site power.The FSAR Chapter 14 Loss of Normal Feedwater: QON-F) analysis evaluates the eventoccurring with and without offsite power available, and a single active failure. This analysis hasdetermined that one motor driven AFW pump is not sufficient to meet the acceptance criteria.Therefore, two AFW pumps (two motor-driven AFW pumps, or one-motor driven AMW pumpand the steam-driven AFW pump) are required to meet the acceptance criteria for this moderatefrequency event. To meet the requirement of two AFW pumps available for mitigation, all threepumps must be OPERABLE to accommodate the failure of one pump. This is consistent with thelimiting cQndition for operation and ACTION statements of Technical Specification 3.7.1.2.Although not part of the bases of Technical Specification 3.7.1.2, the less conservativeFSAR Chapter 10 Best Estimate Analysis of the LONF event was performed to demonstrate thatone motor-driven AEW pump is adequate to remove decay heat, prevent steam generator drout,maintain Reactor Coolant System (RCS) subcooling, and prevent pressurizer level fromexceeding acceptable limits. This best estimate analysis is performed to demonstrate theautomatic start of both motor driven AFW pumps on low steam generator level satisfies theautomatic AFW initiation requirements of NUiREG-0737 Item lI.E. 1.2. Automatic start of theturbine driven AFW pump is not required. From this best estimate analysis of the LONE event, anevaluation was performed to demonstrate that a single motor-driven AEW pump has sufficientcapacity to reduce the RCS temperature to 3 00°F (in addition to decay heat removal) where theShutdown Cooling System may be placed into operation for continued cooldown. As a result ofthese evaluations, one motor-driven AEW pump (or the steam-driven AFW pump which hastwice the capacity of a motor-driven AFW pump) can meet the requirements to remove decayheat, prevent steam generator dryout, maintain RCS subcooling, prevent the pressurizer fromexceeding acceptable limits, and reduce RCS temperature to 3 00°3F.+The Auxiliary Feed Water (AFW) system is OPERABLE when the MFW pumps and flowpaths required to provide MFW to the steam generators are OPERABLE. Technical Specification3.7. 1.2 requires three MFW pumps to be OPERABLE and provides ACTIONS to addressinoperable AMW pumps. The MFW flow path requirements are separated into MFW pump suctionflow path requirements, MFW pump discharge flow path to the common discharge headerrequirements, and common discharge header to the steam generators flow path requirements.There are two MFW pump suction flow paths from the Condensate Storage Tank to theMFW pumps. One flow path to the turbine driven MFW pump, and one flow path to both motordriven MFW pumps. There are three MFW pump discharge flow paths to the common dischargeheader, one flow path from each of the three MFW pumps. There are two MFW discharge flowpaths from the common discharge header to the steam generators, one flow path to each steamgenerator. With 2-F W-44 open (normal position), the discharge from any MFW pump will besupplied to both steam generators through the associated MFW regulating valves.MILLSTONE -UN[T 2 B 3/4 7-2 Amendment No. g2, 64-, 6-3, 44-t, 2, 36,'2-4, LBD CR 04-MP2-016February 24, 2005PLANT SYSTEMSBASES3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued)2-F W-44 should remain open when the AFW system is required to be OPERABLE(MODES 1, 2, and 3). Closing 2-F W-44 places the plant in a configuration not considered as aninitial condition in the Chapter 14 accident analyses. Therefore, if 2-F W-44 is closed while theplant is operating in MODES 1, 2, or 3, two AEW pumps should be considered inoperable and theappropriate ACTION requirement of Technical Specification 3.7.1.2 entered to limit plantoperation in this configuration.A flow path may be considered inoperable as the result of closing a manual valve, failureof an automatic valve to respond correctly to an actuation signal, or failure of the piping. In thecase of an inoperable automatic AFW regulating valve (2-F W-43A or B), flow pathOPERABILITY can be restored by use of a dedicated operator stationed at the associated bypassvalve (2-F W-56A or B) as directed by OP 2322. Failure of the common discharge header pipingwill cause both discharge flow paths to the steam generators to be inoperable.An inoperable suction flow path to the turbine driven AFW pump will result in oneinoperable AFW pump. An inoperable suction flow path to the motor driven AFW pumps willresult in two inoperable MFW pumps. The ACTION requirements of Technical Specification3.7.1.2 are applicable based on the number of inoperable AFW pumps.An inoperable pump discharge flow path from an MFW pump to the common dischargeheader will cause the associated AFW pump to be inoperable. The ACTION requirements ofTechnical Specification 3.7.1.2 for one MFW pump are applicable for each affected pumpdischarge flow path.MFW must be capable of being delivered to both steam generators for design basisaccident mitigation. Certain design basis events, such as a main steam line break or steamgenerator tube rupture, require that the affected steam generator be isolated, and the RCS decayheat removal safety function be satisfied by feeding and steaming the unaffected steam generator.If a failure in an MFW discharge flow path from the common discharge header to a steamgenerator prevents delivery of MFW to a steam generator, then the design basis events may not beeffectively mitigated. In this situation, the ACTION requirements of Technical Specification 3.0.3are applicable and an immediate plant shutdown is appropriate.Two inoperable AFW System discharge flow paths from the common discharge header toboth steam generators will result in a complete loss of the ability to supply MFW flow to the steamgenerators. In this situation, all three MFW pumps are inoperable and the ACTION requirementsof Technical Specification 3.7.1.2. are applicable. Immediate corrective action is required.However, a plant shutdown is not appropriate until a discharge flow path from the commondischarge header to one steam generator is restored.MILLSTONE -UNIT 2 B 3/4 7-2a Amendment No. ,Acknowledged by NRC letter dated 6/28/05 November 10, 2005LBDCR 04-MP2-0133/4.7 PLANT SYSTEMSBASES3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued)If the turbine-driven auxiliary feedwater train is inoperable due to an inoperable steamsupply in MODES 1, 2, and 3, or if the turbine-driven auxiliary feedwater pump is inoperablewhile in MODE 3 immediately following REFUIEL1INJQ action must be taken to restore theinoperable equipment to an OPERABLE status within 7 days. The 7 day allowed outage time isreasonable, based on the following:a. For the inoperability of the turbine-driven auxiliary feedwater pump due aninoperable steam supply, the 7 day allowed outage time is reasonable since theauxiliary feedwater system design affords adequate redundancy for the steamsupply line for the turbine-driven pump.b. For the inoperability of a turbine-driven auxiliary feedwater pump while in MODE3 immediately subsequent to a refueling, the 7 day allowed outage time isreasonable due to the minimal decay heat levels in this situation.c. For both the inoperability of the turbine-driven pump due to an inoperable steamsupply and an inoperable turbine-driven auxiliary feedwater pump while in MODE3 immediately following a refueling outage, the 7 day allowed outage time isreasonable due to the availability of redundant OPERABLE motor driven auxiliaryfeedwater pumps, and due to the low probability of an event requiring the use ofthe turbine-driven auxiliary feedwater pump.When one steam supply to the turbine-driven auxiliary feedwater pump is inoperable, theturbine-driven auxiliary feedwater pump is inoperable. In this case, although the turbine-drivenauxiliary feedwater pump with a single oper~able steam supply is capable of perfonning its safetyfunction in the absence of a single failure, the turbine-driven auxiliary feedwater pump isconsidered inoperable due to the lack of redundancy with respect to steam supplies.The required ACTION dictates that if the 7 day allowed outage time is reached the unitmust be in at least HOT STAND)BY within the next 6 hours and in HOT SHUTDOWN within thefollowing 12 hours.The allowed time is reasonable, based on operating experience, to reach the requiredconditions from full power conditions in an orderly manner and without challenging plantsystems.MILLSTONE -UNIT 2 B 3/4 7-2b Amendment No. g2, 6-1-, 63-, 2-l44,-2-36,2g3-2, LB3DCR 14-MIP2-016September 4, 20143/4.7 PLANT SYSTEMSBASES 03/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued')A Note limits the applicability of the inoperable equipment condition b. to when the unithas not entered MODE 2 following a REFUELING..Required ACTION b. allows one auxiliaryfeedwater pump to be inoperable for 7 days vice the 72 hour allowed outage time in requiredACTION c. This longer allowed outage time is based on the reduced decay heat followingREFUELING and prior to the reactor being critical.With one of the auxiliary feedwater PUmps inoperable in MODE 1, 2, or 3 for reasons other thanACTION a. or b., ACTION must be taken to restore the inoperable equipment to OPERABLEstatus within 72 hours. This includes the loss of both steam supply lines to the turbine-drivenauxiliary feedwater pump. The 72 hour allowed outage time is reasonable, based on redundantcapabilities afforded by the auxiliary feedwater system, time needed for repairs, and the lowprobability of a DBA occurring during this time period. Two auxiliary feedwater pumps and flowpaths remain to supply feedwater to the steam generators.If all three AFW pumps are inoperable in MODE 1, 2, or 3, the unit is in a seriouslydegraded condition with no safety related means for conducting a cooldown, and only limitedmeans for conducting a cooldown with non-safety related equipment. In such a condition, the unitshould not be perturbed by any action, including a power change that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW pumpto OPERABLE status. Required ACTION e. is modified by a Note indicating that all requiredMODE changes or power reductions are suspended until one MFW pump is restored toOPERABLE status. Ina this case, LCO 3.0,3 is not applicable because it could force the unit into aless safe condition.During periodic surveillance testing. of the turbine driven AFW pump, valve 2-CN-27A isclosed and valve 2-CN-28 is opened to prevent overheating the water being circulated. In thisconfiguration, the suction of the turbine driven AFW pump is aligned to the Condensate StorageTank via the motor driven AFW pump suction flow path, and the pump minimum flow is directedto the Condensate Storage Tank by the turbine driven AFW pump suction path upstream of2-CN-27A in the reverse direction. During this surveillance, the suction path to the motor drivenAFW pump suction path remains OPERABLE, and the turbine driven AFW suction path isinoperable. In this situation, the ACTION requirements of Technical Specification 3.7.1.2 for oneMFW pump are applicable. The surveillance frequency is controlled under the SurveillanceFrequency Control Program.IMILLSTONE -UNIT 2 B3472 mnmn o 8-B 3/4 7-2cAmendment No. -2gg, LBDCR 14-MP2-016September 4, 20143/4.7 PLANT SYSTEMSBASES3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued)Surveillance Requirement 4.7.1I.2.a verifies the correct alignment for manual, power operated,and automatic valves in the Auxiliary Feedwater (AFW) System flow paths (water and steam) toprovide assurance that the proper flow paths will exist for AFW operation. This surveillance doesnot apply to valves that are locked, sealed, or otherwise secured in position, since these valveswere verified to be in the correct position prior to locking, sealing, or securing. A valve thatreceives an actuation signal is allowed to be in a nonaccident position provided the valveautomatically repositions within the proper stroke time. This surveillance does not require anytesting or valve manipulation. Rather, it involves verification that those valves capable of beingmispositioned are in the correct position. The surveillance frequency is controlled under theSurveillance Frequency Control Progr'am.Surveillance Requirement 4.7.1.2.b, which addresses periodic surveillance testing of theAFW pumps to detect gross degradation caused by impeller structural damage or other hydrauliccomponent problems, is required by the ASMIE Code for Operations and Maintenance of NuclearPower Plants (ASME GM Code). This type of testing may be accomplished by measuring thepump developed head at only one point of the pump characteristic curve. This verifies both thatthe measured performance is within an acceptable tolerance of the original pump baselineperformance and that the performance at the test flow is greater than or equal to the perfonnanceassumed in the unit safety analysis. The surveillance requirements are specified in the InserviceTesting Program. The ASME GM Code provides the activities and frequencies necessary tosatisfy the requirements. This surveillance is modified to indicate that the test can be deferred forthe steam driven AFW pump until suitable plant conditions are established. This deferral isrequired because steam pressure is not sufficient to perform the test until after MODE 3 isentered. Once the unit reaches 800 psig, 24 hours would be allowed for completing thesurveillance. However, the test, if required, must be performed prior to entering MODE 2.Surveillance Requirements 4.7.1.2.c and 4.7.1 .2.d demonstrate that each automatic AFWvalve actuates to the required position on an actual or simulated actuation signal (AF WAS) andthat each AFW pump starts on receipt of an actual or simulated actuation signal (AF WAS). Thissurveillance is not required for valves that are locked, sealed, or Otherwise secured in the requiredposition under administrative controls. The surveillance frequency is controlled under theSurveillance Frequency Control Program. The actuation logic is tested as part of the EngineeredSafety Feature Actuation System (ESFAS) testing, and equipment performance is monitored aspart of the Inservice Testing Program. These surveillances do not apply to the steam driven AFWpump and associated valves which are not automatically actuated.MILLSTONE -UNIT 2 B3472 mnmn oB 3/4 7-2dAmendment No. November 10, 2005LBDCR 04-MP2-0133/.7PLNS SSTM0BASES3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued)Surveillance Requirement 4.7.1 .2.e demonstrates the AIEW System is properly aligned byverifyiing the flow path to each steam generator prior to entering MODE 2, after 30 cumulativedays in MODE 5, MODE 6, or a defueled condition. OPERABILITY of the AFW flow pathsmust be verified before sufficient core heat is generated that would require operation of the AFWSystem during a subsequent shutdown. To further ensure AEW System alignment, theOPERABILITY of the flow paths is verified following extended outages to determine that nomisalignmaent of valves has occurred. The frequency is reasonable, based on engineeringjudgment, and other administrative controls to ensure the flow paths are OPERABLE.3/4.7.1.3 CONDENSATE STORAGE TANKThe OPERABILITY of the condensate storage tank with the minimum water volumeensures that sufficient water is available for cooldown of the Reactor Coolant System to less than300°F in the event of a total loss of off-site power. The minimum water volume is sufficient tomaintain the RCS at HOT STANDBY conditions for 10 hours with steam discharge toatmosphere. The contained water volume limit includes an allowance for water not usable due todischarge nozzle pipe elevation above tank bottom, plus an allowance for vortex formation. ib3/4.7.1.4 ACTIVTYThe limitations on secondary system specific activity ensure that the resultant off-siteradiation dose will be limited to a small fractionMILLSTONE -UNIT 2 B 3/4 7-2e Amendment No. . LBDCR 04-MP2-016February 24, 2005PLANT SYSTEMSBASES..3/4.7.1i.4 ACTIVITY (Continued)of 10 CFR Part 100 limits in the event of a steam line rupture. The dose calculations for anassumed steam line rupture include the effects of a coincident 1.0 GPM primary to Secondary tube -.leak in the steam generator of the affected steam line and a concurrent loss of offsite electricalpower. These values are consistent with theassumptions used in the accident analyses.3/4.7.1.5 MAIN STEAM. LINE IsoLATIoN VALVESThe OPERABILITY of the main steam line isolation valves ensures, that no *more than onesteam generator will blowdown in the event of a steam line rupture. This restriction is *required to1I) minimize te p~ositi.ve Teactivity ffe tfth'e Ractor, Coklant;,Siystem-.o-ol[down i.sso~5iated.with the blowdown, and:2) -limiti-the!pr~es~sure-rise:w~ithin-coigtginmehtiin:he- eve-nt--th, steoan l~inerupture occurs within conitainment. fTheOP'ERABILITY of the maini steam valves withinthe closure times of the surveillance requiremenats are consistent with the assumptions used in theaccident analyses.The ability of the main steam line isolation valves (MSIVs) to close is verified after theplant has been heated up. Since it is necessary to establish a high Reactor Coolant Systemtemperature before the surveillance test can be performed, on exception to TechnicalSpecification 4.0.4 has been added to SR 4.7.1.5 to allow entry into MODE 3. This is necessary toallow plant startup to proceed with equipment that is believed to be OPERABLE; but that Cannotbe verified by performance of the surveillance test until the appropriate plant conditions havebeen established. After entering MODE 3 and establishing the necessary plant conditions(Tavg > 51 50F), the MSIVs will be declared inoperable if SR 4.7.1.5 has not been performedwithin the required frequency, plus 25%, in accordance with Technical Specifications 4.0:2 and4.0.3. The ACTION statement for MODES 2 and 3 Would thenbe entered. However, the requiredACTIONS can be deferred for up to 24 hours (Technical Specification 4.0.3) to allowperformance of SR 4.7.1.5. If the surveillance test is not performed within this 24 hour timeperiod, the requirements of the ACTION statement for MODES 2 and 3 apply, and the MSIV(s) [must be either restored to OPERABLE status or closed. Closing the MSIV(s) put the valve(s) inthe required accident condition. However, the MSIV(s) may be opened to perform SR 4.7.1.5. Ifthe MSIV(s) carmnot be closed, the plant must be shut down to MODE 4.3/4.7.1.6 MAMN FEEDWATER ISOLATION COMIPONENTS (MFICS)Feedwater isolation response time ensures a rapid isolation of feed flow to the steam.generators via the feedwater regulating valves, feedwater bypass Valves, and: as backup, feedpump discharge valves. :The response time includes signal generation time and valve stroke. Feedline block valves also receiveMILLSTONE -UNIT 2 'B 3/4 7-3 Amendment No. 4-88, 24-9,Acknowledged by NRC letter dated 6/28/05 LBDCR 07-MP2-03 1August 8, 2007PLANT SYSTEMSBASESa feedwater isolation signal Since the steam line break accident analysis credits them in preventionof feed line volume flashing in some cases. Feedwater pumps are assumed to trip immediatelywith an MSI signal.3/4.7.1.7 ATMOSPHERIC DUMP VALVESThe atmospheric dump valve (ADV) lines provide a method to maintain the unit* in HoTSTANDBY, and to replace or supplement the condenser steam dump valves to cool the unit toShutdown Cooling (SDC) entry conditions. Each ADV line contains an air operated.ADV, and anuipstream manual isolation Vcalve. The manual isolation valves are normally open; anid the ADVSclosed. The ADVs, which are normally operated from the main control* room, can be operated*locally using a manual handwheel.An ADV is, ..if the manual iso~latin val~ve-,iS,,pen and .if~tocal:-mranual..of theADN.c~an bed u ;9:4 t: eroxc~nrolole4;0r~easeofgstamn .t t~he *atospere. If:the manual isolation valve is closed the ADV line is inoperable The considerable: time and effortrequired to open the valve Wvould challenge the timing of critical operator act~ions and establishedoperator dose limits. This is consistent with the LOCA analysis and Steam Generator TubeRupture analysis which credits local manual operation of the ADV lines for accident mitigation.3/4.7.1.8 STEAM GENERATOR BLOWDOWN ISOLATION VALVESThe steam generator blowdown isolation valves will isolate steam generator blowdown on*low steam generator water level; An auxiliary feedwater actuation signal will also be generated at*this steam generator water level. Isolation of steam generator: blowdown will conserve steamgenerator water inventory following, a loss of main feedwater. The steam generator blowdownisolation valves will also*close automatically upon receipt of a containment isolation signal or ahigh radiation signal (steam generator blowdown or condenser air ejector discharge).3/4.7.2 DELETED...3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER sYSTEMThe OPERABILITY of the Reactor Building Closed Cooling Water*(RBCCw) Systemensures that sufficient cooling capacity is available for continued operation of vital componentsand Engineered Safety Feature equipment during normal and accident conditions. The redundantcooling capacity of this system, assuming a single failure, is consistent with the ass usedin the accident analyses...The RBcCW loops areredundant of each other to the degree that each has separate controls andpower supplies and the operation of one does not depend on the other. In the event of a'designbasis accident,: one RBCCW ioop is required to provide the minimum heat removal capabilityassumed in the safety analysis for the systems to. which it supplies cooling water. To enSure thisrequirement is met, two RBCCW loops must be OPERABLE, and independent to the extent"necessary to ensure that a single failure will not result in the unavailabilityMILLSTONE -UNIT 2 B 3/4 7-3a Amendment No. 2N-l9, &224, 226,24m6,-~2-8,-2-7-2, January 10, 2002PTSCR 2-18-01May 1, 2002PLANT SYSTEMSBASESof both RBCCW loops. At least one RBCCW ioop will operate assuming the worst single activefailure occurs following a design basis accident coincident with a loss of offsite power, or theworst single passive failure occurs during post-loss of coolant accident long tenn cooling. Systemdesign is assumed to mitigate the single active failure. System design or operator action isassumed to mitigate the passive failure.The RBCCW System has numerous cross connection points between the redundant loops, withmanual valve isolation capability. When these valves are opened, the two system ioops are nolonger independent. The loss of independence will result in one large RBCCW loop. This mayadversely impact the ability of the RBCCW System to mitigate the design basis events if a singlefailure, active or passive, occurs. Opening the manual cross-connection valves during normaloperation should be evaluated to ensure system stability, minimum component cooling flowrequirements, and the ability to mitigate the design basis events coincident with a single failureare maintained. Continuous operation with cross-connection valves open is acceptable if theconfiguration has been evaluated and protection against a single failure can be demonstrated.(Several system configurations that have been evaluated and determined acceptable forcontinuous plant operation are identified below). If opening a cross-connection valve will result ina plant configuration that does not provide adequate protection against a single failure, thefollowing guidance app lies. If only the manual cross-connect valves have been opened, and theR.BCCW System is in a normal configuration otherwise, with all system equipment OPERABLE,one RBCCW loop should be considered inoperable and the ACTION requirements of TechnicalSpecification 3.7.3.1 applied. If the RBCCW System is not in a normal configuration otherwiseand/or not all equipment is OPERABLE, both RBCCW loops should be considered inoperableand the ACTION requirements of Technical Specification 3.0.3 applied.The loss of loop independence is equivalent to the situation w!here one loop is inoperable.If one loop is inoperable, the remaining OPERABLE loop will be able to meet all design basisaccident functions, assuming an additional single failure does not occur. If the loops are notindependent, the remaining single large OPERABLE loop will be able to meet all design basisaccident functions, assuming a single failure does not occur. Operation in a plant configurationwhere protection against a single failure can not be shown is acceptable provided the time periodin that configuration is limited to less than the Technical Specification specified allowed outagetrine. It is acceptable to operate in the off normal plant configurations identified in the ACTIONrequirements for the time periods specified due to the low probability of occurrence of a designlbasis event concurrent with a single failure during this limited trime period. The allowed outagetime for one inoperable RBCCW loop provides an appropriate lrimit for continued operation withonly one OPERABLE RBCCW loop, and can be applied to a plant configuration where only loopindependence has been compromised. The loop determined to be inoperable should be the loopthat results in the most adverse plant configuration with respect to the availability of accidentmitigation equipment. Restoration of loop independence within the trime constraints of theallowed outage time is required, or a plant shutdown is necessary.MILLSTONE -UNIT 2 B 3/4 7-3b Revised by NRC Letter A 15689Amendment No. LIBDCR 14-MIP2-016September 4, 2014PLANT SYSTEMSBASES3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER SYSTEM (Continued)It is acceptable to operate with the RBCCW pump minimum flow valves (2-RB-107A, 2-RB-l07B, 2-RiB-107C), RBCCW pump sample valves (2-RB-56A, 2-RiB-56B, and 2-RB-56C),and the RBCCW pump radiation monitor stop valves (2-RIB-39, 2-RB-4t,and 2-RB-43) open. Anactive single failure will not adversely impact both RBCCW loops with these valves open. Inaddition, protection against a passive single failure after the initiation of post-loss of coolantaccident long term cooling is achieved by manually closing these accessible valves, as directed bythe emergency operating procedures. In addition, operation with RBCCW chemical additionvalves (2-RB-50A and 2-RB-50B) open during chemical addition evolutions is acceptable sincethese normally closed valves are opened to add chemicals to the RBCCW and then closed asdirected by nonnal operating procedures. Therefore, operation with these valves open does notaffect OPERABILITY of the RBCCW loops.Surveillance Requirement 4.7.3.1 .a verifies the correct alignment for manual, poweroperated, and automatic valves in the RBCCW System flow paths to provide assurance that theproper flow paths exist for RBCCW operation. This surveillance does not apply to valves that arelocked, sealed, or otherwise secured in position, since thlese valves were verified to be in thecorrect position prior to locking, sealing, or securing. A valve that receives an actuation signal isallowed to be in a nonaccident position provided the valve automatically repositions within theproper stroke time. This surveillance does not require any testing or valve manipulation. Rather, itinvolves verification that those valves capable of being mispositioned are in the correct position.The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.7.3.1 .b and 4.7.3.1 .c demonstrate that each automaticRBCCW valve actuates to the required position on an actual or simulated actuation signal and thateach RBCCW pump starts on receipt of an actual or simulated actuation signal. This Surveillanceis not required for valves that are locked, sealed, or otherwise secured in the required positionunder administrative controls. These surveillance frequencies are controlled under theSurveillance Frequency Control Program. The actuation logic is tested as part of the EngineeredSafety Feature Actuation System (ESFAS) testing; and equipment performance is monitored aspart of the Inservice Testing Program.3/4.7.4 SERVICE WATER SYSTEMThe OPERABILITY of the Service Water (SW) System ensures that sufficient coolingcapacity is available for continued operation of vital components and Engineered Safety Featureequipment during normal and accident conditions. The redundant cooling capacity of this system,assuming a single failure, is consistent with the assumptions used in the accident analyses.MILLSTONE -UNIT 2 B 3/4 7-3c Amendment No. -249, g22, 36,2-3&, 2a7-3 February 13, 2003PLANT SYSTEMSBASES3/4.7.4 SERVICE WATER SYSTEM (continued)The SW loops are redundant of each other to the degree that each has separate controls and powersupplies and the operation Of one does not depend on the other. In the event of a design basis accident, oneSW loop is required to provide the minimum heat removal capability assumed in the safety analysis for thesystems to which it supplies cooling water. To ensure this requirement is met, two SW loops must beOPERABLE, and independent to the extent necessary to ensure that a single failure will not result in theunavailability of both SW loops. At least one SW loop will operate assuming the worst single active failureoccurs following a design basis accident coincident with a loss of offsite power, or the worst single passivefailure occurs post-loss of coolant accident long term cooling. System design is assumed to mitigate thesingle active failure. System design or operator action is assumed to mitigate paissive failure.The SW System has numerous cross connection points between the redundant loops, with manualvalve isolation capability. When these valves are opened, the two system loops are no longer independent.The loss of independence will result in one large SW loop. This may adversely impact the ability of theSW System to mitigate the design basis events if a single failure, active or passive, occurs. Opening themanual cross-connection valves during normal operation should be evaluated to ensure system stability,minimum component cooling flow requirements, and the ability to mitigate the design basis eventcoicident with a single failure are maintained. Continuous operation with cross-connection valves open isacceptable if the configuration has been evaluated and protection against a single failure can bedemonstrated. (SeVeral system configurations that have been evaluated and determined acceptable forcontinuous plant operation are identified below). If opening a cross-connection valve will result in a plantconfiguration that does not provide adequate protection against a single failure, the following guidanceapplies: If only the manual cross-connect valves have been opened, and the SW System is in a normalconfiguration otherwise, with all system equipment OPERABLE, one SW loop should be consideredinoperable and the ACTION requirements of Technical Specification 3.7.4.1 applied. If the SW System isnot in a normal configuration otherwise and/or not all equipment is OPERABLE, both SW loops should beconsidered inoperable and the ACTION requirements of Technical Specification 3.0.3 applied.The loss of loop independence is equivalent to the situation where one loop is inoperable. If oneloop is inoperable, the remaining OPERABLE loop will be able to meet all design basis accident functions,assuming an additional single failure does not occur. If the loops are not independent, the remaining singlelarge OPERABLE loop will be able to meet all design basis accident functions, assuming a single failuredoes not occur. Operation in a plant configuration where protection against a single failure can not beshown is acceptable provided the time period in that configuration is limited to less then the TechnicalSpecification specified allowed outage time. It is acceptable to operate in the off normal plantconfigurations identified in the ACTION requirements for the time periods specified due to the lowprobability of occurrence of a design basis event concurrent with a single failure during this limited timeperiod. The allowed outage time for one inoperable SW loop provides an appropriate limit for continuedoperation with only one OPERABLE SW loop, and can be applied to a plant configuration where onlyloop independence has been compromised. The loopMILLSTONE -UNIT 2B3473AmnetNo23B3/4 7-3dAmendment No. 273 REVERSE OF PAGE B314 7-3dINTENTIONALLY LEFT BLANK LBDCR I4-MiP2-016September 4, 2014PLANT SYSTEMSBASES3/4.7.4 SERVICE WATER SYSTEM (Continued)determined to be inoperable should be the ioop that results in the most adverse plant configurationwith respect to the availability of accident mitigation equipment. Restoration of ioopindependence within the time constraints of the allowed outage time is required, or a plantshutdown is necessary.-Branch lines are supplied to isolation valves in the intake for lubrication to the circulatingwater pump bearings (2-S W-298 and 2-S W-299), and alternate supply connections (2-S W-84A,and 2-S W-84B). The flow restricting orifices in these lines ensure that safety related loadscontinue to receive minimum required flow during a LOCA (in which the lines remain intact), orduring a seismic event (when the lines break) even with the valves open. Therefore, operationwith these valves open does not affect OPERABILITY of the SW loops.Surveillance Requirement 4.7.4.1 .a verifies the correct alignment for manual, poweroperated, and automatic valves in the Service Water (SW) System flow paths to provide assurancethat the proper flow paths exist for SW operation. This surveillance does not apply to valves thatare locked, sealed, or otherwise secured in position, since these valves were verified to be in thecorrect position prior to locking, sealing, or securing. A valve that receives an actuation signal isallowed to be in a nonaccident position provided the valve automatically repositions within theproper stroke time. This surveillance does not require any testing or valve manipulation. Rather, itinvolves verification that those valves capable of being mispositioned are in the correct position.The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.7.4.1l.b and 4.7.4.l.c demonstrate that each automatic SWvalve actuates to the required position on an actual or simulated actuation signal and that each SWpump starts on receipt of an actual or simulated actuation signal. This surveillance is not requiredfor valves that are locked, sealed, or otherwise secured in the required position underadministrative controls. These surveillance frequencies are controlled under the SurveillanceFrequency Control Program. The actuation logic is tested as part of the Engineered Safety FeatureActuation System (ESFAS) testing, and equipment performance is monitored as part of theInservice Testing Program..3/4.7.5 DELETEDMILLSTONE -UNIT 2B 3/4 7-4MILLTON -NIT2 B3/47-4Amendment No. 2g-36, June 25, 2007LBDCR 07-MP2-013PLANT SYSTEMSBASES 03/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEMThe OPERABILITY of the Control Room Emergency Ventilation System ensures that1) the ambient air temperature does not exceed the allowable temperature for continuous dutyrating for the equipment and instrumentation cooled by this system and 2) the control room willremain habitable for operations personnel during and following all credible accident conditions.The OPERABILITY of thiis system in conjunction with control room design provisions isbased on limiting the radiation exposure to personnel occupying the control room. For allpostulated design basis accidents, the radiation exposure to personnel occupying the control roomshall be 5 rem TEDE or less consistent with the requirements of 10 CFR 50.67The Control Room Envelope (CRIB) is the area within the confines of the GRE boundary thatcontains the spaces that control room occupants inhabit to control the unit during normal andaccident conditions. This area encompasses the control room, and other non-critical areasincluding adjacent support offices, and utility rooms. The GRE is protected during normaloperation, natural events, and accident conditions. The GRE boundary is the combination ofwalls, floor, ceiling, ducting, valves, doors, penetrations and equipment that physically form theCRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakageof unfiltered air into the GRE will not exceed the inleakage assumed in the licensing basisaanalysis of design basis accident (DBA) consequences to GRE occupants. The GRE and boundary are defined in the Control Room Envelope Habitability Program.In order for the control room emergency ventilation systems to be considered OPERABLE, theGRE boundary must be maintained such that the GRE occupant dose from a large radioactiverelease does not exceed the calculated dose in the licensing basis consequence analyses for DBAs,and that GRE occupants are protected from hazardous chemicals and smoke.TS LCO 3.7.6.1 is modified by a footnote allowing the GRE boundary to be opened intermittentlyunder administrative controls. This footnote only applies to openings in the GRE boundary thatcan be rapidly restored to the design condition, such as doors, hatches, floor plugs, and accesspanels. For entry and exit through doors, the administrative control of the opening is performedby the person(s) entering or exiting the area. For other openings, these controls should beproceduralized and consist of stationing a dedicated individual at the opening Who is incontinuous communication with the operators in the GRE. This individual will have a method torapidly close the opening and to restore the GRE boundary to a condition equivalent to the designcondition when a need for GRE isolation is indicated.MILLSTONE -UNIT 2 B 3/4 7.-4a Amendment No. 22S, 2-36, 7-3,4ng4, LBDCR 14-MIP2-001May 20, 2014PLANT SYSTEMSBASES3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)ACTIONS a. 1, b. 1, b.2, b.3, c. 1, c.2 and c.3 of this specification are applicable at all timesduring plant operation in MODES 1, 2, 3, and 4. ACTIONS d.1, d.2, and e.1 are applicable inMODES 5 and 6, or when recently irradiated fuel assemblies are being moved. The control roomemergency ventilation system is required to be OPERABLE during fuel handling involvinghandling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core withinthe previous 300 hours).With one Control Room Emergency Ventilation (CREV) train inoperable except due to aninoperable CREV boundary, action must be taken to restore OPERABLE status within 7 days. Inthis Condition, the remaining OPERABLE CREV subsystem is adequate to perform control roomradiation protection function. However, the overall reliability is reduced because a single failurein the OPERABLE CREV train could result in loss of CREV function. The 7 day allowed outagetime is based on the low probability of a DBA occunring during this time period, and the ability ofthe remaining train to provide the required capability.If both CREV trains are inoperable in MODE 1, 2, 3, or 4 for reasons other than aninoperable control room boundary (i.e., Condition c), at least one CREV train must be returned toOPERABLE status within 24 hours. The Condition is modified by a Note stating it is notapplicable if the second CREV train is intentionally declared inoperable. The Condition does notapply to voluntary removal of redundant systems or components from service. The Condition isonly applicable if one train is inoperable for any reason and the second train is discovered to beinoperable, or if both trains are discovered to be inoperable at the same time. During the periodthat the CREV trains are inoperable, action must be initiated to implement mitigating actions tolessen the effect on control room (CR) occupants from potential hazai'ds while both trains of.CREV are inoperable. In the event of a DBA, the mitigating actions will reduce the consequencesof radiological exposures to the CR occupants.Specification 3.4.8, "Reactor Coolant System Specific Activity," allows limitedoperation with the reactor coolant system (RCS) activity significantly greater than the LCOlimit. This presents a risk to the plant operator during an accident when all CREV trains areinoperable. Therefore, it must be verified within 1 hour that LCO 3.4.8 is met. This RequiredAction does not require additional RCS sampling beyond that normnally required by LCO 3.4.8.At least one CREV train must be returned to OPERABLE status within 24 hours. Theallowed outage time is based on Reference 1 whtich demonstrated that the 24 hour allowed outagetime is acceptable based on the infrequent use of the Required Actions and tlhe small incrementaleffect on plant risk.MILLSTONE -UNIT 2 B 3/4 7-4b Amendment No. 2-g, 2-36, 5, -24, -54,2g4, LBDCR 14-Mv~P2-001May 20, 2014PLANT SYSTEMSBASES3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)If the control room boundary is in~operable in MODES 1, 2, 3, and 4, the CREV trainscannot perfonn their intended functions. Actions must be taken to restore an OPERABLE controlroom boundary within 90 days. During the period that the control room boundary is inoperable,appropriate compensatory measures (consistent with the intent of GDC 19) should be utilized toprotect contr~ol room operators from potential hazards such as radioactive contamination, toxicchemicals, smoke, temperature and relative humidity, and physical security. Preplarned measuresshould be available to address these concerns for intentional and unintentional entry into thecondition. The 90 days allowed outage time is reasonable based on the low probability of a DBAoccurring during this time period, and the use of compensatory measures. The 90 days allowedoutage time is a typically reasonable time to diagnose, plan and possibly repair, and test mostproblems with the control room boundary.In MODE 5 or 6, or during movement of recently irradiated fuel assemblies, if RequiredAction d. 1 cannot be completed within the required allowed outage time, the OPERABLE CREVtrain must be immediately placed in the recirculation mode of operation. This action ensures thatthe remaining train is OPERABLE, that no failures preventing automatic actuation will occur, andthat any active failure will be readily detected. iAn alternative to Required Action d. 1 s to immediately suspend activities that couldresult in-a release of radioactiv;ity that might require isolation of the control room. This places theunit in a condition that minimizes the accident risk. This does not preclude the movement of fuelassemblies to a safe position.When in MODES 5 and 6, or during movement of recently irr-adiated, fuel assemblies,with two CREV trains inoperable, action muist be taken immediately to suspend activities thatcould result in a release of radioactivity that might require isolation of the control roomJ Thisplaces the unit in a condition that minimizes the accident risk. This does not preclude themovement of fuel to a safe position.The control room radiological dose calculations use the conservative minimum acceptableflow of 2250 cfm based on the flowrate surveillance requirement of 2500 cfm 4+ 10%.MILLSTONE -UNIT 2 B 3/4 7-4c Amendment No. 2-, 2--6, -2A-5, 2a4g,-2-54, 84, LBDCR 14-MP2-001May 20, 2014PLANT SYSTEMSBASES3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)Currently there are some situations where the CREV System may not automatically starton an accident signal, without operator action. Under most situations, the emergency filtrationfans will start and the CREV System will be in the accident lineup. However, a failure of a supplyfan (F21A or B) or an exhaust fan (F31lA or B), will require operator action to return to a full trainlineup. Also, if a single emergency bus does not power up for one train of the CREV System, theopposite train filter fan will automatically start, but the required supply and exhaust fans will notautomatically start. Therefore, operator action is required to establish the whole train lineup. Thisaction is specified in the Emergency Operating Procedures. The radiological dose calculations donot take credit for CREV System cleanup action until 1 hour into the accident to allow foroperator action.When the CREV System is checked to shift to the recirculation mode of operation, thiswill be performed from the nonnal mode of operation, and from the smoke purge mode ofoperation.If the unfiltered inleakage of potentially contaminated air past the CRE boundaiy and intothe CR3 can result in CRE occupant radiological dose greater than the calculated dose of thelicensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequateprotection of CRE occupants from hazardous chemicals or smoke, the CRE boundary isinoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.During the period that the CRE boundary is considered inoperable, action must beinitiated to implement mitigating actions to lessen the effect on CRE occupants from the potentialhazards of a radiological or chemical event or a challenge from smoke. Actions must be takenwithin 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CREoccupant radiological exposures will not exceed the calculated dose of the licensing basisanalyses of DBA consequences, and that CRE occupants are protected from hazardous chemicalsand smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of theinoperable CRE boundary) should be preplanned for implementation upon entry into thecondition, regardless of whether entry is intentional or unintentional. The 24 hour allowed outagetime is reasonable based on the low probability of a DBA occurring during this time period, andthe use of mitigating actions. The 90 day allowed outage time is reasonable based on thedetermination that the mitigating actions will ensure protection of CRE occupants withinanalyzed limits while limiting the probability that CRE occupants will have to implementprotective measures that may adversely affect their ability to control the reactor and maintain it ina safe shutdown condition in the event of a DBA. In addition, the 90 day allowed outage time is areasonable time to diagnose, plan and possibly repair, and test most problems with the CR3boundary.MILLSTON~E -UNIT 2 B3474 mnmn oB 3/4 7-4dAmendment No. LBDCR 14-MIP2-016September 4, 2014PLANT SYSTEMSBASES I13/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)Irmrediate action(s), in accordance with the LCO Action Statements, means that therequired action should be pursued without delay and in a controlled manner.Surveillance Requirement 4.7.6.1 .c. 1 dictates the test frequency, methods and acceptancecriteria for the Control Room Emergency Ventilation System trains (cleanup trains). These criteriaall originate in the Regulatory Position sections of Regulatory Guide 1.52, Rev. 2, March 1978 asdiscussed below.Section C.5 .a requires a visual inspection of the cleanup system be made before the followingtests, in accordance with the provisions of section 5 of ANSI N510-1975:* in-place air flow distribution testo DOP testo activated carbon adsorber section leak testSection C.5 .c requires the in-place Dioctyl phthalate (DOP) test for IT]EPA filters to conform tosection 10 of ANSI N510-1975. The HEPA filters should be tested in place (1) initially, (2) at thefrequency specified in the Surveillance Frequency Control Program, and (3) following painting,fire, or chemical release in any ventilation zone communicating with the system. The testing is toconfirm a penetration of less than or equal to 1%* at rated flow.Section C.5 .d requires the charcoal adsorber section to be leak testedwvith a gaseous halogenatedhydrocarbon refrigerant, in accordance with. section 12 of ANSI N5 10-1975 to ensure that bypassleakage through the adsorber section is less than or equal to 1%. ** Adsorber leak testing shouldbe conducted (1) initially, (2) at the frequency specified in the Surveillance Frequency ControlProgram, (3) following removal of an adsorber sample for laboratoiy testing if the integrity of theadsorber section is affected, and (4) following painting, fire, or chemical release in any ventilationzone communicating with the system.* Means that the HIEPA filter will allow passage of less than or equal to 1% of the testconcentration injection at the filter inlet from a standard DOP concentration injection.*

• Means that the charcoal adsorber sections will allow passage of less than or equal to 1% of theinjected test concentration around the charcoal adsorber section.MILLSTONE -UNIT 2 B 3/4 7-4e Amendment No.

LBDCR 14-MP2-001May 20, 2014PLANT SYSTEMSBASES3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)The ACTION requirements to immediately suspend various activities (COREALTERATIONS, irradiated fuel movement, etc.) do not preclude completion of the movement ofa component to a safe position.Technical Specification 3.7.6.1 provides the OPERABILITY requirements for the ControlRoom Emergency Ventilation Trains. If a Control Room Emergency Ventilation Train emergencypower source or normal power source becomes inoperable in MODES 1, 2, 3, or 4 therequirements of Technical Specification 3.0.5 apply in determining the OPERABILITY of theaffected Control Room Emergency Ventilation Train. If a Control Room Emergency VentilationTrain emergency power source or normal power source becomes inoperable in MODES 5 or 6 theguidance provided by Note "**~" of this specification applies in determining the OPERABILITYof the affected Control Room Emergency Ventilation Train. If a Control Room EmergencyVentilation Train emergency power source or normal power source becomes inoperable while notin MODES 1, 2, 3, 4, 5, or 6 the requirements of Technical Specification 3.0.5 apply indetermining the OPERABILITY of the affected Control Room Emergency Ventilation Train.Surveillance Requirement 4.7.6.1.h verifies the OPERABILITY of the CRE boundary bytesting for -unfiltered air inleakage past the CRE boundary and into the CRE. The details of thetesting are specified in the Control Room Envelope Habitability Program.*Means that the HF-EPA filter will allow passage of less than or equal to 1% of the testconcentration injection at the filter inlet from a standard DOP concentration injection.** Means that the charcoal adsorber sections will allow passage of less than or equal to 1% of theinjected test concentration around the charcoal adsorber section.MILLSTONE -UNIT 2 B3474 mnmn oB 3/4 7-4fAmendment No. ] LBDCR 14-MIP2-001~May 20, 2014PLANT SYSTEMSBASES3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)The GRE is considered habitable when the radiological dose to GRE occupants calculatedin the licensing basis analyses of DBA consequences is no more than 5 remn TEDE and the GREoccupants are protected from hazardous chemicals and smoke. This SR verifies that the unfilteredair inleakage into the GRE is no greater than the flow rate assumed in the licensing basis analysesof DB3A consequences. When unfiltered air inleakage is greater than the assumed flow rate,ACTION c. must be entered. ACTION c. allows time to restore the GRE boundary toOPERABLE status provided mitigating actions can ensure that the GRE remains within thelicensing basis habitability limits for the occupants following an accident. Compensatorymeasures are discussed in Regulatory Guide 1.196, which endorses, with exceptions, NEI 99-03.These compensatory measures may also be used as mitigating actions as required by ACTION c.Temporary analytical methods may also be used as compensatory measures to restoreOPERABILITY. Options for restoring the GRE boundary to OPERABLE status include changingthe licensing basis DBA consequence analysis, repairing the GRE boundary, or a combination ofthese actions. Depending upon the nature of the problem and the corrective action, a full scopeinleakage test may not be necessary to establish that the GRE boundary has been restored toOPERABLE status.REFERENCE !1. WCAP- 16 125-NP-A, "Justification for Risk-Informed Modifications to Selected TeclmicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2 B 3/4 7-4g 10O LBDCR 11-MP2-010August 23, 2011PLANT SYSTEMSBASES3/4.7.7 DELETED3/4.7.8 SNUBBERSAll snubbers are required OPERABLE to ensure that the structural integrity of the reactorcoolant system and all other safety related systems is maintained during and following a seismicor other event initiating dynamic loads. Snubbers excluded from this inspection program are thoseinstalled on nonsafety-related systems and then only if their failure or failure of the system onxWhich they are installed would have no adverse effect on any safety-related system.MILLSTONE -UNIT 2B 3/4 7-5Amendment No. 141, 3-5, 96, 4-1-6, LW2: LBDCR 11-MP2-010August 23, 2011PLANTSYSTM0BASES3/4.7.9 DELETEDMILLSTONE -UNIT 2B 3/4 7-6Amendment No.. 1-t, 2_,-, %, -t-l-, 49-1-,-244 LBDCR 13-MP2.-004May 2, 2013PLANT SYSTEMSBASES3/4.7.10 DELETED3/4.7.11 ULTIMATE HEAT SINKBACKGROUNDThe ultimate heat sink (UI-{S) for Millstone Unit No. 2 is Long Island Sound. The LongIsland Sound is connected to the Atlantic Ocean and provides the required 30 day supply of water.It serves as a heat sink for both safety and non-safety-related cooling systems. Sensible heat isdischarged to the UtIIS via the service water (SW) and circulating water (CW) systems.The basic performance requirement is that a 30 day supply of water be available, and thatthe design basis temperatures of safety related equipment not be exceeded.Additional information on the design and operation of the system, along with a list ofcomponents served, can be found in References 1, 2, and 3.APPLICABLE SAFETY ANALYSESThe U-FIS is the sink for heat removed from the reactor core following all accidents andanticipated operational occurrences in which the unit is cooled down and placed on shutdowncooling system (SDC) operation. With UHIS as the normal heat sink for condenser cooling via theCW System, unit operation at full power is its maximum heat load. Its maximum post accidentheat load occurs < 1 hour after a design basis loss of coolant accident (LOCA). Near this time, theunit switches from injection to recirculation and the containment cooling system is required toremove the core decay heat ...The operating limits are based on conservative heat transfer analyses for the worst caseLOCA. References 1, 2, and 3 provide the details of the assumptions used in the analysis, whichinclude worst expected meteorological conditions, conservative uncertainties when calculat~ingdecay heat, and worst case single active failure (e.g., single failure of a man-made structure).The limitations on the temperature of the UHIS ensure that the assumption for temperatureused in the analyses for cooling of safety related components by the SW system are satisfied.These analyses ensure that under normal operation, plant cooldown, or accident conditions, allcomponents cooled directly or indirectly by SW will receive adequate cooling to perform theirdesign basis functions.The UJIS satisfies Criterion 3 of 10 CFR 50.3 6(c)(2)(ii).M'VILLSTON\E -UNIT 2 B 3/4 7-7 Amendment No. 4-t4-, 1I94I-, 1-, 24-7-, 25~7, 214I~A gx...... 1 byI,- l./t-r dat+cd-12,'l9/'0 LBDCR 14-MP2-016September 4, 2014PLAINT SYSTEMSBASES3/4.7.11 ULTIMATE HEAT SINK (Continued)LCOThe UIHS is required to be OPERABLE and is considered OPERABLE if it contains asufficient volume of water at or below the maximum temperature that would allow the SWSystem to operate for at least 30 days following the design basis LOCA without the loss of netpositive suction head (NPSHJ), and without exceeding the maximum design temperature of theequipment served by the SW System. To meet this condition, the UJIS temperature should notexceed 800F during normal unit operation.While the use of any supply side SW temperature indication is adequate to ensurecompliance with the analysis assumptions, precision instruments installed at the inlet to thereactor building closed cooling water (RBCCW) heat exchangers will normally be used.Therefore, instrument uncertainty need not be factored into the surveillance acceptance criteria.All in-service instruments must be within the limit. If all of the precision instruments are out ofservice, alternative instruments that measure SW supply side temperature will be used. In thiscase, an appropriate instrument uncertainty will be subtracted from the acceptance criteria.Since Long Island Sound temperature changes relatively slowly and in a predictable fashion according to the tides, it is acceptable to monitor this temperature at the frequency0specified in the Surveillance Frequency Control Program when there is ample (>5°F) margin tothe limit. When within 5°F of the limit, the temperature shall be monitored every 6 hours toensure that tidal variations are appropriately captured.APPLICABILITYIn MODES 1, 2, 3, and 4, the UIIS is required to support the OPERABILITY of theequipment serviced by the UIH-S and required to be.OPERABLE in these MODES.In MODE 5 or 6, the OPERABILITY requirements of the UIIS are determined by thesystems it supports.ACTIONIf the U911 is inoperable, the unit must be placed in a MODE in which the LCO does notapply. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hoursand in COLD SHUTDOWN within the following 30 hours.The allowed outage times are reasonable, based on operating experience, to reach therequired unit conditions from full power conditions in an orderly manner and without challengingunit systems.MILLSTONE -UNIT 2B3/7-B 3/4 7-8 LBDCR 13-MP2-004May 2, 2013PLANT SYSTEMSBASES3/4.7.11 ULTIMATE HEAT SINK (Continued)SURVEILLANCE REQUIREMENTSThis surveillance requirement verifies that the UTIS is capable of providing a 30 daycooling water supply to safety related equipment without exceeding its design basis temperature.This surveillance requirement verifies that the water temperature of the UHIS is < 80°F.REFERENCES1. FSAR, Sections 6.3, 6.4, 6.5, and 6.6 addressing Containment Systems.2. FSAR, Sections 9.3, 9.4, and 9.5 addressing Water Systems.3. FSAR, Section 14.6, Decrease in Reactor Coolant Inventory.MILLSTONE -UNIT 2B3/79B 3/4 7-9 REVERSE OF PAGE B 3/4 7-9INTENTIONALLY LEFT BLANK : LBDCR 11-MP2-012December 21, 20113/4.8 ELECTRICAL POWER SYSTEMSBASESThe OPERABILITY of the A.C. and D.C. power sources and associated distributionsystems during operation ensures that sufficient power will be available to supply the safetyrelated equipment required for 1) the safe shutdown of the facility and 2) the mitigation andcontrol of accident conditions within the facility. The minimum specified independent andredundant A.C. and D.C. power sources and distribution systems satisfy the requirements ofGeneral Design Criteria 17 of Appendix "A" to 10 CFR 50.The required circuits between the offsite transmission network and the onsite Class 1Edistribution system (Station Busses 24C, 24D, and 24E) that satisfy Technical Specification3.8.1.1 .a (MODES 1, 2, 3, and 4) consist of the following circuits from the switchyard to theonsite electrical distribution system:a. Station safeguards busses 24C and 24D via the Unit 2 Reserve Station ServiceTransformer; andb. Station bus 24E via the Unit 3 Reserve Station Service Transformer or Unit 3Normal Station Service Transformer (energized with breaker 1 5G-13T-2 (13T) andassociated disconnect switches open) and bus 34A or 34B.When taking credit for the Unit 3 Normal Station Service Transformer as a second offsitecircuit, breaker 13T and its associated disconnect switches are required to be open. This removesthe potential for a single failure (that of breaker 13T) to cause a simultaneous loss of both offsitecircuits. Should the other offsite circuit (i.e., the Unit 2 Reserve Station Service Transformer)already be inoperable, the requirement for maintaining breaker 1 3T and its associated disconnectswitches open is no longer applicable.If the plant configuration will not allow Unit 3 to supply power to Unit 2 from the Unit 3Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer within 3hours, Unit 2 must consider the second offsite source inoperable and enter the appropriateACTION statement of Technical Specification 3.8.1.1 for an inoperable offsite circuit.This is consistent with the GDC 17 requirement for two offsite sources. Each offsitecircuit is required to be available in sufficient time following a loss of all onsite alternating currentpower supplies and the other offsite electric power circuit to assure that specified acceptable fueldesign limits and design conditions of the reactor coolant pressure boundary are not exceeded.The first source is required to be available within a few seconds to supply power to safety relatedequipment following a loss of coolant accident. The second source is not required to be available*immediately and no accident is assumed to occur concurrently with the need to use the secondsource. However, the second source is required to be available in sufficient time to assure thereactor remains in a safe condition The 3 hour time period is based on the Millstone Unit No. 2Appendix R analysis. This analysis has demonstrated that the reactor will remain in a safecondition (i.e., the pressurizer will not empty) if charging is restored within 3 hours.MILLSTONE -UNIT 2B 3/4 8-1MILSTOE UNT 2B /4 -1Amendment No. 4-l-, 4-92, 3-1-, LBDCR 11-MP2-012December 21, 20113/4.8 ELECTRICAL POWER !BASESIn MODES 1 through 4 (Technical Specification 3.8.1 .1), the Unit 2 Normal StationService Transformer can be used as the second offsite source after the main generator disconnectlinks have been removed and the backfeed lineup established.The required circuit between the offsite transmission network and the onsite Class lEdistribution system (Station Busses 24C, 24D, and 24E) that satisfies Technical Specification3.8.1 .2.a (MODES 5 and 6) consists of the following circuit from the switchyard to the onsiteelectrical distribution system:a. Station safeguards bus 24C or 24D via the Unit 2 Reserve Station ServiceTransformer; orb. Station safeguards bus 24C or 24D via the Unit 2 Normal Station ServiceTransformer and bus 24A or 24B after the main generator disconnect links havebeen removed and the back~feed lineup established; orc. Station bus 24E via the Unit 3 Reserve Station Service Transformer or Unit 3Normal Station Service Transformer and bus 34A or 34B.When the plant is operating with the main generator connected to the grid, the output ofthe main generator will normally be used to supply the onsite Class lE distribution sYstem.During this time the required offsite circuits will be in standby, ready to supply power to theonsite Class lE distribution system if the main generator is not available. When shut down, onlyone of the offsite circuits will normally be used to supply the onsite Class lE distribution system.The other offsite circuit, if required, will be in standby. Verification of the required offsite circuitsconsists of checking control power to the breakers (breaker indicating lights), proper breakerposition for the current plant configuration, and voltage indication as appropriate for the currentplant configuration.The ACTION requirements specified for the levels of degradation of the power sourcesprovide restriction upon continued facility operation commensurate with the level of degradation.The OPERABILITY of the power sources are consistent with the initial condition assumptions ofthe accident analyses and are based upon maintaining at least one of each of the onsite A.C. andD.C. power sources and associated distribution systems OPERABLE during accident conditionscoincident with an assumed loss of offsite power and single failure of the other onsite A.C.source............ MILLSTONE- UNIT 2 "B 3/4 8:-2 ......--MILSTOE -UNI 2 3/4~2.... Amendment No:4-148; 4-9W2g34-, LBDCR 07-MP2-009" March 29, 20073/4.8 ELECTRICAL POWER SYSTEMSBASESTechnical Specification 3.8.1.1 ACTION Statements b and c provide an allowance toavoid unnecessary testing of the other OPERABLE diesel generator. If it can be determined thatcause of the inoperable diesel generator does not exist on the OPERABLE diesel generator,Surveillance Requirement 4.8.1.1 .2.a.2 does not have to be performed. If the cause ofinoperability exists on the other OPERABLE diesel generator, the other OPERABLE dieselgenerator would be declared inoperable upon discovery, ACTION Statement e would be entered,and appropriate ACTIONS will be taken. Once the failure is corrected, the common cause failureno longer exists, and the required ACTION Statements (b, c, and e) will be Satisfied.If it cannot be determined that the cause of the inoperable diesel generator does not existon the remaining diesel generator, performance of Surveillance Requirement 4.8.1i.1 .2.a.2, withinthe allowed time period, suffices to provide assurance of continued OPERABILITY of the dieselgenerator. If the inoperable diesel generator is restored to OPERABLE status prior to thedetermination of the impact on the other diesel generator, evaluation will continue of the possiblecommon cause failure. This continued evaluation is no longer under the time constraint imposedwhile in ACTION Statement b or c.The determination of the existence of a common cause failure that would affect theremaining diesel generator will require an evaluation of the current failure and the applicability tothe remaining diesel generator. Examples that would not be a common cause failure include, butare not limited to:1. Preplanned preventive maintenance or testing, or2. An inoperable support system with no potential common mode failure for theremaining diesel generator, or3. An independently testable component with no potential common mode failure for theremaining diesel generator.If one Millstone Unit No. 2 diesel generator is inoperable in MODES 1 though 4,ACTION Statements b.3 and c.3 require verification that the steam-driven auxiliary feedwaterpump is OPERABLE (MODES I; 2, and 3 only). If the steam-driven auxiliary feedwater pump isinoperable, restoration within 2 hours is required or a plant shutdown to MODE 4 will benecessary. This requirement is intended to provide assurance that a loss of offsite power eventwill not result in degradation of the auxiliary feedwater safety function to below accidentmitigation requirements during the period one of the diesel generators is inoperable. The termverify, as used in this context, means to administratively check by examining logs or otherinformation to determine if the steam-driven auxiliary feedwater pump is out of service formainten~ance or other reasons. It does not mean to perform Surveillance Requirements needed todemonstrate the OPERABILITY of the steam-driven auxiliary feedwater pump.MILLSTONE -UNIT 2 B 3/4 8-3 Amendment No. 4-8, +/-9-2,, 23-1-, 248,-2-6, LBDCR 07-MP2-009March 29, 20073/4.8 ELECTRICAL POWER SYSTEMS 9 BASESIf one Millstone Unit No. 2 diesel generator is inoperable in MODES 1 through 4, a 72hour allowed outage time is provided by ACTION Statement b.5 to allow restoration of the dieselgenerator, provided the requirements of ACTION Statements b. I, b.2, and b.3 are met. Thisallowed outage time can be extended to 14 days if the additional requirements contained inACTION Statement b.4 are also met. ACTION Statement b.4 requires verification that theMillstone Unit No. 3 diesel generators are OPERABLE as required by the applicable MillstoneUnit No. 3 Technical Specification (2 diesel generators in MODES 1 through 4, and 1 dieselgenerator in MODES 5 and 6) and the Millstone Unit No. 3 SBO0 diesel generator is available.The term verify, as used in this context, means to administratively check by examining logs orother information to determine if the required Millstone Unit No. 3 diesel generators and theMillstone Unit No. 3 SBO diesel generator are out of service for maintenance or other reasons. Itdoes not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITYof the required Millstone Unit No. 3 diesel generators or availability of the Millstone Unit No. 3SBO diesel generator.When using the 14 day allowed outage time provision and the Millstone Unit No. 3 dieselgenerator and/or the Millstone Unit No. 3 SBO diesel generator requirements are not met, 72hours is allowed for restoration of the required Millstone Unit No. 3 diesel generators and theMillstone Unit No. 3 SBO diesel generator. If any of the required Millstone Unit No. 3 diesel :generators and/or the Millstone Unit No. 3 SBO diesel generator are not restored within 72. hours,l i, ,and one Millstone Unit No. 2 diesel generator is still inoperable, Millstone Unit No. 2 is required.....to shut down.The 14 day allowed outage time for one inoperable Millstone Unit No. 2 diesel generatorwill allow performance of extended diesel generator maintenance and repair activities (e.g., dieselinspections) while the plant is operating. To minimize plant risk when using this extendedallowed outage time the following additional requirements must be met:1. The extended diesel generator maintenance outage shall not be scheduled whenadverse or inclement weather conditions and/or unstable grid conditions are predictedor present.2. The availability of the Millstone Unit No. 3 SBO DG shall be verified by testperformance within the previous 30 days prior to allowing a Millstone Unit No. 2diesel generator to be inoperable for greater than 72 hours.3. All activity in the switchyard shall be closely monitored and controlled. No electivemaintenance within the switchyard that could challenge offsite power availabilityshall be scheduled.MILLSTONE -UNIT 2 B 3/4 8-4 Amendment No. 4-8, 40-2-, ;3-i-, 948, I ".j,6-1-, 77, LBDCR 07-MvP2-009March 29, 20073/4.8 ELECTRICAL POWER SYSTEMSBASESIn addition, the plant configuration shall be controlled during the diesel generator-maintenance and repair activities to minimize plant risk consistent with a Conafiguration RiskManagement Program, as required by 10 CFR 50.65(a) (4).Diesel Generator TestingAn engine prelube period is allowed prior to engine start for all diesel generator testing.This 'will minimize wear on moving parts that do not get lubricated when the engine is notrunning.When specified in the surveillance tests, the diesel generators must be started from astandby condition. Standby condition for a diesel generator means the diesel engine coolant andoil are being circulated and temperature is being maintained consistent with manufacturerrecommendations.SR 4.8.1.l.2.a.2This surveillance helps to ensure the availability of the standby electrical power supply tomitigate design basis accidents and transients and to maintain the unit in a safe shutdowncondition. It verifies the ability of the diesel generator to start from a standby condition andachieve steady state voltage and frequency conditions. The time for voltage and speed(frequency) to stabilize is periodically monitored and the trend evaluated to identify' degradationof governor or voltage regulator performance when testing in accordance with the requirements ofthe surveillance.This surveillance is modified by two notes. Note 1 allows the use of a modified startbased on recommnendations of the manufacturer to reduce stress and wear on diesel engines.When using a modified start, the starting speed of the diesel generators is limited, wanmup islimited to this lower speed, and the diesel generators are gradually accelerated to synchronousspeed prior to loading. If a modified start is not used, the 15 second start requirement of SR4.8.l.I.2.d applies. Note 2 states that SR 4.8.1.1.2;d, ainore rigorous test, may be perfornned inlieu of 4.8.1.l.2.a.During performance of SR 4.8.1.1.2.a.2, the diesel generator shall be started by using oneof the following signals:1. Manual;2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;3. Simulated safety injection actuation signal alone; or4. simulated loss of power alone.MILLSTONE -UNIT 2 B3485AedetN.mB 3/4 8-5Amendment No. g7-7, [ LBDCR 14.-MIP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESThe surveillance frequency is controlled under the Surveillance Frequency Control Program.SR 4.8.1.1 .2.a.3This surveillance verifies that the diesel generators are capable of synchronizing with theoffsite electrical system and accepting loads greater than or equal to the equivalent of themaximum expected accident loads. A minimum run time of 60 minutes is required to stabilizeengine temperatures, while minimizing the time that the diesel generator is connected to theoffsite source. Although no power factor requirements are established by this surveillance, thediesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 valueis the design rating of the machine, while 1.0 is an operational limitation.This surveillance is modified by five Notes. Note 1 indicates that diesel engine runs forthis surveillance may include gradual loading, as recommended by the manufacturer, so thatmechanical stress and wear on the diesel engine are minimized. Note 2 states that momentarytransients because of changing bus loads do not invalidate this test. Similarly, momentary powerfactor transients above the limit will not invalidate the test. Note 3 indicates that this surveillanceshould be conducted on only one diesel generator at a time in order to avoid common causefailures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisiterequirement for performance of this surveillance. A successful diesel generator start must precedethis test to credit satisfactory performance. Note 5 states that SR 4.8.1.1 .2.d, a more rigorous test,may be performed in lieu of 4.8.1.1.2.a.The surveillance frequency is controlled under the Surveillance Frequency Control Program.SR 4.8.l.1.2.b.1Microbiological fouling is a major cause of fuel' oil degradation. There are numerousbacteria that can grow in fuel oil and cause fouling, but all must have a water environment inorder to survive. Removal of water from the three fuel storage tanks at the frequency specified inthe Surveillance Frequency Control Program eliminates the necessary environment for bacterialsurvival. This is the most effective means of controlling microbiological fouling. In addition, iteliminates the potential for water entrainment in the fuel oil during EDG operation. Water maycome from any of several sources, including condensation, rain water, contaminated fuel oil, andfrom breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulatedwater minimizes fouling and provides data regarding the watertight integrity of the fuel oilsystem. This surveillance is for preventative maintenance. The presence of water does notnecessarily represent failure of this surveillance provided the accumulated water is removedduring performance of the surveillance.MILLSTONE -UNMT 2 B3486Aed~n o -7B 3/4 8-6Amendment No. ggg, LBDCR April 3, 20123/4.8 ELECTRICAL POWER SYSTEMSBASESSR 4.8.1.1.2.b.2This surveillance requires testing of the new and stored fuel oil in accordance with theDiesel Fuel Oil Testing Program, as defined in Section 6 of the Technical Specifications.The tests listed below are a means of determining whether new fuel oil is of theappropriate grade and has not been contaminated with substances that would have an immediate,detrimental impact on diesel engine combustion. If results from these tests are within acceptablelimits, the fuel oil may be added to the storage tanks without concern for contaminating the entirevolume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the newfuel to the storage tank(s), but in no case is the time between receipt of new fuel and conductingthe tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows(more restrictive State of Connecticut and/or equipment limits may apply):a. Sample the new fuel oil in accordance with ASTM D4057,b. Verify in accordance with the tests specified in ASTM D975-81 that the samplehas an absolute specific gravity at 60/60°F of 0.83 and < 0.89, or an API gravityat 60°F of> 270 and < 390, a kinematic viscosity at 40°C of> 1.9 centistokes and <4.1 centistokes (alternatively, Saybolt viscosity, STJS at 100°F of> 32.6 bit< 40.1)and a flash point _> 125°F, andc. Verify that the new fuel oil has a clear and bright appearance with proper colorwhen tested in accordance with ASTM D4176 or a water and sediment contentwithin limits when tested in accordance with ASTM D2709 or D1796.Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does notrepresent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish thatthe other properties specified in Table 1 of ASTM D975-8:1 are met for new fuel oil when testedin accordance with ASTM D975-81, except that the analysis for sulfur may be performed inaccordance with ASTM D 1552 or ASTM D2622. The 31 day period is acceptable because thefuel oil properties of interest, even if they were not within stated limits, would not have animnmediate effect on DG operation.This surveillance ensures the availability of high quality fuel oil for the diesel generators.Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly tooxidation. The presence of particulate does not mean the fuel oil will not burn properly in a dieselengine. The particulate can cause fouling of filters and fuel oil injection equipment, however,which can cause engine failure. Particulate concentrations should be determined in accordancewith ASTM D2276-78, Method A, every 92 days. This method involves a gravimetricMILLSTONE -UNIT 2B3/8-AmnetNo 7,B 3/4 8-7Amendment No. 7--7, LBDCR 14-MP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESdeternination of total particulate concentration in the fuel oil and has a limit of 10 rag/I. It isacceptable to obtain a field sample for subsequent laboratory testing in lieu of fied testing.The frequency of this test takes into consideration fuel oil degradation trends that indicatethat particulate concentration is unlikely to change significantly between surveillance intervals.SR 4.8.1.1.2.c.2Under accident and loss of offsite power conditions, loads are sequentially connected tothe bus by the automatic load sequencer. The sequencing logic controls the permissive andstarting signals to motor breakers to prevent overloading of the diesel generators due to highmotor starting currents. The load sequence time interval tolerances ensure that sufficient timeexists for the diesel generator to restore frequency and voltage prior to applying the next load andthat safety analysis assumptions regarding Engineered Safety Features (ESE) equipment timedelays are not violated.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.This surveillance is modified by a Note. The reason for the Note is that performing thesurveillance would remove a required offsite circuit from service, perturb the electricaldistribution system, and challenge safety systems. This restriction from normally perforning thesurveillance in MODE 1, 2, 3, or 4 is further amplified to allow the surveillance to be performedfor the purpose of reestablishing OPERABILITY (e.g. post work testing following correctivemaintenance, corrective modification, deficient or incomPlete surveillance testing, and otherunanticipated OPERABILITY concerns) provided an assessment detertnines plant safety ismaintained or enhanced. This assessment shall, as a minimum, consider the potential outcomesand transients associated with a failed surveillance, a successful surveillance, and a perturbationof the offsite or onsite system when they are tied together or operated independently for thesurveillance; as well as the operator procedures available to cope with these outcomes. Theseshall be measured against the avoided risk of a plant shutdown and start up to determine that plantsafety is maintained or enhanced when the surveillance is performed in MODE 1, 2, 3, or 4. Riskinsights or deterninistic methods may be used for this assessment.MILLSTONE -UNIT 2 B3488AedetN.2--B 3/4 8-8Amendment No. LBDCR 14-MiP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESSR 4.8.1 .3.2.c.3Each diesel generator is provided with an engine overspeed trip to prevent damage to theengine. Recovery from the transient caused by the loss of a large load could cause diesel engineoverspeed, which, if excessive, might result in a trip of the engine. This surveillance demonstratesthe diesel generator load response characteristics and capability to reject the largest single loadwithout exceeding a predetermined frequency limit. The single largest load for each dieselgenerator is identified in the FSAR (Tables 8.3-2 and 8.3-3).This surveillance may be accomplished by either:a. Tripping the diesel generator output breaker with the diesel generator carryinggreater than or equal to its associated single largest post-accident load whileparalleled to offsite power or while solely supplying the bus; orb. Tripping the equivalent of the single largest post-accident load with the dieselgenerator solely supplying the bus.The time, voltage, and frequency tolerances specified in this surveillance are based on therepneduring load sequence intervals. The 2.2 seconds seiidi qa o4%o h .second load sequence interval associated with sequencing of the largest load (Safety Guide 9).The voltage and frequency spe~cified are consistent with the design range of the equipmentpowered by the diesel generator. SR 4.8.1.1.2.c.3.a corresponds to the maximum frequencyexcursion, while SR 4.8.1.1.2.c.3.b and SR 4.8.1.1.2.c.3.c are steady state voltage and frequencyvalues to which the system must recover following load rejection.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.This surveillance is modified by a Note to ensure that the diesel generator is tested underload conditions that are as close to design basis conditions as practical. When synchronized withoffsite power, testing should be performed at a power factor of_< 0.9 lagging. This power factor isrepresentative of the inductive loading a diesel generator would see based on the motor rating ofthe single largest load. It is within the adjustment capability of the Control Room Operator basedon the use of reactive load indication to establish the desired power factor. Under certainconditions, however, the note allows the surveillance to be conducted at a power factor other than_<0.9. These conditions occur when grid voltage is high, and the additional field excitation neededto get the power factor to _ 0.9 results in voltages on the emergency buses that are tooMILLSTON'E -UNIT 2 B3489AedetN.2~B 3/4 8-9Amendment No. 7-7, LBDCR 14-MIP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASEShigh. Under these conditions, the power factor should be maintained as close as practicable to 0.9while still maintaining acceptable voltage limits on the emergency buses. In other circumstances,the grid voltage may be such that the diesel generator excitation levels needed to obtain a powerfactor of 0.9 may not cause unacceptable voltages on the emergency buses, but the excitationlevels are in excess of those recommended for the diesel generator. In such cases, the power factorshall be maintained as close as practicable to 0.9 lagging without exceeding the diesel generatorexcitation limits.SR 4.8.1.1.2.c.4This surveillance demonstrates the diesel generator capability to reject a rated loadwithout overspeed tripping. A diesel generator rated load rejection may occur because of a systemfault or inadvertent breaker tripping. This surveillance ensures proper engine generator loadresponse under the simulated test conditions. This test simulates the loss of the total connectedload that the diesel generator experiences following a rated load rejection and verifies that thediesel generator will not trip upon loss of the load. While the diesel generator is not expected toexperience this transient during an event, this response ensures that the diesel generator is notdegraded for future application, including reconnection to the bus if the trip initiator can becorrected or isolated.This surveillance is performed by tripping the diesel generator output breaker with thediesel generator carrying the required load while paralleled to offsite power.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.This surveillance is modified by a Note to ensure that the diesel generator is tested underload conditions that are as close to design basis conditions as practical. When synchronized withoffsite power, testing should be performed at a power factor of < 0.83 lagging. This power factoris representative of the inductive loading a diesel generator would see under design basis accidentconditions. Under certain conditions, however, the note allows the surveillance to be conducted ata power factor other than < 0.83. These conditions occur when grid voltage is high, and theadditional field excitation needed to get the power factor to < 0.83 results in voltages on theemergency buses that are too high. Under these conditions, the power factor should be maintainedas close as practicable to 0.83 while still maintaining acceptable voltage limits on the emergencybuses. In other circumstances, the grid voltage may be such that the diesel generator excitationlevels needed to obtain a power factor of 0.83 may not cause unacceptable voltages on theemergency buses, but the excitation levels are in excess of those recommended for the dieselMILLSTON"E -UNIT 2B3/8-0AedntN.27B 3/4 8-10Amendment No. LBDCR 14-MiP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESgenerator. In such cases, the power factor shall be maintained as close as practicable to 0.83lagging without exceeding the diesel generator excitation limits.SR 4.8.1 .1 1.2 .c.5In the event of a design basis accident coincident with a loss of offsite power, the dieselgenerators are required to supply the necessary power to ESF systems so that the fuel, RCS, andcontainment design limits are not exceeded. This surveillance demonstrates the diesel generatoroperation during a loss of offsite power actuation test signal in conjunction with an ESF actuationsignal, including shedding of the nonessential loads and energization of the emergency buses andrespective loads from the diesel generator. It further demonstrates the capability of the dieselgenerator to automatically achieve the required voltage and speed (frequency) within thespecified time. The diesel generator auto-start time of 15 seconds is derived from requirements ofthe accident analysis to respond to a design basis large break LOCA. The surveillance should becontinued for a minimum of 5 minutes in order to demonstrate that all starting transients havedecayed and stability has been achieved. The requirement to verify the connection of pernanentand auto-connected loads is intended to satisfactorily show the relationship of these loads to thediesel generator loading logic. In certain circumstances, many of these loads cannot actually beconnected or loaded without undue hardship or potential for undesired operation. In lieu of actualdemonstration of connection and loading of loads, testing that adequately shows the capability ofthe diesel generator system to perform these functions is acceptable. This testing may include anyseries of sequential, overlapping, or total steps so that the entire connection and loading sequenceis verified.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram. *..For the purpose of this testing, .the diesel generators must be started from a standbycondition. Standby condition for a diesel generator means the diesel engine coolant and oil arebeing circulated and temperature is being maintained consistent with manufacturerrecormmendations.This surveillance is modified by a Note. The reason for the Note is that performing thesurveillance would remove a required offsite circuit from service, perturb the electricaldistribution system, and challenge safety systems. This restriction from normally performing thesurveillance in MODE 1 2, 3, or 4 is further amplified to allow portions of the surveillance to beperformed for the purpose of reestablishing OPERABILITY (e.g. post work testing followingcorrective maintenance, corrective modification, deficient or incomplete surveillance testing, andMILLSTOYNE -UNIT 2B318-1AedntN.27B 3/4 8-11Amendment No. LBDCR 14-MP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESother unanticipated OPERABILITY concerns) provided an assessment detennines plant safety ismaintained or enhanced. This assessment shall, as a minimum, consider the potential outcomesand transients associated with a failed partial surveillance, a successful partial surveillance, and aperturbation of the offsite or onsite system when they are tied together or operated independentlyfor the partial surveillance; as well as the operator procedures available to cope with theseoutcomes. These shall be measured against the avoided risk of a plant shutdown and start up todetermine that plant safety is maintained or enhanced when portions of the surveillance areperformed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for theassessment.SR 4.8.l. 1.2.c.6This surveillance demonstrates that diesel generator noncritical protective functions (e.g.,high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ESFactuation test signal. During this time, the critical protective functions (engine overspeed,generator differential current, low lube oil pressure [2 out of 3 logic], and voltage restraintovercurrent) remain available to trip the diesel generator andlor output breaker to avert substantialdamage to the diesel generator unit. An EDG Emergency Start Signal (Loss of Power signal orSIAS) bypasses the EDG mechanical trips in the EDG control circuit, except engine overspeed,and switches the low lube oil trip to a 2 of 3 coincidence. The loss of power to the emergency bus,based on supply breaker position (A302, A304, and A505 for Bus 24C; A410, A4tl, and A505for Bus 24D), bypasses the EDG electrical trips in the breaker control circuit except generatordifferential current and voltage restraint over current. The noncritical trips are bypassed duringdesign basis accidents and provide an alarm on an abnormal engine condition. This alarmprovides the operator with sufficient time to react appropriately. The diesel generator availabilityto mitigate the design basis accident is more critical than protecting the engine against minorproblems that are not inrmediately detrimental to emergency operation of the diesel generator.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.This surveillance is modified by a Note. The reason for the Note is that perfonning thesurveillance would remove a required offsite circuit from service, perturb the electricaldistribution system, and challenge safety systems. This restriction from normally performing thesurveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to beperformed for the purpose of reestablishing OPERABILITY (e.g. post work testing followingcorrective maintenance, corrective modification, deficient or incomplete surveillance testing, andother unanticipated OPERABILITY concerns) provided an assessment detennines plant safety isMILLSTONE -UNIT 2B3/812AedntN.7,B 3/4 8-I2Amendment No. -7-7-, LBDCR September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESmaintained or enhanced. This assessment shall, as a minimum, consider the potential outcomesand transients associated with a failed partial surveillance, a successful partial surveillance, and aperturbation of the offsite or onsite system when they are tied together or operated independentlyfor the partial surveillance; as well as the operator procedures available to cope with theseoutcomes. These shall be measured against the avoided risk of a plant shutdown and startup todetermine that plant safety is maintained or enhanced when portions of the surveillance areperformed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for theassessment.SR 4.8.1.1 .2.c.7This surveillance demonstrates the as designed operation of the standby power sourcesduring loss of the offsite source. This test verifies all actions encountered from the loss of offsitepower, including shedding of the nonessential loads and energization of the emergency buses andrespective loads from the diesel generator. It further demonstrates the capability of the dieselgenerator to automatically achieve the required voltage and speed (frequency) within thespecified time. The diesel generator auto-start time of 15 seconds is derived from requirements ofthe accident analysis to respond to a design basis large break LOCA. The surveillance should becontinued for a minimum of 5 minutes in order to demonstrate that all starting transients havedecayed and stability has been achieved. The requirement to verify the connection and powersupply of permanent and auto-connected loads is intended to satisfactorily show the relationshipof these loads to the diesel generator loading logic. In certain circumstances, many of these loadscannot actually be connected or loaded without undue hardship or potential for undesiredoperation. In lieu of actual demonstration of connection and loading of loads, testing thatadequately shows the capability of the diesel generator system to perform these functions isacceptable. This testing may include any series of sequential, overlapping, or total steps so thatthe entire connection and loading sequence is verified.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.This surveillance is modified by two Notes. The reason for Note 1 is that performing thesurveillance would remove a required offsite circuit from service, perturb the electricaldistribution system, and challenge safety systems. This restriction from normally perfonning thesurveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to beperformed for the purpose of reestablishing OPERABILITY (e.g. post work testing followingcorrective maintenance, corrective modification, deficient or incomplete SUlrveillance testing, andother unanticipated OPERABILITY concerns) provided an assessment determines plant safety isMILLSTONE -UNIT 2 B3481 mnmn o 7-B 3/4 8-13Amendment No. LBDCR 14-MP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESmaintained or enhanced. This assessment shall, as a minimum, consider the potential outcomesand transients associated with a failed partial surveillance, a successful partial surveillance, and aperturbation of the offsite or onsite system when they are tied together or operated independentlyfor the partial surveillance; as well as the operator procedures available to cope with theseoutcomes. These shall be measured against the avoided risk of a plant shutdown and start up todetermine that plant safety is maintained or enhanced when portions Of the surveillance areperformed in MODE 1, 2, 3, or 4. Risk insights or detenninistic methods may be used for theassessment.Surveillance Note 2 specifies that the start of the diesel generator from a standbycondition is not required if this surveillance is performed in conjunction with SR 4.8.l.l.2.c.5.Since this test is normally performed in conjunction with SR 4.8.1.1.2.c.5, the proposed note willexclude the requirement to start fr'om a standby condition to minimize the time to perfonn thistest. This will reduce shutdown risk since plant restoration, and subsequent equipment availabilitywill occur sooner. In addition, it is not necessary to test the ability of the EDG to auto start from astandby condition for this test since that ability will have already been verified by SR4.8.1.1.2.c.5, which will have just been performed if the note's exclusion is to be utilized. If thistest is to be performed by itself, the EDG is required to start from a standby condition.SR 4.8.1.1.2.c.8This surveillance demonstrates that the diesel generator automatically starts and achievesthe required voltage and speed (frequency) within the specified tine (15 seconds) fr~om the designbasis actuation signal (Safety Injection Actuation Signal) and operates for >5 minutes. The 5minute period provides sufficient time to demonstrate stability. Since the specified actuationsignal (ESF signal without loss of offsite power) will not cause the emergency bus loads to beshed, and will not cause the diesel generator" to load, the surveillance ensures that permanentlyconnected loads and autoconnected loads remain energized from the offsite electrical powersystem (Unit 2 RSST or NSST, or Unit 3 RSST or NSST). In certain circumstances, many of theseloads cannot actually be connected without undue hardship or potential for undesired operation. Itis not necessary to verify all autoconnected loads remain connected. A representative sample isacceptable.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.MILLSTONE -UNIT 2B3/8-4AedntN.2,B 3/4 8-14Amendment No. 7-7-, LBD CR 14-MP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESFor the purpose of this testing, the diesel generators must be started from a standbycondition. Standby condition for a diesel generator means the diesel engine coolant and oil arebeing circulated and temperature is being maintained consistent with manufacturerrecommendations.SR 4.8.1.1.2.c.9This surveillance demonstrates that the diesel engine can restart from a hot condition, suchas subsequent to shutdown from a normal surveillance, and achieve the required voltage andspeed within 15 seconds. The 15 second time is derived from the requirements of the accidentanalysis to respond to a design basis large break LOCA.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.This surveillance is modified by a Note. The Note ensures that the test is performed withthe diesel sufficiently hot. The load band is provided to avoid routine overloading of the dieselgenerator. Routine overloads may result in more frequent teardown inspections in accordancewith vendor recommendations in order to maintain diesel generator OPERABILITY. Therequirement that the diesel has operated for at least 1 hour at rated load conditions prior toperformance of this surveillance is based on manufacturer recotmmendations for achieving hotconditions. Momentary transients due to changing bus loads do not invalidate this test.SRs 4.8.1.l.2.d.1 and 4.8.l.1.2.d.2SR 4.8.1.1 .2.d. 1 verifies that, at the frequency specified in the-Surveillan~ce FrequencyControl Program, the diesel generator starts from standby conditions and achieves requiredvoltage and speed (frequency) within 15 seconds. The 15 second start requirement supports theassumptions of the design basis LOCA analysis in the FSAR. Diesel generator voltage and speedwill continue to increase to rated values, and thern should stabilize. SR 4.8.l.1.2.d.2 verifies theability of the diesel generator to achieve steady state voltage and frequency conditions. The timefor voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated toidentify degradation of governor or voltage regulator performance when besting in accordancewith the requirements of this surveillance.These surveillance frequencies are controlled under the Surveillance Frequency ControlProgram. In addition, SR 4.8.1.1.2.d may be performed in lieu of 4.8.1.1.2.a.MILLSTONE -UNIT 2B3/815AedntN.27B 3/4 8-15Amendment No. LBDCR 14-MP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESFor the purpose of this testing, the diesel generators must be started from a standbycondition. Standby condition for a diesel generator means the diesel engine coolant and oil arebeing circulated and temperature is being maintained consistent with manufacturerrecommendations.During performance of SR 4.8.1.1,2.d. 1, the diesel generators shall be started by using oneof the following signals:1. Manual;2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;3. Simulated safety injection actuation sign~al alone; or4. Simulated loss of power alone.SR 4.8.1.1.2.d.3This surveillance verifies that the diesel generators are capable of synchronizing with theoffsite electrical system and accepting loads greater than or equal to the equivalent of maximum expected accident loads. A minimum run time of 60 minutes is required to stabilizeengine temperatures, while minimizing the time that the diesel generator is connected to theoffsite source. Although no power factor requirements are established by this surveillance, thediesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 valueis the design rating of the machine, while 1.0 is an operational limitation.The surveillance frequency is controlled under the Surveillance Frequency Control [ProgramIThis SR is modified by four Notes. Note 1 indicates that diesel engine runs for thissurveillance may include gradual loading, as recommended by the manufacturer, so thatmechanical stress and wear on the diesel engine are minimized. Note 2 states that momentarytransients because of changing bus loads do not invalidate this test. Similarly, momentary powerfactor transients above the limit will not invalidate the test. Note 3 indicates that this surveillanceshould be conducted on only one diesel generator at a time in order to avoid common causefailures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisiterequirement for performance of this surveillance. A successful diesel generator start must precedethis test to credit satisfactory performance.MILLSTONE -UNIT 2 B 3/4 8-16 Amendment No. 4g, 92, 2-3-1-, 248,2641-, 2-T, , February 19, 2009LBDCR 09-MP2-0023/4.8 ELECTRICAL POWER SYSTEMSBASESThe OPERABILITY of the minimum specified A.C. and D.C. power sources andassociated distribution systems during shutdown and refueling ensures that 1) the facility can bemaintained in the shutdown or REFUELING condition for extended time periods and 2) sufficientinstrumentation and control capability is available for monitoring and maintaining the facilitystatus. If the required power sources or distribution systems are not OPERABLE in MODES 5and 6, operations involving CORE ALTERATIONS, positive reactivity additions, or movement ofrecently irradiated fuel assemblies are required to be suspended. Suspending positive reactivityadditions that could result in failure to meet the minimum SDM or boron concentration limit isrequired to assure continued safe operation. Introduction of coolant inventory must be fromsources that have a boron concentration greater than that what would be required in the RCS forminimum SDM or refueling boron concentration. This may result in an overall reduction in RCSboron concentration, but provides acceptable margin to maintaining subcritical operation.Introduction of temperature changes including temperature increases when operating with apositive MTC must also be evaluated to ensure they do not result in a loss of required SDM. The.movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a criticalreactor core within the previous 300 hours), is also required to be suspended.Suspension of these activities does not preclude completion of actions to establish a safeconservative condition. These actions minimize the probability of the occurrence of postulatedevents. It is further required to immediately initiate action to restore the required AC and DCelectrical power source or distribution subsystems and to continue this action until restoration isaccomplished in order to provide the necessary power to the unit safety systems.Each 125-volt D.C. bus train consists of its associated 125-volt D.C. bus, a 125-volt D.C.battery bank, and a battery charger with at least 400 ampere charging capacity. To demonstrateOPERABILITY of a 125-volt D.C. bus train, these components must be energized and capable ofperforming their required safety functions. Additionally;in~MODES 1 through 4 at least one tiebreaker between the 125-volt D.C. bus trains must be open for a 125-volt D.C. bus train to beconsidered OPERABLE.For MODES 5 and 6, each battery is sized to supply the total connected vital loads (onebattery connected to both buses) for one hour without charger support. Therefore, in MODES 5and 6 with at least one. 125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied, the 125-volt D.C: support system operability requirements for both buses-are satisfied.Footnote (a) to Technical Specification Tables 4.8-i and 4.8-2 permits the electrolyte levelto be above the specified maximum level for the Category A limits during equalizing charge,provided it is not overflowing. Because of the internal gas generation during the performance ofan equalizing charge, specific gravity gradients and artificially elevated electrolyte levels areproduced which may exist for several days following completion of the equalizing charge. Theselimits ensure that the plates suffer no physical damage, and that adequate electron transfercapability is maintained in the event of transient conditions. In accordance with therecommendations of IEEE 450-1980, electrolyte level readings should be taken only after thebattery has been at float charge for at least 72 hours.MILLSTONE -UNIT 2 B 3/4 8-17 Amendment No. 4-88, 4-9-2, 2-34-, 248~,-264-, mg, 27-9, 3, March 29, 2007LBDCR 07-MP2-0093/4.8 ELECTRICAL POWER SYSTEMSBASES1Based on vendor recommendations and past operating experience, seven (7) days has beendetermined a reasonable time frame for the 1 25-volt D.C. batteries electrolyte level to stabilizeand to provide sufficient time to verify battery electrolyte levels are with in the Category A limits.Footnote (b) to Technical Specification Tables 4.8-1 and 4.8-2 requires that levelcorrection is not required when battery charging current is < 5 amps on float charge. This currentprovides, in general, an indication of overall battery condition.Footnote (c) to Technical Specification Tables 4.8-1 and 4.8-2 states that level correctionis not required when battery charging current is < 5 amps on float charge. This currentprovides,in general, an indication of overall battery condition. Because of specific gravity gradients thatare produced during the recharging process, delays of several days may occur while waiting forthe specific gravity measurement for determining the state of charge. This footnote allows thefloat charge current to be used as an alternative to specific gravity to show OPERABILITY of abattery for up to seven (7) days following the completion of a battery equalizing charge. Eachconnected cells specific gravity must be measured prior to expiration of the 7 day allowance.Surveillance Requirements 4.8.2.3.2.c. 1 and 4.8.2.5.2.c.1 provide for visual inspection ofthe battery cells, cell plates, and battery racks to detect any indication of physical damage orabnormal deterioration that could potentially degrade battery performance.The non-safety grade 125V D.C. Turbine Battery is required for accident mitigation for a main steam line break within containment with a coincident loss of a vital D.C. bus. The TurbineBattery provides the alternate source of power for Inverters 1 & 2 respectively via non-safetygrade Inverters 5 & 6. For the loss of a D.C. eveit[ wiiltaicbincident steam line break withincontainment, the feedwater regulating valves are required to close to ensure containment designpressure is not exceeded.The Turbine Battery D.C. electrical power subsystem consists of 125-volt D.C. bus 201Dand 125-volt D.C. battery bank 201D. To demonstrate OPERABILITY of this subsystem, thesecomponents must be energized and capable of performing their required safety functions.*The feedwater regulating valves require power to close. On loss of a vital D.C. bus, thealternate source of power to the vital A.C. bus via the Turbine Battery ensures power is availableto the affected feedwater regulating valve such that the valve will isolate feed flow into the faultedgenerator. The Turbine Battery is considered inoperable when bus voltage is less than 125 voltsD.C., thereby ensuring adequate capacity for isolation functions via the feedwater regulating.valves during the onset of a steam line break.The Turbine Battery Charger is not required to be included in Technical Specificationseven though the Turbine Battery is needed to power backup Inverters 5 & 6 for a main steam linebreak inside containment coincident with a loss of a Class 1 E D.C. bus. This is due to the fact thatfeedwater isolation occurs within seconds from the onset of the event.MILLSTONE -UNIT 2 B 3/4 8-18 Amendment No. 4-18, 4-9, -24%, j 9 June 28, 2006.3/4.9 REFUELING OPERATIONSBASES3/4.9 REFUELING OPERATIONSThe ACTION requirements to immediately suspend various activities (COREALTERATIONS, fuel movement, CEA movement, etc.) do not preclude completion of themovement of a component to a safe position.3/4.9.1 BORON CONCENTRATIONThe limitations on reactivity conditions during REFUELING ensure that: 1) the reactorwill remain subcritical during CORE ALTERATIONS, and 2) sufficient boron concentration ismaintained forlreactivity control in the water volume having direct access to the reactor vessel.These limitations are consistent with the initial conditions assumed for the boron dilution incidentin the accident-analyses. Reactivity control in the water volume having direct access to thereactor vessel is achieved by determining boron concentration in the refueling canal. Therefueling canal is defined as the entire length of pool stretching from refuel pool through transfercanal to spent fuel pool.The applicability is modified by a Note. The Note states that the limits on boronconcentration are only applicable to the refueling canal when this volume is connected to theReactor Coolant System (RCS). When the refueling canal is isolated from the RCS, no potential.~ *path for boron dilution exists. Prior to reconnecting portions of the refueling canal to the RCS,S Surveillance 4.9.1 .2 must be met. If aydilution activity has occurred while the refueling canal: was disconnected from the RCS, this ansurveillance ensures the correct boron concentration prior tocommunication with the RCS.Concerning the ACTION statement, operations that individually add limited positive reactivity(e.g., temperature fluctuations from inventory addition or temperature control fluctuations), butwhen combined with all other operations affecting core reactivity (e.g., intentional boration)result in overall net negative reactiv'ity addition, are not precluded by this ACTION.314.9.2 INSTRUMENTATIONThe OPERABILITY of the source range neutron flux monitors ensures that redundantmonitoring capability is available to detect changes in the reactivity condition of the core.Concerning ACTION a., with only one SRM OPERABLE, redundancy has been lost. Since theseinstruments are the only direct means of monitoring core reactivity conditions, COREALTERATIONS and introduction of coolant into the RCS with boron concentration less thanrequired to meet the minimum boron concentration of LCO 3.9.1 must be suspended immediately.Suspending positive reactivity additions that could result in failure to meet the minimum boronconcentration limit is required to assure continued safe operation. Introduction of coolantinventory must be from sources that have a boron concentration greater than that which would berequired in the RCS for minimum refueling boron concentration. This may result in an overallreduction in RCS boron concentration, but provides acceptable margin to maintaining subcriticaloperation. Performance of ACTION a. shall not preclude completion of movement of acomponent to a safe position..MILLSTONE -UNIT 2 B 3/4 9-1 Amendment No. 72, 14, 4-50, 1-,24-5, 26-3, 293 LBDCR 1 0-MP2-007June 22,.2010REFUELING OPERATIONSBASES (continued)3/4.9.3 DECAY TIMEThe minimum requirement for reactor subcriticality prior to movement of irradiated fuelensures that sufficient time has elapsed to allow the radioactive decay of the-short-lived fissionproducts so that the calculated radiological dose consequences of the fu~el handling accident arebounding.3/4.9.4 CONTAINMENT PENETRATIONSThe requirements on containment penetration closure and OPERABILITY ensure that arelease of radioactive material within containment to the environment will be minimized. TheOPERABILITY, closure restrictions, and administrative controls are sufficient to minimize therelease of radioactive material from a fuel element rupture based upon the lack of containmentpressurization potential durirng the movement of in'adiated fu~el assemblies within containment.The containment purge valves are containment penetrations and must satisfy all requirementsspecified for a containment penetration.Containment penetrations, including the personnel airlock doors and equipment door, canbe open during the movement of irradiated fuel provided that sufficient administrative controlsare in place such that any of these containment penetrations can be closed within 30 minutes.Following a Fuel Handling Accident, each penetration, including the equipment door, is closedsuch that a containment atmosphere boundary can be established. However, if it is thatclosure of all containment penetrations would represent a significant radiological hazard to thepersonnel involved, the decision may be made to forgo the closure of the affected penetration(s).The containment atmosphere boundary is established when any penetration which provides directaccess to the outside atmosphere is closed such that at least one barrier between the containmentatmosphere and the outside atmosphere is established. Additional actions beyond establishing thecontainment atmosphere boundary, such as installing flange bolts for the equipment door or acontainment penetration, are not necessary.Administrative controls for opening a containment penetration require that one or moredesignated persons, as needed, be available for isolation of containment from the outsideatmosphere. Procedural controls are also in place to ensure cables or hoses which pass through acontainment opening can be quickly removed. The location of each cable and hoses isolationdevice for those cables and hoses which pass through a containment opening is recorded to ensuretimely closure of the containment boundary. Additionally, a closure plan is developed for eachcontainment opening which includes an estimated time to close the containment opening. A log ofpersonnel designated for containment closure is maintained, including identification of whichcontainment openings each person has responsibility for closing. As necessary,equipment will bepre-staged to support timely closure of a containment penetration.MILLSTONE -UNIT 2 B 3/4 9-l a Amendment No. 7-2-, -144, 1-N0, 20-1,,240, 24#5, 24, September 20, 2004REFUELING OPERATIONSBASES (continued)3/4.9.4 CONTAINMENT PENETRATIONS (Continued')Prior to opening a containment penetration, a review of containment penetrationscurrently open is performed to verify that sufficient personnel are designated such that allcontainment penetrations can be closed within 30 minutes. Designated personnel may have otherduties, however, they must be available such that their assigned containment openings can beclosed within 30 minutes. Additionally, each new work activity inside containment is reviewed toconsider its effect on the closuire of the equipment dooi, personnel air lock, and/or other opencontainmaent penetrations. The required number of designated personnel are continuouslyavailable to perform closure of their assigned containment openings whenever irradiated fuel isbeing moved within the containmaent.Administrative controls are also in place to ensure that the containment atmosphereboundary is established if adverse weather conditions which could present a potential missilehazard threaten the plant. Weather conditions are monitored during irradiated fuel movementwhenever a containment penetration, including the equipment door and personnel air lock, is openand a storm center is within the plant monitoring radius of 150 miles.The administrative controls ensure that the containment atmosphere boundary can bequickly established (i.e., within 30 minutes) upon determining that adverse weather conditionsexist which pose a significant threat to the Millstone Site. A significant threat exists when ahurricane warning or tornado warning is issued which applies to the Millstone Site, or if anaverage wind speed of 60 miles an hour or greater is recorded by plant meteorological edluipmentat the meteorological tower. If the meteorological equipment is inoperable, information from theNational Weather Service can be used as a backup in determining plan~t wind speeds. Closure ofcontaimnent penetrations, including the equipment door and personnel air lock door, beginimmediately upon determination that a significant threat exists.When severe weather conditions which could generate a missile are within the plantmonitoring radius, containment and spent fuel pool penetrations are closed to establish thecontainment atmosphere boundary.314.9.5 DELETEDMILLSTONE -UNIT 2 B349l mnmn o 8B 3/4 9-1bAmendment No. 284 LIBDCR 15-MP2-003March 26, 2015REFUELING OPERATIONS EBASES3/4.9.6 DELETED3/4.9.7 DELETED3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATIONIn MODE 6 the shutdown cooling trains are the primary means of heat removal. One SDCtrain provides sufficient heat removal capability. However, to provide redundant paths for heatremoval either two SDC trains are required to be OPERABLE and one SDC train must be inoperation, or" one SDC train is required to be OPERABLE and in operation with the refuelingcavity water level 23 feet above the reactor vessel flange. This volume of water in the refuelingcavity will provide a large heat sink in the event of a failure of the operating SDC train. Anyexception to these requirements are contained in the LCO Notes.An OPERABLE SDC train, for plant operation in MODE 6, includes a pump, heatexchangei; valves, piping, instruments, and controls to ensure an OPERABLE flow path and todetermine RCS temperature. In addition, sufficient portions of the Reactor Building ClosedCooling Water (RBCCW) and Service Water (SW) Systems are available to provide cooling to theSDC heat exchanger. The flow path starts at the RCS hot leg and is retum-ed to the RCS cold legs.An OPERABLE SDC train consists of the following equipment: ::1. An OPERABLE SDC pump (low pressure safety injection pump);2. The associated SDC heat exchanger from the same facility as the SDC pump;3. An RBCCW pump, powered from the same facility as the SDC pump, and RBCCW heatexchanger capable of cooling the associated SDC heat exchanger;4. A SW pump, powered from the same facility as the SDC pump, capable of supplyingcooling water to the associated RBCCW heat exchanger; and5. All valves required to support SDC System operation are in the required position or arecapable of being placed in the required position.In MODE 6, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchanger-s,2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headersare required to provide cooling to the SDC heat exchangers, but only 1 SW header is required tosupport the SDC trains. The equipment specified is sufficient to address a single active failure ofthe SDC System and associated support systems.MILLSTONE -UNIT 2 B 3/4 9-2 Amendment No. 6-9, p-l-, 4-7, 4-8g, 24G,244, -240., September 14, 2006LBDCR 06-MP2-030REFUELING OPERATIONSBASES3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued)In addition, two SDC trains can be considered OPERABLE, with only one 125-volt D.C.bus train OPERABLE, in accordance with Limiting Condition for Operation (LCO) 3.8.2.4.2-SI-306 and 2-SI-657 are both powered from the same 125-volt D.C. bus, on Facility 1. Shouldthese valves reposition due to a loss of power, SDC would no longer be aligned to cool the RCS.However, a designated operator is assigned to reposition these valves as necessary in the event125-volt D.C. power is lost. Consistent with the bases for LCO 3.8.2.4, the 125-volt D.C. supportsystem operability requirements for both trains of SDC are satisfied in MODE 6 with at least one125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied.Either SDC pump may be aligned to the refueling water storage tank (RWST) to supportfilling the fueling cavity or for performance of required testing. A SDC pump may also be used totransfer water from the refueling cavity to the RWST. In addition, either SDC pump may bealigned to draw a suction on the spent fuel pool (SFP) through 2-RW- 11 and 2-SI-442 instead ofthe normal SDC suction flow path, provided the SFP transfer canal gate valve 2-RW-280 is openunder administrative control (e.g., caution tagged). When using this alternate SDC flow path, itwill be necessary to secure the SFP cooling pumps, and limit SDC flow as specified in theappropriate procedure, to prevent vortexing in the suction piping. The evaluation of this alternateSDC flow path assumed that this flow path will not be used during a refueling outage until afterthe completion of the fuel shuffle such that approximately one third of the reactor core willcontain new fuel. By waiting until the completion of the fuel shuffle, sufficient time (at least 14days from reactor shutdown) will have elapsed to-.ensure-the limited SDC flow rate specified forthis alternate lineup will be adequate for decay heat removal from the reactor core and the spentfuel pool. In addition, CORE ALTERATIONS shall be suspended when using this alternate flowpath, and this flow path should only be used for short time periods, approximately 12 hours. If thealternate flow path is expected to be used for greater than 24 hours, or the decay heat load will notbe bounded as previously discussed, further evaluation is required to ensure that this alternateflow path is acceptable.These alternate lineups do not affect the OPERABILITY of the SDC train. In addition,these alternate lineups will satisfy the requirement for a SDC train to be in operation if theminimum required SDC flow through the reactor core is maintained.In MODE 6, with the refueling cavity filled to >_ 23 feet above the reactor vessel flange,both SDC trains may not be in operation for up to 1 hour in each 8 hour period, provided nooperations are permitted that would dilute the RCS boron concentration by introduction of coolantinto the RCS with boron concentration less than required to meet the minimum boronconcentration of LCO 3.9.1. Boron concentration reduction with coolant at boron concentrationsless than required to assure the RCS boron concentration is maintained is prohibited becauseMILLSTONE -UJNIT 2 B 3/4 9-2a Amendment No. 69, 7-l-, 4-1-7-, -l-8-5, 24O,24-5, 2.49,-2-g4,-29)3,Acknowledged By NRC July 5, 2007 January 27, 2009LBDCR 08-MP2-030.REFUELING OPERATIONSBASES314.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued)uni~form concentration distribution cannot be ensured without forced circulation. This permitsoperations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles,and RCS to SDC isolation valve testing. During this 1 hour period, decay heat is removed bynatural convection to the large mass o fwater in the refueling pool.In MODE 6, with the refueling cavity filled to >_ 23 feet above the reactor vessel flange,both SDC trains may also not be in operation for local leak rate testing of the SDC cooling suctionline (containment penetration number 10) or to permit maintenance on valves located in thecommon SDC suction line. This will allow the performance of required maintenance and testingthat otherwise may require a full core offload. an adition to the requirement prohibitingoperations that would dilute the RCS boron concentration by introduction of coolant into the RCSwith boron concentration less than required to meet the minimum boron concentration of LCO3.9.1, CORE ALTERATIONS are suspended and all containment penetrations providing directaccess from the containment atmosphere to outside atmos phere must be closed. The containmentpurge valves are containment penetrations and must satisf all requirements specified for acontainment penetration. No time limit is specified to operate in this configuration. However,factors such as scope of the work, decay heat load/heatup rate, and RCS temperature should beconsidered to determine if it is feasible to perform the work. Prior to using thisprovision, a reviewand approval of the evolution by the Facility Safety Review Committee (FSRC is required. Thisreview will evaluate currentplant conditions and the proposed work to determine if this provisionshould be used, and to establi~sh the termination criteria and appropriate contingency plans. ~During this period, decay heat is removed by natural convection to the large mass of water in the0In Mode 6, with the refueling cavity filled to > 23 feet above the reactor vessel flange andthe required shutdown cooling train inoperable or not-in operation (with the exceptions providedin the note. following LCO 3.9.8.1I), there will be no forced circulation to provide mixing to ensureuniform boron concentration distribution. Suspending posi~tive reactivity additions that couldresult in failure to meet the boron concentration-i-riihit in aiccordance with LCO 3.9.1 is required toassure continued safe .operation. Also, actions shall be taken immediately to suspend loadingirradiated fuel assemblies in the core. With no forced circulation cooling, decay neat removalfrom the core occurs by natural convection to the heat sink provided by the water above the core.A minimum refueling water level of 23 feet above the reactor vessel fange provides an adequateavailable heat sink. Suspending any operation that would increase the decay heat load, such asloading an irradiated fuel assembly, is a prudent action under this condition. However, suspensionof loading irradiated fuel assemblies shall not preclude completion of movement of an irradiatedfuel assembly to a safe position outsidte the core."The requirement that at least one shutdown cooling loop be in operation at >_ 1000 g pmensures that (1) sufficient cooling capacity is available to remove decay heat and maintain thewater in the reactor pressure vessel below 1 400F as required during the REFUELING MODE, (2)sufficient coolant circulation is maintained through the reactor core to minimize the effects of aboron dilution incident and prevent boron stratification, and (3) is consistent with boron dilutionanalysis assumptions. The 1000 gpm shutdown cooling flow limit is the minimum analyticallimit. Plant operating procedures maintain the minimum shutdown cooling flow at a higher valueto accommodate flow measurement uncertainties.Average Coolant Temperature (Tavg) values are derived under shutdown coolingconditions, using the designated formula for use in Unit 2 operating procedures.* SDC flow greater than 1000 gpm: (SDCoutiet + SDCiniet) / 2 = Tav 0MILLSTONE -UNIT 2 B 3/4 9-2b Amendment No. 69, 7-l-, 44-7-, 4-84, 240,-24-5, 249, 29-LBDCR 06-MP2-030September 14, 2006REFUELING OPERATIONSBASES3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued)During SDC only operation, there is no significant flow past the loop RTDs. Core inletand outlet temperatures are accurately measured during those conditions by using T3 51 Y, SDCreturn to RCS temperature indication, and T351IX, RCS to SDC temperature indication. The.average of these two indicators provides a temperature that is equivalent to the average RCStemperature in the core.T35 IX will not be available when using the alternate SDC suction flow path from the SFP.Substitute temperature monitoring capability shall be established to provide indication of reactorcore o~utlet temp~erature. ..A portable temp~erature device can be used.to -indicate reactor, core outlet.to ,thle cottrl .rod'tu petr'oi~tel.: A~r~nmfte {teevisioti cdti-neia dr- an a~sgigifi~dindividual are acceptable alternative methods to provide this indication to control room personnel.3/4.9.9 AND_3/4.9.10 DELETED3/4.9.11 AND 3/4.9.12 WATER LEVEL-REACTOR VESSEL AND STORAGE POOL WATERLEVELThe restrictions on minimum water level ensure that sufficient water depth is available toremove 99% of the assumed 10% iodine gap activity released from the rupture of an irradiatedfuel assembly. The minimum water depth is consistent with the assumptions of the accident.analysis.MILLSTONE -UNIT 2B 3/4 9-2cAmendment No.Acknowledged By NRC July 5, 2007 .REVERSiE OF PAGE B 3/4 INTENTIONALLY LEFT BLANK... September 20, 2004F"REFUELING OPERATIONSBASES3/4.9.13 DELETED3/4,9.14 DELETED3/4.9.15 DELETEDMILLSTONE -UNIT 2B 3/4 9-3Amendment No. gO, 4-09, 44-7, 4-5n,4-1-5, 4~-7, g08, 24g, 284 September 20, 2004THIS PAGE TNTENTIONALLY LEFT BLANKOMILLSTONE -UNIT 2B 3/4 9-3aAmendment No. 3%, 4-09, 4-4-, 4-5-4,4-5-7, 4-7-2, Q, 245-, 284 LBDCR 14-MP2-016September 4, 2014REFUELING OPERATIONSBASES (Continued)314.9.16 SHIELDED CASKThe limitations of this specification ensure that in the event of a shielded cask dropaccident the doses from ruptured fuel assemblies will be within the assumptions of the safetyanalyses.3/4.9.17 SPENT FUEL PO OL B ORON CONCENTRATIONThe limitations of this specification ensures that sufficient boron is present to maintainspent fuel pool Keff_< 0.95 under accident conditions.Postulated accident conditions which could cause an increase in spent fuel pool reactivityare: a single dropped or mis-loaded fuel assembly, a single dropped or mis-loaded ConsolidatedFuel Storage Box, or a shielded cask drop onto the storage racks. A spent fuel pool soluble boronconcentration of 1400 ppm is sufficient to ensure Keff _ 0.95 under these postulated accidentconditions. The required spent fuel pool soluble boron concentration of___ 1720 ppmconservatively bounds the required 1400 ppm. The ACTION statement ensure that if the solubleboron concentration falls below the required amount, that fuel movement or shielded caskmovement is stopped, until the boron concentration is restored to within limits.An additional basis of this LCO is to establish 1720 ppm as the minimum spent fuel pooisoluble boron concentration which is sufficient to ensure that the design basis value of 600 ppmsoluble boron is not reached due to a postulated spent fuel pool boron dilution event. As part ofthe spent fuel pool criticality design, a spent fuel soluble boron concentration of 600 ppm issufficient to ensure Keff < 0.95, provided all fuel is stored consistent with LCO requirements. Bymaintaining the spent fuel pool soluble boron concentration > 1720 ppm, sufficient time isprovided to allow the operators to detect a b~oron dilution event, and terminate the event, prior tothe spent fuel pool being diluted below 600 ppm. In the unlikely event that the spent fuel poolsoluble boron concentration is decreased to 0 ppm,. Keff will be maintained <1.00, provided allfuel is stored consistent with LCO requirements. The ACTION statement ensures that if thesoluble boron concentration falls below the required amount, that immediate action is taken torestore the soluble boron concentration to within limits, and that fuel movement or shielded caskmovement is stopped. Fuel movement and shielded cask movement is stopped to prevent thepossibility of creating an accident condition at the same time that the minimum soluble boron isbelow limits for a potential boron dilution event.The surveillance of the spent fuel pool boron concentration within 24 hours of fuelmovement, consolidated fuel movement, or cask movement over the cask layout area, verifies thatthe boron concentration is within limits just prior to the movement. The periodic surveillanceinterval is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 2 B 3/4 9-3b Amnendment No. g-Q, 1409,1447, 4--57, 1-7-2, 208, 2Ag, 2-74,2,84,...n.....g.. N,. C .. uly. 5, 2007 April 1, 2003R.EFUELING OPERATIONSBASES3/4.9.18 SPENT FUEL POOL -STORAGEThe limitations described by Figures 3.9-la, 3.9-Ib, and 3.9-3 ensure that the reactivity offuel assemblies and consolidated fuel storage boxes, introduced into the Region C spent fuelracks, are conservatively within the assumptions of the safety analysis.The limitations described by Figure 3.9-4 ensure that the reactivity of the fuel assemblies,introduced into the Region A spent fuel racks, are conservatively within the assumptions of thesafety analysis.3/4.9.19 SPENT FUEL POOL -STORAGE PATTERNThe limitations of this specification ensure that the reactivity condition of the Region Bstorage racks and spent fuel pool Keffwill remain less than or equal to 0.95.The Cell Blocking Devices in the 4th location of the Region B storage racks are designedto prevent inadvertent placement andlor storage in the blocked locations. The blocked locationremains empty, or a Batch B fuel assembly may be stored in the blocked location, to maintainreactivity control for fuel assembly storage in any adjacent locations. Region B (non-cell blockerlocations) is designed for the storage of new assemblies in the spent fuel pool, and for fuelassemblies which have not sustained sufficient burnup to be stored in Region A or Region C.This LCO is not applicable during the initial installation of Batch B fuel assemblies in thecell blocker locations of Region B. This is acceptable because only Batch B fuel assemblies willbe moved during the initial installation of Batch B fuel assemblies, under the Region B cellblockers. Batch B fuel assemblies are qualified for storage in any spent fuel pool storage racklocation, hence a fuel misloading event which causes a reactivity consequence is not credible.This exception is valid only during the initial installation of Batch B fuel assemblies in the cellblocker locations.3/4.9.20 SPENT FUEL POOL -CONSOLIDATIONThe limitations of these specifications ensure that the decay heat rates and radioactiveinventory of the candidate fuel assemblies for consolidation are conservatively within theassumptions of the safety analysis.MILLSTONE -UNIT 2 B 3/4 9-4 Amendment No. -447, 4-1-5, 4-58, 4-7-2,274 September 25, 2003P 3.4.10 SpECIAL TEST EXCEPTIONSBASES3/4.10.1 SHUTDOWN MARGINThis special test exception provides that a minimum amount of CEA worth is immediatelyavailable for reactivity control or that the reactor is sufficiently subcritical so as to provide safeoperating conditions when tests are performed for CEA worth measurement. This special testexception is required to permit the periodic verification of the actual versus predicted corereactivity condition oecuring as a result of fuel bumup or fuel cycling operations.3/4.10.2 GROUP HEIGHT ANTD INSERTION LIMITSThis special test exception permits individual CEAs to be positioned ouside of theirnormal group heights and insertion limits during the performance of such PHYSICS TESTS asthose required .to 1) measure CEA worth and 2) determine the reactor stability index and dampingfactor under xenon oscillation conditions.SMiLLSTONE -UNIT 2 3401AedetN.,28B 3/4 10-1Amendment No. 280 October 27, 1977DELETED I27MILLSTONE -UNIT 2 B341-B 3/4 10-2 November 28, 20003/4.11 DELETEDBASES3/4.11.1 -DELETED3/4.11.2 -DELETED3/4.11.3 -DELETEDMILLSTONE -UNIT 2B 3/4 11-1MILLTONE- UNT 2 3/411-1Amendmient No. 250 November 28, 2000This page intentionally left blankNillstone Unit 2B 3/4 11-2MilltoneUnit2 B /4 1-2 /Aendment No. J79, 250 November 28, 2000This page intentionally left blankMILLSTONE -UNIT 2B 3/4 11-3MILLTON -NIT B /4 1-3Amendment No. 250 November 28, 2000This page intentionally left blankMILLSTONE -UNIT 2B 3/4 11-4MILLTONE- UNT 2 3/411-4Amendment No. JX9, 250 Serial No. 16-078Docket No. 50-423ATTACHMENT 2BASES PAGES FOR MILLSTONE POWER STATION UNIT 3DOMINION NUCLEAR CONNECTICUT, INC.MILLSTONE POWER STATION UNIT 3 BASESFORSECTION 2.0SAFETY LIMITSANDLIMITING SAFETY SYSTEM SETTINGS NOTEThe BASES contained in succeeding pages summarizethe reasons for the Specifications in Section 2.0,but in accordance with 10 CFR 50.36 are not partof these Technical Specifications. LBDCR No. 06-MP3-014June 22, 2006D.' BASES*:, 2.1.1 REACTOR COREBACKGROUND10 CER 50, Appendix A, General Design Criterion 10, requires that specified acceptable fueldesign limits are not exceeded during steady state operation, normal operational transients, andanticipated operational occurrences (AOOs). This is accomplished by having a departure fromnucleate boiling (DNB) design basis, which corresponds to a 95% probability at a 95%confidence level (the 95/95 DNB criterion) that DNB will not occur and by requiring that fuelcenterline temperature stays below the melting temperature.The restrictions of this Safety Limit (SL) prevent overheating of the fuel and cladding, as well aspossible cladding perforation, that would result in the release of fission products to the reactorcoolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate(LHR) below the level at which fuel centerline melting occurs. Overheating of the fuel claddingis prevented by restricting fuel operation to within the nucleate boiling regime, where the heattransfer coefficient is large and the cladding surface temperature is slightly above the coolantsaturation temperature.Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel ishigh enough to cause the fuel centerline temperature to reach the melting point of the fuel.Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the>: point of failure, allowing an uncontrolled release of activity to the reactor coolant.Operation above the boundary of the nucleate boiling regime could result in excessive claddingtemperature because of the onset of DNB and the resultant sharp reduction in heat transfercoefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water(zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuelcladding to a structurally weaker form. Thisweaker form may lose its integrity, resulting in anuncontrolled release of activity to the reactor coolant.The proper functioning of the Reactor Protection System (RPS) and steam generator safety valvesprevents violation of the reactor core SLs.APPLICABLE SAFETY ANALYSESThe fuel cladding must not sustain damage as a result of nonnal operation and AOOs. The reactorcore SLs are established to preclude violation of the following fuel design criteria:a. There must be at least 95% probability at a 95% confidence level (the 95/95 DNBcriterion) that the hot fuel rod in the core does not experience DNB, andb. The hot fuel pellet in the core must not experience centerline fuel melting.MILLSTONE -UNIT 3 B-B2-1Amendment No. 60, 2--t4, LBDCR No. 06-MP3-014June 22, 20062.1 SAFETY LIMITSBASES (Continued)The Reactor Trip System setpoints, in combination with all the LCOs, are designed to prevent anyanticipated combination of transient conditions for Reactor Coolant System (RCS) temperature,pressure, RCS Flow, ALI, and THERMAL POWER level that would result in a departure fromnucleate boiling ratio (DNBR) of less than the DNBR limit and preclude the existence of flowinstabilities.Automatic enforcement of these reactor core SLs is provided by the appropriate operation of theRPS and the steam generator safety valves.SAFETY LIMITSThe figure provided in the CORE OPERATING LIMITS REPORT (COLR) shows the loci ofpoints of THERMAL POWER, RCS pressure, and average temperature for which the minimumDNBR is not less than the safety analyses limit, that fuel centerline temperature remains belowmelting, that the average enthalpy in the hot leg is less than or equal to the enthalpy of saturatedliquid, or that the exit quality is within the limits defined by the DNBR correlation.The reactor core SLs are established to preclude violation of the following fuel design criteria:a. There must be at least a 95% probability at a 95% confidence level (the 95/95DNB criterion) that the hot fuel rod in the core does not experience DNB, andb. There must be at least a 95% probability at a 95% confidence level that the hot fuelpellet in the core does not experience centerline fuel melting.The reactor core SLs are used to define the various RPS .functions such that the above criteria aresatisfied during steady state operation, normal operational transients, and AOOs. To ensure thatthe RPS precludes the violation of the above criteria, additional criteria are applied to theOvertemperature and Overpower AT reactor trip functions. That is, it must be demonstrated thatthe average enthalpy in the hot leg is less than or equal to the saturation enthalpy and that the coreexit quality is within the limits defined by the DNBR correlation. Appropriate functioning of theRPS ensures that for variations in the THERMAL POWER, RCS Pressure, RCS averagetemperature, RCS flow rate, and AI that the reactor core SLs will be satisfied during steady stateoperation, normal operational transients, and AOOs.APPLICABILITYSL 2.1.1 only applies in MODES 1 and 2 because these are the only MODES in which the reactoris critical. Automatic protection functions are required to be OPERABLE during MODES 1 and2 to ensure operation within the reactor core SLs. The steam generator safety valves or automaticprotection actions serve to prevent RCS heatup to the reactor core SL conditions or to initiate areactor trip function, which forces the unit into MODE 3. In MODES 3, 4, 5, and 6, applicabilityis not required since the reactor is not generating significant THERMAL POWER.MILLSTONE -UNIT 3 B2l mnmn oB2-1aAmendment No. LBDCR No. 06-MP3-014June 22, 20062.1 SAFETY LIMITSBASES (Continued)SAFETY LIMIT VIOLATIONSIf SL 2.1.1 is violated, the requireme~nt to go to HOT STANDBY places the unit in a MODE inwhich this SL is not applicable. The allowed completion time of 1 hour recognizes theimportance of bringing the unit to a MODE of operation where this SL is not a~ppicable, andreduces the probability of fuel damage.Amendment No.MILLSTONE -UNIT 3 B2lB2-1b January 31, 1986SAFETY LIMITSBASES2.1.2 REACTOR COOLANT SYSTEM PRESSUREThe restriction of this Safety Limit protects the integrity of the Reactor Coolant Systemn(RCS) fromn overpressurization and thereby prevents the release of radionuclides contained in the-reactor coolant from reaching the containment atmosphere.The reactor vessel, pressurizer, and the RCS piping, valves and fittings are designed toSection III of the ASME Code for Nuclear Power Plants which permits a. maximum transientpressure of 110% (2750 psia) of design pressure.. The Safety Limit of 2750 psia is thereforeconsistent with the design criteria and associated Code requirements.The entire RCS is hydrotested at 125% (3125 psia) of design pressure, to demonstrateintegrity prior to initial operation.MILLSTONE -UNIT 3B22B 2-2 LBDCR Noj)4-MP3-01 5February 24, 20052.2 LIMITING SAFETY SYSTEM SETTINGSBASES2.2.1 REACTOR TRIP SYSTEM INSTRUMENTATION SETPOINTSThe Nominal Trip Setpoints specified in Table 2.2-1 are the nominal values at which thereactor trips are set for each functional unit. The Allowable Values (Nominal Trip Setpoints +/-k thecalibration tolerance) are considered the Limiting Safety System Settings as identified in10OCFR50.36 and have been selected to ensure that the core and Reactor Coolant System are .prevented from exceeding their safety limits during normal operation and design basis anticipatedoperational occurrences and to assist the Engineered SafetyFeatures Actuation System inmitigating the consequences of accidents. The Setpoint for a Reactor Trip System or interlockfunction is considered to be consistent with the nominal value when the measured "as left"Setpoint is within the administratively controlled (+) calibration tolerance identified in plantprocedures (which specifies the difference between the Allowable Value and Nominal TripSetpoint). Additionally, the Nominal Trip Setpoints may be adjusted in the conservative directionprovided the calibration tolerance remains unchanged.Measurement and Test Equipment accuracy is administratively controlled by plantprocedures and is included in the plant uncertainty calculations as defined in WCAP-10991.OPERABILITY determinations are based on the use of Measurement and Test Equipment thatconforms with the accuracy used in the plant uncertainty calculation.The Allowable Value specified in Table 2.2-1 defines the limit beyond which a channel isinoperable. If the process rack bistable setting is measured within the "as left" calibrationtolerance, which specifies the difference between-the A-iiowable Value and Nominal TripSetpoint, then the channel is considered to be OPERABLE.The methodology, as defined in WCAP- 10991 to derive the Nominal Trip Setpoints, isbased upon combining all of the uncertainties .in the channels. Inherent in the determination of theNominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and otherinstrumentation utilized in these channels should be capable of operating within the allowances ofthese uncertainty magnitudes. Occasional drift in excess of the allowance may be determined tobe acceptable based on the other device performance characteristics. Device drift in excess of theallowance that is more than occasional, may be indicative of more serious problems and wouldwarrant further investigation.The various reactor trip circuits automatically open the reactor trip breakers whenever acondition monitored by the Reactor Trip System reaches a preset or calculated level. In additionto the redundant channels and trains, the design approach provides Reactor Trip Systemfunctional diversity. TheMILLSTONE -UNIT 3 B 2-3 Amendment No. 59,Acknowledged by NRC letter dated08/25/05 LBDCR 07-MP3-037-July 12, 20072.2 LIMITING SAFETY SYSTEM SETTINGSBASESREACTOR TRIP SYSTEM INSTRUMENTATION SETPOINTS (Continued)functional capability at the specified trip setting is required for those anticipatory or diversereactor trips for which no direct credit was assumed in the safety analysis to enhance the overallreliability of the Reactor Trip System. The Reactor Trip System initiates a turbine trip signalwhenever reactor trip is initiated. This prevents the reactivity insertion that would otherwiseresult from excessive Reactor Coolant System cooldown and thus avoids unnecessary actuation of:the Engineered Safety Features Actuation System.Manual Reactor TripThe Reactor Trip System includes manual Reactor trip capability.Power Range. Neutron FluxIn each of the Power Range Neutron Flux channels there are two independent bistables,each with its own trip setting used for a High and Low Range trip setting. The Low Setpoint tripprovides protection during subcritical and low power operations to mitigate the consequences of apower excursion beginning from low power, and the High Setpoint trip provides protection duringpower operations to mitigate the consequences of a reactivity excursion from all power levels. lThe Low Setpoint trip may be manually blocked above P-i 10 (a power level ofapproximately 10% of RATED THERMAL PO.WER)._and is automatically reinstated below theP-10 Setpoint.Power Range. Neutron Flux. High Positive RateThe Power Range Positive Rate trip provides protection against rapid flux increases whichare characteristic of positive reactivity insertion events. Specifically, this trip complements thePower Range Neutron Flux High and Low trips to ensure that the criteria are met for all rodejection accidents. This trip also complements the Pressurizer Pressure-High trip, along with theOvertemperature AT and the Power Range Neutron Flux High Positive Rate trips, to ensure thatthe criteria are met for the rod withdrawal at power accidents.MILLSTONE -UNIT 3 B 2-4 Amendment No. 4-46, 4-59, 24-l-, LBDCR No. 07-MP3-017April 12, 2007LIMITING SAFETY SYSTEM SETTINGSBASESIntermediate and Source Range. Neutron FluxThe Intermediate and Source Range, Neutron Flux trips provide core protection duringreactor startupto mitigate the consequences of an uncontrolled rod cluster control assembly bankwithdrawal from a. subcritical condition. These trips provide redundant protection to the LowSetpoint trip of the Power Range, Neutron Flux channels. The Source Range channels willinitiate a Reactor trip at about 105 counts per second unless manually blocked when P-6 becomesactive. The Intermediate Range channels will initiate a Reactor trip at a current level equivalentto approximately 25% of RATED THERMAL POWER unless manually blocked when P-10becomes active. No credit was taken for operation of the trips associated with either theIntermediate .or Source Range Channels in the accident analyses; however, their functionalcapability at the specified trip settings is required by this specification to enhance the overallreliability of the Reactor Trip System.Overtemperature ATThe Overtemperature AT trip provides core protection to prevent DNB for allcombinations of pressure, power, coolant temperature, and axial power distribution, provided thatthe transient is slow with respect to piping transit delays from the core to the temperaturedetectors, and pressure is within the range between the Pressurizer High and Low Pressure trips.The Setpoint is automatically varied with: (1) coolant temperature to correct for temperatureinduced changes in density and heat capacity of water and ~includes dynamic compensation for .piping delays from the core to the loop temperature detectors, (2) pressurizer pressure, and(3) axial power distribution. With normal axial power distribution, this Reactor trip limit isalways below the core Safety Limit as shown by the Reactor Core Safety Limit curves in theCOLR. If axial peaks are greater than design, as indicated by the difference between top andbottom power range nuclear detectors, the Reactor trip is automatically reduced according to thenotations in Table 2.2-1. Although a direction of conservatism is identified for theOvertemperature AT reactor trip function K2 and K3 gains, the gains should be set as close aspossible to the values contained in Note 1 to ensure that the Overtemperature AT setpoint isconsistent with the assumptions of the safety analyses.Overpower ATThe Overpower AT trip provides assurance of fuel integrity (e.g., no fuel pellet meltingand less than 1% cladding strain) under all possible overpower conditions, limits the requiredrange for Overtemperature ATMILLSTONE -UNIT 3B 2-5MILLTON -NIT3 B2-5Amendment No. 2, 60, 4-52, 2-l--7-, LBDCR No.;08-MP3-014October 21, 2008LIMITING SAFETY SYSTEM SETTINGSBASEStrip, and provides a backup to the High Neutron Flux trip. The Setpoint is automatically variedwith: (1) coolant temperature to correct for temperature induced changes in density and heatcapacity of water, and (2) rate of change of temperature for dynamic compensation for pipingdelays from the core to the loop temperature detectors, to ensure that the allowable heatgeneration rate (kW/ft) is not exceeded. The Overpower AT trip provides protection to mitigatethe consequences of various size steam breaks as reported in WCAP-9226, "Reactor CoreResponseto Excessive Secondary Steam Releases."Pressurizer PressureIn each of the pressurizer pressure channels, there are two independent bistables, each with itsown trip setting to provide for a High and Low Pressure trip thus limiting the pressure range inwhich reactor operation is permitted. The Low Setpoint trip protects against low pressure whichcould lead to DNB by tripping the reactor in the event of a loss of reactor coolant pressure.On decreasing power the Low Setpoint trip is automatically blocked by P-7 (a power level ofapproximately 10% of RATED THERMAL POWER with turbine impulse chamber pressure atapproximately 10% of full power equivalent); and on increasing power, automatically reinstatedby P-7.The High Setpoint trip functions in conjunction with the pressurizer relief and safety valves toprotect the Reactor Coolant System against system overpressure.Pressurizer Water LevelThe Pressurizer Water Level High trip is provided~-.to pre-vent water relief through the pressurizersafety valves. On decreasing power the Pressurizer High Water Level trip is automaticallyblocked by P-7 (a power level of approximately 10% of RATED THERMAL POWER with aturbine impulse chamber pressure at approximately 10% of full power equivalent); and onincreasing power, automatically reinstated by P-7.Reactor Coolant FlowThe Reactor Coolant Flow Low trip provides core protection to prevent DNB by mitigating theconsequences of a loss of flow resulting from the loss of one or more reactor coolant pumps.The nominal RCS flow is the actual measured RCS flow during POWER OPERATION. The lowRCS flow RPS trip is set to be greater than or equal to 90% of the actual measured flow.Technical Specification 3.2.3, RCS Flow Rate and Nuclear Enthalpy Rise Hot Channel Factor,assures that the nominal (actual measured) RCS flow will exceed the RCS design Hlow rate usedfor design basis accidents and the Minimum Measured Flow used in the DNBR analysis asspecified in the COLR and consequently the trip setpoint based upon the nominal (actualmeasured) RCS will be conservative with respect to the safety analysis. A trip setpoint basedupon 90% of nominal (actual measured) RCS flow assures that the design basis analyses and theDNBR analyses are conservative and bounding.MILLSTONE -UNIT 3 B- mnmn oB 2-6Amendment No. LBDCR No. 08-MP3-036October 30, 2008LIMITING SAFETY SYSTEM SETTINGSBASESOn increasing power above P-7 (a power level of approximately 10%. of RATED THERMALPOWER or a turbine impulse chamber pressure at approximately 10% of full power equivalent),an automatic Reactor trip will occur if the flow in more than one loop drops below 90% ofnominal full loop flow. Above P-8 (a power level of approximately 50% of RATED THERMALPOWER) an automatic Reactor trip will occur if the flow in any single loop drops below 90% ofnominal full loop flow. Conversely, on decreasing power between P-8 and the P-7 an automaticReactor trip will occur on low reactor coolant flow in more than one loop and below P-7 the tripfunction is automatically blocked.'Steam Generator Water LevelThe Steam Generator Water Level Low-Low trip protects the reactor from loss of heat sink in theevent of a sustained steamn/feedwater flow mismatch resulting from loss of normal feedwater. Thespecified Setp~oint provides allowances for starting delays of the Auxiliary Feedwater System.Low Shaft Speed -Reactor Coolant PumpsThe Low Shaft Speed -Reactor Coolant Pumps trip provides core protection to prevent DNB inthe event of a sudden significant decrease in reactor coolant pump speed (with resulting decreasein flow) on two reactor coolant pumps in any two operating reactor coolant loops. The tripsetpoint ensures that a reactor trip will be generated, considering instrument errors andresponse times, in sufficient time to allow the DNBR to be maintained greater than the designabove limit following a four-pump loss of flow event.Turbine TripA Turbine trip initiates a Reactor trip. On decreasing power the Reactor trip from the Turbine tripis automatically blocked by P-9 (a power level of approximately 50% of RATED THERMALPOWER); and on increasing power, reinstated automatically by P-9. The P-9 setpoint isacceptable with up to two steam dump valves out of service.Safe.ty Injection Input from ESFIf a Reactor trip has not already been generated by the Reactor Trip System instrumentation, theESF automatic actuation logic channels will initiate Reactor trip upon any signal which initiates aSafety Injection. The ESF instrumentation channels which initiate a Safety Injection signal areshown in Table 3.3-3.Reactor Trip System InterlocksThe Reactor Trip System interlocks perform the following functions:P-6 On increasing power, P-6 becomes active above the Interlock Allowable Valuespecified on Table 2.2-1 to allow the manual block of the Source Range trip (i.e.,prevents premature block of the Source Range trip during reactor startup) anddeenergizes the high voltage to the detectors. On decreasing power during aMILLSTONE -UNIT 3B27AmnetNoB 2-7Amendment No. LBDCR No,-08-MP3-014*October 21, 2008LIMITING SAFETY SYSTEM SETTINGSBASESReactor Trip System Interlocks (Continued)reactor shutdown, Source Range Level trips are automatically reactivated and highvoltage restored when P-6 deactivates. The P-6 deactivation will occur at a valuebelow its activation value and may be calibrated to occur below the P-6 InterlockAllowable Value specified on Table 2.2-1 to prevent overlap and chatter based upon.:the expected bistable drift.P-7 On increasing power P-7 automatically enables Reactor trips on low flow in morethan one reactor coolant loop, reactor coolant pump low shaft speed, pressurizer lowpressure and pressurizer high level. On decreasing power, the above listed trips areautomatically blocked.P-8 On increasing power, P-8 automatically enables Reactor trips on low flow in one ormore reactor coolant loops. On decreasing power, the P-8 automatically blocks theabove listed trips.P-9 On increasing power, P-9 automatically enables Reactor trip on Turbine trip. Ondecreasing power, P-9 automatically blocks Reactor trip on Turbine trip.P-i10 On increasing power, P- 10 provides input to P-7 to ensure that Reactor Trips on lowflow in more than one reactor coolant loop, reactor coolant pump low shaft speed,pressurizer low pressure and pressurizer high level are active when powver reaches11%. It also allows the manual block of the Intermediate Range trip and the LowSetpoint Power Range trip; and automatically blocks the Source Range trip anddeenergizes the Source Range high voltage power.On decreasing power, P-10 resets to automatically reactivate the Intermediate Rangetrip and the Low Setpoinit Power Range trip before power drops below 9%. It alsoprovides input to reset P-7.P-13 On increasing power, P-13 provides input to P-7 to ensure that Reactor trips onlow flow in more than one reactor coolant loop, reactor coolant pump low shaftspeed, pressurizer low pressure and pressurizer high level are active when powerreaches 10%.On decreasing power, P-13 resets when power drops below 10% and provides input,along with P-10, to reset P-7.MILLSTONE -UNIT 3B 2-8MILSTOE UNT B -8Amendment No. -5 2--l-g, :2---, BASES FORSECTIONS 3.0 AND 4.0LIMITING CONDITIONS FOR OPERATIONANDSURVEILLANCE REQUIREMENTS NOTEThe BASES contained in succeeding pages summarizethe reasons for the Specifications in Sections 3.0and 4.0, but in accordance with 10 CFR 50.36 arenot part of these Technical Specifications. october 25, 1990.3/4.0 APPLICABILITY'! BASES3/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS3/4.0 APPLICABILITYSpecification 3.0.1 throuah 3.0.4 establish the general requirementsapplicable to Limiting Conditions for Operation. These requirements are basedon the requirements for Limiting Conditions for Operation stated in the Codeof Federal Regulations, 10 CFR 50.36(c)(2):"Limiting conditions for operation are the lowest functional capability orperformance levels of equipment required for safe operation of the facility.When a limiting condition for operation of a nuclear reactor is not met, thelicensee shall shut down the reactor or follow any remedial action permittedby the technical specification until the condition can be met."Specification 3.0.1 establishes the Applicability statement within eachindividual specification as the requirement for when (i.e., in whichOPERATIONAL MODES or other specif'ied conditions) conformance to the LimitingConditions for Operation is required for safe operation of the facility. TheSACTION requirements establish those remedial measures that must be takenwithin specified time limits when the requirements of a Limiting Condition for*Operation are not met.S There are two basic types of ACTION requirements. The first specifies theS remedial measures that permit continued operation of the facility which is notfurther restricted by the time limits of the ACTION requirements. In thiscase, conformance to the ACTION requirements provides an acceptable level ofsafety for unlimited continued operation as long as the ACTION requirementscontinue to be met. The second type of ACTION requirement specifies a timelimit in which conformance to the conditions of the Limiting Condition forOperation must be met. This time limit is the allowable outage time torestore an inoperable sYstem or component to OPERABLE status of for restoringparameters within specified limits. If these actions are not completed withinthe allowable outage time limits, a shutdown is required to place the facilityin a MODE or condition in which the specification no longer applies. It isnot intended that the shutdown ACTION requirements be used as an operationalconvenience which permits (routine) voluntary removal of a system(s) orcomponent(s) from service in lieu of other alternatives that would not resultin redundant systems or components being inoperable.The specified time limits of the ACTION requirements are applicable from thepoint in time it is identified that a Limiting Condition for Operation is notmet. The time limits of the ACTION requirements are also applicable when asystem or component is removed from service for surveillance testing orinvestigation of operational problems. Individual specifications may includea specified time limit for the completion of a Surveillance Requirement whenequipment is removed from service. In this case, the allowable outage timern limits of the ACTION requirements are applicable when this limit expires if~the surveillance has not been completed. When a shutdown is required toMILLSTONE -UNIT 3 B3401 AEDETN.5B 3/4 0-IAMENDMENT NO. 57 October 25, 3/4.0 APPLICABILITY WBASEScomply with ACTION requirements, the plant may have entered a MODE in which anew specification becomes applicable. In this case, the time limits of theACTION requirements would apply from the point in time that the newspecification becomes applicable if the requirements of the Limiting Conditionfor Operationfare not met.Specification 3.0.2 establishes that noncompliance with a specificationexistswhen the requirements of the Limiting Condition for Operation are not met andthe associated ACTION requirements have not been implemented within thespecified time interval. The purpose of this specification is to clarify that(I) implementation of the ACTION requirements within the specified timeinterval constitutes compliance with a specification and (2) completion of theremedial measures of the ACTION requirements is not required when compliancewith a Limiting Condition of Operation is restored within the time intervalspecified in the associated ACTION requirements.Specification 3.0.3 establishes the shutdown ACTION requirements that must beimplemented when a Limiting Condition for Operation is not met and thecondition is not specifically addresFzA by the associated ACTION requirements.The purpose of this specification is 'o delineate the time limits for placingthe unit in a safe shutdown MODE when plant operation cannot be maintainedwithin the limits for safe operation defined by the Limiting Conditions for i.Operation and its ACTION requirements. It is not intended to be used as anoperational convenience which permits (routine) voluntary .removal of redundantsystems or components from service in lieu of other alternatives that wouldnot result in redundant systems or components being inoperable. This timepermits the operator to coordinate the reduction in electrical generation withthe load dispatcher to ensure the stability and availability of the electricalgrid. The time limits specified to reach lower MODES of operation permit theshutdown to proceed in a controlled and orderly manner that is well within thespecified maximum cooldown rate and Within the cooldown capabilities of thefacility assuming only the minimum required equipment is OPERABLE. Thisreduces thermal stresses on components of the primary coolant system and thepotential for a plant upset that could challenge safety systems underconditions for which this specification applies.If remedial measures permitting limited continued operation of the facilityunder the provisions of the ACTION requirements are completed, the shutdownmay be terminated. The time limits of the ACTION requirements are applicablefrom the point in time it is identified that a Limiting Condition forOperation is not met. Therefore, the shutdown may be terminated if the ACTIONrequirements have been met or the time limits of the ACTION requirements havenot expired, thus providing an allowance for the completion of the requiredactions. The time limits of Specification 3.0.3 allow 37 hours for the plantto be in COLD SHUTDOWN MODE when a shutdown is required during the POWER MODEof operation. If the plant is in a lower MODE of operation when a shutdown isrequired, the time limit for reaching the next lower MODE of operationapplies. However, if a lower MODE of operation is reached in less time thanallowed, the total allowable time to reach COLD SHUTDOWN, or other applicable MILLSTONE -UNIT 3MILTN NT3B 3/4 0-2 AMENDMENT NO. 57 3/4.0 APPLICABILITY Apr11 17, 2000BASESMODE, is not reduced. For example, if HOT STANDBY is reached in 2 hours, thetime allowed to reach HOT SHUTDOWN is the next 11 hours because the total timeto reach HOT SHUTDOWN is not reduced from the allowable limit of 13 hours.Therefore, if remedial measures are completed that would permit a return toPOWER operation, a penalty is not incurred by having to reach a lower MODE ofoperation in less than the total time allowed.The same principle applies with regard to the allowable outage time limits ofthe ACTION requirements, if compliance with the ACTION requirements for one*specification results in entry. into a MODE or condition of operation foranother specification in which the requirements of the Limiting Condition forOperation are not met. If the new specification becomes applicable in lesstime than specified, the difference may be added to the allowable outage timelimits of the second specification. However, the allowable outage.time limitsof ACTION requirements for a higher MODE of operation may not be used toextend the allowable outage time that is applicable when a Limiting Conditionfor Operation is not met in a lower MODE of operation.The Shutdown requirements of Specification 3.0.3 do not apply in MODES 5 and6, because the ACTION requirements of individual specifications define theremedial measures to be taken.Specification 3.0.4 establishes limitations on MODEchanges when a LimitingCondition for Operation is not met. It precludes placing the facility in ahigh MODE of operation when the requirements for a Limiting Condition forOperation are not met and continued noncompliance to these conditions wouldresult in a shutdown to comply with the ACTION requirements if a change inMODES were permitted. The purpose of this specification is to ensure thatfacility operation is not initiated or that higher MODES of operation are notentered when corrective action is being taken to obtain compliance with aspecification by restoring equipment to OPERABLE status or parameters tospecified limits. Compliance with ACTION requirements that permit continuedoperation of the facility for an unlimited period of time provides *anacceptable level of safety for continued operation without regard to thestatus of the plant before or after a MODE change. Therefore, in this case,entry into an OPERATIONAL MODE or other specified condition may be made inaccordance with the provisions of the ACTION requirements. The provisions ofthis specification should not, however, *be interpreted as endorsing thefailure to exercise good practice in restoring systems or components toOPERABLE status before plant startup.When a shutdown is required to comply with ACTION requirements, the provisionof Specification 3.0.4 do not apply because they would delay placing thefacility in a lower MODE of operation.Specification 3.0.5 establishes the allowance for restoring equipment toservice under administrative controls when it has been removed from serviceor declared inoperable to comply with ACTIONS. The sole purpose of thisSpecification is to provide an exception to Specifications 3.0.1 and 3.0.2(e.g., to not comply with the applicable Required Action(s)) to allow theperformance of required testing to demonstrate either:a. The OPERABILITY of the equipment being returned to. service; orb. The OPERABILITY of other equipment.MILLSTONE -UNIT 3B 3/4 0-3MILLTONE- UNT 3 3 40-3Amendment No. F7, 179 3/4.0 APPLICABILITY Arl1,20April 17, 2000BASESThe administrative controls ensure the time the equipment is returned to ,service in conflict with the requirements of the ACTIONS is limited to thetime absolutely neCessary to perform the required testing to demonstrate,OPERABILITY. This Specification does not provide time to perform any otherpreventive or corrective maintenance.An example of demonstrating the OPERABILITY of the equipment being returnedto service is reopening a containment isolation valve that has been closed tocomply with Required Actions and must be reopened to perform the requiredtesting.An example of demonstrating the OPERABILITY of other equipment is taking aninoperable channel or trip system out of the tripped condition to prevent thetrip function from occurring during the performance of required testing onanother channel in the other trip system. A similar example of demonstratingthe OPERABILITY of other equipment is taking an inoperable channel or tripsystem out of the tripped condition to permit the logic to function andindicate the appropriate response during the performance of required testingon another channel in the same trip system.Specifications 4.0.1 through 4.0.5 establish the general requirementsapplicable to Surveillance Requirements. These requirements are based on theSurveillance Requirements stated in the Code of Federal Regulations, 10 CFR50.36(c) (3) :0iMILLSTONE UNIT 3B 3/40-3aMILLTONEUNI 3 B3/4 -3aAmendment No. 179 November 15, 20023/4.0 APPLICABILITYBASES"Surveillance requirements are requirements relating to test, calibration, or inspection toensure that the necessary quality of systems and components is maintained, that facility operationwill be within safety limits, and that the limiting conditions of operation will be met."Specification 4.0.1 establishes the requirement that surveillances must be met during theOPERATIONAL MODES or other conditions for which the requirements of the LimitingConditions for Operation apply unless otherwise stated in an individual SurveillanceRequirement. The purpose of this specification is to ensure that surveillances are performed toverify the OPERABILITY of systems and components and that parameters are within specifiedlimits to ensure safe operation of the facility when the plant is in a MODE or other specifiedcondition for which the associated Limiting Conditions for Operation are applicable. Failure tomeet a Surveillance within the specified surveillance interval, in accordance with Specification4.0.2, constitutes a failure to meet a Limiting Condition for Operation.Systems and components are assumed to be OPERABLE when the associated SurveillanceRequirements have been met. Nothing in this Specification, however, is to be construed asimplying that systems or components are when either:a. The systems or components are known to be inoperable, although still meeting theSurveillance Requirements orb. The requirements of the Surveillance(s) are known to be not met between requiredSurveillance performances.Surveillance requirements do not have to be performed when the facility is in an OPERATIONALMODE or other specified conditions for which the requirements of the associated LimitingCondition for Operation do not apply unless otherwise specified. The Surveillance Requirementsassociated with a Special Test Exception are only applicable when the Special Test Exception isused as an allowable exception to the requirements of a specification.Unplanned events may satisfy the requirements (including applicable acceptance criteria) for agiven Surveillance Requirement. In this case; the unplanned event may be credited as fulfillingthe performance. of the Surveillance Requirement. This allowance includes those SurveillanceRequirement(s) whose performance is normally precluded in a given MODE or other specifiedcondition.Surveillance Requirements, including Surveillances invoked by ACTION requirements, do nothave to be performed on inoperable equipment because the ACTIONS define the remedialmeasures that apply. Surveillances have to be met and performed in accordance withSpecification 4.0.2, prior to returning equipment to OPERABLE status.Upon completion of maintenance, appropriate post maintenance testing is required to declareequipment OPERABLE. This includes ensuring applicable Surveillances are not failed and theirmost recent performance is in accordance with Specification 4.0.2. Post maintenance testing maynot be possible in the current MODE or other specified conditions in the Applicability due to thenecessary unit parameters not having been established. In these situations, the equipment may beconsidered OPERABLE provided testing has been satisfactorily completed to the extent possibleand the equipment is not otherwise believed to be incapable of performing its function. This willallow operation to proceed to a MODE or other specified condition where other necessary postmaintenance tests can be completed.MILLSTONE -UNIT 3B 3/4 0-4MILL TON -NIT3 B3/40-4Amendment No. =5-7, -l-2-, 213 LBDCR No. 074-MP3-015February 24, 20053/4.0 APPLICABILITY 'BASESSome examples of this process are:a. Auxiliary feedwater (AFW) pump turbine maintenance during refueling thatrequires testing at steam pressure > 800 psi. However, if other appropriate testingis satisfactorily completed, the AFW System can be considered OPERABLE. Thisallows startup and other necessary testing to proceed until the plant reaches thesteam pressure required to perform the testing.b. High pressure safety in~jection (I-PSI) maintenance during shutdown that requires*system functional tests at a specified pressure. Provided other appropriate testingis satisfactorily completed, startup can proceed with HPSI consideredOPERABLE. This allows operation to reach the specified pressure to complete thenecessary post maintenance testing.Specification 4.0.2 This specification establishes the limit for which the specified time intervalfor surveillance requirements may be extended. It permi~ts an allowable extension of the normalsurveillance interval to facilitate surveillance scheduling and consideration of plant operatingconditions that may not be suitable for conducting the surveillance; e.g., transient conditions orother ongoing surveillance or maintenance activities. It also provides flexibility to accommodatethe length of a fuel cycle for surveillances that are performed at each refueling outage and arespecified typically with an 18-month surveillance interval. It is not intended that this provision be used repeatedly as a convenience to extend surveillance intervals beyond that specified forsurveillances that are not performed during refueling outage. The limitation of 4.0.2 is based on"engineering judgment and the recognition that the most probable result of any particularsurveillance being performed is the verification of conformance with the surveillancerequirements. This provision is sufficient to ensure that the reliability ensured throughsurveillance activities is not significantly degraded beyond that obtained from the specifiedsurveillance interval.*Specification 4.0.3. establishes the flexibility to defer declaring affected equipment inoperable oran affected variable outside the specified limits when a Surveillance has not been completedwithin the specified surveillance interval. A delay period of up to 24 hours or up to the limit ofthe specified surveillance interval, whichever is greater, applies from the point in time that it isdiscovered that the Surveillance has not been performed in accordance with Specification 4.0.2,and not at the time that the specified surveillance interval was not met.This delay period provides adequate time to complete Surveillances that have been missed. Thisdelay period permits the completion of a Surveillance before complying with ACTIONrequirements or other remedial measures that might preclude completion of the Surveillance.The basis for this delay period includes consideration of unit conditions, adequate planning,availability of personnel, the time required to perform the Surveillance, the safety significance of'the delay in completing the required Surveillance, and the recognition that the most probableresult of any particular Surveillance being performed is the verification of conformance with therequirements.MILLSTONE -UNIT 3 B 3/4 0-5 Amendment No. , 22, 06, t-3,0Acknowledged by NRC letter dated08/25/05 LBDCR No. 04-MP3-015February 24, 20053/4.0 APPLICABILITYBASESWhen a Surveillance with a surveillance interval based not on time intervals, but upon specifiedunit conditions, operating situations, or requirements of regulations, (e.g., prior to enteringMODE I after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified byapproved exemptions, etc.) is discovered to not havje been performed when specified,Specification 4.0.3 allows for the full delay period of up to the specified surveillance interval toperform the Surveillance. However, since there is not a time interval specified, the missedSurveillance should be performed at the first reasonable opportunity.Specification 4.0.3 provides a time limit for, and allowances for the performance of, Surveillancesthat become applicable as a consequence of MODE changes imposed by ACTION requirements.[Failure to comply with specified surveillance intervals for the Surveillance Requirements isexpected to be an infrequent occurrence. Use of the delay period established by Specification4.0.3 is a flexibility which is not intended to be used as an operational convenience to extendSurveillance intervals. While up to 24 hours or the limit of the specified surveillance interval isprovided to perform the missed Surveillance, it is expected that the missed Surveillance will beperformed at the first reasonable opportunity. The determination of the first reasonableopportunity should include consideration of the impact on plant risk (from delaying theSurveillance as well as any plant configuration changes required or shutting the plant down to.perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions,planning, availability of personnel, and the time required to perform the Surveillance. This riskimpact should~be managed, through the program in place to implement 10 CFR 50.65(a)(4) and itsimplementation guidance, NRC Regulatory Guide 1.182, "Assessing and Managing Risk BeforeMaintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses considerationof temporary and aggregate risk impacts, determination of risk management action thresholds,and risk management action up to and including plant shutdown. The missed Surveillance shouldbe treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluationmay use quantitative, qualitative, or blended methods. The degree of depth and rigor of theevaluation should be commensurate with the importance of the component. Missed Surveillancesfor important components should be analyzed quantitatively. If the results of the risk evaluationdetermine the risk increase is significant, this evaluation should be used to determinethe safestcourse of action. All missed Surveillances will be placed in the licensee's Corrective ActionProgram.If a Surveillance is not completed within the allowed delay period, then the equipment isconsidered inoperable or the variable* is considered outside the specified limits and the entry intothe ACTION requirements for the applicable Limiting Condition for Operation beginsimmediately upon, expiration of the delay period. If a Surveillance is failed within the delayperiod, then the equipment is inoperable, or the variable is outside the specified limits and entryinto the ACTION requirements for the applicable Limiting Conditions for Operation beginsimmediately upon the failure of the Surveillance.Completion of the Surveillance within the delay period allowed by this Specification, or withinthe Allowed Outage Time of the applicable ACTIONS, restores compliance with Specification4.0.1.MILLSTONE -UNIT 3 B 3/4 0-5a Amendment No. 2-4-3,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 07-MP3-009June 19, 20073/4.0 APPLICABILITYBASESSpecification 4.0.4 establishes the requirement that all applicable surveillances must be metbefore entry into an OPERATIONAL MODE or other condition of operation specified in theApplicability statement. The purpose of this specification is to ensure that system and componentOPERABILITY requirements or parameter limits are met before entry into a MODE or conditionfor which these systems and components ensure safe operation of the facility. This provisionapplies to changes in OPERATIONAL MODES or other specified conditions associated withplant shutdown as well as startup.Under the provisions of this specification, the applicable Surveillance Requirements must beperformed within the specified surveillance interval to ensure that the Limiting Conditions forOperation are met during initial plant startup or following a plant outage.When a shutdown is required to comply with ACTION requirements, the provisions ofSpecification 4.0.4 do not apply because this would delay placing the facility in a lower MODE ofoperation.Specification 4.0.5 establishes the requirement that inservice testing of ASME Code Class 1, 2,and 3 pumps and valves shall be performed in accordance with a periodically updated version ofthe ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OMN Code) andapplicable Addenda as required by l0CFR5O.55a(f). These requirements apply except whenrelief has been provided in writing by the Commission.This specification includes a clarification of the frequencies for performing the inservice testingactivities required by the ASME. OM Code and applicable Addenda. This clarification isprovided to ensure consistency in surveillance intervals throughout the Technical Specificationsand to remove any ambiguities relative to the frequencies for performing the required inservicetesting activities..Under the terms of this specification, the more restrictive requirements of the TechnicalSpecifications take precedence over the ASME OM Code and applicable Addenda. Therequirements of Specification 4.0.4 to perform surveillance activities before entry into anOPERATIONAL MODE or other specified condition takes-precedence over the ASME OM Code"provision which allows pumps and valves to be tested up to one week after return to normaloperation.MILLSTONE -UNIT 3B 3/4 0-6MILLTONE- UNT 3 3/40-6Amendment No. 2--3, LBDCR 06-MP3-013April 5, 20063/4.1 REACTIVITY CONTROL SYSTEMSBASES3/4.1.1 BORATION CONTROL3/4.1.1.1i and 3/4.1.1.2 SHUTDOWN MARGINA sufficient SHUTDOWN MARGIN ensures that: (1) the reactor can be made subcriticalfrom all operating. conditions, (2) the reactivity transients associated with postulated accidentconditions are controllable within acceptable limnits, and (3) the reactor will be maintainedsufficiently subcritical to preclude inadvertent criticality in the shutdown condition.sHUTDOWN MARGIN requirements vary throughout core life as a function of fueldepletion, RCS boron concentration, and RCS Tavg. In MODES I and 2, the mnost restrictivecondition occurs at EOL with Tav at n1o load operating temperature, and is associated with apostulated steam line break accident and resulting uncontrolled RCS cooldown. In the analysis ofthis accident, a minimum SHUTDOWN MARGIN as defined in Specification 3/4.1.1.1.1 isrequired to: control the reactivity transient. Accordingly, the SHUTDOWN MARGINrequirement is based upon this limiting condition and is consistent with FSAR safety analysisassumptions. In MODES 3, 4 and 5, the mnost restrictive condition occurs at BOL, associated witha boron dilution accident. In the analysis of this accident, a minimum SHUTDOWN MARGIN asdefined in Specification 3/4.1.1 .1 .2 is required to allow the operator 15 minutes from the initiationof the Shutdown Margin Monitor alarm to total loss of SHUTDOWN MARGIN. Accordingly,the SHUTDOWN MARGIN requirement is based upon this limiting requirement and isconsistent with the accident analysis assumption.The locking closed of the required valves in MODE 5 (with the loops not filled) willpreclude the possibility of uncontrolled boron dilution of the Reactor Coolant System bypreventing flow of unborated water to the RCS.3/4.1.1.3 MODERATOR TEMPERATURE COEFFICIENTThe limitations on moderator temperature coefficient (MTC) are provided to ensure thatthe value of this coefficient remains within the limniting condition assumned in the FSAR accidentand transient analyses.The MTC values of this specification are applicable to a specific set of plant conditions;accordingly, verification of MTC values at conditions other than those explicitly stated willrequire extrapolation to those conditions in order to permit an accurate comparison.The most negative MTC, value equivalent to the nmost positive moderator densitycoefficient (MDC), was obtained by incrementally correcting the MDC used in the ESARanalyses to nominal operating conditions.MILLSTONE -UNIT 3 B 3/4 1-1 Amendment No. 9,-6O, 9~9, 4-1-,Acknowledged by NRC Letter dated 12/19/06 August 27, 2001REACTIVITY CONTROL SYSTEMSBASESMODERATOR TEMPERATURE COEFFICIENT (Continued)These corrections involved: (1) a conversion of the MDC used in the FSAR safetyanalyses to its equivalent MTC, based on the rate of change of moderator density withtemperature at RATED THERMAL POWER conditions, and (2) subtracting from this value thelargest differences in MTC observed between EOL, all rods withdrawn, RATED TIHERMALPOWER conditions, and those most adverse conditions of moderator temperature and pressure,rod insertion, axial power skewing, and xenon concentration that can occur in normal operationand lead to a significantly more negative EOL MTC at RATED THERMAL POWER. Thesecorrections transformed the MDC value used in the FSAR safety analyses into the limiting End ofCycle Life (EOL) MTC value. The 300 ppm surveillance limit MTC value represents aconservative MTC value at a core condition of 300 ppm equilibr/ium boron concentration, and isobtained by making corrections for burnup and soluble boron to the limiting EOL MTC value.The Surveillance Requirements for measurement of the MTC at the beginning and nearthe end of the fuel cycle are adequate to confirm that the MTC remains within its limits since thiscoefficient changes slowly due principally to the reduction in RCS boron concentration associatedwith fuel burnup.3/4.1.1.4 MINIMUM TEMPERATURE FOR CRITICALITYThis specification ensures that the reactor will not be made critical with the ReactorCoolant System average temperature less than 551. This limitation is required to ensure: (1) themoderator temperature coefficient is within it analyzed temperature range, (2) the tripinstrumentation is within its normal operating range, (3) the P-12 interlock is above its setpoint,(4) the pressurizer is capable of being in an OPERABLE status with a steam bubble, and (5) thereactor vessel is above its minimum RTNDT temperature.3/4.1.2 DELETEDMILLSTONE -UNIT 3B 3/4 1-2MILLTON -NIT3 B3/41-2Amendment No. 2-9, 5-0, 4457-, 197 LBDCR 07-MP3-037Jtily 12, 2007REACTIVITY CONTROL SYSTEMSBASES3/4.1.3 MOVABLE CONTROL ASSEMBLIESThe specifications of this section ensure that: (1) acceptable power distribution limits aremaintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effectsof rod misalignment on associated accident analyses are limited. OPERABILITY of the controlrod position indicators is required to detennine control rod positions and thereby ensurecompliance with the control rod aligmnent and insertion limits. Verification that the Digital RodPosition Indicator agrees with the demanded position within +/--12 steps at 24, 48, 120, and fullywithdrawn position for the Control Banks and 18, 210, and fully withdrawn position for theShutdown Banks provides assurances that the Digital Rod Position Indicator is operatingcorrectly over the full range of indication. Since the Digital Rod Position Indication System doesnot indicate the actual shutdown rod position between 18 steps and 210 steps, only points in theindicated ranges are picked for verification of agreement with demanded position.The ACTION statements which permit limited variations from the basic requirements areaccompanied by additional restrictions which ensure that the original design criteria are met.Misalignment of a rod requires measurement of peaking factors and a restriction in TI-ERMALPOWER. These restrictions provide assurance of fuel rod integrity during continued operation. Inaddition, those safety analyses affected by a misaligned rod are reevaluated to confirm that theresults remain valid during future operation.The maximaum rod drop time restriction is consistent with the assumed rod drop time used in thesafety analyses. Measurement with Tavg greater than or equal to 500°F and with all reactor coolantpumps operating ensures that the measured drop times will be representative of insertion timesexperienced during a Reactor trip at operating conditions.The required rod drop time of< 2.7 seconds specified in Technical Specification 3.1.3A4 is used inthe FSAR accident analysis. A rod drop time was calculated to validate the TechnicalSpecification limit. This calculation accounted for all uncertainties, including a plant specificseismic allowance of 0.50 seconds. Since the seismic allowance should be removed whenverifying the actual rod drop time, the acceptance criteria for surveillance testing is 2.20 seconds(Reference 4).Measuring rod drop times prior to reactor criticality, after reactor vessel head removal andinstallation, ensures that the reactor internals and rod drive mechanism will not interfere with rod.motion or rod drop time, and that no degradation in these systems has occurred that wouldadversely affect rod motion or drop time. Any time the OPERABILITY of the control rods hasbeen affected by a repair, maintenance, modification, or replacement activity, post maintenancetesting in accordance with SR 4.0.1 is required to demonstrate OPERABILITY.MILLSTONE -UNIT 3 B 3/4 1-3 Amendment No..-!-2., 60, .83, 4-4-, 4-5-7,164, 4-9-7, LBDCR l2-MP3-010September 20, 2012REACTVTSCNRLSYTMBASESMOVABLE CONTROL ASSEMIBLIIES (Continued')Control rod positions and OPERABILITY of the rod position indicators are required to beverified at the frequency specified in the Surveillance Frequency Control Program with morefrequent verifications required if an automatic monitoring channel is inoperable. Theseverification frequencies are adequate for assuring that the applicable LCOs are satisfied.The Digital Rod Position Indication (DRPI) System is defined as follows:* Rod position indication as displayed on DRPI display panel (MB4), or* Rod position indication as displayed by the Plant Process Computer System.With the above definition, LCO 3.1.3.2, "ACTION a." is no applicable with either DRPI displaypanel or the plant process computer points OPERABLE.The plant process computer may be utilized to satisfy DRIPI System requirements which meetsLCO 3.1.3.2, in requiring diversity for determining digital rod position indication.Technical Specification SR 4.1.3.2.1 determines each digital rod position indicator to beOPERABLE by verifying the Demand Positioni Indication System and the DRPI System agreewithin 12 steps at the frequency specified in the Surveillance Frequency Control Program, exceptduring the time when the rod position deviation monitor is inoperable, then compare the DemandPosition Indication System and the DRIPI System at least once each 4 hours.The Rod Deviation Monitor is generated only from the DRIPI panel at M4I34. Therefore, when rodposition indication as displayed by the plant process computer is the only available indication,then perform SURVEILLANCE REQUIREMENTS every 4 hours.MILLSTONE -UNIT 3 B 3/4 1-4 Amendment No. 6Q0 : LBDCR 12-MP3-010September 20, 2012REACTIVTY CONTROL SYSTEMSD BASESMOVABLE CONTROL ASSEMBLIES (Continued)Additional surveillance is required to ensure the plant process computer indications are inagreement with those displayed on the DRPI. This additional SURVEILLANCEREQUIREMENT is as follows:Each rod position indication as displayed by the plant process computer shall bedetermined to be OPERABLE by verifying the rod position indication as displayed on theDRPI display panel agrees with the rod position indication as displayed by the plantprocess computer at the frequency specified in the Surveillance Frequency ControlProgram.The rod position indication, as displayed by DRPI display panel (@AB4), is a non-QA system,calibrated on a refueling interval, and used to implement T/S 3.1.3.2. Because the plant processcomputer receives field data from the same source as the DRPI System (MB4), and is alsocalibrated on a refueling interval, it fully meets all requirements specified in T/S 3.1.3.2 for rodposition. Additionally, the plant process computer provides the same type and level of accuracy asthe DRPI System (MB4). The plant process computer does not provide any alarm or rod positioni deviation monitoring as does DRPI display panel (MB4).For Specification 3.1.3.1 ACTIONS b. and c., it is incumbent upon the plant to verify thetrippability of the inoperable control rod(s). Tripp ability is defined in Attachment C to a letterdated December 21, 1984, from E. P. Rahe (Westinghouse) to C. 0. Thomas (NRC). This may beby verification of a control system failure, usually electrical in nature, or that the failure is....as.sociated with the control rod stepping mechanism. In the event the plant is unable to verify therod(s) trippability, it must be assumed to be untrippable andi-thus f~alls undr therequirements of-ACTION a. Assuming a controlled shutdoWn from 100% RATED THERMAL POWER, thisallows approximately 4 hours for this verification.For LCO 3.1.3.6 the control bank insertion limits are specified in the CORE OPERATINGLIMITS REPORT (COLR). These insertion limits are the initial assumptions in safety analysesthat assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuelburnup distributions, assumptions of available SHUTDOWN MARGIN, and initial reactivityinsertion rate.The applicable I&C calibration procedure (Reference 1.) being current indicates the associatedcircuitry is OPERABLE.There are conditions when the Lo-Lo and Lo alarms of the RIu Monitor are limited below the RILspecified in the COLR. The RIL Monitor remains OPERABLE because the lead control rod bankstill has the Lo and Lo-Lo alarms greater than or equal to the RIL.MILLSTONE -UNIT 3 B3415AedetN.6B 3/4 1-5Amendment No. 60 LBDCR 14-MP3-005May 8, 2014REACTIVITY CONTROL SYSTEMSBASESMOVABLE CONTROL ASSEMBLIES (Continued)When rods are at the top of the core, the Lo-Lo alarm is limited below the RIL to prevent spuriousalarms. The RIL is equal to the Lo-Lo alarm until the adjustable upper limit setpoint on the RILMonitor is reached, then the alarm remains at the adjustable upper limit setpoint. When the RIL isin the region above the adjustable upper limit setpoint, the Lo-Lo alarm is below the RIL.

References:

1. SP 3451N23, Rod Insertion Limits Calibration.2. Letter NS-OPLS-OPL-1-91-226, (Westinghouse Letter NEU-91-563), dated April 24, 1991.3. Millstone Unit 3 Technical Requirements Manual, Appendix 8.1, "CORE OPERATINGLIMITS REPORT".4. Westinghouse Letter NEU-07-62, "MPS3 -SPUP RCCA Drop Time," dated June 4, 2007.5. Westinghouse Letter 98NEU-G-0060, "Millstone Unit 3. -Robust Fuel Assembly (DesignReport) and Generic SECL," dated October 2, 1998.MILLSTONE -UNIT 3 B3416Amnmn oB 3/4 1-6Amendment No.

LBDCR No. 04~-MP3-0l5February 24, 20053/4.2 POWER DISTRIBUTION LIMITSBASESThe specifications of this section provide assurance of fuel integrity during Condition I(Normal Operation) and II (Incidents of Moderate Frequency) events by: (1) maintaining theminimum DNBR in the core greater than or equal to the design limit during normal operation and*in short-tenn transients, and (2) limiting the fission gas release, fuel pellet temperature, andcladding mechanical properties to within assumed design criteria. In addition, limiting the peaklinear power density during Condition I events provides assurance that the initial conditionsassumed for the LOCA analyses are met and the ECCS acceptance criteria limit of 2200°F is notexceeded.The definitions of certain hot channel and peaking factors as used in these specifications-are as follows:FQ(Z) Heat Flux Hot Channel Factor, is defined as the maximum local heat flux on thlesurface of a fuel rod at core elevation Z divided by the average fuel rod heat flux,allowing for manufacturing tolerances on fuel pellets and rods;, andF NNuclear Enthalpy Rise. Hot Channel Factor, is defined as the ratio of the integral ofAH linear power along the rod with the highest integrated power to the average rodpower.3/4.2.1 AXIAL FLUX DIFFERENCEThe limits on AXIAL FLUX DIFFERENCE (AFD) assure that the FQ(Z) up~per boundenvelope of the FQ limit specified in. the CORE OPERATING LIMITS REPORT (COLR) times.the normalized axial peaking factor is not exceeded during either normal operation or in the eventof xenon redistribution following power changes.Target flUX difference is determined at equilibrium xenon conditions. The full-length rodsmay be positioned within the core in accordance with their respective insertion limits and shouldbe inserted near their normal position for steady-state operation at high power levels.' The val~ueof the target flux difference Obtained under these conditions divided by the fraction of RATEDTHERMAL POWER is the target flux difference at RATED THERMAL POWER for the.associated core burnup conditions. Target flux differences for other THERMAL POWER levelsare obtained by multiplying the RATED THERMAL POWER value by the appropriate fractionalTHERMAL POWER level. The periodic updating of the target flux difference value is necessaryto reflect core burnup considerations.MILLSTONE -UNIT 3 B 3/4 2-1 Amendment No. g0, 60,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015Februaiy 24, 2005POWER DISTRIBUTION LIMITSBASESAXIAL FLUX DIFFERENCE (Continued)At power lev'els below APLND, the limits on AFD are defined in the COLR consistent with thaeRelaxed Axial Offset Control (RAOC) operating procedure and limits. These limits werecalculated in a manner such that expected operational transients, e.g., load follow operations,would not result in the AFD deviating outside of those limits. However, in the event such adeviation occurs, the short period of time allowed outside of the limits at reduced power levelswill not result in significant xenon redistribution such that the envelope of peaking factors wouldchange sufficiently to prevent operation in the vicinity of the APLND power level.At power levels greater than APLNO, two modes of operation are permissible: (1) RAOC,the AFD limit of which are defined in the COLR, and (2) base load operation, which is defined asthe maintenance of the AFD within COLR specifications band about a target value. The RAOCoperating procedure above APLNO is the same as that defined for operation, below APLND.However, it is possible when following extended load following maneuvers that the AFD limitsmay result in restrictions in the maximum allowed power or AFD in order to guarantee operationwith FQ(Z) less than its limiting value. To allow operation at. the maximum permissible powerlevel, the base load operating procedure restricts the indicated AFD to relatively small target band(as specified in the COLR) and power swings (APLND < power < APLBL or 100% RATEDTHERMAL POWER, whichever is lower). For base load operation, it is expected that the plantwill .operate within the target band. Operation outside of the target band for the short time periodallowed will not result in significant xenon redistribution such that the envelope of peakingfactors wotuld change sufficiently to prohibit cohatint~e&d operation iti the power tegiori definedabove.. To assure there is no residual xenon redistribution impact from .past operation on the baseload operation, a 24-hour waiting period at a power level above APLND and allowed by RAOC isnecessary. During this time period load changes and rod motion are restricted to that allowed bythe base load procedure. After the waiting period, extended base load operation is permissible.The computer determines the 1-minute average of each of the oPERABLE excore detectoroutputs and provides an alarm message immediately if the AFD for at least 2 of 4 or 2 of 3OPERABLE excore channels are: (1) outside the allowed delta-I power operating space (forRAOC operation), or (2) outside the allowed delta-I target band (for base load operation). These.alarms are active when power is greater than (1) 50% of RATED THERMAL POWER (forRAOC operation), orMILLSTONE -UNIT 3 B 3/4 2-2 Amendment No. NO, 60,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 06-MP3-014June 22, 2006POWER DISTRIBUTION LIMITSBASESAXIAL FLUX DIFFERENCE (Continued)(2) APN (for base load operation). Penalty deviation minutes for base load operation are notaccumulated based on the short period of time during which operation outside of the target band isallowed.3/4.2.2 AND 3/4.2.3 HEAT FLUX HOT CHANNrEL FACTOR AND RCS FLOW RATE ANDNUCLEAR ENTHALPY RISE HOT CHANNEL FACTORThe limits on heat flux hot channel factor, RCS flow rate, and nuclear enthalpy rise hotchannel factor ensure that: (1) the design limits on peak local power density and minimum.DNBR are not exceeded and (2) in the event of a LOCA the peak fuel clad temperature will notexceed the 2200°F ECCS acceptance criteria limit.Each of these is mieasurable but will normally only be determined periodically as specifiedin Specifications 4.2.2 and 4.2.3. This periodic sutrveillance is sufficienat to ensure that the limitsare maintained provided:a. Control rods in a single group move together with no individual rod insertiondiffering by more than +/-12 steps, indicated, from the group demand position;b. Control rod groups are sequenced with overlapping groups as described inSpecification 3.1.3.6;c. The control rod insertion limits of Specifications 3.1.3.5 and 3.1.3.6 aremaintained; andd. The axial power distribution, expressed in terms of AXIAL FLUX DIFFERENCE,is maintained within the lhinits.FNAH will be maintained within its limits provided Conditions a. through d. above aremaintained. The relaxation of FNAH as a function of THERMAL POWER allows changes in theradial power shape for all permissible rod insertion limits.The FNaH as calculated in Specification 3.2.3.1 is used in the various accident analyseswhere FNN_ influences parameters other than DNBR, e.g., peak clad temperature, and thus is themaximum "as measured" value allowed.The RCS total flow rate and FNAHt are specified in the CORE OPERATING LIMITSREPORT (COLR) to provide operating and analysis flexibility from cycle to cycle. However, theminimum RCS flow rate, that is based on 10% steam generator tube plugging, is retained in theTechnical Specifications.MILLSTONE -UNIT 3B 3/4 2-3MILSTOE -UNI 3 3/2-3Amendment No. .5-, 60, _9-1--7-, LBDCR 12-MP3-010September 20, 2012POWER DISTRIBUTION LIMITSBASES3/4.2.2 and 3/4.2.3 HEAT FLUX HOT CHANNEL FACTOR and RCS FLOW RATE ANDNUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR (Continued)Margin is maintained between the safety analysis limit DNBR and the design limit DNBR. Thismargin is more than sufficient to offset the effect of rod bow and any other DNB penalties thatmay occur. The remaining margin is available for plant design flexibility.When an FQ measurement is taken, an allowance for both experimental error and manufacturingtolerance mnust be made. An allowance of 5% is appropriate for a full core map taken with theincore detector flux mapping system and a 3% allowance is appropriate for manufacturingtolerance.The heat flux hot channel factor, FQ(Z), is measured periodically in accordance with theSurveillance Frequency Control Program using the incore detector system. These measurementsare generally taken with the core at or near steady state conditions. Using the measured threedimensional power distributions, it is possible to derive F.QM~z),.a computed value Of FQ..(Z).However, because this value represents a steady state condition, it does not include the variationsin the value Of FQ(Z) that are present during nonequilibrium situations.To account for these possible variations, the steady state limit of FQ(Z) is adjusted by an elevationdependent factor appropriate to either RAOC or base load operatio~n, W(~Z) or W(Z)BL, thataccounts for the calculated worst case transient conditions. The W(Z) and W(Z)BL, factorsdescribed above for normal operation are specified in the COLR per Specification 6.9.1.6. Coremonitoring and control under nonsteady state conditions are accomplished by operating the corewithin the limits of the appropriate LCOs, including the limits on AFD, QPTR, and control rodinsertion. Evaluation of the steady state FQ(Z) limit is performed in Specification 4.2.2.1 .2.b and4.2.2.1.4.b while evaluation nonequilibriumn limits are performed in Specification 4.2.2.1.2.c and4.2.2.1 .4.c.When RCS flow rate and FNAH_ are measured, no additional allowances are necessary prior tocomparison with the limits of the Limiting Condition for Operation. Measurement errors for RCStotal flow rate and for have been taken into account in determination of the design DNBRvalue.The measurement error for RCS total flow rate is based upon performing a precision heat balanceand using the result to calibrate the RCS flow rate indicators. To perform the precision heatbalance, the instrumentation used for determination of steam pressure, feedwater pressure,feedwater temperature, and feedwater venturi AP in the calorimetric calculations shall becalibrated in accordance with the Surveillance Frequency Control Program. Potential fouling of.the feedwater venturi which might not be detected could bias the result fl'om the precision heatbalance in a non-conservative manner. Any fouling which might bias the RCS flow ratemeasurement can be detected by monitoring and trending various plant perfonmance parameters.If detected, action shall be taken before performing subsequent precision heat balancemeasurements, i.e., either the effect of the fouling shall be quantified and compensated for in theRCS flow rate measurement or the venturi shall be cleaned to eliminate the fouling.MILLSTONE -UNIT 3B 3/4 2-4MILLTONE- UNT 3 3/42-4Amendment No. 2, 61), -!-7@,2-7 LBD CR 12-MP3-010September 20, 2012POWER DISTRIBUTION LIMITSBASESHEAT FLUX HOT CHANNhEL FACTOR and RCS FLOW RATE AND1T NUCLEARENTHAIPY RISE HOT CHAINNEL FACTOR (Continued)The periodic surveillance of indicated RCS flow in accordance with the SurveillanceFrequency Control Program is sufficient to detect only flow degradation which could lead tooperation outside the acceptable region of operation defined in Specifications 3.2.3.1.3/4.2.4 QUADRANT POWER TILT RATIOThe QUADRANT POWER TILT RATIO limit assures that the radial power distributionsatisfies the design values used in the power capability analysis. Radial power distributionmeasurements are made during STARTUP testing and periodically during POWEROPERATION.The limit of 1.02, at which corrective action is required, provides DNB and linear heatgeneration rate protection with x-y plane power tilts. A limiting tilt of 1.025 can be toleratedbefore the margin for uncertainty in FQ is depleted. A limit of 1.02 was selected to provide anallowance for the uncertainty associated with the indicated power tilt.The 2-hour" time allowance for operation with a tilt condition greater than 1.02 but lessthan 1.09 is provided to allow identification and correction of a dropped or misaligned controlrod. In the event such action does riot conrect the tilt, the margin for uncertainty on FQ is reinstatedby reducing the maximum allowed power by 3% for each percent of tilt in excess of 1.For purposes of monitoring QUADRANT POWER TILT RATIO when one excoredetector is inoperable, the moveable incore detectors are used to confirm that the normalizedsymmetric power distribution is consistent with the QUADRANT POWER TILT RATIO. Theincore detector monitoring is done with a full incore flux map or two sets of four symmetricthimbles. The two sets of four symmetric thimbles is a unique set of eight detector locations.These locations are C-8, E-5, E-11, H-3, H-13, L-5, L-11, N-8.3/4.2.5 DNB The limits on the DNB-related parameters assure that each of the parameters aremnaintained within the normal steady-state envelope of operatioii assumed in the transient andaccident analyses. The limits are consistent with the initial FSAR assumptions and have beenanalytically demonstrated adequate to maintain a minimum DNBR greater than the design limitthroughout each analyzed transient. The indicated Tavg valuesMILLS TON~E -UNIT 3 B 3/4 2-5 Amnendment No. 7-, .50, 60,1),!7-LBDCR 12-MP3-010September 20, 2012POWER DISTRIBUTION LIMITS BASESDNB PARAMETERS (Continued)and the indicated pressurizer pressure values are specified in the CORE OPERATING LIMITSREPORT. The calculated values of the DN-B related parameters will be an average of theindicated values for the OPERABLE channels.The periodic surveillance of these parameters through instrument readout inaccordance with the Surveillance Frequency Control Program is sufficient to ensure that theparameters are restored within their limits following load changes and other expected transientoperation. Measurement uncertainties have been accounted for in detennining the parameterlinuits.MILLSTONE -UNIT 3B 3/4 2-6MILLSONE -UNIT3 B 342-6Amendment No. 4-!, 60, -- LBDCR 12-MIP3-010September 20, 20123/4.3 INSTRUMENTATIONBASES3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION AND ENGINEEREDSAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATIONThe OPERABILITY of the Reactor Trip System and the Engineered Safety FeaturesActuation System instrumentation and interlocks ensures that: (1) the associated action and/orReactor trip will be initiated when the parameter monitored by each channel or combinationthereof reaches its setpoint, (2) the specified coincidence logic is maintained, (3) sufficientredundancy is maintained to permit a channel to be out of service for testing or maintenance, and(4) sufficient system functional capability is available from diverse parameters.The OPERABILITY of these systems is required to provide the overall reliability,redundancy, and diversity assumed available in the facility design1 for the protection andmitigation of accident and transient conditions. The integrated operation of each of these systemsis consistent with the assumptions used in the safety analyses. The Surveillance Requirementsspecified for these systems ensure that the overall system fimlctional capability is maintainedcomparable to the original design standards. The periodic surveillance tests performed aresufficient to demonstrate this capability. The surveillance frequency is controlled under theSurveillance Frequency Contr'ol Program.The Engineered Safety Features Actuation System Nominal Trip Setpoints specified inTable 3.3-4 are the nominal values of which the bistables are set for each functional unit. TheAllowable Values (Nominal Trip Setpoints +/-- the calibration tolerance) are considered theLimiting Safety System Settings as identified in lOCFR5O.36 and have been selected to mitigatethe consequences of accidents. A Setpoint is considered to be consistent with the nominal valuewhen the measured "as left" Setpoint is within the administratively controlled (#) calibrationtolerance identified in plant procedures (which specifies the difference between the AllowableValue and Nominal Trip Setpoint). Additionally, the Nominal Trip Setpoints may be adjusted inthe conservative direction provided the calibration tolerance remains unchanged.Measurement and Test Equipment accuracy is administratively controlled by plantprocedures and is included in the plant uncertainty calculations as defined in WCAP- 10991.OPERABILITY determinations are based on the use of Measurement and Test Equipment thatconfonns with the accuracy used in the plant uncertainty calculation.The Allowable Value specified in Table 3.3-4 defines the limit beyond which a channel is.inoperable. If the process rack bistable setting is measured within the "as left" calibrationtolerance, which specifies the difference between the Allowable Value and Nominal TripSetpoint, then the channel is considered to be OPERABLE.MILLSTONE -UNMT 3B3/31AmnetNo -9B 3/43-1Amendment No. 4-5-9 LBDCR 12-MP3-010September 20, 2012INSTRUMENTATIONBASES3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINJEEREDSAFETY FEATUIRES ACTUATION SYSTEM 1NSTRUMIENTATION (Continued).The methodology, as defined in WCAP-10991 ito derive the Nomhinal Trip Setpoints, is basedupon combining all of the uncertainties in the channels. Inherent in the detennination of theNominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and otherinstrumentation utilized in these channes should be capable of operating within the allowances ofthese uncertainty magnitudes. Occasional drift in excess of the allowance may be determined tobe acceptable based on the other device perfonnance characteristics. Device drift in excess of theallowance that is more than occasional, may be indicative of more serious problems and wouldwarrant further investigation.The above Bases does not apply to the Control Building Inlet Ventilation radiation monitors ESFTable (Item 7E). For these radiation monitors the allowable values are essentially nominal values.Due to the uncertainties involved in radiological parameters, the methodologies of WCAP- 10991were not applied. Actual trip setpoints will be reestablished below the allowable value based oncalibration accuracies and good practices.The OPERABILITY requirements for Table 3.3-3, Functional Units 7.a, "Control BuildingIsolation, Manual Actuation," and 7.e, "Control Building Isolation, Control Building InletVentilation Radiation," are defined by table notation "*". These functional units are required to beOPERABLE at all times during plant operation in MODES 1, 2, 3, and 4. These functional units are also required to be OPERABLE during movement of recently irradiated fuel assemblies, as -specified by table notation "*i". The Control Building Isolation Manual Actuation and ControlBuilding.Inlet Ventilation Radiation are required to be OPERABLE during movement of recentlyirradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within theprevious 350 hours*). Table notation "*" of Table 4.3-2 has the same applicability.The verification of response time provides assurance that the reactor iri and the engineeredsafety features actuation associated with each channel is completed within the tim~e limit assumedin the safety analysis. No credit is taken in the analysis for those channels with response timesindicated as not applicable (i.e., N.A.). The surveillance frequency is controlled under theSurveillance Frequency Control Program.Required ACTION 4. of Table 3.3-1 is modified by a Note to indicate that nonnal plant controloperations that individually add limited positive reactivity (e.g., temperature or b~oron fluctuationsassociated with RCS inventory management or temperature control) are not precluded by thisACTION provided they are accounted for in the calculated SDM. The proposed change pennitsoperations introducing positive reactivity additions but prohibits the temperature change oroverall boron concentration from decreasing below that required to maintain the specified SDMor required boron concentration.* During fuel assembly cleaning evolutions that involve the handling or cleaning of twofuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part ofa critical reactor core within the previous 525 hours.MILLSTONE -UNIT 3 B 3/4 3:2 Amendment No. 3,-9-1, 4-!-9,14-7-, 4-7, 2-!9, -230 O March 17, 2004INSTRUMENTATIONBASESI': 3/4.3-1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION andl ENGINEEREDSAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)Response time may be verified. by actual response time tests in any series of sequential,overlapping or total channel measurements, or by the summation of allocated sensor, signalprocessing and actuation logic responsetimes with actual response time tests on the remainder ofthe channel. Allocations for sensor response times may be obtained from: (1) historical recordsbased on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace,onsite, or offsite (e.g. vendor) test measurements, or (3) utilizing vendor engineeringspecifications. WCAP-13 632-P-A, Revision 2, "Elimination of Pressure Sensor Response TimeTesting Requirements" provides the basis and methodology for using allocated sensor~responsetimes in the overall verification of the channel response time for specific sensors identified in theWCAP. Response time verification for other sensor types must be demonstrated by test. Detectorresponse times may be measured by the in-situ online noise analysis-response time degradationmethod described in the Westinghouse Topical Report, "The Use of Process Noise Measurementsto Determine Response Characteristics of Protection Sensors in U.S. Plants," dated August 1983.WCAP- 14036, Revision 1, "Elimination of Periodic Protection Channel Response TimeTests" provides the basis and methodology for using allocated signal processing and actuationlogic response times in the overall verification .of the protection system channel response time.O I The allocations for sensor, signal conditioning and actuation logic response times must be verifiedi! prior to placing the component in operational service and re-verified following maintenance thatmay adversely affect response time. In general, electrical repair work does not impact response._time provided the parts used for repair are of the same. type and value. Specific componentsidentified in the WCAP may be replaced without verification testing. One example whereresponse time could be affected is replacing the sensing assembly of a transmitter.The Engineered Safety Features Actuation System senses selected plant parameters anddetermines whether or not predetermined limits are being exceeded. If they are, the signals arecombined into logic matrices sensitive to. combinations indicative of various accidents, events,and transients. Once the required logic combination is completed, the system sends actuationsignals to those Engineered Safety Features components whose aggregate function best serves the.requirements of the condition. As an example, the following actions may be initiated by theEngineered Safety Features Actuation System to mitigate the consequences of a steam line breakor loss-of-coolant accident: (1) Safety Injection pumps start and automatic valves position, (2)Reactor trip, (3) feed-water isolation, (4) startup of the-emergency diesel generators, (5) quenchspray pumps start and automatic valves .position, (6) containment isolation, (7) steam lineisolation, (8) Turbine trip, (9) auxiliary feedwater pumps start, (10) Service water pumps start andautomatic valves position, and (1 1) Control Room isolates.O MILLSTONE -UNIT 3 B 3/4 3-2a Amendment No. 3, 9-3-, 4-98, 219 LBDCR No. 0J4-MP3-015February 24, 2005INSTRUMENTATIONBASES3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEEREDSAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)For slave relays, or any auxiliary relays in: ESFAS circuits that are of the type Potter & BrumfieldMVDR series relays, the SLAVE RELAY TEST is performed at an "R" frequency (at least onceevery 18 months) provided the relays meet the reliability assessment criteria presented inWCAP- 13 878, of Potter and Brumfield MDR series relays," andWCAP-13 900, "Extensiin of Slave Relay Surveillance Test Intervals." The reliabilityassessments performed as part of the aforementioned WCAPs are relay specific and apply only toPotter and B~rumfield MDR series relays. Note that for normally energized applications, the relaysmay have to be replaced periodically in accordance with the guidance given in WCAP-13 878 forMDR relays.REACTOR TRIP BREAKERThis trip function applies to the reactor trip breakers (RTBs) exclusive of individual tripmechanisms. The LCO requires two OPERABLE trains of trip breakers. A trip breaker trainconsists of all trip breakers associated with a single RTS logic train that are racked in, closed, andcapable of supplying power to the control rod drive (CRD) system. Thus, the train may consist ofthe main breaker, bypass breaker, or main breaker and bypass breaker, depending upon the systemconfiguration. Two OPERABLE trains ensure no single random failure can disable the RTS tripcapability.These trip f-unctions must be.OPE.R.AB3LE in MODE 1 .or 2 when the reactor is critical.. InMODE 3, 4, or 5, these RTS trip functions must be OPERABLE when the RTBs or associatedbypass breakers are closed, and the CRD system is capable of rod withdrawal.BYPASSED CHANNEL* -. Technical Specifications 3.3.1 and 3.3.2 often allow thebypassing of instrument channels in the case of an inoperable instrument or for surveillancetesting.A BYPASSED CHARNEL shall be a channel which is:* Required to be .in its accident or tripped condition, but is not presently in its accident ortripped condition using a method described below; or* Prevented from tripping.MILLSTONE -UNIT 3 B 3/4 3-2b Amendment No. 24-9,Acknowledged by NRC letter dated 08/25/05 March 17, 2004INSTRUMENTATIONBASES3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEEREDSAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)A channel may be bypassed by:* Insertion of a simulated signal to the bistable; or* Failing the transmitter or input device to the bypassed condition; or* Returning a channel to service in a untripped condition; or* An equivalent method, as determined by Engineering and I&C*Bypass switches exist only for NIS source range, NIS intermediate range, and containmentpressure Hi-3.TRIPPED CHANN'EL -Technical Specifications 3.3.1 and 3.3.2 often require the tripping.of instrument channels in the case of an inoperable instrument or for surveillance testing.A TRIPPED CHANNEL shall be a channel which is in its required accident or trippedcondition.A channel may be placed in trip by:-The Bistable Trip Switches; or.. ....o Insertion of a simulated signal to the bistable; or* Failing the transmitter or input device to the tripped condition; or* An equivalent method, as determined by Engineering and I&CThe Engineered Safety Features Actuation System interlocks perform the followingfunctions:P-4 Reactor tripped -Actuates Turbine trip, closes main feedwater valves on Tavbelow Setpoint, prevents the opening of the main feedwater valves which wereclosed by a Safety Injection or High Steam Generator Water Level signal, allowsSafety Injection block so that components can be reset or tripped.Reactor not tripped .- prevents manual block of Safety Injection.MILLSTONE -UNIT 3B 3/4 3-3MILLTONE- UNT 3 3/43-3Amendment No. 4-, 4-64, 219 LBDCR ¶ 0-MP3-003February 23, 2010INSTRUMENTATIONBASES3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEEREDSAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)P-Il On increasing pressurizer pressure, P-1l automatically reinstates Safety Injectionactuation on low pressurizer pressure and low steam line pressure. On decreasingpressure, P-l1 allows the manual block of Safety Injection actuation on lowpressurizer pressure and low steam line pressure.P-12 On increasing reactor coolant ioop temperature, P-12 automatically provides anarming signal to the Steam Dump System. On decreasing reactor coolant looptemperature, P-12 automatically removes the arming signal from the Steam DumpSystem.P-14 On increasing steam generator water level, P-14 automatically trips all feedwaterisolation valves, main feed pumps and main turbine, and inhibits feedwater controlvalve modulation.P-19 Upon decreasing Reactor Coolant System pressure, permits the cold leg injectionvalves to automatically open upon receipt of a Safety Injection signal.314.3.3 MONITORING INSTRUMENTATION3/4.3.3.1 RADIATION MONITORING FOR PLANT OPERATIONSThe OPERABILITY of the radiation monitoring instrumentation for plant operations ensures.that: (1) the associated action will be initiated when the radiation level monitored by eachchannel or combination thereof reaches its Setpoint, (2) the specified coincidence logic ismaintained, and (3) sufficient redundancy is maintained to permit a channel to be out-of-servicefor testing or maintenance. The radiation monitors for plant operations .senses radiation levels inselected plant systems and locations and determines whether or not predetermined limits arebeing exceeded. If they are, the signals are combined into logic matrices sensitive to combinationsindicative of various accidents and abnormal conditions. Once the required logic combination iscompleted, the system sends actuation signals to initiate alarms.The Fuel Storage Pool Area Monitor is required to be OPERABLE during movement of recentlyirradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within theprevious 350 hours*).*During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuelassemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a criticalreactor core within the previous 525 hours.MILLSTONE -UNIT 3B 3/4 3-4MILLTONE- UIT 3B 3/3-4Amendment No. 49-3, 2-1-9 LBDCR October 21, 2008INSTRUMENTATIONBASES3/4.3.3.2 DELETED3/4.3.3.3 DELETED3/4.3.3.4 DELETED3/4.3.3.5 REMOTE SHUTDOWN INSTRUMENTATIONThe OPERABILITY of the Remote Shutdown Instrumentation ensures that sufficient capability isavailable to permit safe shutdown of the facility from locations outside of the control room. Thiscapability is required in the event control room habitability is lost and is consistent with GeneralDesign Criterion 19 of 10 CFR Part 50.Calibration of the Intermediate Range Neutron Amps channel from Table 4.3-6 applies to thesignal that originates from the output of the isolation amplifier within the intermediate rangeneutron flux processor drawers in the control room and terminates at the displays within theAuxiliary Shutdown Panel.The OPERABILITY of the Remote Shutdown Instrumentation ensures that a fire will not.preclude achieving safe shutdown. The remote shutdown monitoring instrumentation, control,and power circuits and transfer switches necess.a~ryto eliminate effects of the fire and allowoperation of instrumentation, control and power circuits required to achieve and maintain a safe-shutdown condition are independent of areas where a fire could damage systems normally used toshut down the reactor. This capability is consistent with General Design Criterion 3 andAppendix R to 10 CFR Part 50.3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATIONThe OPERABILITY of the accident monitoring instrumentation ensures that sufficientinformation is available on selected plant parameters to monitor and assess these variablesfollowing an accident. The instrumentation included in this specification are those instrumentsprovided to monitor key variables, designated as Category 1 instruments following the guidancefor classification contained in Regulatory Guide 1.97, Revision 2, "Instrumentation forLight-Water-Cooled Nuclear Power Plants To Assess Plant and Environs Conditions During andFollowing an Accident."MILLSTONE -UNIT 3B 3/4 3-5MILLTON -JNIT3 B3/43-5Amendment No. 3, :76, g4, 2, 2-1-9, LBDCR No;.04.-MP3-015February 24, 2005INSTRUMENTATIONBASES3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continued)ACTION Statement "a":The use of one main control board indicator and one computer point, total of twoindicators per steam generator, meets the requirements for the total number of channels forAuxiliary Feedwater flow rate. The two channels used to satisfy this Technical Specification foreach steam generator are as follows:Steam Instrument (M5 Instrument .(Computer),eneratorS/G 1 FWA*FI51A1 (Orange) FWA -F33A3 (Purple)S/G 2 FWA*FI33B 1 (Purple) FWA -F51 B3 (Orange)I/G 3 FWA*FI33C1 (Purple) FWA -F51 C3 (Orange)S/0 4 FWA*FI51D1 (Orange) FWA -F33D3 (Purple)The SPDS computer point for auxiliary feedwater flow will be lost 30 minutes followingan LOP when the power supply for the plant computer is lost. However, this design configuration-one continuous main control board indicator and one indication via the SPDS/plant computer,total of two per steam generator -was submitted[-o~ the-N!C via "Response to question 420.6"dated January 13, 1984, B 11002. NRC review and approval was obtained with the acceptance ofMP3, SSER 4 Appendix L, "Conformance to Regulatory Guide 1.97," Revision 2. (datedNovember 1985).LCO 3.3.3.6, Table 3.3-10, Item (17), requires 2 OPERABLE reactor vessel water level(heated junction thermocouples -IHJTC) channels. An OPERABLE reactor vessel water levelchannel shall be defined as:1. Four or more total sensors operating.2. At least one of two operating sensors in the upper head.3. At least three of six operating sensors in the upper plenum.MILLSTONE -UNIT 3B 3/4 3-5aAmendment No. :3, :-6, 84, 4-42, 2-1-9,Acknowledged by NRC letter dated 08/25/05 LBDCR 05-MP3-028November 30, 2005INSTRUMENTATIONBASES3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continued)A channel is OPERABLE if four or more sensors, half or more in the upper head regionand half or more in the upper plenum region, are OPERABLE.In the event more than four sensors in a Reactor Vessel Level channel are inoperable,repairs may only be possible during the next refueling outage. This is because the sensors areaccessible only after the missile shield and reactor vessel head are removed. It is not feasible torepair a channel except during a refueling outage when the missile shield and reactor vessel headare removed to refuel the core. If only one channel is inoperable, it should be restored toOPERABLE status in a refueling outage as soon as reasonably possible. If both channels areinoperable, at least one channel shall be restored to OPERABLE status in the nearest refuelingoutage..... The Reactor Coolant System Subcooling Margin Monitor, Core Exit The.rmocouples, andReactor Vessel Water Level instruments are processed by two separate trains of ICC (InadequateCore Cooling) and HJTC (Heated Junction ThennoCouple) processors. The preferred indicationfor these parameters is the Safety Parameter Display System (SPDS) via the non-qualified PPC(Plant Process Computer) but qualified indication is provided in the instrument rack room. When.the PPC data links cease to transmit data, the processors must be reset in order to restore the flowof data to the PPC. During reset, the qualified indication in the instrument rack room is lost.These instruments are OPERABLE during this reset since the indication is only brieflyinterrupted while the processors reset and the indication is promptly restored. The sensors are notremoved from service during this reset. The train should be considered inoperable only if thequalified indication fails to be restored following reset. Except for the non-qualified PPC display,the instruments operate as required.3/4.3.3.7 DELETED3/4.3.3.8 DELETED3/4.3.3.9 DELETED3/4.3.3.10 DELETED3/4.3.4 DELETEDMILLSTONE -UN4IT 3 B 3/4 3-6 Amendment No. 4-8%, 9-3,-24-9,Acknowledged by NRC Letter dated 04/12/06 REVERSE OF PAGE B 3/4 3-6INTENTIONALLY LEFT BLANK 0 LBDCR No. 04-MP3-015February 24, 2005INSTRUMENTATION.. BASES3/4.3.5 SHUJTDOWN MARGIN MONITORThe Shutdown Margin Monitors provide an alarm that a Boron Dilution Event may be inprogress. The minimum count rate of Specification 3/4.3.5 and the SHUTDOWN MARGINrequirements specified in the CORE OPERATING LIMITS REPORT for MODE 3, MODE 4 andMODE 5 ensure that at least 15 minutes are available for operator action from the time of the "Shutdown Margin Monitor alarm to total loss of SHUTDOWN MARGIN. By borating anadditional 1:50 ppm above the SHUTDOWN MARGIN specified in the CORE OPERATINGLIMITS REPORT for MODE 3 or 350 ppm above the SHUTDOWN MARGIN specified in theCORE OPERATING LIMITS REPORT for MODE 4, MODE 5 With RCS loops filled, or MODE5 with RCS loops not filled, lower values of minimum count rate are accepted.Shutdown Margin Monitors

Background:

The purpose of the Shutdown Margin Monitors (SMM) is-to annunciate an increase in coresubcritical multiplication allowing the operator at least 15 minutes response time to mitigate theconsequences of the inadvertent addition of unborated primary grade water (boron dilution event)into the Reactor Coolant System (RCS) when the reactor is shut down (MODES 3, 4, and 5).* The SMMs utilizes two channels of source range instrumentation (GM detectors). Each channel.provides a signal to its applicable train of SMM. The SMM channel uses the last 600 or morecounts to calculate the count rate and updates the measurement after 30 new counts or 1* Second,whichever is longer. Each channel has 20 registers that hold the counts (20 registers X 30 count=600 counts) for averaging the rate. As the .cduiit rate decreasges, the ldiigei- it takes t6 fIl theregisters (fill the 30 count minimum). As the instrume~n.t's measured count rate decreases, thedelay time in thie instrument's response increases. This delay time leads to the requirement of aminimum count rate for OPERABILITY.During the dilution event, count rate will increase to. a level above the normal steady state countrate. When this new count rate level increases above, the. instrument's setpoint, .the channel willalarm alerting the operator of the event.Applicable Safety AnalysisThe SMM senses abnormal increases in the source range count per second and alarms theoperator of an inadvertent dilution event. This alarm will occur at least 15 minutes prior to thereactor achieving criticality. This 15 minute window allows adequate operator response time toterminate the dilution, FSAR Section 15.4.6.LCOLCO 3.3.5 providesthe requirements for OPERABILITY -of the instrumentation of the SMMsthat are used to mitigate the boron dilution event. Two trains are required to be OPERABLE toprovide protection against single failure.* MILLSTONE -UN4IT 3 B 3/4 3-7 Amendment No. 64, 217T-,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015February 24, 2005BASES (continued)Applicability 9The SMM must be OPERABLE in MODES 3, 4, and 5 because the safety analysis identifies thissystem as the primary means to alert the operator and mitigate the event. The SMMs are allowed*to be blocked during start up activities in MODE 3 in accordance with approved plant procedures.The alarm is blocked to allow the SMM channels to be used to monitor the 1/M approach tocriticality.The SMM are not required to be OPERABLE in MODES 1 and 2 as other RPS is credited withaccident mitigation, over temperature delta temperature and power range neutron flux high (lowsetpoint of 25 percent RTP) respectively. The SMMs are not required to be OPERABLE inMODE 6 as the dilution event is precluded by administrative controls over all dilution flow paths(Technical Specification 4.1.1.2.2).ACTIONS*Channel inoperability of the SMMs can be caused by failure of the channel's electronics, failureof the channel to pass its calibration procedure, or by the channel's count rate falling below theminimum count rate for OPERABILITY. This can occur when the count rate is so low that the ]channel's delay time is in excess of that assumed in the safety analysis. In any of the aboveconditions, the channel must be declared inoperable and the appropriate ACTION statemententered. If the SMMs are declared inoperable due to low count rates, an RCS heatup will causethe SMM channel count rate to increase to above the minimum count rate for OPERCABILITY. I Allowing the plant to increase modes will actually return the SMMs to OPERABLE status. Oncethe SMM channels are above the minimum count rate for OPERABILITY, the channels can~bedeclared OPERABLE and the LCO ACTION statements can be exited-.LCO 3.3.5, ACTION a. -With one train of SMM inoperable, ACTION a. requires the inoperabletrain to be returned to OPERABLE status within 48 hours. In this condition, the remaining SMMtrain is adequate to provide protection. If the above required ACTION cannot be met, alternatecompensatory actions must be performed to provide adequate protection from the boron dilution.event. All operations involving positive reactivity changes associated with RCS dilutions and rod~withdrawal must be suspended, and all dilution flowpaths must be closed and secured in position(locked closed per Technical Specification 4.1.1.2.2) within the following 4 hours.LCO 3.3.5, ACTION b. -With both trains of SMM inoperable, alternate protection must beprovided:1. Positive reactivity operations via dilutions and rod withdrawal are suspended. The intentof this ACTION is to stop any planned dilutions of the RCS. The SMMs are not intendedto monitor core reactivity during RCS temperature changes. The alarm setpoint isroutinely reset during the plant heatup due to the increasing count rate. During cooldownsas the count rate, decreases, baseline count rates are continually lowered automatically bythe SMMs. The Millstone Unit No. 3 boron dilution. analysis assumes.steady state RCStemperature conditions.MILLSTONE -UNIT 3 B 3/4 3-8 Amendment No. 4-164,Acknowledged by NRC letter dated 08/25/05 LBDCR 12-MP3-010September 20, 2012INSTRUMENTATION3/4.3.5 SHUTDOWN MARGIN MONITORBASES (continued)Required ACTION b. is modified by a Note which permits plant temperature changesprovided the temperature change is accounted for in the calculated SDM. Introduction oftemperature changes, including temperature increases when a positive MTC exists, mustbe evaluated to ensure they do not result in a loss of required SDM.2. All dilution flowpaths are isolated and placed under admninistrativye control (lockedclosed). This action provides redundant protection and defense in depth (safety overlap) tothe SMMs. In1 this configuration, a boron dilution event (BDE) cannot occur. This is thebasis for not having to analyze for BDE in MODE 6. Since the BDE cannot occur with thedilution flow paths isolated, the SMMs are not required to be OPERABLE as the eventcannot occur and OPERABLE SMMs provide no benefit.3. Increase the SIIUTDOWN MARGIN surveillance frequency fi-om the frequencyspecified in the Surveillance Frequency Control Program to every 12 hours. This action incombination with the above, provide defense in depth and overlap to the loss of theSMMs.Surveillance RequirementsThe SMMs are subject to an ANALOG CHANNEL OPERATIONAL TEST to ensure each trainof SMM is fully operational. This test shall include verification that the SMvfls are set per theCORE OPERATING LIMITS REPORT. The surveillance fr'equency is controlled under theSurveillance Frequency Control Program.MILLSTONE-UNIT3B 3/4 3-9MILLSONE -UMT B 31 3-9Amendmnent No. 4-64, 2. REVERSE OF PAGE B 314 3-9INTENTIONALLY LEFT BLANK LBDCR No. 06-MP3-005May 25, 20063/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.1 REACTOR COOLANT LOOPS AND COOLANT CIRCULATIONThe purpose of Specification 3.4.1.1 is to require adequate forced flow rate for core heatremoval in MODES 1 and 2 during all normal operations and anticipated transients. Flow isrepresented by the number of reactor coolant pumps in operation for removal of heat by the steamgenerators. To meet safety analysis acceptance criteria for DNB, four reactor coolant pumps arerequired at rated power. An OPERABLE reactor coolant ioop consists of an OPERABLE reactorcoolant pump in operation providing forced flow for heat transport and an OPERABLE steamgenerator. With less than the required reactor coolant loops in operation this specificationrequires that the plant be in at least HOT STANDBY within 6 hours.In MODE 3, three reactor coolant loops, and in MODE 4, two reactor coolant loopsprovide sufficient heat removal capability for removing core decay heat even in the event of abank withdrawal accident; however, in MODE 3 a single reactor coolant loop provides sufficientheat removal capacity~if a bank withdrawal accident can be prevented, i.e., the Control Rod DriveSystem is not capable of rod withdrawal.In MODE 4, if a bank withdrawal accident can be prevented, a single reactor coolant loopor RHR loop provides sufficient heat removal capability for removing decay heat; but singlefailure considerations require that at least two loops (any combination of RI-R or RCS) beOPERABLE.In MODE 5, with reactor coolant loops filled, a single RUR loop provides sufficient heatremoval capability for removing decay heat; but single failure considerations require that at leasttwo RIIR loops or at least one RIHR loop and two steam generators be OPERABLE.In MODE 5 with reactor coolant loops not filled, a single RHR loop provides sufficientheat removal capability for removing decay heat; but single failure considerations, and theunavailability of the steam generators as a heat removing component, require that at least twoRHR loops be OPERABLE.In MODE 5, during a planned heatup to MODE 4 with all RAIR loops removed fromoperation, an RCS loop, OPERABLE and in operation, meets the requirements of an OPERABLEand operating RI-R loop to circulate reactor coolant. During the heatup there is no requirementfor heat removal capability so the OPERABLE and operating RCS loop meets all of the requiredfunctions for the heatup condition. Since failure of the RCS loop, which is OPERABLE andoperating, could also cause the associated steam generator to be inoperable, the associated steamgenerator cannot be used as one of the steam generators used to meet the requirement of LCO3.4.1l.4.1.b.MILLSTONE -UNIT 3B 3/4 4-1MILLTONE- UNT 3 3/44-1 Amendment No. 60, gO, 99, 4-5--5, -7, 2-t--7, LBDCR No. 04-MP3-015February 24, 20053/4.4 REACTOR COOLANT SYSTEMBASES (Continued)The operation of one reactor coolant pump (RCP) or one RH-R pump provides adequateflow to ensure mixing, prevent stratification and produce gradual reactivity changes during boronconcentration reductions in the Reactor Coolant System. The reactivity change rate associatedwith boron reduction will, therefore, be within the capability of operator recognition and control.The restrictions on starting the first RCP in MODE 4 below the cold overpressureprotection enable temperature (226°F), and in MODE 5 are provided to prevent RCS pressuretransients. These transients, energy additions due to the differential temperature between thesteam generator secondary side and the RCS, can result in pressure excursions which couldchallenge the PIT limits. The RCS will be protected against overpressure transients and will notexceed the reactor vessel isothermal beitline PIT limit by restricting RCP starts based on thedifferential water temperature between the secondary side of each steam generator and the RCScold legs. The restrictions on starting the first RCP only apply to RCPs in RCS loops that are notisolated. The restoration of isolated RCS loops is normally accomplished with all RCPs secured.If an isolated RCS loop is to be restored when an RCP is operating,. the appropriate temperaturedifferential limit between the secondary side of the isolated loop steam generator and the inservice RCS cold legs is applicable, and shall be met prior to opening the loop isolation valves.The temperature differential limit between the secondary side of the steam generators andthe RCS cold legs is based on the equipment providing cold overpressure protection as requiredby Technical Specification 3.4.9.3. If the pressurizer PORVs are providing cold overpressureprotection, the steam generator secondary to RCS cold leg water temperature differential islimited to a maximum of 50°F. If any P1-R relief valve is providing cold overpressure protectionand RCS cold leg temperature is above 150OT, the steam generator secondary water temperaturemust be at or below RCS cold leg water temperature. If any RHJR relief valve is providing coldoverpressure protection and RCS cold leg temperature is at or below 1500'F, the steam generatorsecondary to RCS cold leg water temperature differential is limited to a maximum of 50°F.Specification 3.4.1.5The reactor coolant loops are equipped with loop stop valves that permit any loop to beisolated from the reactor vessel. One valve is installed on each hot leg and one on each cold leg.The loop stop valves are used to perform maintenance on an isolated loop. Operation in MODES1-4 with a RCS loop stop valve closed is not permitted except for the mitigation of emergency orabnormal events. If a loop stop valve is closed for any reason, the required ACTIONS of thisspecification must be completed. To ensure that inadvertent closure of a loop stop valve does notoccur, the valves must be open with power to the valve operators removed in MODES 1, 2, 3 and4.MILLSTONE -UNIT 3 B 3/4 4-la Amendment No. 60, :7O, 9-9, .447, 4-9-7, 20-2,,2--7, j Acknowledged by NRC letter dated 08/25/05 W LBDCR 12-MP3-0i0September 20, 20123/4.4 REACTOR COOLANT SYSTEMBASESThe safety analyses performed for the reactor at power assume that all reactor coolantloops are initially in operation and the loop stop valves are open. This LCO places controls on theloop stop valves to ensure that the valves are not inadvertently closed in MODES 1, 2, 3 and 4.The inadvertent closure of a loop stop valve when the Reactor Coolant Pumps (RCPs) areoperating will result in a partial loss of forced reactor coolant flow. If the reactor is at rated powerat the time of the event, the effect of the partial loss of forced coolant flow is a rapid increase inthe coolant temperature which could result in DNB with subsequent fuel damage if the reactor isnot tripped by the Low Flow reactor trip. If the reactor is shutdown and a RCS loop is in operationremoving decay heat, closure of the loop stop valve associated with the operating ioop could alsoresult in increasing coolant temperature and the possibility of fuel damage.The loop stop valves have motor operators. If power is inadvertently restored to one ormore loop stop valve operators, the potential exists for accidental closure of the affected loop stopvalve(s) and the partial loss of forced reactor coolant flow. With power applied to a valveoperator, only the interlocks prevent the valve from being operated. Although operatingprocedures and interlocks make the occurrence of this event unlikely, the prudent action is toremove power from the loop stop valve operators. The time period of 30 mninutes to removepower from the loop stop valve operators is sufficient considering the complexity of the task.Should a loop stop valve be closed in MODES 1 through 4, the affected valve must bemaintained closed and the plant placed in MODE 5. Once in MODE 5, the isolated loop may bestarted in a controlled manner in accordance with LCO 3.4.1.6, "Reactor Coolant System IsolatedLoop Star'tup." Opening the closed loop stop valve in MODES 1 tin'ough 4 could result in colderwater or water at a loweriboron concentration being mixed with the operating RCS loops resultingin positive reactivity insertion. The time period provided in ACTION 3.4.1.5 .b allows time forborating the operating loops to a shutdown boration level such that the plant can be brought toMODE 3 within 6 hours and MODE 5 within 30 hours. The allowed ACTION times arereasonable, based on operating experience, to reach the required plant conditions from full powerconditions in an orderly manner and without challenging plant systems.Surveillance Requirement 4.4.1.5 is perforned to ensure that the RCS loop stop valves areopen, with power removed from the loop stop valve operators. The primamyr function of thisSurveillance is to ensure that power is removed from the valve operators, since SurveillanceRequirement 4.4.1.1 requires verification that all loops are operating and circulating reactorcoolant, thereby ensuring that the loop stop valves are open. The frequency specified in theSurveillance Frequency Control Program ensures that the required flow is available. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3MILSTOE -UNI 3B 3/4 4-lb Amnendlnent No. 60, 7-0, 9-, 1-7,4-9-7-,-202,2-1 LBDCR No. 05-MVP3-026October 19, 20053/4.4 REACTOR COOLANT SYSTEMBASES (Continued)Specification 3.4.1.6The requirement to maintain the isolated loop stop valves shut with power removedensures that no reactivity addition to the core could occur due to the startup of an isolated loop.Verification of the boron concentration in an isolated loop prior to opening the first stop valveprovides a reassurance of the adequacy of the boron concentration in the isolated loop.RCS Loops FilledINot Filled:In MODE 5, any RHR train with only one cold leg injection path is sufficient to provideadequate core cooling and prevent stratification of boron in the Reactor Coolant System.The definition of OPERABILITY states that the system or subsystem must be capable ofperforming its specified function(s). The reason for the operation of one reactor coolant pump(RCP) or .one RHR pump is to:* Provide sufficient decay heat removal capability* Provide adequate flow to ensure mnixing to:* Prevent stratification* Produce gradual reactivity changes due to boron concentration changes in theRCSThe definition of "Reactor coolant loops filled" includes a ioop that is filled, swept, andvented, and capable of supporting natural circulation heat transfer. This allows the non-operatingRHR loop to be removed from service while filling and unisolating loops as long as steamgenerators on the OPERABLE reactor coolant loops are available to support decay heat removal.Any loop being unisolated is not OPERABLE until the ioop has been swept and vented. Theprocess of sweep and vent will make the previously OPERABLE loops finoperable and therequirements of LCO 3.4.1.4.2, "Reactor Coolant System,.COLD SI{UTDOWN -Loops NotFilled," are applicable. When the RCS has been filled, swept and vented using an approvedprocedure, all unisolated loops may be declared OPERABLE.The definition of "Reactor coolant loops filled" also includes a ioop that has been vacuum [filled and capable of supporting natural circulation heat transfer. Any isolated loop that has been Ivacuum filled is OPERABLE as soon as the loop is unisolated.One cold leg injection isolation valve on an RI-R train may be closed without consideringthe train to be inoperable, as long as the following conditions exist:* CCP temperature is at or below 950F* Initial RUR temperature is below 1 84°FMILLSTONE -UNIT 3 B 3/4 4-ic Amendmnent No. ;2-4-7,Acknowledged by NRC Letter dated 04/12/06 LBDCR No._08-MP3-014October 21, 20083/4.4 REACTOR COOLANT SYSTEMBASES (Continued)* The single RI-R cold leg injection flow path is no_! utilized until a minimum of 48hours after reactor shutdown* CCP flow is at least 6,600 gpm* RHR flow is at least 2,000 gpmIn the above system lineup, total flow to the core is decreased compared to the flow whentwo cold legs are in service. This is acceptable due to the substantial margin between the flowrequired for cooling and the flow available, even through a slightly restricted R.HR train.The review concerning boron stratification with the utilization of the single injection pointline, indicates there will not be a significant change in the flow rate or distribution through thecore, so there is not an increased concern due to stratification.Flow velocity, which is high, is not a concern from a flow erosion or pipe loadingstandpoint. There are no loads imposed on the piping system which would exceed thoseexperienced in a seismic event. The temperature of the fluid is low and is not significant from aflow erosion standpoint.The boron dilution accident analysis, for Millstone Unit 3 in MODE 5, assumes a fullRHR System flow of approximately 4,000 gpm. Westinghouse analysis, Reference (1), for RHRflows down to 1,000 gpm, determined adequate mixing results. As the configuration will result ina R}IR flow rate only slightly less then 4,000 gpm:-here-is no concern in regards to a borondilution accident.The basis for the requirement of two RCS loops OPERABLE is~to provide naturalcirculation heat sink in the event the operating RHR loop is lost. If the RI-R loop were lost, withtwo loops filled and two loops air bound, natural circulation would be established in the two filledloops.Natural circulation would not be established in the air bound loops. Since there would beno circulation in the air bound loops, there would be no mechanism for the air in those loops to becarried to the vessel, and subsequently into the filled loops rendering them inoperable for heatsink requirements.The LCO is met as long as at least two reactor coolant loops are OPERABLE and thefollowing conditions are satisfied:* One RI-R loop is OPERABLE and in operation, with exceptions as allowed inTechnical Specifications; andMILLSTONE -UNIT 3B3/4-dAemntN.2,B 3/4 4-1dAmendment No. g-t-7-, LBDCR. 04-MP3-001December 10, 20033/4.4 REACTOR COOLANT SYSTEMBASES (Continued)Either of the following:o An additional RHR loop OPERABLE, with exceptions as allowed in TechnicalSpecifications; or* The secondary side water level of at least two steam generators shall be greater than .17% (These are assumed to be on OPERABLE reactor coolant loops)When the reactor coolant loops are swept, the mechanism exists for air to be carried intopreviously OPERABLE loops. All previously OPERABLE loops are declared inoperable and anadditional RIIR loop is required OPERABLE as specified by LCO 3.4.1.4.2 for loops not filled.When the RCS has been filled, swept, and vented using an approved procedure, all unisolatedloops may be declared OPERABLE.ISOLATED LOOP STARTUPThe below requirements are for unisolating a loop with all four loops isolated while decayheat is being removed by RIIR and to clarify, prerequisites to meet T/S requirements forunisolating a loop at any time.With no RCS loops operating, the two RHR loops referenced in Specification 3.4.1.4.2 arethe operating loops. Starting in MODE 4 as referenced in Specification 3.4.1.3, the RHR loopsare allowed to be used in place of an operating R CS loop:. Specification 3.4.1.4.2 requires twoRH{R loops OPERABLE and at least one in operation. Ensuring the isolated cold leg temperatureis within 20°F of the highest RHR outlet temperature for the operating RHR loops within 30minutes prior to opening the cold leg stop valve is a conservative approach since the majorconcern is a positive reactivity addition.SR 4.4.1.6.1 : When in MODE 5 with all RCS loops isolated, the two RH-R loopsreferenced in LCO 3.4.1.4.2 shall be considered the OPERABLE RCS loops. The isolated loopcold leg temperature shall be determined to be within 20°F of the highest RHR outlet temperaturefor the operating RHR loops within 30 minutes prior to opening the cold leg stop valve.Surveillance requirement 4.4.1.6.2 is met when the following actions occur within 2 hoursprior to opening the cold leg or hot leg stop valve:* An RCS boron sample has been taken and analyzed to determine current boronconcentration* The SHUTDOWN MARGIN has been determined using OP 3209B, "ShutdownMargin" using the current boron concentration determined aboveMILLSTONE -UNIT 3 B 3/4 4-1le Amendment No. 2-1-7,Acknowledged by NRC Letter dated 04/12/06 LBDCR 12-MiP3-010September 20, 20123/4.4 REACTOR COOLANT SYSTEMBASES (continued)*For the isolated loop being restored, the power to both loop stop valves has beenrestoredSurveillance 4.4.1.6.2 indicates that the reactor shall be determined subcritical by at leastthe amount required by Specifications 3.1.1.1.2 or 3.1.1.2 for MODE 5 or Specification 3.9.1.1for MODE 6 within 2 hours of opening the cold leg or hot leg stop valve.The SHUTDOWN MvARGIN requirement in Specification 3.1.1.1.2 is specified in theCORE OPERATING LIMITS REPORT for MODE 5 with RCS loops filled. Specification3.1.1.1.2 cannot be used to determine the required SHUTDOWN MARGIN for MODE 5 loopsisolated condition.Specification 3.1.1.2 requires the SHUTDOWN MARGIN to be greater than or equal tothe limits specified in the CORE OPERATING LIMITS REPORT for MODE 5 with RCS loopsnot filled provided CVCS is aligned to preclude boron dilution. This specification is for loops notfilled and therefore is applicable to an all loops isolated condition.Specification 3.9.1.1 requires Keff of 0.95 or less, or a boron concentration of greater thanor equal to the limit specified in the COLR in MODE 6.Specification 3.1.1.1.2 or 3.1.1.2 for MODE 5, both require boron concentration to bedetennined at the frequency specified in the Surveillance Frequency Control Program.SR 4.1.1.1.2.1 .b.2 and 4.1.1 .2.1.b.1 satisfy the requirements of Specifications 3.1.1.1.2 and 3.1.1.2respectfully. Specification 3.9.1.1 for MODE 6 requires boron concentration to be determined atthe frequency specified in the Surveillance Frequency Control Program. S.R. 4.9..1.1.2 satisfy therequirements of Specification 3.9.1.1.Per Specifications 3.4.1.2, ACTION c.; 3.4.1.3, ACTION c.; 3.4.1.4.1, ACTION b.; and3.4.1.4.2, ACTION b., suspending the introductiorn of coolant into the RCS of coolant with boronconcentr~iion less than required to meet the minimum SDM of LCO 3.1.1.1.2 is required to assurecontinued safe operation. With coolant added without forced circulation, unmrixed coolant couldbe introduced to the core, however, coolant added with boron concentration meeting theminimum SDM maintains acceptable margin to subcritical operations.

References:

1. Letter NEU-94-623, dated July 13, 1994; Mixing Evaluation for Boron DilutionAccident in Modes 4 and 5, Westinghouse HR-5 9782.2. Memo No. MP3-E-93-821, dated October 7, 1993.MILLSTONE -UNIT 3B 3/4 4-1fMILSTOE -UNT 3B 34 4ifAmendment No. 2-3g.

REVERSE OF PAGE B 3/4 4-ifINTENTIONALLY LEFT BLANK LBDCR No. 07-MP3-009June 19, 2007REACTOR COOLANT SYSTEMBASES314.4.2 SAFETY VALVESThe pressurizer Code safety valves operate to prevent the RCS from being pressurizedabove its Safety Limit of 2750 psia. Each safety valve is designed to relieve 420,000 lbs per hourof saturated steam at the valve Setpoint. The relief capacity of a single safety valve is adequate torelieve any overpressure condition which could occur during shutdown. If any pressurizer Codesafety valve is inoperable, and cannot be restored to OPERABLE status, the ACTION statementrequires the plant to be shut down and cooled down such that Technical Specification 3.4.9.3 willbecome applicable and require cold overpressure protection to be placed in service.During operation, all pressurizer Code safety valves must be OPERABLE to prevent theRCS firom being pressurized above its Safety Limit of 2750 psia. The combined relief capacity ofall of these valves is greater than the maximaum surge rate resulting from a complete loss-of-loadassuming no Reactor trip until the first Reactor Trip System Trip Setpoint is reached (i.e., nocredit is taken for a direct Reactor trip on the loss-of-load) and also assuming no operation of thepower-operated relief valves or steam dump valves.Demonstration of the safety valves' lift settings will occur only during shutdown and willbe performed in accordance with the provisions of the ASME Code for Operation andMaintenance of Nuclear Power Plants.3/4.4.3 PRESSURIZERTh~e pressurizer provides a point in the RCS when liquid and vapor are maintained inequilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in theremainder of the RCS. Key functions include maintaining required primatyr system pressureduring steady state operation and limiting the pressure changes caused by reactor. coolant thermalexpansion and contraction during load transients.MODES 1 AND 2The requirement for the pressurizer to be OPERABLE, with pressurizer level maintainedat pro granmmed level within 4- 6% of full scale is consistent with the accident analysis in Chapter15 of the FSAR. The accident analysis assumes that pressurizer level is being maintained at theprogrammed level by the automatic control system, and when in manual control, similar limits areestablished. The progralmmed level ensures the capability to establish and maintain pressurecontrol for steady state operation and to minimize the consequences of potential overpres sure andpressurizer overfill transients. A pressurizer level control error based upon automatic level controlhas been taken into account for those transients where pressurizer overfill is a concern (e.g., lossof feedwater, feedwater line break, and inadvertent ECCS actuation at power). When in manualcontrol, the goal is to maintain pressurizer level at the program level value. The +/-- 6% of full scaleacceptance criterion in the Technical Specification establishes a band for operation toaccommnodate variations between level measurements. This value is bounded by the marginapplied to the pressurizer overfill events.MILLSTONE -UNIT 3B 3/4 4-2MILLTON -NIT3 B3/44-2Amendment No. -!-60, 4-9-7-, LBDCR 12-MP3-010September 20, 2012REACTOR COOLANT SYSTEMBASES3/4.4.3 PRESSURIZER ('continued)The periodic surveillances require that pressurizer level be maintained at programmedlevel within =k 6% of full scale. The surveillance is performed by observing the indicated level.The surveillance frequency is controlled under the Surveillance Frequency Control Program.During transitory conditions, i.e., power changes, the operators will maintain progralmmed level,and deviations greater than 6% will be corrected within 2 hours. Two hours has been selected forpressurizer level restoration after a transient to avoid an unnecessary downpower with pressurizerlevel outside the operating brand. Nonnally, alarms are also available for early detection ofabnormal level indications.Electrical itmmersion heaters, located in the lower section of the pressurizer vessel, keepthe water in the pressurizer at saturation temperature and maintain a constant operating pressure.A minimumn required available capacity of pressurizer heaters ensures that the RCS pressure canbe maintained. The capability to maintain and control system pressure is important formaintaining subcooled conditions in the RCS and ensuring the capability to remove core decayheat by either forced or natural circulation of the reactor coolant. Unless adequate heater capacityis available, the hot high-pressure condition cannot be maintained indefinitely and still providethe required subcooling margin in the primary system. Inability to control the system pressure andmaintain subcooling under conditions of natural circulation flow in the primary system could leadto a loss of single-phase natural circulation and decreased capability to remove core decay heat.The LCO requires 'two groups of OPERABLE pressurizer heaters, each with a capacity ofat least 175 kW. The heaters are capable of being powered from either the offsite power source orthe emergency power supply. The minimum heater capacity required is sufficient to maintain theRCS near normal operating pressure when accounting for heat losses thraough the pressurizerinsulation. By maintaining the pressure near" the operating conditions, a wide margin tosubcooling can be obtained in the loops. The requirement for two groups of pressurizer heaters,each having a capacity of 175 kW, is met by verifying the capacity of the pressurizer heatergroups A and B. Since the pressurizer heater groups A and B are supplied from the emergency480V electrical buses, there is reasonable assurance that these heaters can be energized during aloss of offsite power to maintain natural circulation at HOT STANhDBY. Providing an emergency(Class 1EB) power source for the required pressurizer heaters meets the requirement of NUREG-0737, "A Clarification of TMI Action Plan Requirements," II.E.3.1, "Emergency PowerRequirements for Pressurizer Heaters."If one required group of pressurizer heaters is inoperable, restoration is required within72 hours. The Completion Time of 72 hours is reasonable considering that a demand caused byloss of offsite power would be unlikely in this time period. Pressure control may be maintainedduring this time using normal station powered heaters.MODE 3The requirement for the pressurizer to be OPERABLE, with a level less than or equal to89%, ensures that a steam bubble exists. The 89% level preserves the steam space for pressurecontrol. The 89% level has been established to ensure the capability to establish and maintainpressure control for MODE 3 and to ensure a bubble is present in the pressurizer. Initialpressurizer level is not significant for those events analyzed for MODE 3 in Chapter 15 of theFSAR.MILLSTONE -UNIT 3B 3/4 4-2aMILLTON -NIT B /4 -2aAmendment No. 60, !-0 LBDCR 12-MP3-010September 20, 2012.REACTOR COOLANT SYSTEMO BASES3/4.4.3 PRESSURIZER (cont'd.)The periodic surveillance requires that during MODE 3 operation, pressurizer level ismaintained below the nominal upper limit to provide a minimum space for a steam bubble. Thesurveillance is performed by observing the indicated level. The surveillance frequency iscontrolled under the Surveillance Frequency Control Program. Alarms are also available for earlydetection of abnormal level indications.The basis for the pressurizer heater requirements is identical to MODES 1 and 2.3/4.4.4 RELIEF VALVESThe power-operated relief valves (PORVs) and steam bubble function to relieve RCSpressure during all design transients up to and including the design step load decrease with steamdump. Operation of the PORVs minimizes the undesirable opening of the spring-loadedpressurizer Code safety valves. Each PORV has a remotely operated block valve to provide apositive shutoff capability should a relief valve become inoperable. Requiring the PORVs to beOPERABLE ensures that the capability for depressurization during safety grade cold shutdown ismet.ACTION statements a, b, and c distinguishes the inoperability of the power operated relief valves! (ORV). Specifically, a PORV mybe designated inoperable but it mybe able to automatically*and manually open and close and therefore, able to perform its function. PORV inoperability maybe due to seat leakage which does not prevent automatic or manual use and does not create thepossibility for a small-break LOCA. For these reasons, the block valve may be closed but theaction requires power to be maintained to the valve. This allows quick access to the PORV forpressure control. On the other hand if a PORV is inoperable and not capable of beingautomatically and manually cycled, it must be either restored or isolated by closing the associatedblock valve and removing power.Note: PORV position indication does not affect the ability of the PORV to perform any of itssafety functions. Therefore, the failure of PORV position indication does not cause the PORV tobe inoperable. However, failed position indication of these valves must be restored "as soon aspracticable" as required by Technical Specification 6.8.4.e.3.Automatic operation of the PORVs is created to allow more time for operators to terminate anInadvertent ECCS Actuation at Power. The PORVs and associated piping have been demonstratedto be qualified for water relief. Operation of the PORVs will prevent water relief fr'om thepressurizer safety valves for which qualification for water relief has not been demonstrated. If thePORVs are capable of automatic operation but have been declared inoperable, closure of thePORV block valve is acceptable since the Emergency Operating Procedures provide guidance toassure that the PORVs would be available to mitigate the event. OPERABILITY and setpointcontrols for the safety grade PORV opening logic are maintained in the Technical RequirementsManual..MILLSTONE -UNIT 3 B 3/4 4-2b Amendment No. 4-10, 4-4-1 LBDCR No. 14-MP3-014September 18, 2014REACTRCOLNESSE0BASESRELIEF VALVES (Continued)The prime importan~ce for the capability to close the block valve is to isolate a stuck-open FORM.Therefore, if the block valve(s) cannot be restored to OPERABLE status within 1 hour, theremedial action is to place the PORV in manual control (i.e., the control switch in the "CLOSE"position) to preclude its automatic opening for an overpressure event and to avoid the potential ofa stuck-open PORV at a time that the block valve is inoperable. The time allowed to restore theblock valve(s) to OPERABLE status is based upon. the remedial action time limits for inoperablePORV per ACTION requirements b. and c. ACTION statement d. does not specify closure of theblock valves because such action would not likely be possible when the block valve is inoperable.For the same reasons, reference is not made to ACTION statements b. and c. for the requiredremedial actions.SURVEILLANCE REQUIREMENT 4.4.4.2 verifies that a block valve(s) can be opened orclosed if necessary. This SURVEILLANCE REQUIREMENT is not required to be perform~edwith the block valve(s) closed in accordance with the ACTIONS of TS 3.4.4. Opening the blockvalve(s) in this condition increases the risk of an unisolable leak from the RCS since the PORV(s)is already inoperable.MILLSTONE -UNIT 3B 3/4 4-2cAmendment No. gg, 4-10, 61-,Acknowledged by NRC letter dated 08/28/15 LBDCR No. 12-MP3-007June 26, 2012REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITYLCOThe LCO requires that steam generator (SG) tube integrity be maintained. The LCO also requiresthat all SG tubes that satisfy the plugging criteria be plugged in accordance with the SteamGenerator Program.During a SG inspection, any inspected tube that satisfies the Steam Generator Program pluggingcriteria is removed from service by plugging. If a tube was determined to satisfy the pluggingcriteria but was not plugged, the tube may still have tube integrity.In the context of this Specification, a SG tube is defined as the entire length of the tube, includingthe tube wall between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weldat the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performancecriteria are defined in Specification 6.8.4.g, "Steam Generator Program," and describe acceptableSG tube performance. The Steam Generator Program also provides the evaluation process fordetermining conformance with the SG performance criteria. There are three SG performancecriteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure tomeet any one of these criteria is considered failure to meet the LCO.The structural integrity performance criterion provides a margin of safety against tube burst orcollapse under normal and accident conditions, and ensures structural integrity of the SG tubesunder all anticipated transients included in the design specification. Ttibe burst is defined as, "Thegross structural failure of the tube wall. The condition typically corresponds to an unstableopening displacement (e.g., opening area increased in response to constant pressure) accompaniedby ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse isdefined as, "For the load displacement curve for a given structure, collapse occurs at the top of theload versus displacement curve where the slope of the curve becomes zero." The structuralintegrity performance criterion provides guidance on assessing loads that have a significant effecton burst or collapse. In that context, the term "significant" is defined as "An accident loadingcondition other than differential pressure is considered significant when the addition of such loadsin the assessment of the structural integrity performance criterion could cause a lower structurallimit or limiting burst/collapse condition to be established." For tube integrity evaluations, exceptfor circumferential degradation, axial thermal loads are classified as secondary loads. Forcircumferential degradation, the classification of axial thermal loads as primary or secondaryloads will be evaluated on a case-by-case basis. The division between primary and secondaryclassifications will be based on detailed analysis and/or testing.MILLSTONE -UNIT 3B3/4-AmnetNoB 3/4 4-3Amendment No. LBDCR No. 06-MP3-005May 25, 2006REACTOR COOLANT SYSTEMBASES.° 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)* Structural integrity requires that the primary membrane stress intensity in a tube not exceed the* yield strength for all ASME Code, Section III, Service Level A (normal operating conditions) andService Level B (upset or abnormal conditions) transients included in the design specification.This includes safety factors and applicable design basis loads based on ASMIE Code, Section III,* Subsection NB (Ref. 4).and Draft Regulatory Guide 1.121 (Reference 5).The accident induced leakage performance criterion ensures that the primary to secondary.....LE-AKAGE caused by a design basis accident, other than a SGTR, is within the accident analysisassumptions. The accident analysis assumes that accident induced leakage does not exceed 1* gallon per minute or is assumed to increase to 1 gallon per minute for all steam generators. The: accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the,.-. accident in addition to primary to secondary LEAKAGE induced during the accident..The operational LEAKAGE performance criterion provides an observable indication of SG tubeconditions during plant operation. The limit on operational LEAKAGE is contained in RCS LCO3.4.6.2, "Operational Leakage," and limits primary to secondary LEAKAGE through any one SG* .to 150 gallons per day. This limit is based on the assumption that a single crack leaking this* amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steamline break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small,r .. and the above assumption is conservative.* APPLICABILITYSteam generator tube integrity is challenged when the pressure differential across the tubes is* large. Large differential pressures across SG tubes can only be experienced during MODES 1, 2,3, and 4.* .. RCS conditions are far less challenging during MODES 5 and 6 than during MODES 1, 2, 3, and" 4. During MODES 5 and 6, primary to secondary differential pressure is low, resulting in lowerstresses and reduced potential for LEAKAGE.ACTIONSThe ACTIONS are modified by a NOTE clarifying that the Conditions may be entered* ...independently for each SG tube. This is acceptable because the Required Actions provideappropriate compensatory actions for each affected SG tube. Complying with the RequiredActions may allow for continued operation, and subsequent affected SG tubes are governed bysubsequent Condition entry and application of associated Required Actions.MILLSTONE -UNIT 3 B3443 mnmnoB 3/4 4-3aAmendment No. LBDCR No. 12-MiP3-007June 26, 2012REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued')a.1 and a.2ACTION a. applies if it is discovered that one or more SG tubes examined in an inserviceinspection satisfy the tube plugging criteria but were not plugged in accordance with the SteamGenerator Program as required by SR 4.4.5.2. An evaluation of SG tube integrity of the affectedtube(s) must be made. Steam generator tube integrity is based on meeting the SG performancecriteria described in the Steam Generator Program. The SG plugging criteria define limits on SGtube degradation that allow for flaw growth between inspections while still providing assurancethat the SG performance criteria will continue to be met. In order to determine if a SG tube thatshould have been plugged has tube integrity, an evaluation must be completed that demonstratesthat the SG performance criteria will continue to be met until the next refueling outage or SG tubeinspection. The tube integrity determination is based on the estimated condition of the tube at thetime the situation is discovered and the estimated growth of the degradation prior to the next SGtube inspection. If it is determined that tube integrity is not being maintained, ACTION b. applies.A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk ofplant operation with a SG tube that may not have tube integrity.If the evaluation determines that the affected tube(s) have tube integrity, Required ACTION a.2allows plant operation to continue until the next refueling outage or SG inspection provided theinspection interval continues to be supported by an operational assessment that reflects theaffected tube(s). However, the affected tube(s) must be plugged prior to entering MODE 4following the next refueling outage or SG inspection. This Completion Time is acceptable sinceoperation until the next inspection is supported by the operational assessment.b. I and b.2If the ACTIONS and associated Completion Times of ACTION a. are not met or if SG tubeintegrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours andMODE 5 within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reach thedesired plant conditions from full power conditions in an orderly manner and without challengingplant systems.MILLSTONE -UNIT 3 B3443 mnmn oB 3/4 4-3bAmendment No. LBDCR No. 12-MiP3-007Iune 26, 2012REACTOR COOLANT SYSTEM 'BASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued~)SURVEILLANCE REQUIREMENTSTS 4.4.5.1During shutdown periods the SGs are inspected as required by this SR and the Steam Generator" Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRIGuidelines, establish the content of the Steam Generator Program. Use of the Steam GeneratorProgram ensures that the inspection is appropriate and consistent with accepted industry practices.During SG inspections a condition monitoring assessment of the SG tubes is performed. Thecondition monitoring assessment determines the "as found" condition of the SG tubes. Thepurpose of the condition monitoring assessment is to ensure that the SG performance criteria havebeen met for the previous operating period.The Steam Generator Program determines the scope of the inspection and the methods used todetermine whether the tubes contain flaws satisfying the tube plugging criteria. Inspection scope(i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing andpotential degradation locations. The Steam Generator Program also specifies the inspectionmethods to be used to find potential degradation. Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, andinspection locations.The Steam Generator Program defines the Frequency of TS 4.4.5.1. The Frequency is determinedby the operational assessment and other limits in the SG examination guidelines (Reference 6).The Steam Generator Program uses information on existing degradations and gr'owth rates todetermine an inspection Frequency that provides reasonable assurance that the tubing will meetthe SG performance criteria at the next scheduled inspection. In addition, Specification 6.8.4.gcontains prescriptive requirements concerning inspection intervals to provide added assurancethat the SG performance criteria will be met between scheduled inspections. If crack indicationsare found in any SG tube, the maximum inspection interval for all affected and potentiallyaffected SGs is restricted by Specification 6.8.4.g until subsequent inspections support extendingthe inspection interval.TS 4.4.5.2During a SG inspection, any inspected tube that satisfies the Steam Generator Program pluggingcriteria is removed from service by plugging. The tube plugging criteria delineated inSpecification 6.8.4.g are intended to ensure that tubes accepted for continued service satisfy theS G performance criteria with allowance for error~ in the flaw size measurement and for future flawgrowth. In addition, the tube plugging criteria, in conjunction with other elements of the SteamGenerator Program, ensure that the SG performance criteria will continue to be met until the nextinspection of the subject tube(s). Reference 1 provides guidance for performing operationalMILLSTONE -UNIT 3 B/43 mnmn oB 3/4 4-3cAmendment No. LBDCR No. 12-MIP3-007June 26, 2012REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued~)assessments to verify, that the tubes remaining in service will continue to meet the SGperformance criteria.The Frequency of prior to entering MODE 4 following a SG inspection ensures that theSurveillance has been completed and all tubes meeting the plugging criteria are plugged prior tosubjecting the SG tubes to significant primary to secondary pressure differential.BACKGROUNDSG tubes are small diameter, thin walled tubes that carry primary coolant through the primary tosecondary heat exchangers. The SG tubes have a number of important safety functions. Steamgenerator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such,are relied on to maintain the primary system s pressure and inventory. The SG tubes isolate theradioactive fission products in the primary coolant from the secondary system. In addition, as partof the RCPB, the SG tubes are unique in that they act as the heat transfer surface between theprimary and secondary systems to remove heat from the primary system. This Specificationaddresses only the RCPB integrity function of the SG. The SG heat removal function is addressedby LCO 3.4.1.1, "STARTUP and POWER OPERATION," LCO 3.4.1.2, "HOT STANDBY,"LCO 3.4.1.3, "HOT SI{UTDOWN," and LCO 3.4.1.4.1, "COLD SI{UTDOWN -Loops Filled."SG tube integrity means that the tubes are capable of performing their intended RCPB safetyfunction consistent with the licensing basis, including applicable regulatory requirements.SG tubing is subject to a variety of degradation mechanisms. Steam generator tubes mayexperience tube degradation related to corrosion phenomena, such as wastage, pitting,intergranular attack, and stress corrosion cracking, along with other mechanically inducedphenomena such as denting and wear. These degradation mechanisms can impair tube integrity ifthey are not managed effectively. The SG performance criteria are used to manage SG tubedegradation.Specification 6.8.4.g., "Steam Generator (SG) Program," requires that a program be establishedand implemented to ensure that SG tube integrity is maintained. Pursuant to Specification6.8.4.g., tube integrity is maintained when the SG performance criteria are met. There are threeSG performance criteria: structural integrity, accident induced leakage, and operationalLEAKAGE. The SG performance criteria are described in Specification 6.8.4.g. Meeting the SOperformance criteria provides reasonable assurance of maintaining tube integrity at normal andaccident conditions.The processes used to meet the SG performance criteria are defined by the Steam GeneratorProgram Guidelines (Reference 1).MILLSTONE -UNIT 3 B3443 mnmnoB 3/4 4-3dAmendment No. LBDCR No. 06-MP3-005May 25, 2006REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)APPLICABLE SAFETY ANALYSESThe steam generator tube rupture (SGTR) accident is the limiting design basis event for SG tubesand avoiding an SGTR is the basis for this Specification. The analysis of a SGTR event assumes abounding primary to secondary LEAKAGE rate greater than the operational LEAKAGE ratelimits in RCS LCO 3.4.6.2, "Operational LEAKAGE," plus the leakage rate associated with adouble-ended rupture of a single tube. The accident analysis for a SGTR assumes thecontaminated secondary fluid is released to the atmosphere via safety valves or atmospheric dumpvalves.The analysis for design basis accidents and transients other than a SGTR assume the SG tubesretain their structural integrity (i.e., they are assumed not to rupture.) In these analyses, the steamdischarge to the atmosphere is based on the total primary to secondary LEAKAGE from all S~sof 1 gallon per minute or is assumed to increase to 1 gallon per minute as a result of accidentinduced conditions. For accidents that do not involve fuel damage, the primary coolant activitylevel of DOSE EQUIVALENT 1-131 is assumed to be equal to the RCS LCO 3.4.8, "SpecificActivity" limits. For accidents that assume fuel damage, the primary coolant activity is a functionof the amount of activity released from the damaged fuel. The dose consequences of these eventsare within the limits of GDC 19 (Reference 2), 10 CER 50.67 (Reference 3) or the N-RC approvedlicensing basis (e.g., a small fraction of these limits).Steam Generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).REFERENCES1. NEJ 97-06, "Steam Generator Program Guidelines."2. 10 CFR 50 Appendix A, GDC 19.3. 10OCFR 50.67.4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.*5. Draft Regulatory Guide 1.12 1, "Basis for Plugging Degraded Steam GeneratorTubes," August 1976.6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines."MILLSTONE -UNIT 3B3/43eAenmtNoB 3/4 4-3eAmendment No. LBDCR No. 07-MP3-032August 8, 2007REACTOR COOLANT SYSTEMBAsEs3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.1 LEAKAGE DETECTION SYSTEMSThe RCS Leakage Detection Systems required by this specification are provided to monitor anddetect leakage from the reactor coolant pressure boundary. These Detection Systems areconsistent with the recommendations of Regulatory Guide 1.45, "Reactor Coolant PressureBoundary Leakage Detection Systems," May 1973.ACTION c-provides a 72 hour allowed outage time (AOT) when both the containmentatmosphere particulate radioactivity monitor and the containment drain sump monitoring system,are inoperable. The 72 hour AOT is appropriate since additional actions will be taken during thislimited time period to ensure RCS leakage, in excess of the UNIDENTIFIED LEAKAGE TSlimit of 1 gpm (TS 3.4.6.2), will be readily detectable. This will provide reasonable assurancethat any significant reactor coolant pressure boundary degradation is detected soon afteroccurrence to minimize the potential for propagation to a gross failure. This is consistent with therequirements of General Design Criteria (GDC) 30 and also Criterion 1 of 10 CFR 50.3 6(d)(2)(ii)which requires installed instrumentation to detect, and indicate in the control roo~m, a significantabnormal degradation of the. reactor coolant pressure boundary. The RCS water inventorybalance calculation determines the magnitude of RCS UNIDENTIFIED LEAKAGE by use ofinstrumentation readily available to the control room operators. However, the proposedadditional actions will not restore the continuous monitoring capability normally provided by theinoperable equipment.The RCS water inventory balance is capable of identifying a one gpm RCS leak rate. Thecontainment grab samples will also indicate an increase in RCS leak rate which would then bequantified by the RCS water inventory balance. Since these additional actions are sufficient toensure RCS LEAKAGE is withi~n TS limits, it is appropriate to provide a limited time period to.restore at least one of the TS-required LEAKAGE monitoring systems.LCO 3.4.6.1 .b. Containment Sump Drain Monitoring SystemThe intent of LCO 3.4.6.1.b is to have a system able to monitor and detect leakage from thereactor coolant pressure boundary (RCPB). Any of the following three methods may be used tomeet LCO 3.4.6.l.b:A. 3DAS-P1O, Unidentified Leakage Sump Pump, and associated local and mainboard annunciation.B. 3DAS-P 10, Unidentified Leakage Sump Pump, and computer point 3DAS-L39and CVLKR2.C. 3DAS-P2A or 3DAS-P2B, Containment Drains Sump Pump, and computer points.3DAS-L22 and CVLKR2 or CVLKjR3I.To meet Regulatory Guide 1.45 recommendations, the Containment Drain Sump MonitoringSystem must meet the following five criteria:1. Must monitor changes in sump water level, changes in flow rate or changes in theoperating frequency of pumps.2. Be able to detect an UNIDENTIFIED LEAKAGE rate of 1 gpm in less than one hour.MILLSTONE -UNIT 3B3/44AmnetNoB 3/4 4-4Amendment No. LBDCR No. 07-MP3-032August 8, 2007REACTOR COOLANT SYSTEMBASES3/4.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued)3. Remain OPERABLE following an Operating Basis Earthquake (OBE).4. Provide indication and alarm in the Control Room.5. Procedures for converting various indications to a common leakage equivalentmust be available to the Operators.The three Containment Drain Sump Monitoring Systems identified above meet these fiverequirements as follows:A. 3DAS-PiO. Unidentified Leakage Sump Pump. and associated main boardannunciation.1. Sump level is monitored at two locations by the starting-and stopping of3DAS-P 10, Unidentified Leakage Sump Pump. Flow is measured as afunction of time between pump starts/stops and the known sunap levels atwhich these Occur.2. Two timer relays in the control circuitry of 3DAS-P 1O are set to identify a 1 .gpmleak rate within 1 hour.3. This monitoring, system is not seismic Category I, but is expected to remainOPERABLE during an OBE. If the monitoring system is not OPERABLEfollowing a seismic event, the appropriate ACTION according to TechnicalSpecifications will. be taken. This position has been reviewed by the NRC anddocumented as acceptable in the Safety Evaluation Report.4. If the control circuitry of 3DAS-P10 identifies a 1 gpm leak rate within 1 hour,Liquid Radwaste Panel Annunciator LWS :4-5, CTMT UJNIDENT LEAKAGETROUBLE, and Main Board Annunciator MB1 B 4-3, RAD LIQUID WASTESYS TROUBLE, will alarm. These control circuits and alarms operateindependently from the plant process computer.If the computer is inoperable, these control circuits and alarms meet the TechnicalSpecification requirements for the Containment Drain Sump Monitoring System.5. To convert the unidentified leakage sump pump run times to a leakage rate, use thefollowing formula:(3DAS-P1O run times in minutes -[number of 3DAS-P10 starts x.5 minutes]) x 20 gpm' Elapsed monitored Time in minutesB. 3DAS-P 10. Unidentified Leakage Sump Pump. and computer points 3DAS-L39 andCVLKR2.1. Sump level is monitored by 3DAS-LI39, the Unidentified Leakage Sump Levelindicator. This level indicator provides an input to computer point 3DAS-L39.MILLSTONE -UNIT 3 B/44 mnmn oB 3/4 4-4aAmendment No. LBDCR No. 1 1-MP3-004March 22, 2011REACTOR COOLANT SYSTEMBASES3/4.4.6.1I LEAKAGE DETECTION SYSTEMS (Continued)2. The plant process computer calculates a leakage rate every 30 seconds when3DASP1O indicates stop. This leakage rate is displayed via computer pointCVLKR2. When pump Pl10 does run, the leakage rate calculation is stopped andresumes 10 minutes after pump PlO stops. If it cannot provide a value of theleakage rate within any 54 minute interval, CVDASPIONC (UNDNT LKG RTNOT CALC) alarms which alerts the Operator that UNIDENTIFIED LEAKAGEcannot be determined.3. This monitoring system is not seismic Category I, but is expected to remainOPERABLE during an OBE. If the monitoring system is not OPERABLEfollowing a seismic event, the appropriate ACTION according to TechnicalSpecifications will be taken.4. A priority computer alarm (CVLKR2) is generated if the calculated leakage rate isgreater than a value specified on the Priority Alarm Point Log. This alarm valueshould be set to alert the Operators to a possible RCS leak rate in excess of theTechnical Specification maximum allowed UNIDENTIFIED LEAKAGE. Thealarm value may be set at one gallon per minute or less above the rate ofIDENTIFIED LEAKAGE, from the reactor coolant or auxiliary systems, into theunidentified leakage sump. The rate of IDENTIFIED LEAKAGE may bedetermined by either measurement or analysis. If the Priority Alarm Point Log isadjusted,.the high leakage rate alarm will be bounded by the IDENTIFIEDLEAKAGE rate and the low leakage rate alarm will be set to notify the operatorthat a decrease in leakage may require the high leakage rate alarm to be reset. Thepriority alarm setpoint shall be no greater than 2 gallons per minute. This ensuresthat the IDENTIFIED LEAKAGE will not mask a small increase inUNIDENTIFIED LEAKAGE that is of concern. The 2 gallons per minute limit isalso within the identified leakage sump level monitoring system alarm operatingrange which has a maximumn setpoint of 2.3 gallons per minute.To convert unidentified leakage sump level changes to leakage rate, use thefollowing formula:Note: Wait 10 minutes after 3DAS-Pl10 stops before taking level readings.1.083 15 gallons X % change in level from 3DAS-L391% time between level readings in minutesC. 3DAS-P2A or 3DAS-P2B. Containment Drains Sump Pump, and computer points3DAS-L22 and CVLKR2 or CVLKR3I.1. Sump level is monitored by 3DAS-L122, the Containment Drains Sump LevelIndicator. This level indicator provides an input to computer point 3DAS-L22.This method can be used to monitor UNIDENTIFIED LEAKAGE when Pump Pl10and its associated equipment is inoperable provided Pump Pl10 is out of service and3DAS-L1 39 indicates that the unidentified leakage sump is overflowing to thecontainment drains sump (approximately 40% level on 3DAS-LI39).MILLSTONE -UNIT 3B 3/4 4-4bAmendment No. LBDCR No. 07-MP3-032August 8, 2007REACTOR COOLANT SYSTEMBASES3/4.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued)In this case, CVLKR2 and CVLKR3I monitor flow rate by comparing levelindications on the containment drains sump when Pumps Pl10, P2A, P2B and P 1are not running.2. The plant process computer calculates a leakage rate every 30 seconds when3DAS-P 10, 3DAS-Pl1, 3DAS-P2A and 3DAS-P2B indicate stop. This leakage rateis displayed via computer points CVLKR3I and CVLKR2 when 3DAS-PI10 is offand when the unidentified leakage sump is overflowing to the containment drainssump. When one of these pumps does run, the leakage rate calculation is stoppedand resumes 10 minutes after all pumps stop. If it cannot provide value of theleakage rate within any 54 minute interval, two computer point alarms(CVDASP2NC, UNDNT LKG RT NOT CALC and CVDASP2NC, SMP 3 LKGRT NT CALC) are generated which alerts the Operator that UNIDENTIFIEDLEAKAGE cannot be determined.3. This monitoring system is not seismic Category I, but is expected to remainOPERABLE during an OBE. If the monitoring system is not OPERABLEfollowing a seismic event, the appropriate ACTION according to TechnicalSpecifications will be taken.4. Two priority computer alarms (CVLKR2 and CVLKR3I) are generated if thecalculated leakage rate is greater than a value specified on the Priority Alarm PointLog. This alarm value should be set to alert the Operators to a possible RCS leakrate in excess of the Technical Specification maximum allowed UNIDENTIFIEDLEAKAGE. The alarm value may be set at one gallon per minute or less above the Wi :Prate of IDENTIFIED LEAKAGE, from the reactor coolant or auxiliary systems,into the containment drains sump. The rate of IDENTIFLED LEAKAGE may bedetermined by either, measurement or by analysis. If the Priority Alarm Point Logis adjusted, the high leakage rate alarm will be bounded by the IDENTIFIEDLEAKAGE rate and the low leakage rate alarm will be set to notify the operatorthat a decrease in leakage may require the high leakage, rate alarm to be reset. Thepriority alarm set-point shall be no greater than 2 gallons per minute. This ensuresthat the IDENTIFIED LEAKAGE will not mask a small increase inUNIDENTIFIED LEAKAGE that is of concern. The 2 gallons per minute limit isalso within the contaimnent drains sump level monitoring system alann operatingrange which has a maximum setpoint of 2.5 gallons per minute.5. To convert containment drains sump run times to a leakage rate, refer to procedureSP3 670.1 for guidance on the conversion method.3/4.4.6.2 OPERATIONAL LEAKAGELCORCS operational LEAKAGE shall be limited to:a. PRESSURE BOUNDARY LEAKAGENo PRESSURE BOUNDARY LEAKAGE is allowed, being indicative of materialdeterioration. LEAKAGE of this type is unacceptable as the leak itself could cause furtherMILLSTONE -UNIT 3 B3444 mnmn oB 3/4 4-4cAmendment No. LBDCR No. 07-MP3-032August 8, 2007REACTOR COOLANT SYSTEMBASES3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)deterioration, resulting in higher LEAKAGE. Violation of this LCO could result incontinued degradation of the RCPB. LEAKAGE past seals and gaskets is not PRESSUREBOUNDARY LEAKAGE.b. UNIDENTIFIED LEAKAGEOne gallon per minute (gpm) of UNIDENTIFIED LEAKAGE is allowed as a reasonableminimum detectable amount that the containment air monitoring and containment sumplevel monitoring equipment can detect within a reasonable time period. Violation of thisLCO could result in continued degradation of the RCPB, if the LEAKAGE is from thepressure boundary.*c. Primary_ to Secondary. LEAKAGE through Any One Steam Generator (SG)The limit of 150 gallons per day per SG is based on the operational LEAKAGEperformance criterion in NEl 97-06, Steam Generator Program Guidelines (Reference 4).The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states, "The RCS operational primaryr to secondary LEAKAGE through any one SGshall be limited to 150 gallons per day." The limit is based on operating experience withSG tube degradation mechanisms that result in tube leakage. The operational LEAKAGErate criterion in conjunction with the implementation of the Steam Generator Program isan effective measure for minimizing the frequency of steam generator tube ruptures.d. IDENTIFIED LEAKAGEUp to 10 gpm of IDENTIFIED LEAKAGE is considered allowable because LEAKAGEis from known sources that do not interfere with detection of UNIDENTIFIEDLEAKAGE and is well within the capability of the RCS makeup system. IDENTIFIEDLEAKAGE includes LEAKAGE to the containment from specifically known and locatedsources, but does not include PRESSURE BOUNDARY LEAKAGE or controlled reactorcoolant pump (RCP) seal leakoff (CONTROLLED LEAKAGE). Violation of this LCOcould result in continued degradation of a component or system.e. CONTROLLED LEAKAGEThe CONTROLLED LEAKAGE limitation restricts operation when the total flowsupplied to the reactor coolant pump seals exceeds 40 gpm with the modulating valve inthe supply line fully open at a nominal RCS pressure of 2250 psia. This limitation ensuresthat in the event ofa LOCA, the safety injection flow will not be less than assumed in thesafety analyses.A limit of 40 gpm is placed on CONTROLLED LEAKAGE.f. RCS Pressure Isolation Valve LEAKAGEThe specified allowable leakage from any RCS pressure isolation valve is sufficiently lowto ensure early detection of possible in-series valve failure. It is apparent that whenpressure isolation is provided by two in-series valves and when failure of one valve in thep~air can go undetected for a substantial length of time, verification of valve integrity isrequired. Since these valves are important in preventing overpressurization and rupture ofthe ECCS low pressure piping which could result in a LOCA, these valves should betested periodically to ensure low probability of gross failure.MILLSTONE -UNIT 3B3/44dAemntN.2,B 3/4 4-4dAmendment No. g09, LBDCR No. 06-MP3-005May 25, 2006REACTOR COOLANT SYSTEMBASES3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)APPLICABILITYIn MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS ispressurized.In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is farlower, resulting in lower stresses and reduced potentials for LEAKAGE.LCO 3.4.6.2.f~, RCS Pressure Isolation Valve (PIV) Leakage, measures leakage through eachindividual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakagemeasured through one PIV does not result in RCS LEAKAGE when the. other is leak tight. Ifboth valves leak and result in a loss of mass from the RCS, the loss must be included in theallowable identified LEAKAGE.ACTIONSb.,c.UNIDENTIFIED LEAKAGE, IDENTIFIED LEAKAGE or RCS pressure isolation valveLEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours. ThisCompletion Time allows time to verify leakage rates and either identify' UNIDENTIFIEDLEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. Thisaction is necessary to prevent further deterioration of the RCPB.a. b. c.If any PRESSURE BOUNDARY LEAKAGE exists, or primary to secondary LEAKCAGE is notwithin limits, or if UNIDENTIFIED LEAKAGE, IDENTIFIED LEAKAGE, or RCS pressureisolation valve LEAKAGE cannot be reduced to within limits within 4 hours, the reactor must bebrought to lower pressure conditions to reduce the severity of the LEAKAGE and its potentialconsequences. It should be noted that LEAKAGE past seals and gaskets is not PRESSUREBOUNDARY LEAKAGE. The reactor must be brought to HOT STANDBY within 6 hours andCOLD SHUTDOWN within the following 30 hours. This action reduces the LEAKAGE and alsoreduces the factors that tend to degrade the pressure boundary.The allowed Completion Times are reasonable, based on operating experience, to reach therequired plant conditions from full power conditions in an orderly manner and withoutchallenging plant systems. In COLD SHUTDOWN, the pressure stresses acting on the reactorcoolant pressure boundary are much lower, and further deterioration is much less likely.MILLSTONE -UNIT 3B3444eA ndntN.O,B 3/4 4-4eAmendment No. -2419, LBDCR No. 06-MP3-005May 25, 2006REACTOR COOLANT SYSTEMBASES3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)SURVEILLANCE REOUIREMENTS4.4.6.2.1 .cCONTROLLED LEAKAGE is determined under; a set of reference conditions, listed below:a. One Charging Pump in operation.b. RCS pressure at 2250 +/- 20 psia.By limiting CONTROLLED LEAKAGE to 40 gpm during normal operation, it can be assuredthat during an SI with only one charging pump injecting, RCP seal injection flow will continue toremain less than 80 gpin as assumed in the accident analysis. When the seal injection throttlevalves are set with a normal charging lineup, the throttle valve position bounds conditions wherehigher charging header pressures could exist. Therefore, conditions which create higher chargingheader pressures such as an isolated charging line, or two pumps in service are bounded by thesingle puinp-nonnal system lineup surveillance configuration. Basic accident analysisassumptions are that 80 gpin flow is provided to the seals by a single pump in a runout condition.4.4.6.2.1 .dVerifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the reactor coolantpressure is maintained. PRESSURE BOUNDARY LEAKAGE would at first appear asUNIDENTIFIED LEAKAGE and can only be positively identified by inspection. It should benoted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE.UNIDENTIFIED LEAKAGE and IDENTIFIED LEAKAGE are determined by performance ofan RCS water inventory balance.The RCS water inventory balance must be performed with the reactor at steady state operatingconditions (stable temperature, power level, pressurizer and makeup tank levels, makeup andletdown, and RCP seal injection and return flows). The Surveillance is modified by two Notes.Note 1 states that this SR is not required to be performed until 12 hours after establishing steadystate operation. The 12 hour allowance provides sufficient thne to collect and process allnecessary data after stable plant conditions are established.Steady state operation is required to perform a proper water inventory balance since calculationsduring maneuvering are not useful. For RCS operational LEAKAGE detennination by waterinventory balance, steady state is defined as stable RCS pressure, temperature, power level,pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and returnflOWS.MILLSTONE -UNIT 3B /4fAenetNoB 3/4 4-4fAmen&nent No. [ LBDCR 12-MP3-010September 20, 2012REACTOR. COOLANT SYSTEM lBASES3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)An early warning of PRES SURE BOUNDARY LEAKAGE or UNIDENTIFIED LEAKAGE isprovided by the automatic systems that monitor the containment atmosphere radioactivity and thecontainment sump level. It should be noted that LEAKAGE past seals and gaskets is notPRESSURE BOUNDARY LEAKAGE. These leakage detection systems are specified in RCSLCO 3.4.6.1, "Leakage Detection Systems."Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGEof 150 gallons per day caimot be measured accurately by an RCS water inventory balance.The surveillance frequency is controlled under the Surveillance Frequency Control Program.4.4.6.2.1 .eThis SR verifies that primary to secondary¢ LEAKAGE is less than or equal to 150 gallons per daythrough any one SG. Satisfying the primary to secondary LEAKAGE limait ensures that theoperational LEAKAGE performance criterion in the Steam Generator Progr'am is met. If this SR isnot met, compliance with LCO 3.4.5, "Steam Generator Tube Integrity," should be evaluated. The150 gallons per day limit is measured at room temperature as described in Reference 5. The ,operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should beconservatively assumed to be from one SG.The Surveillance is modified by a Note which states that the surveillance is not required to beperformed until 12 hours after establishment of steady state operation. For RCS primary tosecondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature,power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection andreturn flows.The surveillance frequency is controlled under the Surveillance Frequency Control Program. Theprimary to secondary LEAKAGE is determined using continuous process radiation monitors orradiochemical grab sampling in accordance with the EPRI guidelines (Reference 5).4.4.6.2.2The Surveillance Requirements for RCS pressure isolation valves provide assurance of valveintegrity thereby reducing the probability of gross valve failure and consequent intersystem LOCA.Leakage from the RCS pressure isolation valve is IDENTIFIED LEAKAGE and will be consideredas a portion of the allowed limit.MILLSTONE -UNIT 3B3/4gAenetNoB 3/4 4-4gAmendment No. LBDCR No. 06-MP3--005May 25, 2006REACTOR COOLANT SYSTEMBASES3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)Entry into MODES 3 and 4 is allowed to establish the necessary differential pressures and stableconditions for performance of Surveillance Requirement 4 .4 .6.2 .2 (including SurveillanceRequirement 4.4.6.2.2.d) for RCS pressure isolation valves which can only be leak-tested atelevated RCS pressures. The requirements of Surveillance Requirement 4.4.6.2.2.d to verify thata pressure isolation valve is OPERABLE shall be performed within 24 hours after the requiredRCS pressures has been met.In MODES 1 and 2, the plant is at normal operating pressure and Surveillance Requirement4.4.6.2.2.d shall be performed within 24 hours of valve actuation due to automatic or manualaction or flow through the valve. In MODES 3 and 4, Surveillance Requirement 4.4.6.2.2.d shall*be performed within 24 hours of valve actuation due to automatic or manual actuation of flowthrough the valve if and when RCS pressure is sufficiently high for performance of thissurveillance.BACKGROUNDComponents that contain or transport the coolant to or from the reactor core make up the reactorcoolant system (RCS). Component joints are made by welding, bolting, rolling, or pressureloading, and valves isolate connecting systems from the RCS.During plant life, the joint and valve interfaces can produce varying amounts of reactor coolantLEAKAGE, through either normal operational wear or mechanical deterioration. The purpose ofthe RCS "Operational LEAKAGE" LCO is to limit system operation in the presence ofLEAKAGE from these sources to amounts that do not compromise safety. This LCO specifiesthe types and amounts of LEAKAGE.10 CFR 50, Appendix A, GDC 30 (Reference 1), requires means for detecting and, to the extent.practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45(Reference 2) describes acceptable methods for selecting leakage detection systems.The safety significance of RCS LEAKAGE varies widely depending on its source, rate, andduration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containmentarea is necessary. Quickly separating the IDENTIFIED LEAKAGE from the UNIDENTIFIEDLEAKAGE is necessary to provide quantitative information to the operators, allowing them totake corrective action should a leak occur detrimental to the safety of the facility and the public.A limited amount of leakage inside containment is expected from auxiliary systems that cannot bemade 100% leaktight. Leakage from these systems should be detected, located, and isolated fromthe containment atmosphere, if possible, to not interfere with RCS LEAKAGE detection.This LCO deals with protection of the reactor coolant pressure boundary (RCPB) fromdegradation and the core from inadequate cooling, in addition to preventing the accident analysisradiation release assumptions from being exceeded. The consequences of violating this LCOinclude the possibility of a loss of coolant accident (LOCA).MILLSTONE -UNIT 3 B3444 mnmn oB 3/4 4-4hAmendment No. [ LBDCR No. 06-MP3-005May 25, 2006REACTOR COOLANT SYSTEMBASES3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)APPLICABLE SAFETY ANALYSES -OPERATIONAL LEAKAGEExcept for primary to secondary LEAKAGE, the safety analyses do not address operationalLEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA;the amount of leakage can affect the probability of such an event. The safety analysis for an eventresulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGEfrom all steam generators (SGs) is 1 gallon per minute or increases to 1 gallon per minute as aresult of accident induced conditions. The LCO requirement to limit primary to secondaryLEAKAGE through any one SG to less than or equal to 150 gallons per day is significantly lessthan the conditions assumed in the safety analysis.Primary to secondary LEAKAGE is a factor in the dose releases outside containment resultingfrom a main steam line break (MSLB). To a lesser extent, other accidents or transients involvesecondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR)accident. The leakage contaminates the secondary fluid.The ESAR (Reference 3) analysis for SGTR assumes the contaminated secondary fluid is releasedvia atmospheric dump valves. The 1 gpm primary to secondary LEAKAGE safety analysisassumption is relatively inconsequential.The safety analysis for the MSLB accident assumes 500 gpd primary to secondary LEAKAGE isthrough the affected steam generator and the remainder of the 1 gpm is through the intact SGs asan initial condition. The dose consequences resulting from the MSLB accident are within theguidelines based on 10 CFR 50.67 or other staff approved licensing basis.The RCS operational LEAKAGE satisfies Criterion 2 of 10 CER 50.36(c)(2)(ii).REFERENCES1. 10 CFR 50, Appendix A, GDC 30.2. Regulatory Guide 1.45, May 1973.3. FSAR, Section 15.4. NEI 97-06, "Steam Generator Program Guidelines."5. EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."* 6. Letter FSD/SS-NEU-37 13, dated March 25, 1985.7. Letter NEU-89-639, dated December 4, 1989.MILLSTONE -UNIT 3 B3444 mnmn oB3/4 4-4iAmendment No. LBDCR No. 08-MP3-013March 18, 2008REACTOR COOLANT SYSTEMBASES3/4.4.7 DELETED3/4.4.8 SPECIFIC ACTIVITYBACKGROUNDThe maximum dose that an individual at the exclusion area boundary can receive for 2 hoursfollowing an accident, or at the low population zone outer boundary for the radiological releaseduration, is specified in 10 CFR 50.67 (Reference 1). Doses to control room occupants must belimited per GDC 19. The limits on specific activity ensure that the offsite and Control RoomEnvelope (CRE) doses are appropriately limited during analyzed transients and accidents.The RCS specific activity LCO limits the allowable concentration of radionuclides in the reactorcoolant. The LCO limits are established to minimize the dose consequences in the event of asteam line break (SLB) or steam generator tube rupture (SGTR) accident.The LCO contains specific activity limits for both DOSE EQUIVALENT I-i131 and DOSEEQUIVALENT XE-133. The allowable levels are intended to ensure that offsite and CRE dosesmeet the appropriate acceptance criteria in the Standard Review Plan (Reference 2).APPLICABLE SAFETY ANALYSESThe LCO limits on the specific activity of the reactor coolant ensure the resulting offsite and CREdoses meet the appropriate SRP acceptance criteria following a SLB or SGTR accident. Thesafety analyses (References 3 and 4) assume the specific activity of the reactor coolant is at theLCO limits, and an existing reactor coolant (SG) tube leakage rate of"l gpmexists. The safety analyses assume the specific activity of the secondary coolant is at its limit of0.1 jgCi/gm DOSE EQUIVALENT 1-131 from LCO 3.7.1.4, "Specific Activity."The analyses for the SLB and SGTR accidents establish the acceptance limits for RCS specificactivity. Reference to these analyses is used to assess changes to the unit that could affect RCSspecific activity, as they relate to the acceptance limits.The safety analyses consider two cases of reactor coolant iodine specific activity. One caseassumes specific activity at 1.0 .ixCi/gm DOSE EQUIVALENT 1-131 with a concurrent largeiodine spike that increases the rate of release of iodine from the fuel rods containing claddingdefects to the primary coolant immediately after a SLB (by a factor of 500), or SGTR (by a factorof 335) respectively. The second case assumes the initial reactor coolant iodine activity at 60.0gICi/gm DOSE EQUIVALENT 1-131 due to an iodine spike caused by a reactor or an RCStransient prior to the accident. In both cases, the noble gas specific activity is assumed to be 81 .2gaCi/gm DOSE EQUIVALENT XE- 133.The SGTR analysis also assumes a loss of offsite power at the same time as the reactor trip. TheSGTR causes a reduction in reactor coolant inventory. The reduction initiates a reactor trip from alow pressurizer pressure signal or an RCS overtemperature AT signal.MILLSTONE -UNIT 3B3/45AmnetNo24B 3/4 4-5Amendment No. 2-04 LBDCR No:08-MP3-013March 18, 2008REACTOR COOLANT SYSTEMBASESSPECIFIC ACTIVITY (Continued)The loss of offsite power causes the steam dump valves to close to protect the condenser. The risein pressure in the ruptured SG discharges radioactively contaminated steam to the atmospherethrough the SG power operated relief valves and/or the main steam safety valves. The unaffectedSGs remove core decay heat by venting steam to the atmosphere until the cooldown ends and theResidual Heat Removal (RHIR) system is put in service."The SLB radiological analysis assumes offsite power is lost at the same time as the pipe breakoccurs outside containment. Reactor trip occurs after the generation of an SI signal on low steamline pressure. The affected SG blows down completely and steam is vented directly to theatmosphere. The unaffected SGs remove core decay heat by venting steam to the atmosphereuntil the cooldown ends and the RUR system is placed in service.Operation with iodine specific activity levels greater than I /tCi/gm but less than or equal to60.0 jixCi/gm is permissible for up to 48 hours while efforts are made to restore DOSEEQUIVALENT 1-131 to within the 1 pCi/gm LCO limit. Operation with iodine specific activitylevels greater than 60 jgCi/gm is not permissible.The RCS specific activity limits are also used for establishing standardization in radiationshielding and plant personnel radiation protection practices.RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).LCOThe iodine specific activity in the reactor coolant is limited to 1.0 paCi/gm DOSE EQUIVALENTI-131, and the noble gas specific activity in the reactor coolant is limited to 81.2 pCi/gm DOSEEQUIVALENT XE-133. The limits on specific activity ensure that offsite and CRE doses willmeet the appropriate SRP acceptance criteria (Reference 2).The SLB and SGTR accident analyses (References 3 and 4) show that the calculated doses arewithin acceptable limits. Operation with activities in excess of the LCO may result in reactorcoolant radioactivity levels that could, in the event of an SLB or SGTR, lead to doses that exceedthe SRP acceptance criteria (Reference 2).APPLICABILITYIn MODES 1, 2, 3, and 4, operation within the LCO limits for DOSE EQUIVALENT 1-131 andDOSE EQUIVALENT XE-133 is necessary to limit the potential consequences of a SLB orSGTR to within the SRP acceptance criteria (Reference 2).In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS andsteam generators are depressurized, and primary to secondary LEAKAGE is minimal. Therefore,the monitoring of RCS specific activity is not required.MILLSTONE -UNIT 3B3/46AmnetNoB 3/4 4-6Amendment No. LBDCR No. 08-MP3-013March 18, 2008REACTOR COOLANT SYSTEMBASESSPECIFIC ACTIVITY (Continued)ACTIONSa. and b.With the DOSE EQUIVALENT 1-131 greater than the LCO limit, samples at intervals of fourhours must be taken to demonstrate that the specific activity is < 60 pCi/gim. Four hours isrequired to obtain and analyze a sample. Sampling is continued every four hours to provide atrend.The DOSE EQUIVALENT 1-131 must be restored to within limit within 48 hours. Thecompletion time of 48 hours is acceptable since it is expected that, if there were an iodine spike,the nonnal coolant iodine concentration would be restored within this time period. Also, there is alow probability of a SLB or SGTR occurring during this time period.A statement in ACTION b. indicates the provisions of LCO 3.0.4 are not applicable. Thisexception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTIONS a. andb. while the DOSE EQUIVALENT 1-13 1 LCO is not met. This exception is acceptable due to thesignificant conservatism incor~porated into the RCS specific activity limit, the low probability ofan event which is limiting due to exceeding this limit, and the ability to restore transient-specificactivity excursions while the plant remains at, or proceeds to, POWER OPERATION.c.If the required action and completion time of ACTION b. is not met, or if the DOSEEQUIVALENT 1-131 is > 60 jFCi/gm, the reactor must be brought to HOT STANDBY (MODE 3)within 6 hours and COLD SHUTDOWN (MODE 5) within 36 hours. The allowed completiontimes are reasonable, based on operating experience, to reach the reqfiired plant conditions fromfull power conditions in an orderly maimer and without challenging plant systems.d_.With the RCS DOSE EQUIVALENT XE-133 greater than the LCO limit, DOSE EQUIVALENTXE-133 must be restored to within limit within 48 hourns. The allowed completion time of 48hours is acceptable since it is expected that, if there were a noble gas spike, the normaal coolantnoble gas concentration would be restored within this time period. Also, there is a low probabilityof a SLB or SGTR occurring during this time period.A statement in ACTION d. indicates the provisions of LCO 3.0.4 are not applicable. Thisexception to LCO 3.0.4 permnits entry into the applicable MODE(S), relying on ACTION d. whilethe DOSE EQUIVALENT XE-133 LCO is not met. This exception is acceptable due to thesignificant conservatism incorporated into the RCS specific activity limit, the low probability ofan event which is limiting due to exceeding this limit, and the ability to restore transient-specificactivity excursions while the plant remnains at, or proceeds to, POWER OPERATION.MILLSTONE -UNIT 3 B3446 mnmn o* B 3/4 4-6aAmendment No. LBDCR 12-MPll3-010September 20, 2012REACTOR. COOLANT SYSTEMBASESSPECIFIC ACTIVITY (Continued)ACTIONS (Continued)e.If the required action and completion time of ACTION d. is not met, the reactor must be broughtto HOT STANDBY (MODE 3) within 6 hours and COLD SIIUTDOWN (MODE 5) within3 6 hours. The allowed completion times are reasonable, based on operating experience, to reachthe required plant conditions from full power conditions in an orderly manner mad withoutchallenging plant systems.SURVEILLANCE REQUIREMENTS4.4.8.1Surveillance Requirement 4.4.8.1 requires performing a gamma isotopic analysis as a measure ofthe noble gas specific activity of the reactor coolant at the frequency specified in the SurveillanceFrequency Control Program. This measurement is the sum of the degassed gamma activities andthe gaseous gamma activities in the sample taken. This Surveillance Requirement provides anindication of any increase in the noble gas specific activity.Trending the results of this Surveillance Requirement allows proper remedial action to be takenbefore reaching the LCO limit under normal operating conditions. The surveillance frequency iscontrolled under the Survweillance Frequency Control Progr-am.Due to the inaherent difficulty in detecting Kr'-85 in a reactor coolant sample due to masking fromradioisotopes with similar decay energies, such as F-18 and 1-134, it is acceptable to include theminimum detectable activity for Kr-85 in the Surveillance Requirement 4.4.8.1 calculation. If aspecific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE-133 is notdetected, it should be assumed to be present at the minimum detectable activity.A Note modifies the Su'veillance Requirement to allow entry into and operation in MODE 4,MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows theSurveillance Requirement to be performned in those MODES, prior to entering MODE 1.4.4.8.2This Surveillance Requirement is performed to ensure iodine specific activity remains within the.LCO limit during normal operation and following fast power changes when iodine spiking ismore apt to occur The surveillance fr'equency is controlled under the Surveillance FrequencyControl Program. The frequency of between 2 and 6 hours after a power change _> 15% RTPwithin a 1 hour period is established because the iodine levels peak during this time followingiodine spike initiation; samples at other times would provide inaccurate results.MILLSTONE -UNIT 3 B3446 mnmn oB 3/4 4-6bAmendment No. LBDCR No. 08-MP3-013March 18, 2008REACTOR COOLANT SYSTEMBASESSPECIFIC ACTIVITY (Continued)SURVEILLANCE REQUIREMENTS (Continued)The Note modifies this Surveillance Requirement to allow entry into and operation in MODE 4,MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows theSurveillance Requirement to be performed in those MODES, prior to entering MODE 1.REFERENCES1. 10CFR5O.67.2. Standard Review Plan (SRP) Section 15.0.1, "Radiological Consequence Analyses UsingAlternate Source Terms."3. FSAR, Section 15.1.5.4. FSAR, Section 15.6.3.3/4.4.9 PRESSURE/TEMPERATURE LIMITSREACTOR COOLANT SYSTEM (EXCEPT THE PRESSURIZER)BACKGROUNDAll components of the RCS are designed to withstand effects of cyclic loads due to systempressure and temperature changes. These loads are introduced by startup (heatup) and shutdown(cooldown) operations, power transients, and reactor trips. This LCO limits the pressure andtemperature changes during RCS heatup and cooldown, within the design assumptions and thestress limits for cyclic operation.Figures 3.4-2 and 3.4-3 contain P/T limit curves for heatup, cooldown, inservice leak andhydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolanttemperature.Each PIT limit curve defines an acceptable region for normal operation. The usual use of thecurves is operational requirements during heatup or cooldown maneuvering, when pressure andtemperature indications are monitored and compared to the applicable curve to determine thatoperation is within the allowable region. A heatup or cooldown is defined as a temperatureincrease or decrease of greater than or equal to 1 0°F in any one hour period. This definition ofheatup and cooldown is based upon the ASME definition of isothermal conditions described inASME, Section XI, Appendix E.MILLSTONE -UNIT 3B 3/4 4-7MILLTONE- UNT 3 3/44-7Amendment No. 5, 4-9-7, LBDCR 3-4-03May 20, 2004REACTOR COOLANT SYSTEMBASESPRESSURE/TEMPERATURE LIMITS (continued)Steady state thermal conditions exist when temperature increases or decreases are <1 0°Fin any one hour period and when the plant is not performing a planned heatup or cooldown inaccordance with a procedure.The LCO establishes operating limits that provide a margin to brittle failure, applicable tothe fenritic material of the reactor coolant pressure boundary (RCPB). The vessel is thecomponent most subject to brittle failure, and the LCO limits apply mainly to the vessel. Thelimits do not apply to the Pressurizer.The P/T limits have been established for the ferritic materials of the RCS consideringASME Boiler and Pressure Vessel Code Section XI, Appendix G (Reference 1) as modified byASME Code Case N-640 (Reference 2), and the additional requirements of 10 CFR 50Appendix G (Reference 3). Implementation of the specific requirements provide adequate marginto brittle fracture of ferritic materials during normal operation, anticipated operationaloccurrences, and system leak and hydrostatic tests.The neutron embrittlement effect on the material toughness is reflected by increasing thenil ductility reference temperature (RTNDT) as exposure to neutron fluence increases.The actual shift in the RTNDT of the vessel material will be established periodically byremoving and evaluating the irradiated reactor ve~ssel material specimens, in accordance withASTM E 185 (Ref. 4) and Appendix H of 10 CFR 50 (Ref. 5). The operating P/T limit curveswill be adjusted, as necessary, based on the evaluation findings and. the recommendations ofRegulatory Guide 1.99 (Ref. 6).The P/T limit curves are composite curves established by superimposing limits derivedfrom stress analyses of those portions of the reactor vessel and head that are the most restrictive.At any specific pressure, temperature, and temperature rate of change, one location within thereactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves,different locations may be more restrictive, and thus, the curves are composites of the mostrestrictive regions.The heatup curve represents a different set of restrictions than the cooldown curve becausethe directions of the thermal gradients through the vessel wall are reversed. The thermal gradient-reversal alters the location of the tensile stress between the outer and inner walls.The P/T limits include uncertainty margins to ensure that the calculated limits are notinadvertently exceeded. These margins include gauge and system loop uncertainties, elevationdifferences, containment pressure conditions and system pressure drops between the beltlineregion of the vessel and the pressure gauge or relief valve location.MILLSTONE -UNIT 3 B 3/4 4-8 Amendment No. 48, -l-5-, 19-7,Acknowledged by NRC letter dated 08/25/05 August 27, 2001REACTOR COOLANT SYSTEMBASES.PRESSURE/TEMPERATURE LIMITS (continued)The criticality limit curve includes the Reference 1lrequirement that it be >_ 40°F above theheatup curve or the cooldown curve, and not less than 1 60°F above the minimum permissible:temperature for ISLH testing. This limit provides the required margin relative to brittle fracture.However, the criticality curve is not operationally limiting; a more restrictive limit exists in LCO3.1.1.4, "Minimurn Temperature for Criticality."The consequence of violating the LCO limits is that the RCS has been operated underconditions that can result in brittle failure of the ferritic RCPB materials, possibly leading to anonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluationmust be performed to determine, the effect on the structural integrity of the RCPB components.The ASME Code, Section XI, Appendix F (Ref. 7) provides a recommended methodology for-evaluating an operating event that causes an excursion outside the limits.APPLICABLE SAFETY ANALYSISThe P/T limits are not derived from Design Basis Accident (DBA) analyses. They areprescribed during normal operation to avoid encountering pressure, temperature, and temperaturerate of change conditions that might cause undetected flaws to prop agate and cause nonductile* failure of the RCPB, an unanalyZed condition. Reference 1, as modified by Reference 2,il!: combined with the additional requirements of Reference 3 provide the methodology fordetermining the P/T limits. Although the PiT limits are not derived from any DBA, the P/T limitsare acceptance limits since they preclude operation in an 'unanalyzed condition.RCS P/T limits satisfy Criterion 2 of.l0CFR,50.36(e)(2)(ii-).LCOThe LCO limits apply to ferritic components of the RCS, except the Pressurizer. These limitsdefine allowable operating regions while providing margin against nonductile failure for the"controlling ferritic components.The limitations imposed on the rate of change of temperature have been established to ensureconsistency with the resultant heatup, cooldown, and ISLH testing P/T'limit curves. These limitscontrol the thermal gradients (stresses) within .the reactor vessel belt line (the limitingcomponent). Note that while these limits are to provide protection to ferritic components withinthe reactor coolant pressure boundary, a limit of 1 000F/hr applies to the reactor, coolant pressuireboundary (except the pressurizer) to ensure that operation is maintained within the ASME SectionIII design loadings, stresses, and fatigue analyses for heatup and cooldown.MILLSTONE -UNIT 3B 3/4 4-9MILLTON -NIT3 B3/44-9Amendment No. 4--57-, 197 LBDCR 04-MP3-001REACTOR COOLANT SYSTEMBASESPRESSURE/TEMPERATURE LIMITS (continued)Violating the LCO limits places the reactor vessel outside of the bounds of the analyses and canincrease stresses in other RCPB components. The consequences depend on several factors, asfollows:a. The severity of the departure from the allowable operating P/T regime or theseverity of the rate of change of temperature;b. The length of time the limits were violated (longer violations allow thetemperature gradient in the thick vessel walls to become more pronounced); andc. The existences, sizes, and orientations of flaws in the vessel material.APPLICABILITYThe RCS P/T limits LCO provides a definition of acceptable operation for prevention ofnonductile failure of ferritic RCS components using ASME Section XI Appendix G, as modifiedby Code Case N-640 and the additional requirements of l0CFR50, Appendix G (Ref. 1). The P/Tlimits were developed to provide requirements for operation during heatup or cooldown (MODES3, 4, and 5) or ISLH testing, in keeping with the concern for nonductile failure. The limits do notapply to the Pressurizer.During MODES 1 and 2, other Technical Specifications priovide limits for operation that can bemore restrictive than or can supplement these P/T limits. LCO 3.2.5, "DNB Parameters"; LCO3.2.3. 1, "RCS Flow Rate and Nuclear En~thaltpy H'ot Channel Facto',;.LCO 3,1.1.4,"Minimum Temperature for Criticality"; and Safety Limit 2.1, "Safety Limits," also provideoperational restrictions for pressure and temperature and maximum pressure. Furthermore,MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stressanalyses have been performed. for normal maneuvering profiles, such as power ascension ordescent.ACTIONSOperation outside the P/T limits must be corrected so that the RCPB is returned to a. condition thathas been verified by stress analyses. The Allowed Outage Times (AOTs) reflects the urgency ofrestoring the parameters to within the analyzed range. Most violations will not be severe, and the*activity can be accomplished in this time in a controlled manner.Besides restoring operation within limits, an evaluation is required to. determine if RCS operationcan continue. The evaluation must verify the RCPB integrity remains acceptable and must becompleted before continuing operation. Several methods may be used, including comparisonwith pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.MILLSTONE -UNIT 3 B 3/4 4-10 Amendment No. 5-7, 1-9-, 2--l--,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP'3-015* February 24, 2005REACTOR COOLANT SYSTEMBASESPRESSURE/TEMPERATURE LIMITS (continued)ASME Code, Section XI, Appendix E (Ref. 7), may be used to support the evaluation. However,its use is restricted to evaluation of the vessel beltline.The 72 hour AOT when operating in MODES 1 through 4 is reasonable to accomplish theevaluation. The evaluation for a mild violation ispossible within this time, but more severeviolations may require special; event specific* stress analyses or inspections. A favorableevaluation must be completed before continuing to operate.This evaluation must be completed whenever a limit is exceeded. Restoration within the AOTalone is insufficient because higher than analyzed stresses may have occurred and may haveaffected the RCPB integrity.If the required remedial actions are not *completed within the allowed times, the plant must beplaced in a lower MODE or not allowed to enter MODE 4 because either the RCS remained in anunacceptable P/T region for an extended period of increased stress or a sufficiently severe eventcaused entry into an unacceptable region. Either possibility indicates a need for more carefulexamination of the event, best accomplished with the RCS at reduced pressure and temperature.In reduced pressure and temperature conditions, the possibility of propagation with undetectedflaws is decreased.If the required evaluation for continued operation in MODES 1 through 4 cannot be accomplishedwithin 72 hours or the results are indeterminate or unfavorable, action must proceed to reducepreSur~e and te~fnperathire as sp~cifr~d~ii the ACT]ION stiatement. A evaluation must becompleted and documented before r-etrnirng to operating pressure and temperature conditions.Pressure and temperature are reduced by bringing the plan~t to MODE 3 within 6 hours and toMODE 5 with RCS pressure < 500 psia within the next 30 hours.Completion of the required evaluation following limit violation in other than MODES 1 through 4is required before plant startup to MODE 4 can* proceed..The AOTs are reasonable, based on operating experience to reach the required plant conditionsfrom full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE REQUIREMENTSVerification that operation is within the LCO limits as well as the :limits of Figures 3.4-2 and -3.4-3 is required every 30 minutes when RCS pressure and temperature conditions areundergoing planned changes. This frequency is considered reasonable in view of the controlroom indication available to monitor RCS status.MILLSTONE -UNIT 3 B 3/4 4-11 Amendment No. 4&, 89, 4-5#, 4)-97,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015February 24, 2005REACTOR COOLANT SYSTEMBASES :PRES SURE/TEMPERATURE LIMITS (continued)Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definitiongiven in the relevant plant procedure for ending the activity is satisfied.This Surveillance Requirement is only required to be performed during system heatup, cooldown,and ISLJ- testing. No Surveillance Requirement is given for criticality operations because LCO3.1.1.4 contains a more restrictive requirement.It is rnot necessary to perform Surveillance Requirement 4.4.9.1.1 to verify' compliance withFigures 3.4-2 and 3.4-3 when the reactor vessel is fully detension'ed. During REFUELING; withthe head fully detensioned or off the reactor vessel, the RCS is not capable of being pressuriz~ed toany significant value. The limiting thermal stresses which could be encountered during this timewould be limited to flood-up using RWST water as low as 40°F. It is not possible to cause crackgrowth of postulated flaws in the reactor vessel at normal REFUELING temperatures eveninjecting 40°F Water.REFERENCES1. ASME Boiler and Pressure Vessel Code, Section XI, Appendix GQ "Fracture :IToughness for Protection Against Failure," 1995 Edition.2. ASME Section XI, Code Case N-640, "Alternative R~eference Fracture Toughnessfor Development of P-T Limit Curves," dated F~ebruary 26, 1999.3. 10 CFR 50 Appendix G, "Fracture Toughness Requirements."4. ASTM E 185-82, "Standard Practice for Conducting Surveillance Tests for Light-Water Cooled Nuclear Power Reactor. Vessels, E 706."5. 10 CFR 50 Appendix IH, "Reactor Vessel Material Surveillance ProgramRequirements."6. Regulatory Guide 1.99 Revision 2, "Radiation Embrittlement of Reactor VesselMaterials," dated May 1988.7. ASME Boiler and Pressure Vessel Code, Section XI, Appendix E, "Evaluation ofUnanticipated Operating Events," 1995 Edition.MILLSTONE -UNIT 3 B 3/4 4-12 Amendment No. 48,14-7, 9-,-2-04,-2-t-4,Acknowledged by NRC letter dated 08/25/05 May 8, 2002This page intentionally left blankMILLSTONE -UNIT 3B 3/4 4-13MILLTON -NIT B /4 -13Amendment No. #$, Z7'7 204 May 8, 2002This page intentionally left blankMILLSTONE -UNIT 3B 3/4 4-14MILLTON -NIT B /4 -14 Amendment No. JF7, 204 REACTRCOLNESSEMay 8, 2002BASESIOVERPRESSURE PROTECTION SYSTEMSBACKGROUNDThe Cold Overpressure Protection System limits RCS pressure at low temperaturesso the integrity of the reactor coolant pressure boundary (RCPB) is notcompromised by violating the isothermal beltline. pressure and temperature (P/I)limits developed using the guidance of ASME Section XI, Appendix G (Reference 1)as modified by ASME Code Case N-640 (Reference 2). The reactor vessel is thelimiting RCPB component for demonstrating such protection.Cold Overpressure Protection consists of two PORVs with nominal lift setting asspecified in Figures 3.4-4a and 3.4-4b, or two residual heat removal (RHR)suction relief valves, or one PORV and one RHR suction relief valve, or adepressurized RCS and an RCS vent of sufficient size. Two relief valves arerequired for redundancy. One relief valve has adequate relieving capability toprevent overpressurization of the RCS for the required mass input capability.MILLSTONE -UNIT 3B 3/4 4-15 Amendment No. J7, J 7, 204 REVERSE OF PAGE B 3/4 4-15INTENTIONALLY LEFT BLANK-LBDCR Nb. 04-MP3-015February 24, 2005REACTOR COOLANT SYSTEMBASESOVERPRESSURE PROTECTION SYSTEMS (continued)The use of a PORV for Cold Overpressure Protection is limited to those conditions when no morethan one RCS loop is isolated from the reactor vessel. When two or more ioops are isolated, ColdOverpressure Protection must be provided by either the two RHR suction relief valves or adepressurized and vented RCS,The reactor vessel material is less tough at low temperatures than at normal operatingtemperature. As the vessel neutron exposure accumulates, the material toughness decreases andbecomes less resistant to stress at low temperatures (Ref. 3). RCS pressure, therefore, ismaintained low at low temperatures and is increased only as temperature is increased.The potential for vessel overpressurization is most acute when the RCS is water solid, occurringwhile shutdown; a pressure fluctuation can occur more quickly than an operator can react torelieve the condition. Exceeding the RCS P/T limits by a significant amount could causenonductile cracking of the reactor vessel. LCO 3.4.9.1, "Pressure/Temperature Limits -ReactorCoolant System,'"requires administrative control of RCS pressure and temperature during heatupand cooldown to prevent exceeding the limits providedin Figures 3.4-2 and 3.4-3.This LCO provides RCS overpressure protection by limiting mass input capability and requiringadequate pressure relief: capacity. Limiting mass input capability requires all Safety InjectionO ~ (illI) pumps and all but one centrifugal charging pump to be incapable of injection into the RCS.W The pressure relief capacity requires either two redundant relief valves or .a depressurized RCSand an RCS vent of sufficient size. One relief valve or the open RCS vent is the overpressureprotection device that acts to terminate an increas~ing presswr~e event..With minimum mass input capability, the ability to p rovi'de core coolant addition is restricted.The LCO does not require the makeup control system deactivated or the safety injection (SI)actuation circuits blocked. Due to the lower pressures in the Cold Overpressure Protection modesand the expected core decay heat levels, the makeup system can provide adequate flow via themakeup control valve.If a loss of RCS inventory or reduction in SHUTDOWN MARGIN event occurs, the appropriateresponse will be to correctthe situation by starting RCS makeup pumps. If the loss of inventory or-SHUTDOWN MARGIN is significant, this may necessitate the use of additional RCS makeuppumps that are being maintained not capable of injecting into the RCS in accordance withTechnical Specification 3.4.9.3. The use of these additional pumps to restore RCS inventory orSHUTDOWN MARGIN will require entry into the associated ACTION statement. The ACTION* Istatement requires immediate action to comply with the specification. The restoration of RCSinventory or SHUTDOWN MARGIN canbe considered to be part of the immediate action to-restore the additional RCS makeup pumps to a not capable of injecting status. While recoveringRCS inventory or SHUTDOWN MARGIN, RCS pressure will be maintained below the P/Tlimits. After RCS inventory or SHUTDOWN MARGIN has been restored, the additional pumpsshould be immediately made not capable of injecting and the ACTION statement exited.O MILLSTONE -UNIT 3 B 3/4 4-16 Amendment No. 4-&, 88 3-8, 4-5-7, Acknowledged by NRC letter dated 08/25/05 August 27, 2001REACTOR COOLANT SYSTEMBASESOVERPRES SURE PROTECTION SYSTEMS (continued)PORV RequirementsAs designed, the PORV Cold Overpressure Protection (COPPS) is *signaled to open if the RCSpressure approaches a limit determined by the COPPS actuation logic..The COPPS actuationlogic monitors both RCS temperature and RCS pressure and determines when the nominalsetpoint of Figure 3.4-4a or Figure 3.4-4b is approached. The wide range RCS temperatureindications are auctioneered to select the lowest temperature signal.The lowest temperature signal is processed through a function generator that calculates a pressuresetpoint for that temperature. The calculated pressure setpoint is then compared with RCSpressure measured by a wide range pressure channel. If the measured pressure meets or exceedsthe calculated value, a PORV is Signaled to open.The use of the PORVs is restricted to three and four RCS loops unisolated: for a loop to beconsidered isolated, both RCS loop stop valves must be closed. If more than one loop is isolated,then the PORVs must have their block valves closed or COPPS must be blocked. For these cases,Cold Overpressure Protection must be provided by either the two RHR suction relief valves or adepressurized RCS and an RCS vent. This is necessary because the PORV mass and heat injectiontransients have only been analyzed for a maximum of one loop isolated, the use of the PORVs is irestricted to three and four RCS loops unisolated. WThe RHR suction relief valves have been qualified for all mass. injection transients for. anycombination of isolated loops. In addition, the heat injection transients not..prohibited by theTechnical"Sp~ecificationis have also b~een' the alilifi~ationi of the RHR s~Ictibr reliefvalves.Figure 3.4-4a and Figure 3.4-4b present the PORY setpoints for COPPS. The setpoints are.staggered so only one valve opens during a low temperature overpressure transient. Setting bothvalves to the values of Figure 3.4-4a and Figure 3.4-4b within the tolerance allowed for thecalibration accuracy, ensures that the isothermal P/T limits will not be exceeded for the analyzed [isothermal events.When a PORV is opened, the release of coolant will cause the pressure increase to slow andreverse; As the PORV releases coolant, the RCS press~ure decreases until a reset pressure isreached and the valve is signaled to close. Thie pressure continues to decrease below the resetpressure as the valve closes.MILLSTONE -UNIT 3B 3/4 4-16aMILLTON -UIT B 34 416aAmendment No. 48, 88, 4-57, 197 August 27, 2001REACTOR COOLANT SYSTEMBASESOVERPRES SURE PROTECTION SYSTEMSRIIR Suction Relief Valve RequirementsThe isolation valves between the RCS and the RIIR suction relief valves must be open to make*the RIIR.suction relief valves OPERABLE for RCS overpressure mitigation. The RHRsuctionvalves are spring loaded, bellows type water relief valves with setpoint tolerances andaccumulation limits established by Section III of the American Society of Mechanical Engineers(AS ME) Code (Ref. 4) for Class 2 relief valves.When the RHR system is operated for decay heat removal or low pressure letdown control, the.isolation valves between the RCS and the RHR suction relief valves are open, and the RHR_suct~ion relief valves are exposed to the RCS and are able to relieve pressure transients in the RCS.RCS Vent RequirementsOnce the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the'RCS at acceptable pressure levels in an RCS overpressure transient, if the relieving requirementsof the transient do not exceed the capabilities of the vent. *Thus, the vent path must be capable Qfrelieving the flow resulting from the limiting mass or heat input transient, and maintaining .pressure below the P/T limits for the analyzed isothermal events.For an RCS vent to meet the flow capacity requirement, it requires removing a Pressurizer safetyvalve, removing a Pressurizer manway, or similarly establishing a vent by opening* an RCS ventvalve provided that the opening meets the relieving capacity requirements. The vent path must beabove the level of reactor coolant, so as not to drain t/he RCS wheri open.MILLSTONE -UNIT 3B 3/4 4-17MILLTONE- UNT 3 3/4-17Amendment No. 1-5-7, 197 LBDCR No. 04-MP3-015February 24, 2005REACTOR COOLANT SYSTEMBASES iOVERPRES SURE PROTECTION SYSTEMS (continued)APPLICABLE SAFETY ANALYSISSafety analyses (Ref. 5) demonstrate that the reactor yessel is adequately protected againstexceeding the PIT limits for the analyzed isothermal events. In MODES 1, 2, AND3, and inMODE 4, with RCS cold leg temperature exceeding 2260F, the pressurizer safety valves willprovide RCS overpressure protection in the ductile region. At.2260F and below, overpressureprevention is provided by two means: (1) two OPERABLE relief valves, or (2) a depressurizedRCS with a sufficiently sized RCS vent, consistent with ASMIE Section XI, Appendix G fortemperatures less than RTNDT +/- 50OF. Each oftlhese means has a limuited overpressure reliefcapability.The required RCS temperature for a given pressure increases as the reactor vessel materialtoughness decreases due to neutron embrittlement. Each time the Technical. Specification curvesare revised, the cold overpressure protection must be re-evaluated to ensure its functionalrequirements continue to be met using the RCS relief valve method or the depressurized andvented RCS condition.Transients capable of overpressurizing the RCS are categorized as either mass or heat inputtransients, examples of which follow:Mass Input Transientsa. Inadvertent safety injection; orb. Charging/letdown flow mismatchHeat Input Transientsa. Inadvertent actuation of Pressurizer heaters;b. Loss of RHIR cooling; orc. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCSor between the RCS and steam generators.The Technical Specifications ensure that mass input transients beyond the OPERABILITY of thecold overpressure protection means do not occur by rendering all Safety Injection Pumps and all*but one centrifugal charging pump incapable of injecting into the RCS whenever an RCS cold legis _2260F.The Technical Specifications ensure that energy addition transients beyond the OPERABILITYof the cold overpressure protection means do not occur by limiting reactor coolant pump starts.LCO 3.4.1.4.1, "Reactor Coolant Loops and Coolant Circulation -COLD SHUTDOWN -LoopsFilled," LCO 3.4.1.4.2, "Reactor CoolantMILLSTONE -UNIT 3 B 3/4 4-18 Amendment No. 1-5-7, I-9-7,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015February 24, 2005REACTOR COOLANT SYSTEMBA.SESOVERPRESSURE PROTECTION SYSTEMS (continued)Loops and Coolant Circulatio~n -COLD SHUTDOWN -Loops Not Filled," and LCO 3.4.1.3,""'Reactor Coolant Loops and Coolant Circulation -HOT SHUTDOWN" limit starting the firstreactor coolant pump such that it shall not be started when any RCS loop wide range cold legtemperature is 226°F unless the secondary side water temperature of each steam generator is< 50°F above each RCS cold leg temperature. The restrictions ensure the potential energyaddition to the RCS from the secondary side of the steam generators will not result in an RCSoverpressurization event beyond the capability of the COPPS to mitigate. The COPPS utilizes thepressurizer PORVs and the RHR relief valves to. mitigate th~e limiting mass .and en~ergy additionevents, thereby protecting the isothermal reactor vessel b.eltline P/T limits. The restrictions w~illensure the reactor vessel. wili~be protected from a. cold .oyerpress~ure event whenlstartinag the firstRCP. If at least, one RCP is operating, no restrictions are necessary to start additional RCPs for'reactor vessel protection. In addition, this restriction only applies to RCS loops and associatedcomponents that are. not isolated from the reactor vessel.The RCP starting criteria are based on the equipment used to provide cold overpressureprotection. A maximum temperature differential of 50°F between the steam generator secondarysides and RCS cold legs will limit the potential energy addition to within the capability of the*pressurizer PORVs to mitigate the transient. The RHR relief valve are also adequate to mitigateenergy addition transients constrained by this temperature differential limit, provided all RCScold leg temperature are at or below 150°F. The ability of the RUR relief valves to mitigate.energ~y cold leg ,temperature is .above,.,500F has not analyzed.As a result, the temperature of the steam-generator secondary sides must 'be at or below the RCScold leg temperature if the RHR relief valves are providing cold overpressure protection and theRCS cold leg temperature is above 150OT.! MILLSTONE -UNIT 3 B 3/4 4-19 Amendment No. t4-7, -l-9-?,Acknowledged by NRC letter dated 08/25/05 August 27, 2001REACTOR COOLANT SYSTEMBASESOVERPRESSURE PROTECTION SYSTEMS (continued)The cold overpres sure transient analyses demonstrate that either one relief valve or thedepressurized RCS and RCS vent can maintain RCS pressure below limits when RCS letdown isisolated and only one centrifugal charging pump is operating. Thus, the LCO allows only onecentrifugal charging pump capable of injecting when cold overpressure protection is required:The cold overpressure protection enabling temperature is conservatively established at a value.< 226°F based on the *criteria provided by ASME Section XI, Appendix G.PORV PerformanceThe analyses show that the vessel is protected against non-ductile failure When the PORVs are setto open at the values shown in Figures 3.4-4a and 3.4-4b within the tolerance allowed for thecalibration accuracy. The curves are derived by analyses for both three and four RCS loopsunisolated that model the performance of the PORV cold overpressure protection system(COPPS), assuming the limiting mass and heat transients of one centrifugal charging pumpinjecting into the RCS, or the energy addition as a result of starting an RCP with temperatureasymmetry between the RCS and the steam generators. These analyses consider pressureovershoot beyond the PORV opening setpoint resulting from signal processing and valve stroke*times.The PORV setpoints in Figures 3.4-4a and 3.4-4b will be updated when the P/T limits conflict*with the cold overpressure analysis limits. The P/T limits are periodically modified as the reactorvessel material toughness decreases due to neutron embrittlement. Revised limits are determinedusing neutron fluence projections and the results of testing of the reactor vessel materialirradiation-survei~ltancee-speeimens. The .Baseso~for ,LCO -3.49-l,. "P..ressure/Temperature Limits -Reactor Coolant System (Except the Pressurizer)," dismiss these, e-valuations.The PORVs are considered active components. Thus, the failure of one PORV is assumed torepresent the worst case, single active failure.RHR Suction Relief Valve PerformanceThe RIIR suction relief valves do not have variable pressure and temperature lift s etpoints as dothe PORVs. Analyses show that one RHIR suction relief valve with a setpoint at or between426.8 psig and 453.2 psig will pass flow greater than that required for the limiting coldoverpressure transient while maintaining RCS pressure less than the isothermal P/T limit curve.Assuming maximum relief flow requirements during the limiting cold overpressure. event, anRHR suction relief valve will maintain RCS pressure to _< 110% of the nominal lift setpoint.Although each RHR suction relief valve is a passive spring loaded device, which meets singlefailure criteria, its location within the RHR System precludes meeting single failure criteria whenspurious RHR suction isolation valve or RIIR suction valve closure is postulated. Thus the los~s ofan RHR suction reliefMILLSTONE -UNIT 3B 3/4 4-20MILLTON -NIT3 B3/4-20Amendment No. I1-5g, 197 REACTOR COOLANT SYSTEM AUgust 27, 2001BASESOVFRPRESSURE PROTECTION SYSTEMS (conti~nued)valve is the worst case single failure. Also, as the RCS P/T limits are revisedto reflect change in toughness in the reactor vessel materials, the RHR suction.rel~ief valve's analyses must be re-evaluated to ensure continued accommodationof-:the design bases cold overpressure transients.RCS vent PerformanceWith the RCS depressurized, analyses show a vent size of > 2.0 square inches iscapable of mitigating the limiting cold overpressure transient. The capacitfofthis vent size is greater .than the flow of the limiting transient, whilemaintaining RCS pressure less than the maximum pressure on the isothermal P/Tlimit curve.The RCS vent size will be re-evaluated for compliance each time the isothermalP/I limit curves are revised.The RCS vent is a passive device and is not subject to active failure.The RCS vent satisfies Criterion 2 of 1OCFR50.36(c)(2)(ii).MILLSTONE- UNIT 3:B 3/4 4-21MILL TON -UIT .B /4 -21Amendment No. 197 REACTOR COOLANT SYSTEM August 27, 2001BASESOVERPRESSURE PROTECTION SYSTEMS (continued)LCOThis LCO requires that cold overpressure protection be OPERABLE and the maximummass input be limited to one charging pump. Failure to meet this LCO could leadto the loss of low temperature overpressure mitigation and violation of thereactor vessel isothermal P/T limits as a result of an operational transient.To limit the mass input capability, the LCO requires a maximum of one centrifugalcharging pump capable of injecting into the RCS.The elements of the LCO that provides low temperature overpressure mitigationthrough pressure relief are:I. Two OPERABLE PORVs; orA PORV is OPERABLE for cold overpressure protection when its block valve is*open, its lift setpoint is set to the nominal- setpoints provided for boththree and four loops unisolated by Figure 3.4-4a or 3.4-4b and when thesurveillance requirements are met.2. Two OPERABLE RHR suction relief valves; orAn RH-R suction relief valve is OPERABLE for cold overpressure protectionwhen its isolation valves from the RCS are open and when its setpoint is ator between 426.8 psig and 453.2 psig, as verified by required testing.3. One OPERABLE PORV and one OPERABLE RHR suction relief valve; or4. A depressurized RCS and an RCS vent.An RCS vent is OPERABLE when open with an area of > 2.0 square inches.Each of these methods of ovepressure prevention is Capable of mitigating thelimiting cold overpressure transient.MILLSTONE -UNIT 3B 3/4 4-Z2MILLTON -NIT B /4 -22Amendment No. 197 LBD CR No. 04-MP3-015February 24, 2005REACTOR COOLANT SYSTEMBASESOVERPRESSURE PROTECTION SYSTEMS (continued)APPLICABILITYThis LCO is applicable in MODE 4 when any RCS cold leg temperature is < 226°F, in MODE 5,and in MODE 6 when the head is on the reactor vessel. The Pressurizer safety valves provideRCS ovelrpressure protection in the ductile region (i.e. > 226°F). When the reactor head is off,overpressurization cannot occur.LCO 3.4.9.1 "Pressure/Temperature Limits" provides the operational P/T limits for all MODES.LCO 3.4.2, "Safety Valves," requires the OPERABILITY of the Pressurizer safety valves thatprovide overpressure protection during MODES 1, 2, and 3, and 4 when all RCS cold legtemperatures are > 226°F.Low temperature overpressure prevention is most critical during shutdown when the RCS is watersolid, and a mass or heat input transient can cause a rapid increase in RCS pressure when little orno time exists for operator action to mitigate the event.ACTIONSa. and b.With two or more centrifugal charging pumps capable of injecting into the RCS, or with any SIHpump capable of injecting into the RCS, RCS over~pressurization is possible.To immediately initiate action to restore restricted massinput capability to the Rcs reflects theurgency of removing the RCS from this condition.Required ACTION a. is modified by a Note that permits two centrifugal charging pumps capableof RCS injection for < 1 hour to allow for pump swaps. This is a controlled evolution of shortduration and the procedure prevents having two charging pumps simultaneously out of pull-to-lock while both charging pumps are capable of injecting into the RCS.c.In MODE 4 when any RCS cold leg temperature is < 226°F, with one required relief valveinoperable, the RCS relief valve must be restored to OPERABLE status within an allowed outagetime (AOT) of 7 days. Two relief valves in any combination of the PORVs and the RHR suctionrelief valves are requi'ed to provide low temperature overpressure mitigation while withstandinga single failure of an active component.MILLSTONE -UNIT 3 B 3/4 4-23 Amendmen~t No. 9-7,Acknowledged by NRC letter dated 0 8/25/05 LBDCR 12-MP3-010September 20, 2012REACTOR COOLANT SYSTEMBASESOVERPRES SURE PROTECTION SYSTEMS (continued')The AOT in MODE 4 considers the facts that only one of the relief valves is required to mitigatean overpressure transient and that the likelihood of an active failure of the remaining valve pathduring this time period is very low. The RCS must be depressurized and a vent must beestablished within the following 12 hours if the required relief valve is not restored toOPERABLE within the required AOT of 7 days.d.The consequences of operational events that will overpressure the RCS are more severe at lowertemperatures (Ref. 8). Thus, with one of the two required relief valves inoperable in MODE 5 orin MODE 6 with the head on, the AOT to restore two valves to OPERABLE status is 24 hours.The AOT represents a reasonable time to investigate and repair several types of relief valvefailures without exposure to a lengthy period with only one OPERABLE relief valve to protectagainst events. The RCS must be depressurized and a vent must be establishedwithin the following 12 hours if the required relief valve is not restored to OPERABLE within therequired AOT of 24 hours.e.The RCS must be depressurized and a vent must be established within 12 hours when bothrequired Cold Overpressure Protection relief valves are inoperable.The vent must be sized >_ 2.0 square inches to ensure that the flow capacity is greater than thatrequired for the worst case cold overpressure transient reasonable during the applicable MODES.This action is needed to protect the RCPB from a low temperature overpressureevent and apossible non-ductile failure of the reactor vessel.The time required to place the plant in this Condition is based on the relatively low probability ofan overpressure event during this time period due to increased operator awareness ofadministrative control requirements.SURVEILLANCE REQUIREMENTS4.4.9.3.1Performance of an ANALOG CHANNEL OPERATIONAL TEST is required within 31 daysprior to entering a condition in which the P0KV is required to be OPERABLE and at the[frequency specified in the Surveillance Frequency Control Program thereafter on each requiredPORV to verify and, as necessary, adjust its lift setpoint. The ANALOG CHANNELOPERATIONAL TEST will verify the setpoint in accordance with the nominal values given inFigures 3.4-4a and 3.4-4b. P0RV actuation could depressurize the RCS; therefore, valveoperation is not required.MILLSTONE -UNIT 3B 3/4 4-24MILLTONE- UNT 3 3/44-24Amendment No. 4-l-57-,4-97 LBDCR 12-MiP3-010September 20, 2012REACTOR COOLANT SYSTEMBASESOVERPRES SURE PROTECTION SYSTEMS (continued)Performance of a CHANNEL CALIBRATION on each required PORV actuation channel isrequired periodically to adjust the channel so that it responds and the valve opens within therequired range and accuracy to a known input. The surveillance frequency is controlled under theSurveillance Frequency Control Program.The PORV block valve must be verified open and COPPS must be verified anned periodically toprovide a flow path and a cold overpressure protection actuation circuit for each required PORVto perform its function when required. The valve is remotely verified open in the main controlroom. This Surveillance is perfonned if credit is being taken for the PORV to satisfy the LCO.The block valve is a remotely controlled, motor operated valve. The power to the valve operator isnot required to be removed, and the manual operator is not required to be locked in the openposition. Thus, the block valve can be closed in the event the PORV develops excessive leakageor does not close (sticks open) after relieving an overpressure transient.The surveillance frequency is controlled under the Surveillance Frequency Control Program.4.4.9.3.2Each required RH-R suction relief valve shall be demonstrated OPERABLE by verifying the .RHRsuction valves, 3R1IS*MV8701A and 3 RHS*M8701 C, are open when suction r.elief valve3PJHS*RV8708A is being used to meet the LCO and by verify"ing theRiHR suction valves,3RHS*MVT8702B and 3RHIS*MV\8702C, are open when suction relief valve 3RHS*RV8708B isbeing used to meet the LCO. Each required RHIR suction relief valve shall also be demonstratedOPERABLE by testing it in accordance with 4.0.5. This Surveillance is only required to beperformed if the RUR suction relief valve is being used to meet this LCO.The RHR suction valves are periodically verified to be open. The surveillance frequency iscontrolled under the Surveillance Frequency Control Program.The ASME Code for Operation and Maintenance of Nuclear Power Plants, (Reference 9), test per4.0.5 verifies OPERABILITY by proving proper relief valve mechanical motion and bymeasuring and, if re~quired, adjusting the lift setpoint.MILLSTONE -UNIT 3B 3/4 4-25MILLSONE -UNIT B 3/4-25Amendment No. 5, -I-97-, 2. LBDCR 12-MP3-010September 20, 2012REACTOR COOLANT SYSTEMdBASESOVERPRESSUJRE PROTECTION SYSTEMS (continued)4.4.9.3.3The RCS vent of> 2.0 square inches is proven OPERABLE periodically by verifying its opencondition. A removed Pressurizer safety valve fits this category.This passive vent arrangement must only be open to be OPERABLE. This Surveillance isrequired to be performed if the. vent is being used to satisfy the pressure relief requirements of theLCO. The surveillance frequency is controlled under the Suareillance Frequency ControlProgram.4.4.9.3.4 and 4.4.9.3.5To minimize the potential for a low temperature overpressure event by limiting the mass inputcapability, all SIHl pumps and all but one centrifugal charging pump are verified incapable ofinjecting into the RCS.The SIll pumps and charging pumps are rendered incapable of injecting into the RCS throughremoving the power from the pumps by racking the breakers out under administrative control.Alternate methods of control may be employed using at least two independent means to preventan injection into the RCS. This may be accomplished thr'ough any of the following methods:1) placing the pump in pull to lock (PTL) and pulling its UJC fuses, 2) placing the pump in pull tolock (PTL) and closing the pump discharge valve(s) to the injection line, 3) closing the discharge valve(s) to the injection line and either removing power from the valve operator(s) orlocking manual valves closed, and 4) closing the valve(s) from th~e injection source and eitherremoving power fr'om the valve operator(s) or locking manual valves closed.An SIN- pump may be energized for testing or for filling* teAcmulators provided it is incapableof injecting inato the RCS.The surveillance frequency is controlled under the Surveillance Frequency Control Program.REFERENCES1. ASME Boiler and Pressure Vessel Code, Section XI, Appendix G-, "FractureToughness for Protection Against Failure," 1995 Edition.2. ASME Section XI, Code Case N-640, "Alternative Reference Fracture Toughnessfor Development of P-T Lim~it Curves," dated February 26, 1999.3. Generic Letter 88-114. ASMiE, Boiler and Pressure Vessel Code, Section III5. FSAR, Chapter 156. lOCFR50, Section 50.467. 10CFR50, Appendix K8. Generic Letter 90-069. ASME Code for Operation and Maintenance of Nuclear Power PlantsMILLSTONE -UNIT 3 B 3/4 4-26 Amendmnent No. 1-5-7-, 4- 0 , May 8, 2002This page intentionally left blankMILLSTONE -UNIT 3B 3/4 4-27 Amendment No. X7204 REVERSE OF PAGE B 3/4-4-27INTENTIONALLY LEFT BLANK LBDCR 05-MP3-025March 7, 20063/4.5 EMERGENCY CORE COOLING SYSTEMSBASES3/4.5.1 ACCUMULATORSThe OPERABILITY of each Reactor Coolant System (RCS) accumulator ensures that a sufficientvolume of borated water will be immnediately forced into the reactor core through each of the coldlegs in the event the RCS pressure falls below the pressure of the accumulators. This initial surgeof water into the core provides the initial cooling mechanism during large RCS pipe ruptures.The limits on accumulator volume, boron concentration and pressure ensure that the assumptionsused for accumulator injection in the safety analysis are met.The accumulator power operated isolation valves are required to meet the guidance of "operatingbypasses" in the context of IEEE Std. 279-1971, which requires that bypasses of a protectivefunction be removed automatically whenever permissive conditions are not met. The "operatingbypass" designed for the isolation valves is applicable to MODES 1, 2, and 3 with Pressurizerpressure above P-Il1 setpoint. In addition, as these accumulator isolation valves fail to meetsingle failure criteria, removal of power to the valves is required.The limits for operation with an accumulator inoperable for any reason except an isolation valveclosed minimizes the time exposure of the plant to a LOCA event occurring concurrent withfailure of an additional accumulator which may result in unacceptable peak claddingtemperatures. If a closed isolation valve cannot be immediately opened, the full capability of oneaccumulator is not available and prompt action is required to place the reactor in a mode wherethis capability is not required.3/4.5.2 AND 3/4.5.3 ECCS SUBSYSTEMSThe OPERABILITY of two independent ECCS subsystems ensures that sufficient emergencycore cooling capability will be available in the event of a LOCA assuming the loss of onesubsystem through any single failure consideration. Either subsystem operating in conjunctionwith the accumulators is capable of supplying sufficient core cooling to limit the peak claddingtemperatures within acceptable limits for all postulated break sizes ranging from the double endedbreak of the largest RCS cold leg pipe downward. In addition, each ECCS subsystem provideslong-term core cooling capability in the re-circulation mode during the accident recovery period.With the RCS temperature below 350°F, one OPERABLE ECCS subsystem is acceptable withoutsingle failure consideration and with some valves out of normal injection lineup, on the basis ofthe stable reactivity condition of the reactor and the limited core cooling requirements.The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System isrequired to be available to support charging pump operation. The Charging Pump/Reactor PlantComponent Cooling Water Pump Ventilation System consists of two redundant trains, eachcapable of providing 100% of the required flow. Each train has a two position, "Off" and "Auto,"remote control switch. With the remote control switches for each train in the "Auto" position, thesystem is capable of automatically transferring operation to the redundant train in the event of alow flow condition in the operating train. The associated fans do not receive any safety relatedautomatic start signals (e.g., Safety Injection Signal).MILLSTONE -UNIT 3B3/5-AmnetNo -,B 3/4 5-1Amendment No. :t-5-7, LBDCR No. 05-MP3-025March 7, 2006EMERGENCY CORE COOLING SYSTEMSBASES "OECCS SUBSYSTEMS (Continued)Placing the remote control switch for a Charging Pump/Reactor Plant Component Cooling WaterPump Ventilation Train in the "Off' position to start the redundant train or" to per~form postmaintenance testing to verify availability of the redundant train will not affect the availability ofthat train, provided appropriate administrative controls have been established to ensure the remotecontrol switch is immediately returned to the "Auto" position after the completion of the specifiedactivities or in response to plant conditions. These administrative controls include the use of anapproved procedure and a designated individual at the control switch for the respective ChargingPump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respondto instructions from procedures, or control room personnel, based on plant conditions.The Surveillance Requirements provided to ensure OPERABILITY of each component ensuresthat at a minimum, the assumptions used in the safety analyses are met and that subsystemOPERABILITY is maintained. Surveillance Requirements for throttle valve position stopsprovide assurance that proper ECCS flows will be maintained in the event of a LOCA.Maintenance of proper flow resistance and pressure drop in the piping system to each injectionpoint is necessary to: (1) prevent total pump flow from exceeding runout conditions when thesystem is in its minimum resistance configuration, (2) provide the proper flow split betweeninjection points in accordance with the assumptions used in the ECCS-LOCA analyses, and :B.(3) provide an acceptable level of total ECCS flow to all injection points equal to or above that.assumed in the ECCS-LOCA analyses.Any time the OPERABILITY of an ECCS throttle valve or an ECCS Subsystem has been affectedby repair, maintenance, modification, or replacement activity that alter flow characteristics, postmaintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY.Surveillance Requirement 4.5.2.b.l1 requires verifying that the ECCS piping is full of water. TheECCS pumps are normally in a standby, nonoperating mode, with the exception of the operatingcentrifugal charging pump(s). As such, the ECCS flow path piping has the potential to developvoids and pockets of entrained gases. Maintaining the piping from the ECCS pumps to the RCSfull of water ensures that the system will perform properly when required to inject into the RCS.This will also prevent water hammer, degraded performance, cavitation, and gas binding of ECCSpumps, and reduce to the greatest extent practical the pumping of non-condensible gases (e.g., air,nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling.This Surveillance Requirement is met by:*VENTING the ECCS pump casings and VENTING or Ultrasonic Test (UT) of theaccessible suction and discharge piping high points including the ECCS pump suctioncrossover piping (i.e., downstream of valves 3RSS*MV8837A/B and3RSS*MV8838A/B to safety injection and charging pump suction). VENTING of the ,MILLSTONE -UNIT 3B 3/4 5-2MILSTOE -UNI 3 3/5-2Amendment No. 4-00, 4-4-7, -l--5-7, LBDCR No. 05-MP3-004April 21, 2005EMERGENCY COPE COOLING SYSTEMS.BASESECCS SUBSYSTEMS (Continued)accessible suction and discharge piping high points including the ECCS pump suctioncrossover piping is required when gas accumulations exceed the gas accumulationlimits. NOTE: Certain maintenance (e.g. ECCS pump overhaul) or other evolutions*can cause gas or air to enter the EGGS. VENTING of the affected portion of theECCS is necessary for these evolutions.*VENTING of the nonoperating centrifugal charging pumps at the suction line testconnection. The nonoperating centrifugal charging pumps do not have casing ventconnections and VENTING the suction pipe will assure that the pump casing does notvoids and pockets of entrained gases.*using ant external water level detection method for the water filled portions of the RSSpiping upstream of valves 3RSS*MV8837AJB and 3RSS*MV8838AJB. Whendeemed necessary by an external water level detection method, filling and venting toreestablish the acceptable water levels may be performed after entering LCO.ACTION statement 3.6.2.2 since VENTING without isolation of the affected trainwould result in a breach of the containment pressure boundary.The following ECCS subsections are exempt from this Surveillance:* the operating centrifugal charging pump(s) and associated piping -as an operatingpump is self VENTING and cannot develop voids and pockets of entrained gases.* the RSS pumps, since this equipment is partially dewatered during plant operation.Each RS S pump is equipped with a pump casing vent line that allows automaticVENTING of the pump casing prior to pump operation following an accident.I* the RSS heat exchangers, since this equipment is laid-up dry during plant operation.Gas is flushed out of the heat exchangers during the initial operation of the RS Spumps following an accident.* the RSS piping that is not maintained filled with water during plant operation. Theconfiguration of this piping is such that it is self VENTING upon initial operation ofthe RSS pumps.*the ECCS discharge piping within containment. These piping sections areinaccessible during reactor operations due to accessibility (containment entry), safety,and radiological concerns. They are static sections of piping relatively insensitive to* gas accumulations since these lines are stagnant during normal power operation. TheECCS discharge piping inside containment is filled and vented upon system return toservice.* the Residual Heat Removal (RI-R) heat exchangers. These are dual pass, verticalu-tube heat exchangers that do not allow direct measurement of gas voids. SystemMILLSTONE -UNIT 3 B 3/4 5-2a Amendment No. 4-1-@, 5-7,Acknowledged by NRC Letter dated 04/12/06 LBDCR 12-MIP3-O00September 20, 2012EMERGENCY CORE COOLING SYSTEMS ,l0BASESECCS SUB SYSTEMS (Continued)flush upon heat exchanger return to service and procedural compliance is relied upon toensure that gas is not present within the heat exchanger u-tubes.Surveillance Requirement 4.5 .2.C.2 requires that the visual inspection of the containment heperformed at least once daily iffthe contaimnent has been entered that day and when the finalcontainment entry is made. This will reduce the number of unnecessary inspections and also reducepersonnel exposure.Surveillance Requirement 4.5.2.d.2 addresses periodic inspection of the containment sump toensure that it is unrestricted and stays in proper operating condition. The surveillance fr'equency iscontrolled under the Surveillance Frequency Control Program.The Emergency Core Cooling System (ECCS) has several piping cross connection points foruse during the post-LOCA recirculation phase of operation. These cross-connection points allow theRecirculation Spray System (RSS) to supply water from the containment sump to the safety injectionand charging pumps. The RSS has the capability to supply both Train A and B safety injectionpumps and both Train A and B charging pumps. Operator action is required to position valves toestablish flow fr'om the containment sump through the RSS subsystems to the safety injection andcharging pumps since the valves are not automatically repositioned. The quarterly stroke testing(Technical Specification 4.0.5) of the ECC/RSS recirculation flowpath valves discussed below willnot result in subsystem inoperability (except due to other equipment manipulations to support valvetesting) since these valves are manually aligned in accordance with the Emnergency OperatingProcedures (EOPs) to establish the recirculation flowpaths. It is expected the valves will be returnedto the normal pre-test position following termination of the surveillance testing in response to the 9accident. Failure to restore any valve to the normal pre-test position will be indicated to the ControlRoom Operators when the ESF status panels are checked, as directed by the EOPs. The EOPs directthe Control Room Operators to check the ESF status panels early in the event to ensure properequipment alignment. Sufficient time before the recirculation flowpath is required is expected to beavailable for operator action to position any valves that have not been restored to the pretest position,including local manual valve operation. Even if the valves are not restored to the pre-test position,sufficient capability will remain to meet ECCS post-LOCA recirculationi requirements. As a result,stroke testing of the ECCS recirculation valves discussed below will not result in a loss of systemindependence or redundancy, and both ECCS subsystems will remain OPERABLE.When performing the quarterly stroke test of 3 SIH*MV8923A, the control switch for safetyinjection pump 3SIH*PIA is placed in the pull-to-lock position to prevent an automatic pump staitwith the suction valve closed. With the control switch for 3 SIH*PIA in pull-to-lock, the Train AECCS subsystem is inoperable and Technical Specification 3.5.2, ACTION a., applies. ThisACTION statement is sufficient to administratively contr'ol the plant configuration with theautomatic start of 3S1H*P1A defeated to allow stroke testing of 3SIH*MV8923A. In addition, theEOPs and the ESF status panels will identify this abnormal plant configuration, if not correctedfollowing the termination of the surveillance testing, to the plant operators to allow restoration of thenormal post-LOCA recirculation flowpath. Even if system restoration is not accomplished, sufficientequipment will be available to perfonn all ECCS and RSS injection and recirculation functions,provided no additional ECCS or RSS equipment is inoperable, and an additional single failure doesnot occur (an acceptable assumption since the Technical Specification ACTION statement limits theplant configuration time such that no additional equipment failure need be postulated). During theinjection phase the redundant subsystem (Train B) is fully functional, as is a significant portion ofthe Train A subsystem. During the recirculation phase, the Train A RSS subsystem can supply waterfrom the containment sumnp to the Train AMILLSTONE -UNIT 3B 3/4 5-2bMILLTON -NIT B 14 -2bAmendment No. -!00, 4-!4-, 4-5 LBDCR No. 05-MP3-004April 21, 2005EMERGENCY CORE COOLING SYSTEMvSBASESand B charging pumps, and the Train B RSS subsystem can supply water from the containmaentsump to the B safety injection pump.When performing the quarterly stroke test of 3 SIH*MV8923B, the control switch forsafety injection pump 3SIH*'PlB is placed in the pull-to-lock position to prevent an automaticpump start with the suction valve closed. With the control switch for 3SIW*P1B in pull-to-lock,the Train B ECCS subsystem is inoperable and Technical Specification 3.5.2, ACTION a.,applies. This ACTION statement is sufficient to administratively control the plant configurationwith the automatic start of 3SIH*PlB defeated to allow stroke testing of 3 SIH*VMV8923B. Inaddition, the EOPs and the ESE status panels will identify this abnormal plant configuration, ifnot corrected following the termination of the surveillance testing, to the plant operators to allowrestoration of the normal po st-LOCA recirculation flowpath. Even if system restoration is notaccomplished, sufficient equipment will be available to perform all ECCS and RSS injection andrecirculation functions, provided no additional ECCS or RSS equipment is inoperable, and anadditional single failure does not occur (an acceptable assumption since the TechnicalSpecification ACTION statement limits the plant configuration time such that no additionalequipment failure need be postulated). During the injection phase the redundant subsystem(Train-A) is fully functional, as is a significant portion of the Train B subsystem. During therecirculation phase, the Train A RSS subsystem can supply water from the containment sump tothe Train A and B charging pumps and the Train A safety injection pump. The Train B RSSsubsystem cannot supply water from the containment sump to any of the remaining pumps.When performing the quarterly stroke test of 3SIH*MV8807A or 3SIH*MV8807B,3 SIH*IMV8924 is closed first to prevent the potential injection of RWST water into the RCSthrough the operating charging pump. When 3S1H*MV8924 is closed, it is not necessary todeclare either ECCS subsystem inoperable..Although expected to be open for post-LOCArecirculation, sufficient time is expected to be available post-LOCA to identify and open31H*IV1-V8924 either from thle Control Room or locally at valve. The EOPs and the ESF statuspanels will identify this abnormal planlt configuration, if not corrected following the terminationof thle surveillance testing, to the plant operators to allow restoration of the normal po st-LOCArecirculation flowpath. Even if system restoration is not accoimplished, sufficient equipment willbe available to perform all ECCS and RSS binjection and recirculation functions, provided noadditional ECCS or RSS equipment is inoperable, eyen if a single failure is postulated. The failureto open 3SIH*'MV8924 due to mechanical binding or the loss of power to ECCS Train A could bethe single failure. If a different single failure is postulated, restoration of 3SIH'*MV8924 can beaccomplished. The closure of 3SIH*MV8924 has no affect on the injection phase. During therecirculation phase, assuming 3SIH*MI\V8924 remains closed (i.e., the single failure), the Train ARSS subsystem can supply water from the containmaent sump to the Train A and B chargingpumps, and the Train B RSS subsystem can supply water from the containment sump to the TrainA and B safety injection pumps. If power is lost to ECCS Train A and 3SIH*MV8924 is notopened locally (i.e., the single failure), cold leg recirculation can be accomplished by using RSSTrain B to supply containment sump water via 3SIW*PIB to the RCS cold legs and3S1L*MV8809B can be opened to supply containment sump water via RSS Train B to the RCScold legs. Hot leg recirculation can be accomplished by using RSS Train B to supply containmentsump water via 3SIH*PlB to the RCS hot legs and maintaining 3SIL*~MV8809B open to supplycontaimnent sump water via RSS Train B to the RCS cold legs.MILLSTONE -UNIT 3 B 3/4 5-2c Amendment No. 4-08, 7,, Ackn~owledged by NRC Letter dated 04/12/06 LBDCR No. 13-MP3-011October 30, 2013CORE COOLING SYSTEMSBASESECCS Subsystems: Auxiliary Building RPCCW Ventilation Area Temperature Maintenance:In MODES 1, 2, 3 and 4, two trains of 4 heaters each, powered from class 1E powersupplies, are required to support charging pump OPERABILITY during cold weather conditions.These heaters are required whenever outside temperature is less than or equal to 17°F.When outside air temperature is below 17°F, if both trains of heaters in the RPCCWVentilation Area are available to maintain at least 65°F in the Charging Pump and ReactorComporhent Cooling Water Pump areas of the Auxiliary Building, both charging pumps areOPERABLE for MODES 1, 2 and 3.When outside air temperature is below 17°F, if one train of heaters in the RPCCWVentilation Area is available to maintain at least 32°F in the Charging Pump and ReactorComponent Cooling Water Pump areas of the Auxiliary Building, the operating charging pump isOPERABLE, for MODE 4.With less than 4 OPERABLE heaters in either train, the corresponding train of charging isinoperable. This condition will require entry into the applicable ACTION statement for LCOs3.5.2 and 3.5.3.LCO 3.5.2 ACTION statement "b", and LCO 3.5.3 ACTION statemnent "c" addressspecial reporting requirements in response to ECCS actuation with water injection to the RCS.The special report completion is not a requirement for logging out of the ACTION statements thatrequire the reports.3/4.5.4 REFUELING WATER STORAGE TANKThe OPERABILITY of the refueling water storage tank (RWST) as part of the ECCSensures that a sufficient supply of borated water is available for injection by theECCS in theevzent of a LOCA. The limits on RWST minimum volume and boron concentration ensure that: (1)sufficient water is available within containmient to permit recirculation cooling flow to the core,and (2) the reactor will remain subcritical in the cold condition following a large break (LB)LOOA, assuming mixing of the RWST, RCS, EGGS water, and other sources of water that mayeventually reside in the sump, with all control rods assumed to be out. These assumptions areconsistent with the LOCA analyses.The contained water volume limit includes an allowance for water not usable because oftank discharge line location or other physical characteristics.The limits on contained water vo lumne and boron concentration of the RWST also ensure a pHvalue of between 7.0 and 7.5 for the solution recirculated within containment after a LOCA. ThispH band minimizes the effect of chloride and caustic stress corrosion on mechanical systems andcomponents.MILLSTONE -UNIT 3 B 3/4 5-2d Amendment No. 4-I0, ,-i4, ,-4-57, LBDCR No. 13-MP3-011October 30, 2013EMERGENCY CORE COOLING SYSTEMSBASESThe minimum and maxinmum solution temperatures for the RV\ST in MODES 1, 2, 3 and 4 arebased on the following:The 42°F minimum and 73 °F maximum solution temperature values identified within theTechnical Specifications include an operational margin of 2°F (e.g., measurement uncertainties,analytical uncertainties, and design uncertainties) from values used in accident analysis/pipingstress analysis. Accident analysis/piping stress analysis used 40°F and 75°F for the minimum andmaximum RWST solution temperature.MILLSTONE -UNIT 3 B3452B 3/4 5-2e 0REVERSE OP PAGE B 3/4 5-2eINTENTIONALLY LEFT BLANK 0 May 26, 1995EMERGENCY CORE COOLING SYSTEMS3/4.5.5 TRISODIUM pHOSpHATE STORAGEBASKETSBASESBACKGROUNDTrisodlum phosphate (TSP) dodecahydrate is stored in porous wire meshbaskets on the floor or in the sump of the containment building to ensure thatiodine, which may be dissolved in the recirculated reactor cooling waterfollowing a loss of coolant accident (LOCA), remains In solution, TSP alsohelps inhibit stress corrosion cracking (SCC) of austenitic stainless steelcomponents in containment during the recirculatlon phase following anaccident.Fuel that is damaged during a LOCA will release iodine in severalchemical forms to the reactor coolant and to the containment, atmosphere. Aportion of the iodine in the containment atmosphere is washed to the sump bycontainment sprays (i.e.., Quench Spray and/or Containment RecirculationSpray). The emergency core cooling water is borated for reactivity control.This borated water causes the sump solution to be acidic. In a low pH(acidic) solution, dissolved iodine will be converted to a volatile form. Thevolatile iodine will evolve out of solution Into the containment atmosphere,significantly increasing the levels of airborne iodine. The increased levelsof airborne iodine in containment contribute to the radiological releases andincrease the consequences from the accident due to containment atmosphereleakage.After a LOCA, the components of the core cooling and containment spraysystems will be exposed to high temperature borated water. Prolonged exposureto the core cooling water combined with stresses imposed on the components cancause SCC. The SCC is a function of stress, oxygen and chlorideconcentrations, pH, temperature, and alloy composition Of the components.High temperatures and low pH,.which would be present after a LOCA, tend topromote SCC. This can lead to the failure of necessary safety systems orcomponents.Adjusting the pH of the recirculation solution to levels above 7.0prevents a significant fraction of the dissolved iodine from converting to avolatile form. The higher pH thus decreases the level of airborne Iodine incontainment and reduces the radiological consequences from containmentatmosphere leakage following a LOCA. Maintaining the solution pH Z 7.0 alsoreduces the occurrence of SCC of austenltic stainless steel components incontainment. Reducing SCC reduces the probability of failure of components.Granular TSP dodecahydrate Is employed as a passive form of pH controlfor post LOCA containment spray and core cooling water. Baskets of TSP areplaced on the floor or In the sump of the containment building to dissolveMILLSTONE UNIT NO. 3 B 3/4 5-3 Amendment No.115 May 26, 1995CORE COOLING SYSTEMSBASES (continued)BACKGROUND (continued)from released reactor coolant water and containment sprays after a LOCA.Recirculation of the water for core cooling and containment sprays thenprovides mixing to achieve a uniform solution pH. The dodecahydrate form ofTSP is used because of the high humidity in the containment building duringnormal operation. Since the TSP is hydrated, it is less likely to abso~rblarge amounts of water from the humid atmosphere and will undergo lessphysical and chemical change than the anhydrous form of TSP.APPLICABLE SAFETY ANALYSESThe LOCA radiological consequences analysis takes credit for "iodineretention in the sump solution based on the recirculation water pH beingS7.0. The radionuclide releases from the containment atmosphere and theconsequences of a LOCA would be increased if the pH of the recirculation waterwere not adjusted to 7.0 or above.LIMITING CONDITION FOR OPERATIONThe TSP is required to adjust the pH of the recirculation water to Z 7.0after a LOCA. A pH 7.0 after a LOCA is necessary to prevent significantamounts of iodine released from fuel failures and dissolved in therecirculation water from converting to a volatile form and evolving into thecontainment atmosphere. Higher levels of airborne iodine in containment mayincrease the release of radionuclides and the consequences of the accident. ApH 7.0 is also necessary to prevent SCC of austenitic stainless steelcomponents in containment. SCC increases the probability of failure ofcomponents.The required amount of TSP is based upon the extreme cases of watervolume and pH possible in the containment sump after a large break LOCA. Theminimum required volume is the volume of TSP that will achieve a sump solutionpH of 7.0 when taking into consideration the maximum possible sump watervolume and the minimum possible pH. The amount of TSP needed in thecontainment building is based on the mass of TSP required to achieve thedesired pH. However, a required volume Is specified, rather than mass, sinceit Is not feasible to weigh the entire amount of TSP In containment. Theminimum required volume is based on the manufactured density of TSPdodecahydrate. Since TSP can have a tendency to agglomerate from highhumidity In the containment building, the density may increase and the volumedecrease during normal plant operation. Due to possible agglomeration andincrease in density, estimating the minimum volume of TSP in containment isconservative with respect to achieving a minimum required pH.MILLSTONE UNIT NO. 3 B 3/4 5-4 Amendment No. 1150303 LBDCR 12-MP3-010September 20, 2012EMERGENCY CORE COOLING SYSTEMSBASES (Continued)APPLICABILITYIn MODES 1, 2, 3, and 4, a design basis accident (DBA) could lead to a fission productrelease to containment, that leaks to the secondary containment boundary. The large break LOCA,on which this system's design is based, is a full-power event. Less severe LOCAs and leakage stillrequire the system to be OPERABLE thraoughout these MODES. The probability and severity of aLOCA decrease as core power and reactor coolant system pressure decrease. With the reactor shutdown, the probability of release of radioactivity resulting from such an accident is low.In MODES 5 and 6, the probability and consequence of a DBA are low due to the pressureand temperature limitations in these MODES. Under these conditions, the SLCRS is not requiredto be OPERABLE.ACTIONSIf it is discovered that the TSP in the containment building sump is not within limits,action must be taken to restore the TSP to within limits. During plant operation, the containmentsuinp is not accessible and corrections may not be possible.The 7-day Completion Time is based on the low probability of a DBA occurring duringthis period. The Completion Time is adequate to restore the volume of TSP to within the technicalspecification limits.If the TSP cannot be restored within limits within the 7-day Completion Time, the plantmust be brought to a MODE in which the LCO does not apply. The specified Completion Timesfor reaching MODES 3 and 4 are those used throughout the technical specifications; they werechosen to allow reaching the specified conditions from full power in an orderly manner andwithout challenging plant systems.SURVEILLANCE REQUIREMENTSSurveillance Requirement 4.5.5Periodic determination of the volume of TSP in containment must be perfonned due to thepossibility of leaking valves and components in the containment building that could causedissolution of the TSP during nonmal operation. This requirement ensures that there is anadequate volume of TSP to adjust the pH of the post LOCA sump solution to a value > 7.0. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3B 3/4 5-5MILLTON -NIT3 B3/45-5Amendment No. 14-5-, 204

• 0REVERSE OF PAGE B 3/4 5-5 iTNTENTIONALLY LEFT BLANK 0 LBDCR No. 06-MP3-026October* 15,. 20063/4.6 CONTAINMENT sYSTEMSBASES3/4.6.1 PRIMARY CONTAINMENT3/4.6.1.1 'CONTAINMENT INTEGRITYPrimary CONTAINMENT INTEGRITY ensures that the release of radioactive materialsfrom the containment atmosphere will be restricted to those leakage paths and associated leakrates assumed in the safety analyses. This restriction, in conjunction with the leakage ratelimitation, will. limit the SITE BOUNDARY radiation doses to within the dose guidelines of10 CFR 50.67 during accident conditions and the control room operators dose to withintheguidelines of GDC 19.* Prim~ary .CONTAINM. ENT INTEGR.TY is-req~ui.red i:.n .MODE...!.h_.ugl;;:, 4 i .......press~ure, low pressufizer pressure and low steam~line pressure. In MODE 4 the automaticcontainment isolation* signals generated by high containment pressure, low pressurizer pressureand 10ow steamline pressure .ar~e not required to be OPERABLE. Automatic actuation of thecontainment i solation system in-MODE 4 is not required because adequate time is available forplant operators to evaluate plant Conditions and respond by manually operating engineered safetyfeatures components. Automatic actuation logic and actuation relays must be OPERABLE inMODE 4 to support system level manual initiation. Since the manual actuation pushbuttonsporti~on.;of the containment isolation system is required to be OPERABLE in MODE 4, the plantoperators can. use the manual pushbuttons to rapidly position all automatic containment isolationvalves to the required accident positioni. Therefore, the containment isolation actuationpushbuttons satisfy the requirementfor an OPERABLE containment automatic isolation valvesystem in MODE 4."3/4.6.1.2 CONTAINMENT LEAKAGEThe limitations on containment leakage rates, as specified in the Containment LeakageRate Testing Program,. ensure that the total containment~leakage volume will not exceed the valueassumed in the safety analyses at the peak accident pressure, P a- As an added conservatism, themeasured overall integra~ted leakage rate is flurther limited to less than 0.75 La during performnanceof the periodic test to account for possible degradation of the containment leakage barriersbetween leakage tests..*The Limiting Conditioh for Operation defines the limitations on containment leakage.The leakage rates are verified by surveillance testing as specified in the Containment LeakageRate Testing Program, in accordance with therequirements of Appendix J. Although the LCOspecifies the leakage rates at accident pressure, Pa, it is not feasible to perform a test at such anexact vahue for~pressiire. Consequently, the surveillance testing is performed at a pressure greaterthan or equal to Pa to. account for test instrument uncertainties and stabilization changes. Thisconservative test pressure en'sures that the measured leakage ratesMILLSTONE -UNIT 3 B 3/4 *6-1 Amendment No. 5gg, 89, 1-, 54, 4-1-6, 2-1-6NRC Verbal Acknowledgement: 07/05/07 May 15, 20023/4.6 CONTAINMENT SYSTEMSBASES3/4.6.1.2 CONTAINMENT LEAKAGE (continued)are representative of those which would occur at accident pressure while meeting the intent of theLCO. This test methodology is in accordance with the Containment Leakage Rate TestingProgram.The surveillance testing. for~measuring leakage rates' are in accordance with theContainment Leakage Rate Testing Program.The enclosure building bypass leakage paths are listed in the "Technical RequirementsManual." The addition or deletion of the enclosure buiilding bypass leakage paths shall be madein accordance with Section 50.59 of 10CFR50.and approved by the Plant Operations ReviewCommittee.Th& requireiiii: :t~ ar6 "ri:di~fi~d !by a -1f46tg That allow6 'nfy it:id exift (6efon.repairs on the affected air lock components. .This means there, m~ay be a short time during whichthe containment boundary .is not intact (e.g., duri~ng access through the OPERABLE door). The -ability to open the OPERABLE door, even if it means the containment boundary is temporarilynot intact, is acceptable due to the low probability of an evenit that could pressurize thecontainment during the short time in which the OPERABLE door is expected to be open. After.each entry and exit, the OPERABLE door must be immediately closed.ACTION a.. is only applicable when one air lock door is inoperable.. With only one airlock door inoperable, the remaining OPERABLE air lock door murst be verified closed within 1hour. This ensures a leak tight containment barrier is maintained by use of the remaining*OPERABLE air lock door. The 1lhour requirement is consistent with the requirements of.Technical Specification 3.6.i. 1 to restore CONTAINMENT INTEGRITY. In addition, theremaining OPERABLE air lock door must be locked closed within 24 hours and then verifiedperiodically to ensure an acceptable containment leakage bounda~ry is maintained. Otherwise, aplant shutdown is required.ACTION b. is only applicable when the air lock door intdrlock mechanism is inoperable.With only the air lock interlock mechanism inoperable, an. OPERABLE air lock door must beverified closed within 1 hour. This ensures a leak tight containment barrier is maintained by useof an OPERABLE air lock door. The 1 hour requirement is consistent with the requirements ofTechnical Specification 3.6.1.1 to restore.CONTAJNMENT INTEGRITY. In addition, anOPERABLE air" lock door must be locked closed within 24 hours and then verified periodically toensure an acceptable containment leakage boundary is maintained. Otherwise, a. plant shutdownis required. In addition, entry into and exit from containment under the control of a dedicatedindividual stationed at the air lock to ensure that only one door is opened at a time (i. e., theindividual perfoimas the function of the in~terlock) is permitted.ACTION c. is applicable when both air lock doors, are inoperable, or the air lock isinoperable for any other reason excluding the door interlock mechanism. With both air lock doorsinoperable or the air lock otherwise inoperable, an evaluation of the overall containmaent leakagerate per Specification 3.6.1.2"MILLSTONE -UNIT 3 B 3/4 6-1la Amendment No. 59189, 4-4,4--7-7,4-1-6,205 3/4.6 .CONTAINMENT SYSTEMS.-May 15, 2002BASES3/4.6.1.3. CONTAINMENT.AIR.LOCKS (continued).shall be initiated immediately, and an air lock door must be verified closedwithin 1.hour. .An evaluation..is acceptable since it is overly .conservative to.i y decl.are .the. cont ai nment .i noper.ab~le eif both doors in the. air .lock. have.failed, a seal-test or if overall a~ir.lockileakage *is not within limi~ts. In many.instances (e.g.,i .only..one. seal iper doQor has fai~led), containment: remainsOPERABLE, yet only 1 hour (.per'..S'pecificati~on"3.6.1.1). woul'd'.be provided to.restore the air .lock to OPERABLE status pri~or to requiri~ng ap1lant s~hutdown.. Inaddition,, even with both.'dOors .fail inlg the seal test., .the. ove~rall, leakage rate can still be within limits. The 1 hour requirement is consistentwith the requirements of Technical Specification 3.6.1.1 to restore CONTAINMENTINTEGRITY. In'addit~ion, the air.lock, and/or at least one air lock door' must be.restored to .OPERABLE. status within .24 hours or a-plant *shutdown is..required...SurveilIlance Requi rement 4 .*6.1..3. a .veri fi es leakage through the .cont ainmentair l ock..i~s within' the requirements specified in' the. Containment .Leakage, Rate.Testing Program. T!he containment air *lock leakage results are account'ed for inthe combined: Type Band C containment, leakage, rate. Failure of an a'ir lock doordoes not invalidate the previous satisfactory overall air lock leakage testbecause either air lock door is capable of providing a fission product barrierin the event of a design basis accident.The .limitations on. closure rate for .the containment air locksare required to meet the restrictions on CONTAINMENT INTEGRITY and containmentleak rate. Surveillance.testing of the air lock seals is performed in accordancewith the Containment Leakage Rate Testing Program, which ensures that the overallair lock leakage will not become excessive due .to seal damage during theintervals between air lock leakage tests. While the leakage rate limitation isspecified at accident pressure, Pa the actual surveillance testing is performedby applying a pressure greater than or equal to Pa. This higher pressureaccounts for test instrument uncertainties and test volume stabilization changeswhich occurs under actual test conditions.3/4.6.1.4 and 3/4.6.1.5 AIR PRESSURE and AIR TEMPERATUREThe limitations on containment pressure and average air 'temperatureensure that: (1) the containment structure is prevented from exceeding itsdesign negative pressure 'of 8 psia, and (2) the containment peak pressure doesnot exceed the design pressure of 60 psia during LOCA conditions. Measure-ments .shall be made at all listed locations, whether by fixed or portableinstruments, prior to determining the average air temperature. The limits onthe pressure and average air temperat~ure are consistent with the assumptionsof the safety analysis. The minimum total containment pressure of 10.6 psiais determined by summing the minimum 'permissible. air partial pressure of.8.9 psia and the maximum expected vapor pressure of .l.7 psia (occurring at themaximum permissible containment initial temperature of 1200F).MILLSTONE -UNIT 3 B3 3/4 6-lb Amendment No. ;I#082 77, 7 zo25 REVERSE OF PAGE B 3/4 6-lbINTENTIONALLY LEFT BLANK June 3, 2002CONTAINMENT SYSTEMSBASES3/4.6.1.6 CONTAINMENT STRUCTURAL INTEGRITYThis limitation ensures that the structural integrity of the containment will be manahtainedcomparable to the original design standards for the life of the facility. Structural integrity isrequired to ensure that the containment will withstand the maximum pressure of 60 psia in theevent of a LOCA. A visual inspection, in accordance with the Containment Leakage Rate TestingProgram, is sufficient to demonstrate this capability.3/4.6.1.7 CONTAINMENT VENTILATION SYSTEMThe 42-inch containment purge supply and exhaust isolation valves are required to be lockedclosed during plant operation since these valves have not been demonstrated capable of closingduring a LOCA or steam. line break accident. Maintaining these valves closed during plantoperations ensures that excessive quantities of radioactive materials will not be released via theContainment Purge System. To provide assurance that these containment valves cannot beinadvertently opened, the valves are locked closed in accordance with Standard Review Plan 6.2.4which incudes mechanical devices to seal or lock the valve closed, or prevents power from beingsupplied to the valve operator.The Type C testing frequency required by 4.6.1.2 is acceptable, provided that the resilient seats ofthese valves are replaced every other refueling outage.3/4.6.2 DEPRESSURIZATION AND COOLING SYSTEMS3/4.6.2.1 and 3/4.6.2.2 CONTAINMENT OUENCH SPRAY SYSTEM and RECIRCULATIONSPRAY SYSTEMThe OPERABILITY of the Containment Spray Systems ensures that containmefltdepressurization and iodine removal will occur in the event of a LOCA. The pressure reduction,iodine removal capabilities and resultant containment leakage are consistent with the assumptionsused in the safety analyses.LCO 3.6.2.2One Recirculation Spray System consists of:* Two OPERABLE contaimnent recirculation heat exchangers* Two OPERABLE contaiznment recirculation pumpsThe Contaimnent Recirculation Spray System. (RSS) consists of two paralle redundantsubsystems which feed two parallel 360 degree spray headers. Each subsystem consists of twopumps and two heat exchangers. Train A consists of 3RSS*P1A and 3R5S*P1C. Tamn B consistsof 3RSS*PIB and 3RSS*PID.MILLSTONE -UNIT 3 B 3/4 6-2 Amendment No. 145,4-4,"Revised by NRC Letter A15710" LIBDCR 12-MP3-010September 20. 2012CONTAINMENT SYSTEMSBASESThe design of the Containment RSS is sufficiently independent so that an active failure in therecirculation spray mode, cold leg recirculation mode, or hot leg recirculation mode of the ECCShas no effect on its ability to perform its engineered safety function. In other words, the failure inone subsystem does not affect the capability of the other subsystem to perfonn its designatedsafety function of assuring adequate core cooling in the event of a design basis LOCA. As long asone subsystem is OPERABLE, with one pump capable of assuring core cooling and the other*pump capable of removing heat from containment, the RSS system meets its design requirements.The LCO 3.6.2.2. ACTION applies when any of the RSS pumps, heat exchangers, or associatedcomponents are declared inoperable. All four RSS pumps are required to be OPERABLE to meetthe requirements of this LCO 3.6.2.2. During the injection phase of a Loss Of Coolant Accidentall four RSS pumps would inject into containment to perform their contaimnent heat removalfunction. The minimum requirement for the RSS to adequately perform this function is to have atleast one subsystem available. Meeting the requirements of LCO 3.6.2.2. ensures the minimumRSS requirements are satisfied.Surveillance Requirement 4.6.2.2.c requires that verification is made that on a CDA test signal,each RSS pump starts automatically after receipt of an RWST Low-Low level signal. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.6.2.1.d and 4.6.2.2.e require verification that each spray nozzle isunobstructed following maintenance that could cause nozzle blockage. Nonnal plant operationand maintenance activities are not expected to trigger performance of these surveillancerequirements. However, activities, such as an inadvertent spray actuation that causes fluid flowthrough the nozzles, a major configuration change, or a loss of for~eign material control whenworking within the respective system boundary may require surveillance performance. Anevaluation, based on the specific situation, Will detennine the appropriate test method (e.g., visualinspection, air or smoke flow test) to verify no nozzle obstruction.MILLSTONE -UNIT 3 B3462 mnmn oB 3/4 6-2aAmendment No.

LBDCR 12-MIP3-010September 20, 2012CONTAINMENT SYSTEMSBASES3/4.6.3 CONTAINMEvffNT ISOLATION VALVESThe OPERABILITY of the contairnment isolation valves ensures that the containmentatmosphere will be isolated from the outside environment in the event of a release of radioactivematerial to the containment atmosphere or pressurization of the containment and is consistentwith the requirements of General Design Criteria 54 through 57 of Appendix A to10 CFR Part 50. Containment isolation within, the time limits specified for these isolation valvesdesigned to close automatically ensures that the release of radioactive material to the environmentwill be consistent with the assumptions used in the analyses for a LOCA. FSAR Table 6.2-65 listsall containment isolation valves. The addition or deletion of any contaimnent isolation valve shallbe made in accordance with Section 50.59 of 10OCFR50 and approved by the committee(s) asdescribed in the QALP Topical Report.For the purposes of meeting this LCO, the safety function of the containment isolationvalves is to shut within the time limits assumed in the accident analyses. As long as the valves canshut within the time limits assurned in the accidefit analyses, the valves are OPERABLE. Wherethe valve position indication does not affect the operation of the valve, the indication is notrequired for valve OPERABILITY under this LCO. Position indication for contaimnent isolationvalves is covered by Technical Specification 6.8.4.e., Accident Monitoring Inastrumentation.Failed position ...indication on these valves must be restored "as soon as practicable" .as re quired byTechnical Specification 6.8.4.e.3. Maintaining the valves OPERABLE, when position indicationfails, facilitates troubleshooting and correction of the failure, allowing the indication to berestored "as soon as practicable.".. With one or more penetration flow paths with one containanent isolation valve inoperable,the inoperable valve must be restored to OPERABLE status or the affected penetration flow pathmust be isolated. The method of isolation must include the use of at least one isolation barrier thatcannot be adversely affected by a single active failure. Isolation barriers that meet this criterionare a closed and deactivated automatic valve, a closed manual valve, and a blind flange. A checkvalve may not be used to isolate the affected penetration.If the containment isolation valve on a closed system becomes inoper'able, the remainingbarrier is a closed system since a closed system is an acceptable alternative to an automatic valve.However, actions must still be taken to meet Technical Specification ACTION 3.6.3 .d and thevalve, not nonnally considered as a containment isolation valve, and closest to the containmentwall should be put into the closed position. No leak testing of the alternate valve is necessary tosatisfy the ACTION statement. Placing the manual valve in the closed position sufficientlydeactivates the penetration for Technical Specification compliance." Closed system isolation valves applicable to Technical Specification ACTION 3.6.3.d areincluded in FSAR Table 6.2-65, and are the isolation valves for those penetrations credited asGeneral Design Criteria 57. The specified time (i.e., 72 hours) of Technical SpecificationACTION 3.6.3.d is reasonable, considering the relative stability of the closed system (hence,reliability) to act as a penetration isolation boundary and the relative importance of supportingcontainment OPERABILITY during MODES 1, 2, 3 and 4. In the event the affected penetration isisolated in accordance with 3.6.3.d, the affected penetration flow path must be verified to beisolated on a periodic basis, (Surveillance Requirement 4.6.1.1 .a). This is necessary to assure leaktightness of contaimnent and that containment penetrations requiring isolation following anaccident are isolated. The surveillance frequency is controlled under the Surveillance FrequencyControl Program.MILLSTONE -UNIT 3B 3/4 6-3MILLTONE- UNT 3 3/46-3Ameihdment No. 2-8, 62:-, 4-4-2_,2-- LBDCR 05-MiP3-028November 30, 2005CONTAINMENT SYSTEMS OBASESFor the purposes of meeting this LCO, neither the containmaent isolation valve, nor anyalternate valve on a closed system have a leakage limit associated with valve OPERABILITY.The opening of contafinment isolation valves on an fintermittent basis under administrativecontrols includes the following considerations: (1) stationing an operator, who is in constantcommunication with the control room, at the valve controls, (2) instructing this operator to closethese valves in an accident situation, and (3) assuring that environmnental conditions will notpreclude access to close the valves and that this action will prevent the release of radioactivityoutside the containment.The appropriate administrative controls, based on the above considerations, to allowcontainment isolation valves to be opened are contained in the procedures that will be used tooperate the valves. Entries should be placed in the Shift Manager Log when these valves areopened or closed. However, it is not necessary to log into any Technical Specification ACTIONStatement for these valves, provided the appropriate administrative controls have beenestablished.Opening a closed containmaent isolation valve bypasses a plant design feature thatprevents the release of radioactivity outside the contafi~nment. Therefore, this should not be donefrequently, and the time the valve is opened should be minimized. The determination of the appropriate administrative controls for containment isolation valves requires an evaluation of the 'expected environmnental conditions. This evaluation must conclude environmental conditions willnot preclude access to close the valve, and this action will prevent the release of radioactivityoutside of contafinment through the respective penetration.When the Residual Heat Removal (RHR) System is placed in. service finthe plantcooldown mode of operation, the RIIR suction isolation remotely operated valves3RHS*MV8701A and 3RHS*MV8701B, and/or 3RTIS*MV8702A and 3RP-IS*MV8702B areopened. These valves are nonnally operated fr~om the control room. They do not receive anautomatic containment isolation closure signal, but are interlocked to prevent their opening ifReactor Coolant System (RCS) pressure is greater than approximately 412.5 psia. When any ofthese valves are opened, either one of the two required licensed (Reactor Operator) control roomoperators can be credited as the operator required for administrative control. It is not necessary touse a separate dedicated operator.3/4.6.4 DELETEDMILLSTONE -UNIT 3 B 3/4 6-3a Amendment No. 2--, 6-3, -42_ ---,0Acknowledged by NRC Letter dated 04/12/06 LBDCR 05-MP3-028November 30, 2005THIS PAGE INTENTIONALLY LEFT BLANK9YILLSTONE -UNIT. 3B 3/4 6-3bAmendment No. , 6-3,. 4-4, 24l-6,.Acknowledged by NRC Letter dated 04/12/06 LBDCR 05-MP3-028November 30, 2005THIS PAGE INTENTIONALLY LEFT BLANKMILLSTONE -uNIT3B 3/46-3cAmendment No. 6-3-, 442, 6Acknowledged by NRC Letter dated 04/12/06 LBDCR 05-MP3-028November 30, 2005CONTAINMENT SYSTEMSBASES3/4.6.5 SUJBATMOSPHERIC PRESSURE CONTROL SYSTEM3/4.6.5.1 STEAM JET AIR EJECTORThe closure of the isolation valves in the suction of the steam jet air ejector ensures that:(1) the containment internal pressure may be maintained within its operation limits by themechanical vacuum pumps, and (2) the containment atmosphere is isolated from the outsideenvironment in the event of a LOCA. These valves are required to be closed for containmentisolation.MILLSTONE -UNIT 3B 3/4 6-3d... Amendment No. 3-3, 4-42, 216,Acknowledged by NRC Letter dated 04/12/06 REVERSE OF PAGE B 314 6-3dINTENTIONALLY LEFT BLANK June 3, 2002CONTAINMENT SYSTEMSBASES3/4.6.6 SECONDARY CONTAINMENT3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEMB ack ground.The OPERABILITY of the Supplementary Leak Collection and Release System (SLCRS)ensures thatradioactive materials that leak from the primary containment into the SecondaryContainment following a Design Basis Accident (DBA) are filtered out and adsorbed prior to any.release to the environment.SLCRS Ductwork Integrity:The Supplementary Leak Collection and Release System (SLCRS) remains OPERABLEwith the following bolting*configuration:a. For 311VR*DMPF44:* Eight bolts properly installed on the ductwork access panels.* At least one bolt must be installed in each corner area.*The remaining bolts should be installed in the center area of each side.b. For 3HVR*DMPF29:* 12 bolts properly installed on the ductwork access panel.* At least one bolt must be installed in each corner area.* The remaining bolts should be approximately equally spaced along each sidewith two bolts per side.With the above bolting specified for- 3HVR*DMPF44 and 3HVR*DMPF29, reference* (l)concluded the foillowing:..* Any leakage around the plates is minimal and causes negligible effect on theperformance of the SLCRS system.* Assures the gasket will not be extruded from between the plate and duct flangewhen the. SLCRS fans are started.* The remaining bolts may be installed with the fans running.* Provides adequate structural integrity in the seismic event based onengineering analysis.Applicable Safety AnalysesThe SLCRS design basis is established by the consequences of the limiting DBA, which isa LOCA. The accident analysis assumes that only one train of the SLCRS and one train of the.auxiliary building filter system is functional due to a single failure that disables the other train.The accident analysis accounts for the reduction of the airborne radioactive material provided bythe remaining one train of this filtration system. The amount of fission products available forrelease from the containment is determined for a LOCA.The SLCRS is not normally in operation. The SLCRS starts on a SIS signal. Themodeled SLCRS actuation in the safety analysis (the Millstone 3MILLSTONE -UNIT 3 B 3/4 6-4 Amendment No. 87 4-2-6,"Revised by NRC Letter A15710". LBDCR No. 04-MP3-015February 24, 2005CONTATNMENT SYSTEMSBASES O3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued)FSAR Chapter 15, Section 15.6) is based upon a worst-case response time following an SIinitiated at the limiting setpoint. One train of the SLCRS in conjunction with the AuxiliaryBuilding Filter (ABF) system is capable of drawing a negative pressure (0.4 inches water gauge at.the auxiliary building 24'6" elevation) within 120 seconds after a LOCA. This time includesdiesel generator startup and sequencing time, system startup time, and time for the system toattain the required negative pressure after starting.LCOIn the event of a DBA, one SLCRS is required to provide the minimum postulated iodineremoval assumed in the safety analysis. Two trains of the SLCRS must be OPERABLE to ensurethat at least one train will operate, assuming that the other train is disabled by a single-activefailure. The SLCRS works in conjunction with the ABF system. Inoperability of one train of theABF system also results in inoperability of the corresponding train of the SLCRS. Therefore,whenever LCO 3.7.9 is entered due to the ABF train A (B) being inoperable, LCO 3.6.6.1 must beentered due to the SLCRS train A (B3) being inoperable.When a SLCRS LCO is not met, it is not necessary to declare the secondary containmentinoperable. However, in this event, it is necessary to determine that a loss of safety function doesnot exist. A loss of safety function exists when, assuming no concurrent single failure, a safetyfunction assumed in the accident analysis cannot be performed.ApplicabilityIn MODES 1, 2, 3, and 4, a DBA could lead to a fission product release to containmentthat leaks to the seco~idar contaipnment. Th~e !rge b~reak LOCA, o~n whic. sys!ter's d~e sign isbased, is a full- power event. Less severe LOCAs and leakage still require the syst.em to beOPERABLE throughout these MODES. The probability and severity of a LOCA decrease as*core power and reactor coolant system pressure decrease. With the reactor shut down, theprobability of release of radioactivity resulting from such, an accident is low.In MODES 5 and 6, the probability and consequences of a DBA are low due to thepressure and temperature limitations in these MODES. Under these conditions, the SLCRS is notrequired to be OPERABLE.ACTIONSWith one SLCRS train inoperable, the inoperable train must be restored to OPERABLEstatus within 7 days. The OPERABLE train is capable of providing 100 percent of the iodineremoval needs for a DBA. The 7-day Completion Time is based on consideration of such factors* as the reliability of the OPERABLE redundant SLCRS train and the low probability of a DBAoccurring during this period. The Completion Time is adequate to make most repairs. If theSLCRS cannot be restored to OPERABLE status :within the required Completion Time, the plantmust be brought to a MODE in which the LCO does not apply. To achieve this status, the plantmust be brought to at least MODE 3 within 6 hours and MODE 5 within the following 30 hours.The allowed Completion Times are reasonable, based on operating experience, to reach therequired plant conditions from full-power conditions in an orderly manner and withoutchallenging plant systems.MILLSTONE -UNIT 3 B 3/4 6-5 Amendment No. g-7, -I-2-6,Acknowledged by NRC letter dated 08/25/05 LBDCR 12-MTP3-010September 20, 2012CONTAINMENT SYSTEMSBASES3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued)Surveillance RequirementsCumulative operation of the SLCRS with heaters operating for at least 10 continuous hours issufficient to reduce the buildup of moisture on the adsorbers and HEPA filters. The surveillancefrequency is controlled under the Surveillance Frequency Control Program.b, c, e, and fThese surveillances verify that the required SLCRS filter testing is performed in accordance withRegulatory Guide 1.52, Revision 2. ANSI N510-1980 shall be used in place of ANSI N510-1975referenced in Regulatory Guide 1.52, Revision 2. Laboratory testing of methyl iodide penetrationshall be performed in accordance with ASTM D3803-89 and Millstone Unit 3 specificparameters. The surveillances include testing HEPA filter perfonnance,. charcoal adsorberefficiency, system flow rate, and the physical properties of the activated charcoal (general use andfollowing specific operations). The heater kW measured must be corrected to its nameplate rating.Variations in system voltage can lead to measurements of kW which cannot be compared to thenameplate rating because the output kW is proportional to the square of the voltage.Any time the OPERABILITY of a HEPA filter or charcoal adsorber housing has been affected byrepair, maintenance, modification, or replacement activity, post maintenance testing inaccordance with SR 4.0.1 is required to demonstrate OPERABILITY.The 720 hours of operation requirement originates from Regulatory Guide 1.52, Revision 2,March 1978, Table 2, Note "c", which states that "Testing should be performed (1) initially, (2) atleast once per 18 months thereafter for systems maintained in a standby status or after 720 hoursof system operations, and (3) following painting, fire, or chemical release in any ventilation zonecolmmunicating with the system." This testing ensures that the charcoal adsorbency capacity hasnot degraded below acceptable limits, as well as providing trend data. The 720 hour figure is anarbitrary number which is equivalent to a 30 day period.. This criteria is directed to filter systemsthat are normally in operation and also provide emergency air cleaning functions in the event of aDesign Basis Accident. The applicable filter units are not normally in operation and the samplecanisters are typically removed due to the 18 month criteria.dThe periodic automatic startup ensures that each SLCRS train responds properly. The surveillancefrequency is controlled under the Surveillance Frequency Contr'ol Program. The surveillanceverifies that the SLCRS starts on a SIS test signal. It also includes the automatic functions toisolate the other ventilation systems that are not part of the safety-related postaccident operatingconfiguration and to start up and to align the ventilation systems that flow thr'ough the secondarycontaimunent to the accident condition.MILLSTONE -UNIT 3B 3/4 6-6MILSTOE UNT 3B /4 -6Amendment No. 8-- 23-, 84-,--2-06 LBDCR 05-MIP3-025March 7, 2006CONTAINMENT SYSTEMSBASES3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued)* The main steam valve building ventilation system isolates.* Auxiliary building ventilation (normaal) system isolates.* Charging pump/reactor plant component cooling water pump area cooling subsystemaligns and discharges to the auxiliary building filters and a filter fan starts.* Hydlrogen recombiner ventilation system aligns to the postaccident configuration.* The engineered safety features building ventilation system aligns to the postaccidentconfiguration.

References:

1. Engineering analysis, Memo MP3-DE-94-539, "Bolting Requirements for Access Panelson Dampers 3HVR*DMPF29 & 44," dated June 16, 1994.MILLTON -NIT B /4 -6aAmendment No. 8-7-, 23-, 84,MILLSTONE -UNIT 3B 3/4 6-6a LBDCR No. 06-MIP3-026October 15, 2006CONTAINMENT SYSTEMSBASES3/4.6.6.2 SECONDARY CONTAINMENTThe Secondary Containment is comprised of the containment enclosure building and allcontiguous buildings (main steam valve building [partially]; engineering safety features building[partially], hydrogen recombiner building [partially], and auxiliary building). The SecondaryContainment shall exist when:a. Each door in each access opening is closed except when the access opening isbeing used for normal transit entry and exit,b. The sealing mechanism associated with each penetration (e.g., Welds, bellows, or0-rings) is OPERABLE.Secondary Containment ensures that the release of radioactive materials from the primarycontainment atmosphere will be restricted to those leakage paths and associated leak ratesassumed in the safety analyses. This restriction, in conjunction with operation of theSupplemnentary Leak Collection and Release System, and Auxiliary Building Filter System willlimit the SITE BOUNDARY radiation doses to within the dose guideline values of 10 CFR 50.67during accident conditions.The SLCRS and the ABF fans and filtration units are located in the auxiliary building. TheSLCRS is described in the Millstone Unit No. 3 FSAR, Section 6.2.3.order to ensure a negative pressure in all areas within the Secondary Containment under mostmeteorological conditions, the negative pressure acceptance criterion at the measured location(i.e., 24' 6" elevation in the auxiliary building) is 0.4 inches water gauge.LCOThe Secondary Containment OPERABILITY must be maintained to ensure proper operation ofthe SLCRS and the auxiliary building filter system and to limit radioactive leakage fr'om thecontainment to those paths and leakage rates assumed in the accident analyses.ApplicabilityMaintaining Secondary Contaimnent OPERABILITY prevents leakage of radioactive materialfr'om the Secondary Containment. Radioactive material may enter the Secondary Containmentfrom the containment following a LOCA. Therefore, Secondary Containment is required inMODES 1, 2, 3, and 4 when a design basis accident such as a LOCA could release radioactivematerial to the containment atmnosphere.MILLSTONE -UNIT 3 B 3/4 6-7 Amendment No. 8-7-, 4--26NRC Verbal Acknowledgement: 97/05/07 LBDCR 12-MP3-010September 20, 2012CONTAINMENT SYSTEMS 1BASES3/4.6.6.2 SECONDARY CONTAINMENT (continued)In MODES 5 and 6, the probability and consequences of a DBA are low due to the RCStemperature and pressure limitation in these MODES. Therefore, Secondary Containmrent is notrequired in MODES 5 and 6.ACTIONSIn th~e event Secondary Containment OPERABILITY is not maintained, SecondaryContainment OPERABILITY must be restored within 24 hours. Twenty-four hours is areasonable Completion Time considering the limited leakage. design of contaimnent and the !owprobability of a DBA occurring during this time period.Inoperability of the Secondary Contahunent does not make the SLCRS fans and filtersinoperable. Therefore, while in this ACTION Statement solely due to inoperability of theSecondary Containment, the conditions and required ACTIONS associated with Specification3.6.6.1 (i.e., Supplementary Leak Collection and Release System) are not required to be entered.If the Secondary Containment OPERABILITY cannot be restored to OPERABLE status withinthe required completion time, the plant must be brought to a MODE in which the LCO does apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and toWMODE 5 within the following 30 hours. The allowed Completion Times are reasonable, based onoperating experience, to reach the required plant conditions from full-power conditions in anorderly manner and without challenging plant Systems.Surveillance Requirements4.6.6.2.1Maintaining Secondary Containment oPERABILITY requires maintaining each door ineach access opening in a closed position except when the access opening is being used for normalentry! and exit. The normal time allowed for passage of equipment and personnel through eachaccess opening at a time is defined as no more than 5 minutes. The access opening shall not beblocked open. During this time, it is not considered necessary to enter the ACTION statement. A5-minute time is considered acceptable since the access opening can be quickly closed withoutspecial provisions and the probability of occurrence of a DBA concurrent with equipment andlorpersonnel transit time of 5 minutes is low.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.MILLSTONE -UNIT 3 B3468AedetN.~-2B 3/4 6-8Amendment No. 8-7-,

February 5, 1998CONTAINMENT SYSTEMSBASES3/4.6.6.2 SECONDARY CONTAINMENT (continued)4.6.6.2.2The ability of a SLCRS to produce the required negative pressure duringthe test operation within the required time provides assurance that theSecondary Containment is adequately sealed.With the SLCRS in postaccident configuration, the required negativepressure in the Secondary Containment is achieved, in 110 seconds from the timeof simulated emergency diesel generator breaker closure. Time delays ofdampers and, logic delays must be accounted for in this surveillance. The timeto achieve the required negative pressure is 120 seconds, with a loss-of-offsite power coincident with a SIS. The surveillance verifies that one trainof-'SLCRS in conjunction with the ABF system will produce a negative pressureof-O.4 inches water gauge at the auxiliary building 24'6" elevation relativeto the outside atmosphere in the Secondary Containment. For the purpose ofthis surveillance, pressure measurements will be made at the 24'6" elevationin the auxiliary building. This single location is considered to be adequateand representative of the entire Secondary Containment due to the large cross-section of the air passages which interconnect the various buildings withinthe Secondary Containment. In order to ensure a negative pressure in allareas inside the Secondary Containment under most meteorological conditions,the negative pressure acceptance criterion at the measured location is_0.4 inch water gauge. It is recognized that there will be an occasionalmeteorological condition under which slightly positive pressure may exist atsome localized portions of the boundary (e.g., the upper elevations on thedown-wind side of a building). For example, a very low outside temperaturecombined with a moderate wind speed could cause a slightly positive pressureat the upper elevations of the containment enclosure building on the leewardface. The probability of occurrence of meteorological conditions which couldresult in such a positive differential pressure condition in the upper levelsof the enclosure building has been estimated to be less than 2% of the time.The probability of wind speed within the necessary moderate band,combined with the probability of extreme low temperature, combined with thesmall portion of the boundary affected, combined with the low probability ofairborne radioactive material migrating to the upper levels ensures that theoverall effect on the design basis dose calculations is insignificant.The SLCRS system and fan sizing was based on an estimated infiltrationrate. The fan flow rates are verified within a minimum and maximum on amonthly basis. Initial testing verified that the drawdown criterion was metat the lowest acceptable flow rate. The new standard Technical Specification(NUREG-1431) 3.6.6.2 surveillance requirement requires that the drawdownHILLSTONE -UNIT 3B 3/4 6-9MILLTONE- UNT 3 3/46-9Amendment No. F7, 126 February 5, 1996CONTAINMENT SYSTEMSBASES3/4.6.6,2 SECONDARY CONTAINMENT (continued)criterion be met while not exceeding a maximum flow rate. It is assumed thatthe purpose of this flow limit is to ensure that adequate attention is givento maintain the SLCRS boundary integrity and not using excess system capacityto cover .for boundary degradation.The SLCRS system was designed with minimal marginand, therefore, doesnot have excess capacity that can be substituted for boundary integrity.Additionally, since SLCRS fan flow rates are verified to be acceptable on amore frequent basis than the drawdown test surveillance, and by means ofprevious testing the minimum flow rate is acceptable, verifying a flow rateduring the drawdown test would not provide an added benefit. Historical SLCRSflow measurements show a lack of repeatability associated with the inaccura-cies of air flow measurement. As a result, the more reliable verification ofsystem performance is the actual negative pressure generated by the drawdowntest and a measured flow rate would add little.3/4.6.6.3 SECONDARY CONTAINMENT STRUCTURAL INTEGRITYThis limitation ensures that the structural integrity of the SecondaryContainment will be maintained comparable to the original design standards forthe life of the facility. Structural integrity is required to provide asecondary boundary surrounding the primary containment that can be maintainedat a negative pressure during accident conditions. A visual inspection issufficient to demonstrate this capability.MILLSTONE -UNIT 3B s/4 6-zoMILLTON -NIT B /4 -10Amendment No. F7, 126 LBDCR-.07-MP3 -037July 12, 20073/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVESBACKGROUNDThe primary purpose of the main steam line Code safety valves (MSSVs) is to provideoverpressure protection for the secondary system. The MSSVs also provide protection againstoverpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for theremoval of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided bythe Condenser and Circulating Water System, is not available.Five MSSVs are located on each main steam header, outside containment, upstream of the mainsteam isolation valves, as described in the FSAR, Section 10.3.1 (Reference 1). The MSSVs musthave sufficient capacity to limit the secondary system pressure to less than or equal to 110% of thesteam generator design pressure in order to meet the requirements of the ASME Code, Section III(Reference 2). The design minimum total relieving capacity for all valves on all of the steam linesis 1.579 x 107 lbs/hr which is 105% of total secondary steam flow of 1.504 x 10 lbs/h at 100%RATED THERMAL POWER. The MSSV design includes staggered setpoints, according to Table3.7-3 in the accompanying LCO, so that only the needed valves will actuate. Staggered setpointsreduce the potential for valve chattering that is due to steam pressure insufficient to fully open allvalves following a turbine reactor trip. Table 3.7-3 allows a +/- 3% setpoint tolerance (allowablevalue) on the lift setting for OPERABILITY to account for drift over an operating cycle.APPLICABLE SAFETY ANALYSESThe design basis for the MSSVs comes from Reference 2 and its purpose is to limit the secondarysystem pressure to less than or equal to 110% of design pressure for any anticipated operationaloccurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transientanalysis.The events that challenge the relieving capacity of the MSSVs, and thus RCS pressure, are thosecharacterized as decreased heat removal events, which are presented in the FSAR, Section 15.2(Reference 3). Of these, the full power turbine trip without steam dump is typically the limitingAOO. This event also terminates normal feedwater flow to the steam generators.The safety analysis demonstrates that the transient response for turbine trip occurring from fullpower without a direct reactor trip presents no hazard to the integrity of the RCS or the MainSteam System. One turbine trip analysis is performed assuming primary system pressure controlvia operation of the pressurizer relief valves and spray. This analysis demonstrates that the DNBdesign basis is met. Another analysis is performed assuming no primary system pressure control,but crediting reactor trip on high pressurizer pressure and operation of the pressurizer safetyMILLSTONE -UNIT 3B 3/4 7-1MILLTON -NIT3 B3/47-1Amendment No. 4-t02,, 7-, LBDCR_.7-MP3-037July 12, 20073/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVES (Continued)valves. This analysis demonstrates that RCS integrity is maintained by showing that themaximum RCS pressure does not exceed 110% of the design pressure. All cases analyzeddemonstrate that the MSSVs maintain Main Steam System integrity by limiting the maximumsteam pressure to less than 110% of the steam generator design pressure.In addition to the decreased heat removal events, reactivity insertion events may also challenge therelieving capacity of the MSSVs. The uncontrolled rod cluster control assembly (RCCA) bankwithdrawal at power event is characterized by an increase in core power and steam generation rateuntil reactor trip occurs when either the Overtemperature AT or Power Range Neutron Flux-Highsetpoint is reached. Steam flow to the turbine will not increase from its initial value for this event.The increased heat transfer to the secondary side causes an increase in steam pressure and mayresult in opening of the MSSVs prior to reactor trip, assuming no credit for operation of theatmospheric or condenser steam dump valves. The FSAR Section 15.4 safety analysis of theRCCA bank withdrawal at power event for a range of initial core power levels demonstrates thatthe MSSVs are capable of preventing secondary side overpressurization for this AOO.The FSAR safety analyses discussed above assume that all of the MSSVs for each steamgenerator are OPERABLE. If there are inoperable Ms sv(s), it is necessary to limit the primarysystem power during steady-state operation and AOOs to a value that does not result in exceedingthe combined steam flow capacity of the turbine (if available) and the remaining OPERABLEMSSVs. The required limitation on primary system power necessary to. prevent secondary systemoverpressurization may be determined by system transient analyses or conservatively arrived atby a simple heat balance calculation. In some circumstances it is necessary to limit the primaryside heat generation that can be achieved during an AOO by reducing the setpoint of the PowerRange Neutron Flux-High reactor trip function. For example, if more than one MSSV on a singlesteam generator is inoperable, an uncontrolled RCCA bank withdrawal at power event occurringfrom a~partial power level may result in an increase in reactor power that exceeds the combinedsteam flow capacity of the turbine and the remaining OPERABLE MSSVs. Thus, for multipleinoperable MSSVs on the same steam generator it is necessary to prevent this power increase bylowering the Power Range Neutron Flux-High setpoint to an appropriate value. If the ModeratorTemperature Coefficient (MTC) is positive, the reactor power may increase above the initial valueduring an RCS heatup event (e.g., turbine trip). Thus, for any number of inoperable MSSVs, it isnecessary to reduce the trip setpoint if a positive MTC may exist at partial power conditions,unless it is demonstrated by analysis that a specified reactor power reduction alone is sufficient toprevent overpressurization of the steam system.MILLSTONE -UNIT 3 B347l mnmn o -2B 3/4 7-1aAmendment No. LBDCR 07-MP3-037July 12, 20073/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVES (Continued)The MSSVs are assumed to have two active and one passive failure modes. The active failuremodes are spurious opening, and failure to reclose once openfed. The passive failure mode is .failure to open upon demand.The MSSVs satisfy Criterion 3 of 10 CFR 50.3 6(c)(2)(ii).LCOThe accident analysis requires that five MSSVs per steam generator be OPERABLE to provideoverpressure protection for design basis transients occurring at 102% RTP. The LCO requires thatfive MSSVs per steam generator be OPERABLE in compliance with Reference 2, and the DBAanalysis.The OPERABILITY of the MSSVs is defined as the ability to open upon demand within thesetpoint tolerances, to relieve steam generator overpressure, and reseat when pressure has beenreduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing inaccordance with the Inservice Testing Program.This LCO provides assurance that the MSSVs will perform their designed safety functions tomitigate the consequences of accidents that challenge to the RCPB, or MainSteam System integrity.APPLICABILITYIn MODES 1, 2, and 3, five MSSVs per steam generator are required to be OPERABLE toprevent Main Steam System overpressurization.In MODES 4 and 5, there are no credible transients requiring the MSSVs. The steam generatorsare not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized;there is no requirement for the MSSVs to be OPERABLE in these MODES.ACTIONSACTIONS are modified by a Note indicating that separate Condition entry is allowed for eachMSSV.With one or more MSSVs inoperable, action must be taken so that the available MSSV relievingcapacity meets Reference 2 requirements for the applicable THERMAL POWER.MILLSTONE -UNIT 3 B347l mnmn oB 3/4 7-1bAmendment No. LBDCR 07-MP3-037-July 12, 20073/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1 .1 SAFETY VALVES (Continued)Operation with less than all five MSSVs OPERABLE for each steam generator is permissible, ifTHERIMAL POWER is limited to the relief capacity of the remaining MSSVs. This isaccomplished by restricting THERMAL POWER so that the energy transfer to the most limitingsteam generator is not greater than the available relief capacity in that steam .generator.In the case of only a single inoperable MSSV on one or more steam generators when theModerator Temperature Coefficient is not positive, a reactor power reduction alone is sufficient tolimit primary side heat generation such that overpressurization of the secondary side is precludedfor any RCS heatup event. Furthermore, for this case there is sufficient total steam flow capacityprovided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in theevent of an increased reactor power due to reactivity insertion, such as in the event of anuncontrolled RCCA bank withdrawal at power. Therefore, ACTION a. requires an appropriatereduction in reactor power within 4 hours. If the power reduction is not completed within therequired time, the unit must be placed in at least HOT STANDBY within the next 6 hours, and inHOT SHUTDOWN within the following 6 hours.The maximum THERMAL POWER correspondin~g to._he.heat removal capacity of the remainingOPERABLE MSSVs is determined via a conservative heat balance calculation as described in theattachment to Reference 4 with an appropriate allowance for calorimetric power uncertainty.The maximum THERMAL POWER corresponding to the heat removal capacity of the remainingOPERABLE MSSVs is determined by the governing heat transfer relationship is the equationq = mnAh, where q is the heat input from the primary side, mn is the mass flow rate of the steam,and Ah is the increase in enthalpy that occurs in converting the secondary side water to steam. Ifit is conservatively assumed that the secondary side water is all saturated liquid (assuming nosubcooled feedwater), then the Ah is the heat of vaporization (hfg) at the steam'relief pressure.For each steam generator, at a specified pressure, the maximum allowable power level isdetermined as follows:100 wQ- x shfgNMaximum Allowable Power Level < KMILLSTONE -UNIT 3 B347l mnmn oB 3/4 7-1cAmendment No. LBDCR- 07-MP3-037July 12, 20073/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVES (Continued)Where:Q =Nominal NSSS power rating of the plant (including reactor coolant pump heat), MWtK =Conversion factor, 947.82(Btu/sec)MWtWs= Minimum total steam flow rate capability of the OPERABLE MSSVs on any one steamgenerator at the highest OPERABLE MSSV opening pressure including tolerance andaccumulation, as appropriate, lb/sec.hfg =Heat of vaporization at the highest MSSV opening pressure including tolerance andaccumulation as appropriate, Btu/lbm.N =Number of loops in the plant.For use in determining the % RTP in ACTION a., the Maximum NSSS Power calculated above isreduced by 2% RTP to account for calorimetric power uncertainty.b and cIn the case of multiple inoperable MSSVs on one or more steam generators, with a reactor powerreduction alone there may be insufficient total steam flow capacity provided by the turbine andremaining OPERABLE MSSVs to preclude overpressurization in the event of an increasedreactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bankwithdrawal at power. Furthermore, for a single inoperable MSSV on one or more steamgenerators when the Moderator Temperature Coefficient is positive the reactor power mayincrease as a result of an RCS heatup event such that flow capacity of the remaining OPERABLEMSSVs is insufficient. The 4 hour completion time to reduce reactor power is consistent withACTION a. An additional 32 hours is allowed to reduce the Power Range Neutron Flux Highreactor setpoint. The total completion time of 36 hours is based on a reasonable time to correctthe MSSV inoperability, the time to perform the power reduction, operating experience to reset allchannels of a protection function, and on the low probability of the occurrence of a transient thatcould result in steam generator overpressure during this period. If the required action is notcompleted within the associated time, the unit must be placed in at least HOT STANDBY withinthe next 6 hours, and in HOT SHUTDOWN within the following 6 hours.MILLSTONE -UNIT 3 B347i mnmn oB 3/4 7-1dAmendment No. LBDCR 07-MP3-037July 12, 20073/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVES (.Continued)The maximum THERMAL POWER corresponding to the heat removal capacity of the remainingOPERABLE MSSVs is determined via a conservative heat balance calculation as described in the.:attachment to Reference 4, with an appropriate allowance for nuclear instrumentation system tripchannel uncertainties. ..To determine the Table 3.7-1 Maximum Allowable Power for Required ACTIONS b and c(%RTP), the calculated Maximum NSSS Power is reduced by 9% RTP to account for NuclearInstrumentation System trip channel uncertainties.ACTIONS b and c are modified by a Note. The Note states that the Power Range Neutron FluxHigh reactor trip setpoint reduction is only required in MODE 1. in MODES 2 and 3 the reactorprotection system trips specified in LCO 2.2.1, "Reactor Trip System Instrumentation Setpoints,"provide sufficient protection.The allowed completion times are reasonable based on operating experience to accomplish theACTIONS in an orderly manner without challenging unit systems.dIf one or more steam generators have four or more inoperable MSSVs, the unit must be placed ina MODE in which the LCO does not apply. To achieve this status, .the unit must be placed in atleast HOT STANDBY within the next 6 hours, and in HOT SHUTDOWN within the following6 hours. The allowed completion times are reasonable, based on operating experience, to reachthe required unit conditions from full power conditions in an orderly manner and withoutchallenging unit systems.SURVEILLANCE REQUIREMENTS (SR) 4.7.1.1This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint(Table 3.7-3) in accordance with the Inservice Testing Program. During this testing, the MSSVsare OPERABLE provided the actual lift settings are within +/- 3% of the required lift setting. TheASME Code specifies the activities and frequencies necessary to satisfy the requirements. Table3.7-3 allows a +/- 3% setpoint tolerance for OPERABILITY; however, the valves are reset to +/- 1%during the Surveillance to allow for drift during the next operating cycle. However, if the testingis done at the end of the operating cycle when the plant is being shut down for refueling,MILLSTONE -UNIT 3 B347l mnmn oB 3/4 7-1eAmendment No. LBDCR 07-MIP3-037July 12, 2007PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE314.7.1.1 SAFETY VALVES (Continued')restoration to +/- 1% of the specified lift setting is not required for valves that will not be used (e.g.,replaced) for the next operating cycle. While the lift settings are being restored to within the +/- 1%of the required setting, the MS SVs remain OPERABLE provided the actual lift setting is within+/-t 3% of the required setting. The lift settings, according to Table 3.7-3, correspond to ambientconditions of the valve at nominal operating temperature and pressure.This SR is modified by a Note that allows entry into and operation in MODE 3 prior toperforming the SR. The MSSVs may be either bench tested or tested in situ at hot conditionsusing an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, thelift setting pressure shall be corrected to ambient conditions of the valve at operating temperatureand pressure.REFERENCES1. FSAR, Section 10.3.1.2. ASMdE, Boiler and Pressure Vessel Code, Section~ III, 1971 edition.3. FSAR, Section 15.2.4. NRC Information Notice 94-60, "Potential Overpressurization of the Main SteamSystem," August 22, 1994.3/4.7.1.2 AUXILIARY FEED WATER SYSTEMThe OPERABILITY of the Auxiliary Feedwater (AFW) System ensures a makeup water supplyto the steam generators (SGs) to support decay heat removal from the Reactor Coolant System(RCS) upon the loss of normal feedwater supply, assuming the worst case single failure. TheAFW System consists of two motor driven AFW pumps and one steam turbine driven AFWpump. Each motor driven AFW pump provides at least 50% of the AEW flow capacity assumedin the accident analysis. After reactor shutdown, decay heat eventually decreases so that onemotor driven AFW pump can provide sufficient SG makeup flow. The steam driven AFW pumphas a rated capacity approximately double that of a motor driven AFW pump and is thus defined*as a 100% capacity pump.Given the worst case single failure, the AFW System is designed to mitigate the consequences ofnumerous design basis accidents, including Feedwater Line Break, Loss of Normal Feedwater,Steam Generator Tube Rupture, Main Steam Line Break, and Small Break Loss of CoolantAccident.MILLSTONE -UNIT 3B 3/4 7-2MILLTON -NIT3 B3/47-2Amendment No. 0-2, 3-, 0, LBDCR 14-MIP3-006July 8, 2014PLANT SYSTEMSBASESAUXILIARY FEED WATER SYSTEM (Continued)In addition, given the worst case failure, the AFW is designed to supply sufficient makeupwater to replace SG inventory loss as the RCS is cooled to less than 350°F at which point theResidual Heat Removal System may be placed into operation.Motor driven auxiliary feedwater pumps and associated flow paths are OPERABLE in thefollowing alig-nment during normal operation below 10% RATED THIERMVAL POWER.*Motor operated isolation valves (3FWA*MOV35A/B/CiD) are open in MODE 1, 2 and 3,*Control valves (3FWA*HV3 1A/B/C/D) may be throffled or closed during alignment,operation and restoration of the associated motor driven AFW pump for steam generatorinventoly control.The motor operated isolation valves must remain fully open due to single failure criteria(the valves and associated pump are powered from the opposite electrical trains).The Turbine Driven Auxiliary Feedwater (TDAFW) pump and associated flow paths areOPERABLE with all control and isolation valves fully open in MODE 1, 2 and 3. Due to HighEnergy Line Break analysis, the TDAFW pump cannot be used for steam generator inventorycontrol during normal operation below 10% RATED THERMAL POWER.At M/IPS 3, only two of the three available steam supplies are required to establish anOPERABLE steam supply sys~tem. With one of the two required steam supplies inoperable,normally the third steam supply will be used to satisfy the requirement for two OPERABLEsteam supplies. If the third steam supply is also inoperable (i.e., only one steam supply to theturbine-driven auxiliary feedwater pump is OPERABLE), then ACTION a. is entered.If the turbine-driven auxiliary feedwater pump is inoperable due to one required steamsupply being inoperable in MODES 1, 2, and 3, or ifra turbine-driven auxiliary feedwater pump isinoperable while in MODE 3 immnrediately following REFUELING, action must be taken torestore the inoperable equipment to an OPERABLE status within 7 days. The 7 day allowedoutage time is reasonable, based on the following reasons:MILLSTONE -UNIT 3B 3/4 7-2aMILLTONE- UNT 3 3/47-2aAmendment No. 03, 4-39, 4-5-0 LBDCR No. 04-MP3-011November 10, 2005PLANT SYSTEMSBASESAUXILIARY FEED WATER SYSTEM (Continued)a. For the inoperability of the turbine-driven auxiliary feedwater pumrp due to onerequired steam supply to the turbine-driven auxiliary feedwater pump beinginoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwaterpump is operable), the 7 day allowed outage time is reasonable since the auxiliary* feedwater system design affords adequate redundancy for the steam supply line forthe turbine-driven pump.b. For the inoperability of a turbine-driven auxiliary feedwater pump while in MODE3 ilmmediately subsequent to a refueling, the 7 day allowed outage time is* reasonable due to the minimal decay heat levels in this situation.c. For both the inoperability of the turbine-driven auxiliary feedwater pump due toone required steam supply to the turbine-driven auxiliary feedwater pump beinginoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwaterpump is operable), and an inoperable turbine-driven auxiliary feedwater pumpwhile in MODE 3 imxmediately following a refueling outage, the 7 day allowedoutage time is reasonable due to the availability of redundant OPERABLE motordriven auxiliary feedwater pumps, and due to the low probability of an eventrequiring the use of the turbine-driven auxiliary feedwater pump.The required ACTION dictates that if either the 7 day allowed outage time is reached theunit must be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWNwithin the following 12 hours.The allowed time is reasonable, based on operating experience, to reachithe requiredconditions from full power conditions in an. orderly manner and without challenging plantsystems.A Note limits the applicability of the inoperable equipment condition b. to when the unithas not entered MODE 2 following a REFUELING. Required ACTION b. allows one auxilia-yfee~dwater pump to be inoperable for 7 days vice the 72 hour allowed outage time in requiredACTION c. This longer allowed outage thne is based on the reduced decay heat followingREFUELING and prior to the reactor being critical.With one of the auxiliary feedwater pumps inoperable in MODE 1, 2, or 3 for reasonsother than ACTION a. or b., ACTION must be taken to restore OPERABLE status within 72hours. This includes the loss of three steam supply lines to the turbine-driven auxiliary feedwaterpump. The 72 hour allowed outage time is reasonable, based on redundant capabilities affordedby the auxiliamy feedwater system, time needed for repairs, and the low probability of a DBAoccurring during this time period. Two auxiliary feedwater pumps and flow pathls remain tosupply feedwater to the steam generators.MILLSTONE -UNIT 3B 3/4 7-2bMILLTON -NIT B /4 -2bAmendment No. -!-02-, 4-39, -0, LBDCR 12-MIP3-010September 20, 2012PLANT SY STEMSBASESAUXILIARY FEED WATER SYSTEM (Continued)If all thr'ee AFW pumps are inoperable in MODE 1, 2, or 3, the unit is in a seriouslydegraded condition with no safety related means for conducting a cooldown, and only limitedmeans for conducting a cooldown with non safety related equipment. In such a condition, the unitshould not be perturbed by any action, including a power change, that might result in a trip. Theseriousness of this condition requires that action be started immediately to restore oneAFW pumpto OPERABLE status. Required ACTION e. is modified by a Note indicating that all requiredMODE changes or power reductions are suspended until one AFW pump is restored toOPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into aless safe conditio~n.SR 4.7.1.2.1 a. verifies the correct alignment for manual, power operated, and automaticvalves in the auxiliaiy¢ feedwater water and steam supply flow paths to provide assurance that theproper flow paths exist for auxiliary feedwater operation. This SR does not apply to valves thatare locked, sealed, or otherwise secured in position, since these valves are verified to be in thecorrect position prior to locking, sealing, or securing. This SR also does not apply to valves thatcannot be inadvertently misalign~ed, such as check valves. This Surveillance does not require anytesting or valve manipulations; rather, it involves verification that those valves capable ofpotentially being mispositioned are in the correct position. The surveillance fr'equency iscontrolled under the Surveillance Frequency Control Program.*The SR is modified by a Note that states one or more auxiliary feedwater pumps may beconsidered OPERABLE during alignment and operation for steam generator level control, if it iscapable of being manually (i.e., remotely or locally, as appropriate) realigned to the auxiliaryfeedwater mode of operation, provided it is not otherwise inoperable. This exception to pumpOPERABILITY allows the pump(s) and associated valves to be out of their normal standbyalignment and temporarily incapable of automatic initiation without declaring the pump(s)inoperable. Since auxiliary feedwater may be used during STARTUP, SI{UTDOWN, HOTSTANDBY operations, and HOT SHUTDOWN operations for steam generator level control, andthese mmaual operations are an accepted function of the auxiliatry feedwater system,OPERABILITY (i.e., the intended safety function) continues to be maintained.MILLSTONE -UNIT 3 B3472 mnmn oB 3/4 7-2cAmendment No. LBDCR 14-MiP3-006July 8, 2014AUXILIARY FEED WATER SYSTEM (Continued)Surveillance Requirement 4.7.1.2.1 .b, which addresses periodic surveillance testing of theAFW pumps to detect gross degradation caused by impeller structural damage or other hydrauliccomponent problems, is required by the ASME GM Code. This type of testing may beaccomplished by measuring the pump developed head at only one point on the pumpcharacteristic curve. This verifies both that the measured performance is within an acceptabletolerance of the original pumps baseline performance and that the performance at the test flow isgreater than or equal to the performance assumed in the unit safety analysis. The surveillancerequirements are specified in the Inservice Testing Program, which encompasses the ASME OMCode. The ASME GM Code provides the activities and frequencies necessary to satisfy therequirements.This surveillance is modified by a note to indicate that the test can be deferred for thesteam driven AFW pump until suitable plant conditions are established. This deferral is requiredbecause steam pressure is not sufficient to perform the test until after MODE 3 is entered.However, the test, if required, nmst be performed prior to entering MODE 2.Surveillance Requirement 4.7.1.2.1 .c demonstrates that each AFW pump starts on receiptof an actual or simulated actuation signal. The surveillance frequency is controlled under theSurveillance Frequency Control Program. The actuation logic is tested as part of the EngineeredSafety Feature Actuation System (ESFAS) testing, and equipment performance is monitored aspart of the Inservice Testing Program.Surveillance Requirement 4.7.1.2.2 demonstrates the AFW System is properly aligned byverifying the flow path to each steam generator prior to entering MODE 2 after more than 30 daysin any comnbination of MODE 5 or 6 or defueled. OPERABILITY of the AFW flow paths must beverified before sufficient core heat is generated that would require operation of the AFW Systemduring a subsequent shutdown. To further ensure AEW System alignmaent, the OPERABILITY ofthe flow paths is verified following extended outages to determnine that no misalignment of valveshas occurred. The frequency is reasonable, based on engineering judgenment, and otheradministrative controls to ensure the flow paths are OPERABLE.MILLSTONE -UNIT 3 B3472B 3/4 7-2d LBDCR 14-MP3-006July 8, 2014PLANT SYSTEMSBASES3/4.7.1.3 DEM1hERALIZED WATER STORAGE TANKThe OPERABILITY of the demineralized water storage tank (DWST) with a 334,000gallon minimum measured water volume ensures that sufficient water is available to maintain thereactor coolant system at HOT STANDBY conditions for 7 hours with steam discharge to theatmosphere, concurrent with a total loss-of-offsite power, and with an additional 6-hour cooldownperiod to reduce reactor coolant temperature to 350°F. The 334,000 gallon required water volumecontains an allowance for tank inventory not usable because of tank discharge line location, othertank physical characteristics, and surveillance measurement uncertainty considerations. Theinventory requirement is conservatively based on 120°F water temperature which maximizesinventory required to remove RCS decay heat. In the event of a feedline break, this inventoryrequirement includes an allowance for 30 minutes of spillage before operator action is credited toisolate flow to the line break.If the combined condensate storage tank (CST) and DWST inventory is being credited,there are 50,000 gallons of unusable CST inventory due to tank discharge line location, otherphysical characteristics, level measurement uncertainty and potential measurement bias error dueto the CST nitrogen blanket. To obtain the Surveillance Requirement 4.7.1.3.2's DWST andCST combined volume, this 50,000 gallons. of unusable CST inventory has been added to the334,000 gallon DWST water volume specified in LCO 3.7.1.3 resulting in a 384,000 gallons 0requirement (334,000 + 50,000 = 384,000 gallons).3/4.7.1.4 SPECIFIC ACTIVITYThe limitations on Secondary Coolant System specific activity ensure that the resultantoffsite radiation dose will be limited to 10 CFR 50.67 and Regulatory Guide 1.183 dose guidelinevalues in the event of a steam line rupture. This dose also includes thae effects of a coincident1 gpm primary-to-secondary tube leak in the steam generator of the affected steam line. Thesevalues are consistent with the assumptions used in the safety analyses.MILLSTONE -UNIT 3 B 3/4 7-2e LBDCR No. 08.-MP3-032Octobher 28, 2008PLANT SYSTEMSBASES3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVESBACKGROUNDThe main steam line isolation valves (MSIVs) isolate steam flow from the secondary side of thesteam generators following a high energy line break (HELB). MSIV closure terminates flowfrom the unaffected (intact) steam generators.One MSIV is located in each main steam line outside, but close to, containment. The MSIVs aredownstream from the main steam safety valves (MSSVs) and auxiliary feedwater (AFW) pumpturbine steam supply, to prevent MSSV and AFW isolation from the steam generators by MSIVclosure. Closing the MSIVs isolates each steam generator from the others, and isolates theturbine, Steam Bypass System, and other auxiliary steam supplies from the steam generators.The MSIVs close on a main steam isolation signal generated by low steam generator pressure,high containment pressure, or steam line pressure negative rate (high). The MSIVs fail closed onloss of control or actuation power.Each MSIV has an MSIV bypass valve. Although these bypass valves are normally closed, theyreceive the same emergency closure signal as do their associated MSIVs. The MSIVs may alsobe actuated manually.A description of the MSIVs is found in the FSAR, Section 10.3.APPLICABLE SAFETY ANALYSISThe design basis of the MSIVs is established by the containment analysis for the large steam linebreak (SLB) inside containment, discussed in the FSAR, Section 6.2. It is also affected by theaccident analysis of the SLB events presented .in the FSAR, Section 15.1.5. The design precludesthe blowdown of more than one steam generator, assuming a single active component failure(e.g., the failure of one MSIV to close on demand).The limiting temperature case for the containment analysis is the SLB inside containment, at102% power with mass and energy releases based on offsite power available following turbinetrip, and failure of the MSIV on the affected steam generator to close.At hot zero power, the steam generator inventory and temperature are at their maximum,maximizing the analyzed mass and energy release to the containment. Due to reverse flow andfailure of the MSIV to close, the additional mass and energy in the steam headers downstreamfrom the other MSIV contribute to the total release. With the most reactive rod cluster controlassembly assumed stuck in the fully withdrawn position, there is an increased possibility that thecore will become critical and return to power. The reactor is ultimately shut down by the boricacid injection delivered by the Emergency Core Cooling System.MILLSTONE -UNIT 3B3/73AmnetNoB 3/4 7-3Amendment No. LBDCR No.-0)4-MP3-0 15February 24, 2005PLANT SYSTEMSBASES3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued)The accident analysis compares several different SLB events against different acceptance criteria.The large SLB outside containment upstream of the MSIVs is limiting for offsite dose, although abreak in this short section of main steam header has a very low probability. The large SLBupstream of the MSIV at hot zero power is the limiting case for a post trip return to power. The ,analysis includes scenarios with offsite power available and with a loss of offsite power followingturbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolantthrough the steam generators, maximizing the Reactor Coolant System cooldown. With a loss ofoffsite power, the response of mitigating systems is delayed. Significant single failuresconsidered include failure of an MSIV to close.The MSIVs serve only a safety function and remain open during POWER OPERATION. Thesevalves operate under the following situations:a. An HELB inside containment. In order to maximize the mass and energy release intocontainment, the analysis assumes that the MSIV in the affected steam generator remainsopen. For this accident scenario, steam is discharged into containment from all steamgenerators until the remaining MSIVs close. After MSIV closure, steam is discharged intocontainment only from the affected steam generator and from the residual steam in themain steam header downstream of the closed MSIVs in the unaffected loops. Closure ofthe MSIVs isolates the break from the unaffected steam generators.b. A break outside of containment and upstream from the MSIVs is not a containmentpressurization concern. The uncontrolled blowdown of more than one steam generatormust be prevented to limit the potential for uncontrolled RCS cooldown and positivereactivity addition. Closure of the MSIVs isolates the break and limits the blowdown to asingle steam generator.c. A break downstream of the MSIVs will be isolated by the closure of the MSIVs.d. Following a steam generator tube rupture, closure of the MSIVs isolates the rupturedsteam generator from the intact steam generators. In addition to minimizing radiologicalreleases, this enables the operator to maintain the pressure of the steam generator with theruptured tube below the MSSV setpoints, a necessary step toward isolating the flowthrough the rupture.e. The MSIVs are also utilized during other events, such as a feedwater line break. Thisevent is less limitinig so far as MSIV OPERABILITY is concerned.MILLSTONE -UNIT 3B 3/4 7-4MILLTONE- UNT 3 3/47-4Amendment No. 4-1-9, 41-3-6, PLANT SYSTEMS10/19/i00BASES3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued)LCOThis [CO requires that four MSIVs in the steam lines be OPERABLE. The MSIVs areconsidered OPERABLE when the isolation times are within limits, and they closeon an isolation actuation signal.This LCO provides assurance that the MSIVs will perform their design safetyfunction to mitigate the consequences of accidents that could result in offsiteexposures comparable to the 1OCFRIOO limits or the NRC Staff approved licensingbasis.APPLICABILITYThe MSIVs must be OPERABLE in MODE 1 and in MODES 2, 3, and 4 except when closedand deactivated when there is significant mass and energy in the RCS and steamgenerators. When the MSIVs are closed, they are already performing the safetyfunction.In MODES 1, 2, and 3 the MSIVs are required to close within 10 seconds to ensurethe accident analysis assumptions are met. In MODE 4 the MSIVs are required toclose within 120 seconds to ensure the accident analysis assumptions are met.*i An engineering evaluation has determined that a Reactor Coolant System (RCS)temperature greater than or equal to 320°F is required to provide sufficientsteam energy to provide the motive force to operate the MSIVs. Therefore, belowan RCS temperature of 320°F the MSIVs are not OPERABLE and are required to beclosed.In MODE 5 or 6, the steam generators do not contain much energy because theirtemperature is below the boiling point of water; therefore, the MSIVs are notrequired for isolation of potential high energy secondary system pipe breaks inthese MODES.ACTIONSMODE 1With one MSIV inoperable in MODE 1, action must be taken to restore OPERABLEstatus within 8 hours. Some repairs to the MSIV can be made with the unit hot.The 8 hour Completion Time is reasonable, considering the low probability of anaccident occurring during this time period that would require a closure of theMSIVs.The 8 hour Completion Time is greater than that normally allowed for containmentisolation valves because the MSIVs are valves that isolate a closed systempenetrating containment. These valves differ from other containment isolationvalves in that the closed system provides a passive barrier for containmentO isolation.MILLSTONE -UNIT 3 B 3/4 7-5 Amendment No. 1 85 PLANT SYSTEMS10119100BASES3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued)If the MSIV cannot be restored to OPERABLE status within 8 hours, the plantmust be placed in a MODE in which the LCO does not apply. To achieve thisstatus, the unit must be placed in MODE 2 within 6 hours. The ComPletionTimes are reasonable, based on operating experience, to reach MODE 2 and toclose the MSIVs in an orderly manner and without challenging plant systems.MODES 2. 3. and 4Since the MSIVs are required to be OPERABLE in MODES 2, 3, and 4, theinoperable MSIVs may either be restored to OPERABLE status or closed. Whenclosed, the MSIVs are already in the position required by the assumptions inthe safety analysis. The MSIVs may be opened to perform SurveillanceRequirement 4.7.1.5.2.The 8 hour Completion Time is consistent with that allowed in MODE 1.For inoperable MSIVs that cannot be restored to OPERABLE status within thespecified Completion Time, but are closed, the inoperable MSIVs must beverified on a periodic basis to be closed. This is necessary to ensure thatthe assumptions in the safety analysis remain valid. The 7 day verificationtime is reasonable, based on engineering judgment, in view of MSIV statusindications available in the control room, and other administrative controls,to ensure that these valves are in the closed position.If the MSIVs cannot be restored to OPERABLE status or are not closed withinthe associated Completion Time, the unit must be placed in a MODE in which theLCO does not apply. To achieve this status, the unit must be placed at leastin MODE 3 within 6 hours, and in MODE 5 within the next 30 hours. The allowedCompletion Times are reasonable, based on operating experience, to reach therequired unit conditions from MODE 2 conditions in an orderly manner andwithout challenging unit systems. The Action Statement is modified by a noteindicating that separate condition entry is allowed for each MSIV.SURVEILLANCE REQUIREMENTS4.7.1.5.1 DELETEDMILLSTONE -UNiT 3 B 3/4 7-6 Amendment No. 7$,185 PLANT SYSTEMS10/19100BASESSURVEILLANCE REQUIREMENTS (continued)4.7.1.5.2 This surveillance demonstrates that MSIV closure time is less than10 seconds (120 seconds for MODE 4 only) on an actual or simulated actuationsignal, when tested pursuant to Specification 4.0.5. A simulated signal isdefined as any of the following engineering safety features actuation systeminstrumentation functional units per Technical Specifications Table 4.3-2:4.a.1) manual initiation, individual, 4.a.2) manual initiation system, 4.c.containment pressure high-2, 4.d. steam line pressure low, or 4.e. steam linepressure -negative rate high. The MSIV closure time is assumed in theaccident analyses. This surveillance is normally performed upon returning theplant to operation following a refueling outage. The test is normallyconducted in MODES 3 or 4 with the plant at suitable (appropriate) conditions(e.g., pressure and temperature). The MSIVs should not be tested at power,since even a part stroke exercise increases the risk of valve closure when theunit is generating power.This surveillance requirement is modified by an exception that will allowentry into and operation in MODES 3 and 4 prior to performing the test toestablish conditions consistent with those under which the acceptancecriterion was generated. Successful performance of this test within therequired frequency is necessary to operate in MODES 3 and 4 with the MSIVsopen, to enter MODE 2 from MODE 3, and for plant operation in MODE 1. If thissurveillance has not been successfully performed within the requiredfrequency, the MSIVs. are inoperable and are required to be closed.In MODE 4 only, the MSIVs can be considered OPERABLE if the closure time isless than 120 seconds. An engineering evaluation has determined that a RCStemperature greater than or equal to 320°F is required to provide sufficientsteam energy to provide the motive force to operate the MSIVs. Therefore,below an RCS temperature of 320°F the MSIVs are not OPERABLE and are requiredto be closed.MILLSTONE -UNIT 3B 3/4 7-6aMILLTON -NIT B /4 -5aAmendment No. X~g 185 REVERSE OF PAGE B 3/4 7-6aINTENTIONALLY LEFT BLANK LBDCR No. 04-MP3--015February 24, 2005PLANT SYSTEMSBASES3/4.7.1.6 STEAM GENERATOR ATMOSPHERIC RELIEF BYPASS LINESThe OPERABILITY of the *steam generator atmospheric relief bypass valve (SGARBV)lines provides a method to recover from a steam generator tube rupture (SGTR) event dulringwhich the operator i's required to perform a-limited coo ldbwn establish adequate sub cooling asanecessary step to *limit the primary to secondary break flow into* the r, ptured steam generator..The time required to limit the primary to"secondary break flow for an SGTR event is more criticalthan the time required to cooldown to RHR entry conditions. Because of these time constraints,these valves afnd associated flow paths must be OPERABLE from the control room. The numberof SGA.RB Vs requiredi to be OPERABLE from the control room to satisfy the S GTR accident.analysis requires consideration of single failure criteria; Four SGARBV are required to beOPER~ABLE to ensure the credited steam release pathways available to conduct a unit cooldownfollowing a SGTR."For other design events, the SGARBVs provide a safety grade method for cooling the unit toresidual heat removal (RHR) entry conditions should the preferred heat sinik via the steam bypasssystem or the steam generator atmospheric relief valves be unavailable. Prior to operator action tocooldown, the main steam safety valves (MS SVs) are assumed to operate automatically to relievesteam and maintain the, steam generator pressure below design limits.Each SGARIBV line consists of one SGARBV and an associated block valve (main steamatmospheric relief isolation valve, 3MSS*MOV18SA/B/C/D). These block valves are used in theevent a steam generator atmospheric relief valve (S GARY) or SGARBV fails to close. Becauiseof the electrical power relationship .b.etw~en the SGARV and the block v~alys,.if a b~iqok yaly.e, ismaintained closed, the SGARBV flow path is inoperable because of single failure consideration.The bases for the required ACTIONS can be found in NUREG 1431, Rev. 1.The LCO APPLICABILITY and ACTION statements uses the terms "MODE 4 whensteam generator is relied *upon for heat removal" and "in MODE 4 without reliance upon steamgenerator for heat removal." This means that those steam generators which are credited for decayheat removal to comply with LCO 3.4.1.3 (Reactor Coolant System, HOT SHUTDOWN) shallhave an OPERABLE SGARBV line. See Bases Section 3/4.4.1 for more detail.3/4.7..2 DELETEDMILLSTONE -UNIT 3 B 3/4 7-7 Amendment No. 4-46, -448, 1-54-, 2-4,Acknowledged by NRC letter dated 08/25/05. LBDCR 3-22-02March 14, 2002PLANT SYSTEMSBASES3/4.7.3 REACTOR PLANT COMPONENT COOLING WATER SYSTEMThe OPERABILITY of the Reactor Plant Component Cooling Water. System ensures thatsufficient cooling capacity is. available for continued operation of safety-related equipment duringnormal and accident conditions. The redundant cooling capacity of this system, assuming a singlefailure, is. consistent with the assumptions used in. the safety analyses.The Charging Pump/Reactor Plant Componenit Cooling Water Pump.Ventilation System isrequired to be available to. support reactor plant component cooling water pump operation. TheCharging Pump/Reactor Plaint Component Cooling Water Pump Ventilation System consists oftwo redundant trains, each capablle of providing 100% of the required flow. Each train has. a twoposition, and "Auto," renmote control S'witch. With the remote control switches for each trainin the "Auto" position, the system is capable of automatically transferring operation to theredundant train in the event of a low flow condition in the..operating train. The associated fans donot receive any safety related automatic start.signals (e.g., Safety Injection Signal).Placing the remote control switch for a Charging Pump/Reactor Plant Component CoolingWater Pump Ventilation Train in the "Off' position to start the redundant train or to perform postmaintenance testing to verify availability of the redundant train will not affect the availability ofthat train, provided appropriate administrative controls have been established to ensurethe remote.control switch is immediately returned to the "Auto" position after the completion of the specifiedactivities or in response to plant conditions. These administrative controls include the use of anapproved procedure and a designated individual .at the control switch for the respective ChargingPumpReaetor" Planit Comrponeni Cooling'Water PUmp Ventilatiori Train Who6 apidly respondto instructions from procedures, or control room personnel, based on plant conditions.3/4.7.4 SERVICE WATER SYSTEMThe OPERABILITY of the Service Water System ensures that 'sufficient cooling capacityis available for contintied operation of safety-related equipmen~t during nonmal land accidentconditions. The redundant.cooling Capacity of this system, assuming a single failure, is consistentwith the assumptions used in the safety analyses.An OPERABLE service water loop requires one OPERABLE service water pump and .associated strainer. Two OPERABLE service water loops, with one OPERABLE service waterpump and associated strainer per loop, will provide sufficient core (and containment) decay heatremoval during a design basis accident coincident with a loss of offsite power and a single failure.MILLSTONE -UNIT 3 B 3/4 7-7a Amendment No. 4-4-~,' Acknowledged by NRC letter dated 08/25/05 LBDCR No. 13-MP3-002May 2, 2013PLANT SYSTEMSBASES3/4.7.5 ULTIMATE HEAT SINKBACKGROUNDThe ultimate heat sink (UIIS) for Millstone Unit No. 3 is Long Island Sound. The Long IslandSound is connected to the Atlantic Ocean and provides the required 30 day supply of water. Itserves as a heat sink for both safety and nonsafety-related cooling systems. Sensible heat isdischarged to the UHS via the service water (SW) and circulating water (CWV) systems.The basic performance requirement is that a 30 day supply of water be available, and that thedesign basis temperatures of safety related equipment not be exceeded.Additional information on the design and operation of the system, along with a list of componentsserved, can be found in References 1, 2, and 3.APPLICABLE SAFETY ANALYSESThe UIHS is the sink for heat removed from the reactor core following all accidents andanticipated operational occurrences in which the unit is cooled down and placed on residual heatremoval (RTIR) operation. With UHS as the normal heat sink for condenser cooling via the CWSystem, unit operation at full power is its maximum heat load. Its maximum post accident heatload occurs <1 hour after a design basis loss of coolant accident (LOCA). Near this time, the unitswitches from injection to recirculation and the containment recirculation system removes thecore decay heat.The operating limits are based on conservative heat transfer analyses for the worst case LOCA.References 1, 2, and 3 provide the details of the assumptions used in the analysis, which includeworst expected meteorological conditions, conservative uncertainties .when calciulating decayheat, and worst case single active failure (e.g., single failure of a man-made structure).The limitations on the temperature of the UTHS ensure that the assumption for temperature used inthe analyses for cooling of safety related components by the SW system are satisfied. Theseanalyses ensure that under normal operation, plant cooldown, or accident conditions, allcomponents cooled directly or indirectly by SW will receive adequate cooling to perform theirdesign basis functions.The UHS satisfies Criterion 3 of 10 CFR 50.3 6(c)(2)(ii).LCOThe UHS is required to be OPERABLE and is considered OPERABLE if it contains a sufficientvolume of water at or below the maximum temperature that would allow the SW System tooperate for at least 30 days following the design basis LOCA without the loss of net positiveMILLSTONE -UNIT 3B347-AmnetNo43-B 3/4 7-8Amendment No. 4-36 REVERSE OF PAGE B 3/4 7-8INTENTIONALLY LEFT BLANK LBDCR No. 13-MP3-002May 2, 2013PLANT SYSTEMSBASESLCO (Continued)suction head (NP SH), and without exceeding the maximum design temperature of the*equipment served by the SW System. To meet this condition, the UHS temperature shouldnot exceed 80°F during normal unit operation.While the use of any supply side SW temperature indication is adequate to ensurecompliance with the analysis assumptions, precision instruments installed at the inlet to thereactor plant closed cooling water (RPCCW) (CCP) heat exchanges will normally be used.Therefore, instrument uncertainty need not be factored into the surveillance acceptancecriteria. All in-service instruments must be within the limit. If all of the precisioninstruments are out of service, alternative instruments that measure SW supply sidetemperature will be used. In this case, an appropriate instrument uncertainty will besubtracted from the acceptance criteria.Since Long Island Sound temperature changes relatively slowly and in a predictable fashionaccording to the tides, it is acceptable to monitor this temperature daily when there is ample(>5°F) margin to the limit. When within 50F of the limit, the temperature shall be monitoredevery 6 hours to ensure that tidal variations are appropriately captured.APPLICABILITYIn MODES 1, 2, 3, and 4, the UHS is required to support the OPERABILITY of theequipment serviced by the UHS and required to be OPERABLE in these MODES.In MODE 5 or 6, the OPERABILITY requirements of the uHS are determined by thesystems its supports.ACTIONIf the UHS is inoperable, the unit must be placed in a MODE in which the LCO does notapply. To achieve this status, the unit must be placed inl at least HOT STANDBY within6 hours and in COLD SHUTDOWN within the following 30 hours.The allowed outage times are reasonable, based on operating experience, to reach therequired unit conditions from full power conditions in an orderly manner and withoutchallenging unit systems.MILLSTONE -UNIT 3 B 3/4 7-9 Amendment No. 4-36, LBDCR 13-MP3-002May 2, 2013PLANT SYSTEMSBASESSURVEILLANCE REQUIREMENTSThis surveillance requirement verifies that the UHS is capable of providing a 30 day coolingwater supply to safety related equipment without exceeding its design basis temperature. Thissurveillance requirement verifies that the water temperature of the UHS is < 80°F.REFERENCES1. FSAR, Section 6.2, Containment Systems2. FSAR, Section 9.2, Water Systems3. FSAR, Section 15.6, Decrease in Reactor Coolant Inventory3/4.7.6 DELETED3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEMBACKGROUNDThe control room emergency ventilation system provides a protected environment from whichdoperators can control the unit following an uncontrolled release of radioactivity, hazardous 0chemicals, or smoke. Additionally, the system provides temperature control for the control room :envelope (CRE) during normal and post-accident operations.The control room emergency ventilation system is comprised of the CRE emergency air filtrationsystem and a temperature control system..The control room emergency air filtration system consists of two redundant systems thatrecirculate and filter the air in the CRE and a CRE boundary that limits the inleakage of unfilteredair. Each control room emergency air filtration system consists of a moisture separator, electricheater, prefilter, upstream high efficiency particulate air (IiEPA) filter, charcoal adsorber,downstream 1-EPA filter, and fan. Additionally, ductwork, valves or dampers, andinstrumentation form part of the system.The CRE is the area within the confines of the CRE boundary that contains the spaces that controlroom occupants inhabit to control the unit during normal and accident conditions. This areaencompasses the control room, and other non-critical areas including adjacent support offices,MILLSTONE -UNIT 3 B 3/4 7-10 Amendment No. 44l9, 4-36, 444, g--t4 O LBDCR No...08-MP3-014October 21, 2008PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)BACKGROUND (Continued)toilet and utility rooms. The CRE is protected during normal operation, natural events, andaccident conditions. The CRE boundary is the combination of walls, floor, ceiling, ducting,valves, doors, penetrations and equipment that physically form the CRE. The OPERABILITYof the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into theCRE will not exceed the inleakage assumed in the licensing basis analysis of design basisaccident (DBA) consequences to CRE occupants. The CRE and its boundary are defined inthe Control Room Envelope Habitability Program and UFSAR Section 6.4.2.1.Normal OperationA portion of the control room emergency ventilation system is required to operate duringnorrnial operations to ensure the temperature of the control room is maintained at or below95°0F.Post Accident OperationThe control room emergency ventilation systemn'is re quired to operate during post-accidentoperations to ensure the temperature of the CRE is maintained and to ensure the CRE willremain habitable during and following accident conditions.The following event occurs upon receipt of a control building isolation (CBI) signal or a signalindicating high radiation in the air supply duct to the CRE.The control room emergency ventilation system will automatically start in theemergency mode (filtered pressurization whereby outside air is diverted through thefilters to the CRE to maintain a positive pressure).APPLICABLE SAFETY ANALYSISThe OPERABILITY of the Control Room Emergency Ventilation System ensures that: (1) theambient air temperature does not exceed the allowable temperature for continuous-duty ratingfor the equipment and instrumentation cooled by this system, and (2) the CRE will remainMILLSTONE -UNIT 3B 3/4 7-11MILLTONE- UNT 3 3/4-11Amendment No. 4-3-6, 2-1-, LBDCR No._08-MP3-014October 21, 2008PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)APPLICABLE SAFETY ANALYSIS (Continued)habitable for occupants during and following all credible accident conditions. TheOPERABILITY of this system in conjunction with control room design provisions is based onlimiting the radiation exposure to CRE occupants. For all postulated design basis accidents,the radiation exposure to CRE occupants shall be 5 rem TEDE or less, consistent with therequirements of 10 CFR 50.67. This limitation is consistent with the requirements of GeneralDesign Criterion 19 of Appendix A, 10 CFR Part 50.LIMITING CONDITION FOR OPERATIONTwo independent control room emergency air filtration systems are required to beOPERABLE to ensure that at least one is available in the event the other system is disabled.Total system failure, such as from a loss of both ventilation trains or from an inoperable CREboundary, could result in exceeding a dose of 5 rem TEDE to the CRE occupants in the eventof a large radioactive release.A control room emergency air filtration system is OPERABLE when the associated:a. Fan is OPERABLE;b. HEPA filters and charcoal adsorbers are not excessively restricting flow and arecapable of performing their filtration, functions; andc. moisture separator, heater, ductwork, valveS, and dampers are OPERABLE, and aircirculation can be maintained.In order for the CREVs to be considered OPERABLE, the CRE boundary must be maintainedsuch that the CRE occupant dose from a large radioactive release does not exceed thecalculated dose in the licensing basis consequence analyses for DBAs, and that CREoccupants are protected from hazardous chemicals and smoke.TS LCO 3.7.7 is modified by a footnote allowing the CRE boundary to be openedintermittently under administrative controls. This footnote only applies to openings in theCRE boundary that can be rapidly restored to the design condition, such as doors, hatches,MILLSTONE -UNIT 3B 3/4 7-12MILLTON -NIT B /4 -12Amendment No. 14-6, -2093, 2--9, LBDCR No.-0O8-MP3-014October 21, 2008PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)LIMITING CONDITION FOR OPERATION (Continued)floor plugs, and access panels. For entry and exit through doors, the administrative controlof the opening is performed by the person(s) entering or exiting the area. For otheropenings, these controls should be proceduralized and consist of stationing a dedicatedindividual at the opening who is in continuous communication with the operators in theGRE. This individual will have a method to rapidly close the opening and to restore theCRE boundary to a condition equivalent to the design condition when a need for CREisolation is indicated.Operation of the Control Room Emergency Ventilation System in the emergency mode iscredited for design basis accident mitigation. The fuel handling accident analyses assumethe emergency mode will be established within 30 minutes of a fuel handling accident. Theother applicable design basis accidents (e.g., large break loss of coolant accident) assumethe emergency mode will be established within 101 minutes of the accident. Even thoughmanual operator action to establish the emergency mode could be credited within these timeperiods, the system has been designed to automatically establish the required equipmentalignment upon receipt of a Control Building Isolation signal. Therefore, when stopping aControl Room Emergency Filter Fan by placing the control switch in OFF, the fan remainsOPERABLE. The administrative controls associated-with the procedure in use to stop thefan are sufficient to ensure the associated control switch is returned to the AUTO position.In addition, the Emergency Operating Procedure will ensure a Control Room EmergencyFilter fan is running in the emergency mode post accident well within the credited accidentmitigation time frame.Control Room inlet isolation valves 3HVC*AOV25 and 3HVC*A0V26 are maintainedopen with air isolated whenever Technical Specification 3.7.7 is applicable. The onlyprocedural guidance to close 31H1VC*AO V25 when this specification is applicable is in thealarm response procedure for smoke in the control room air inlet ventilation duct. Thealarm response procedure will provide direction to establish the filtered recirculation modeof operation by restoring air and closing 3HVC*AOV25. During this limited time period,both Control Room Emergency Filtration trains remain OPERABLE, but degraded. Eventhough 3HVC*AOV25 is closed, it is a fail open valve and will automatically open on aControl Building Isolation signal, making it OPERABLE. However, should it to fail open,the system will not function. Therefore, it is not single failure proof and is degraded.Operation in this condition should be minimized.MILLSTONE -UNIT 3B 3/4 7-12aMILLTON -UIT B 34 712aAmendment No. 3-6, -2O)3, 2-1-, REVERSE OF PAGE B 3/4 7-12aINTENTIONALLY LEFT BLANK LBDCR 10-MP3-003February 23, 2010PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)APPLICABILITYIn MODES 1, 2, 3, and 4.During movement of recently irradiated fuel assemblies.ACTIONS a., b., and c. of this specification are applicable at all times during plantoperation in MODES 1, 2, 3, and 4. ACTIONS d. and e. are applicable during movementof recently irradiated fuel assemblies. The CREVs is required to be OPERABLE duringfuel handling involving handling recently irradiated fuel (i.e., fuel that has occupied partof a critical reactor core within the previous 350 hours*).An analysis was completed that analyzed a bounding drop of a non-spent fuel component. Theanalysis showed that the amount of fuel damage from this drop resulted in control room dose lessthan 5 rem TEDE without operation of the control room ventilation system.ACTIONSMODES 1, 2. 3. and 4a. With one control room emergency air filtration system inoperable for reasons other thanan inoperable CRE boundary, action must be taken to restore the inoperable system to anOPERABLE status within 7 days. In this condition, the remaining control roomemergency air filtration system is adequate to perform the CRE occupant protectionfunction. However, the overall reliability is reduced because a single failure in theOPERABLE train could result in a loss of the control room emergency air filtrationsystem function. The 7-day completion time is based on the low probability of a DBAoccurring during this time period, and the ability of the remaining train to provide therequired capability.If the inoperable train cannot be restored to an OPERABLE status within 7 days, the unitmust be placed in at least HOT STANDBY within the next 6 hours and in COLDSHUTDOWN within the following 30 hours. These completion times are reasonable,based on operating experience, to reach the required unit condition from full powerconditions in an orderly manner and without challenging unit systems.*During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuelassemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a criticalreactor core within the previous 525 hours.MILLSTONE -UNIT 3B 3/4 7-13MILLTONE- UNT 3 3/47-13Amendment No. 36, N3-3, LBDCR 07-MP3-033June 25, 2007PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)ACTIONS (Continued)b. With both control room emergency air filtration systems inoperable, except due to an inoperableCRE boundary, at least one control room emergency air filtration system must be restored toOPERABLE status within 1 hour, or the unit must be in HOT STANDBY within the next 6hours and in COLD SHUTDOWN within the following 30 hours. These completion times arereasonable, based on operating experience, to reach the required unit conditions from fullpower conditions in an orderly manner and without challenging unit systems.c. With one or more control room emergency air filtration systems inoperable due to aninoperable CRE boundary, (1) action must be immediately initiated to implementmitigating actions; (2) action must be taken within 24 hours to verify mitigating actions*ensure CRE occupant exposures to radiological and chemical hazards will not exceedlimits, and mitigating actions are taken to smoke hazards; and (3) the CREboundary must be restored to OPERABLE status within 90 days. Otherwise, the unit mustbe in HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within thefollowing 30 hours.If the unfiltered inleakage of potentially contaminated air past the CRE boundary and intothe CRE can result in CRE occupant radiological dose greater than the calculated dose ofthe licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), orinadequate protection of CRE occupants-ffom chemicals or smoke, the CREboundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundarywithin 90 days.During the period that the CRE boundary is considered inoperable, action must be initiatedto implement mitigating actions to lessen the effect on CRE occupants from the potentialhazards of a radiological or chemical event or a challenge from smoke. Actions must betaken within 24 hours to verify that in the event of a DBA, the mitigating actions willensure that CRE occupant radiological exposures will not exceed the calculated dose ofthe licensing basis analyses of DBA consequences, and that CRE occupants are protectedfrom hazardous chemicals and smoke. These mitigating actions (i.e., actions that are takento offset the consequences of the inoperable CRE boundary) should be preplanned forimplementation upon entry into the condition, regardless of whether entry is intentional orunintentional. The 24 hour Completion Time is reasonable based on the low probability ofa DBA occurring during this time period, and the use of mitigating actions. The 90 dayCompletion Time is reasonable based on the determination that the mitigating actions willensure protection of CRE occupants within analyzed limits while limiting the probabilitythat CRE occupants will have to implement protective measures that may adversely affectMILLSTONE -UNIT 3B 3/4 7-13aMILLSONE UNI 3 B3/4 -13aAmendment No. 36, 8--, 2413, 2-2-9, LBDCR 12-MP3-010September 20, 2012PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)ACTIONS (Continued)their ability to control the reactor and maintain it in a safe shutdown condition in the eventof a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, planand possibly repair, and test most problems with the CRE boundary.Immediate action(s), in accordance with the LCO ACTION Statements, means that therequired action should be pursued without delay and in a controlled manner.During movement of recently irradiated fuel assembliesd. With one control room emergency air filtration system inoperable, action must be taken torestore the inoperable system to an OPERABLE status within 7 days. After 7 days, either* initiate and maintain operation of the remaining OPERABLE control room emergency airfiltration system in the emergency mode or suspend the movement of fuel. Initiating andmaintaining operation of the OPERABLE train in the emergency mode ensures:(i) OPERABILITY of the train will not be compromised by a failure of the automaticactuation logic; and (ii) active failures will be readily detected.e. With both control room emergency air filtration systems inoperable, or with the trainrequired by ACTION 'd' not capable of being powered by an OPERABLE emergencypower source, actions must be taken to suspend all operations involving the movement ofrecently irradiated fuel assemblies. This action places the unit in a condition thatminimizes risk. This action does not preclude the movement of fuel to a safe position.SURVEILLANCE REQUIREMENTS4.7.7.aThe CRE environment should be checked periodically to ensure that the CRE temperature controlsystem is functioning properly. The surveillance frequency is controlled under the SurveillanceFrequency Control Program. It is not necessary to cycle the CRE ventilation chillers. The CRE ismanned during operations covered by the technical specifications. Typically, temperatureaberrations will be readily apparent.4.7.7.bStandby systems should be checked periodically to ensure that they function properly. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.1MILLSTONE -UNIT 3B/4-bAmnetNoB 3/4 7-13bAmendment No. LBDCR 12-MP3-010September 20, 2012PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)SURVEILLANCE REQUIREMENTS (Continued)This surveillance requirement verifies a system flow rate of 1,120 cfln -20%. Additionally, thesystem is required to operate for at least 10 continuous hours with the heaters energized. Theseoperations are sufficient to reduce the buildup of moisture on the adsorbers and HEPA filtersdue to the humidity in the ambient air.4.7.7.cThe performance of the control room emergency filtration systems should be checkedperiodically by verifying the 1HEPA filter efficiency, charcoal adsorber efficiency, minimumflow rate, and the physical properties of the activated charcoal. The frequency is as specified inthe Surveillance Frequency Control Program and following painting, fire, or chemical release inany ventilation zone communicating with the system.ANSI N5 10-1980 will be used as a procedural guide for surveillance testing.Any time the OPERABILITY of a JiEPA filter or charcoal adsorber housing has been affectedby repair, maintenance, modification, or replacement activity, post maintenance testing inaccordance with SR 4.0.1 is required to demonstrate OPERABILITY.4.7.7.c.lThis surveillance verifies that the system satisfies the in-place penetration and bypass leakagetesting acceptance criterion of less than 0.05% in accordance with Regulatory Position C.5.a,C.5.c, and C.5.d of Regulatory Guide 1.52, Revision 2, March 1978, while operating the systemat a flow rate of 1,120 cfm+/-+ 20%. ANSI N510-1980 is used in lieu of ANSI N510-1975referenced in the regulatory guide.4.7.7.c.2This surveillance requires that a representative carbon sample be obtained in accordance withRegulatory Position C.6.b of Regulatory Guide 1.52, Revision 2, March 1978 and that alaboratory analysis verify that the representative carbon sample meets the laboratory testingcriteria of ASTM D3803-89 and Millstone Unit 3 specific parameters. The laboratory analysis isrequired to be performed within 31 days after removal of the sample. ANSI N510-1980 is usedin lieu of ANSI N510-1975 referenced in Revision 2 of Regulatory Guide 1.52.MILLSTONE -UNIT 3B 3/4 7-14MILSTOE UNT 3B /4714Amendment No. -!-3-, 4-84, _2-06 LBDCR 12-MP3-010September 20, 2012PLANT SYSTEMSBASES314.7.7 CONTROL ROOM EMERGENCY VENTILATION sYSTEM (Continued)SURVEILLANCE REGUIREMENTS (Continued)4.7.7.c.3This surveillance verifies that a system flow rate of 1,120 cfrn + 20%, during system operationwhen testing in accordance with ANSI N5 10-1980.4.7.7.dAfter 720 hours of charcoal adsorber operation, a representative carbon sample must beobtained in accordance with Regulatory Position C.6.b of Regulatory Guide 1.52, Revision 2,March 1978, and a laboratory analysis must verify that the representative carbon sample meetsthe laboratory testing criteria of ASTM D3803-89 and Millstone Unit 3 specific parameters.The laboratory analysis is required to be performed within 31 days after removal of the sample.ANSI N510-1980 is used in lieu of ANSI N510-1975 referenced in Revision 2 of RegulatoryGuide 1.52.The maximum surveillance interval is 900 hours, per Surveillance Requirement 4.0.2. The720 hours of operation requirement originates from Nuclear Regulatory Guide 1.52, Table 2,Note C. This testing ensures that the charcoal adsorbency capacity has not degraded belowacceptable limits as well as providing trending data.4.7.7.e. 1This surveillance verifies that the pressure drop across the combined IHEPA filters and charcoaladsorbers banks at less than 6.75 inches water gauge when the system is operated at a flow rateof 1,120 cfmn -20%. The surveillance frequency is controlled under the SurveillanceFrequency Control Program.4.7.7.e.2Deleted.4.7.7.e.3This surveillance verifies that the heaters can dissipate 9.4 4- 1 kW at 480V when tested inaccordance with ANSI N510-1980. The surveillance frequency is controlled under theSurveillance Frequency Control Program. The heater kW measured must be corrected to itsnameplate rating. Variations in system voltage can lead to measurements of kW which cannotbe compared to the nameplate rating becaus~e the output kW is proportional to the square of thevoltage.MILLSTONE -UNIT 3MILSTOE -UNI 3B 314 7-15 Amendment No. 4-3-6,4-1-84-,--84, 2-0-3,20 LBDCR 07-MP3-033June 25, 2007PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)SURVEILLANCE REOUIREMENTS (Continued)4.7.7.fFollowing the complete or partial replacement of a HEPA filter bank, the OPERABILITY of thecleanup system should be confirmed. This is accomplished by verifying that the cleanup systemsatisfies the in-place penetration and bypass leakage testing acceptance criterion of less than0.05% in accordance with ANSI N5 10-1980 for a DOP test aerosol while operating the system ata flow rate of 1,120 cfm d 20%.4.7.7.g_Following the complete or partial replacement of a charcoal adsorber bank, the OPERABILITYof the cleanup system should be confirmed. This is accomplished by verifying that the cleanupsystem satisfied the in-place penetration and bypass leakage testing acceptance criterion of lessthan 0.05% in accordance with ANSI N5I10-1 980 for a halogenated hydrocarbon refrigerant testgas while operating the system at a flow of 1,120 cfmn +/- 20%.4.7.7.h OThis Surveillance verifies the OPERABILITY of the CR3 boundary by testing for unfiltered airinleakage past the CR3 boundary and into the CR3. The details of the testing are specified in theControl Room Envelope Habitability Program.The CR3_ is considered habitable when the radiological dose to CR3 occupants calculated in thelicensing basis analyses of DBA consequences is no more than 5 rem TEDE and the CR3occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfilteredair inleakage into the CR3 is no greater than the flow rate assumed in the licensing basis analysesof DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate,ACTION c. must be entered. ACTION c. allows time to restore the CR3 boundary toOPERABLE status provided mitigating actions can ensure that the CR3 remains within thelicensing basis habitability limits for the occupants following an accident. Compensatorymeasures are discussed in Regulatory Guide 1.196, which endorses, with exceptions, NEI 99-03.These compensatory measures may also be used as mitigating actions as required by ACTION c.Temporary analytical methods may also be used as compensatory measures to restoreOPERABILITY. Options for restoring the CR3 boundary to OPERABLE status include changingthe licensing basis DBA consequence analysis, repairing the CR3 boundary, or a combination ofthese actions. Depending upon the nature of the problem and the corrective action, a full scopeinleakage test may not be necessary to establish that the CR3 boundary has been restored toOPERABLE status.MILLSTONE -UNIT 3 B 3/4 7-16 Amendment No. .-34, _20-3, _206, O LBDCtR-07-MP3-033June 25, 2007PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

References:

(1) Nuclear Regulatory Guide 1.52, Revision 2(2) MP3 UFSAR, Table 1.8-1, NRC Regulatory Guide 1.52(3) NRC Generic Letter 9 1-04(4) Condition Report (CR) #M3-99-027 1(5) NEI 99-03, "Control Room Habitability Assessment"(6) Letter from Eric 3. Leeds (NRC)'to James W. Davis (NEI) dated January 30, 2004, "NEIDraft White paper, Use of Generic Letter 91-18 Process and Alternative Source Terms inthe Context of Control Room Habitability."3/4.7.8 DELETEDMILLSTONE -UNIT 3B3/7-7AedntN.4-6B 3/4 7-17Amendment No. LBDCR No. 06-MP3-026October 15, 2006THIS PAGE INTENTIONALLY LEFT BLANKMILLSTONE -UNIT 3B 3/4 7-18Amendment No. 4-36, 20-3, 2-1-9NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026October 15, 2006THIS PAGE INTENTIONALLY LEFT BLANK.ILLSTONE -UNIT. 3B 3/4 7-19... Amendment No. 3-6, 2O-4, 24-9NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026October 15, 2006THIS PAGE INTENTIONALLY LEFT BLANK ..MILLSTONE -UNIT 3B 3/4 7-20.Amendment No.4--36,4--84-, 20-3, 9NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026October 15, 2006* THIS PAGE INTENTIONALLY LEFT BLANKO -UNIT 3B 3/4 7-21Amendment No. 4-3~6, -2Ot-, -246NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026October 15, 2006THIS PAGE INTENTIONALLY LEFT BLANKMILLSTONE TJN{IT 3B 3/4 7-22.Amendment No. 4-36NRC Verbal Acknowledgement: 07/05/07 LBDCR 12-MiP3-010September 20, 2012PLANT SYSTEMSBASES3/4.7.9 AUXILIARY BUILDING FILTER SYSTEMThe OPERABILITY of the Auxiliary Building Filter System, and associated filters andfans, ensures that radioactive materials leaking from the-~equipment within the charging pump,component cooling water pump and heat exchanger areas following a LOCA are filtered prior toreaching the environmnent. Periodic operation of the system with the heaters operating for at least10 continuous hourns is sufficient to reduce the buildup of moisture on the ads orbers and 1-EPAfilters. The surveillance frequency is controlled under the Surveillance Frequency ControlProgram. The operation of thtis system and the resultant effect on offsite dosage calculations wasassumed in the safety analyses. ANSI N510-1980 will be used as a procedural guide forsurveillance testing. Laboratory testing of methyl iodide penetration shall be performed inaccordance with ASTM D3 803-89 aind Millstone Untit 3 specific parameters. The heater kWmeasured must be corrected to its nameplate rating. Variations in system voltage can lead tomeasurements of kW which cannot be compared to the nameplate rating because the output kW isproportional to the square of the voltage.The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System isrequired to be available to support the Auxiliary Building Filter System and the SupplementaiyLeak Collection and Release System (SLCRS). The Charging Pump/Reactor Plant ComponentCooling Water Pump Ventilation System consists of two redundant trains, each capable ofproviding 100% of the required flow. Each train has a two position, "Off' and "Auto," remotecontrol switch. With the remote control switches for each train in the "Auto" position, the systemis capable of automatically transferring operation to the redundant train in the event of a low flowcondition in the operating train. The associated fans do not receive any safety related automaticstart signals (e.g. Safety Injection Signal).Placing the remote control switch for a Charging Pump/Reactor plant Component CoolingWater Pump Ventilation Train in the "Off' position to start the redundant train or to perform postmaintenance testing to verify availability of the redundant train will not affect the availability ofthat train, provided appropriate administrative controls have been established to ensure the remotecontrol switch is immediately returned to the "Auto" position after the completion of the specifiedactivities or in response to plant conditions. These administrative controls include the use Of anapproved procedure and a designated individual at the control switch for the respective ChargingP~ump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respondto instructions from procedures, or control room personne, based on plant conditions.MILLSTONE -UNIT 3 B 3/4 7-23 Amendment No. &-7, 9, -!3, -!-84, LBDCR March 12, 2012PLANT SYSTEMSBASES6LCO 3.7.9 ACTION statement:With one Auxiliary Building Filter System inoperable, restoration to OPERABLE statuswithin 7 days is required.The 7 days restoration time requirement is based on the following: The risk contribution isless for an inoperable Auxiliary Building Filter System, than for the charging pump or reactorplant component cooling water (RPCCW) systems, which have a 72 hour restoration timerequirement. The Auxiliamyr Building Filter System is not a direct support system for the chargingpumps or RPCCW pumps. Because the pump area is a colmmon area, and as long as the other trainof the Auxiliary Building Filter System remains OPERABLE, the 7 day restoration timne limit isacceptable based on the low probability of a DBA occurring during the time period and the abilityof the remaining train to provide the required capability. A concurrent failure of both trains wouldrequire entry into LCO 3.0.3 due to the loss of functional capability. The Auxiliary Building FilterSystem does support the Supplementary Leak Collection and Release System (SLCRS) and theLCO ACTION statement time of 7 days is consistent with that specified for SLCRS (See LCO3.6.6.1).Any time the OPERABILITY of a I{EPA filter or charcoal adsorber housing has beenaffected by repail; maintenance, modification, or replacement activity, post maintenance testing inaccordance with SR 4.0.1 is required to demonstrate OPERABILITY.Surveillance Requirement 4.7.9.c OSurveillance requirement 4.7.9.c requires that after 720 hours of operation a charcoalsample must be taken and the sample must be analyzed within 31 days after removal.The 720 hours of operation requirement originates from Regulatory¢ Guide 1.52, Revision2, March 1978, Table 2, Note "c", which states that "Testing should be perfonne~d (1) initially, (2)at least once per 18 months thereafter for systems maintained in a stanmdby status or after 720hours of system operations, and (3) following painting, fire, or chemical release in any ventilationzone cormmunicating with the system." This testing ensures that the charcoal adsorbencycapacity has not degraded below acceptable limits as well as providing trending data. The 720hour figure is an arbitramyj numaber which is equivalent to a 30 day period. This criteria is directedto filter systems that are normally in operation and also provide emergency air cleaning functionsin the event of a Design Basis Accident. The applicable filter units are not normaally in operationand sample canisters are typically removed due to the 18 month criteria.3/4.7.10 SNUJBBERSAll snubbers are required OPERABLE to ensure that the structural integrity of the ReactorCoolant System and all other safety-related systems is maintained .during and following a seismicor other event initiating dynamic loads. For the purpose of declaring the affected systemOPERABLE with the inoperable snubber(s), an engineering evaluation may be performed, inaccordance with Section 50.59 of 10 CFR Part 50.MILLSTONE -UNIT 3 B 3/4 7-23 a Amendment No. 8-7-, 4-1--9, 4-1-6, -184 Q LBDCR 12-MP3-003March 12, 2012THIS PAGE INTENTIONALLY LEFT BLANKO@} MILLSTONE -UNIT 3B 3/4 7-24Amendment No. 4-6, -7,4-1-9, 43-6, LBDCR 12-MP3-003March 12, 2012PLANT SYSTEMSBASES3/4.7.11 DELETED314.7.14 DELETED0/MILLSTONE -UNIT 3B 3/4 7-25Amendment Nos. g-g,--84, 4-1-, 4-19,1362 14 LBDCR No. 04-MP3-015* February 24, 20053/4.8 ELECTRICAL POWER SYSTEMSBASESI.:3/4.8.1. 3/4.8.2 and 3/4.8.3 A.C. SOURCES, D.C. SOURCES, and ONSITE POWERDISTRIBUTIONThe OPERABILITY of the A.C. and D.C. power sources and associated distributionsystems during operation ensures that sufficient power will be available to supply the safety-related equipment required for: (1) the safe shutdown of the facility, and (2) the mitigation andcontrol of accident conditions within the facility. The minimum specified independent andredundant A.C. and D.C. power sources and distribution systems satisfy the requirements ofGeneral Design Criterion 17 of Appendix A to 10 CFR Part 50.LCO 3.8.1.l.aLCO 3.8.1.1l.a requires two independent offsite power sources. With both the RSST and* the NSST available, either power source may supply power to the Vital busses to meet the intentof Technical Specification 3.8.1.1. The FSAR, and Regulatory Guide 1.32, 1.6, and 1.93 providethe basis for requirements concerning off-site power sources. The basic requirement is to have*two independent offsite power sources. The requirement to have a fast transfer is not Specificallystated. An automatic fast transfer is required for plants without a generator output trip breaker,where power from the NSST is lost on a turbine trip. The surveillance requirement for transferfrom the nonnal circuit' to the alternate circuit is required for a transfer from the NS ST to theRSST in the event Of an electrical failure. There is no specific requirement to have an automatictransfer from the RSST to the NSST...S~i The ACTION requirements specified for the levels of degradation of the power sources;provide restriction upon continued facility operation commensurate with the level of degradation.The OPERBI-BLITY of the power sources are consistent with tche initi'al' conditiotn a~rpti'ons ofthe safety analy~ses anid are based upon. rnain~tainig at !east set of onsite AL., and.D.C. power sb~itees arid associa~ted' distrbtiofin systehs OPERABLE dturing accident conditions:coincident with an assumed loss-of-offsite power and single failure :of the other onsite A.C.source. The A.C. and D.C. source allowable out-of-service times are based in part on RegulatoryGuide 1.93, "Availability of Electrical Power Sources," December 1974. Technical Specification3.8.1.1 ACTION Statements b.2 and: c.2 provide an allowance to avoid unnecessary testing of theother OPERABLE diesel generator. If it can be determined that the cause of the inoperable diesel:generator does no~t exist on the OPERABLE diesel generator, Surveillance Requirement4.8.1.1.2.a.5 does not have to be performed. If the cause of inoperability exists on the otherOPERABLE diesel generator, the other OPERABLE diesel generator would be declaredinoperable upon discovery, ACTION Statement e. would be entered, and appropriate actions willbe taken. Once the failure is corrected, the common cause failure no longer exists, and thlerequired ACTION Statements (b., c., and e.) will be satisfied.If it can not be determined that the cause of the inoperable diesel generator* does not existon the remaining diesel generator, performance of Surveillance Requirement 4.8.1.1 .2.a.5, withinthe allowed time period, suffices to provide assurance of continued OPERABILITY of the dieselgenerator. If the inoperable diesel generator is restored to OPERABLE status prior to thedetermination of the impact on the other diesel generator, evaluation will continue of the possiblecommon cause failure. This continued evatuation is noO i MILLSTONE.- UNIT 3 B 3/4 8-1 Amendment No. 4-1-2,-1,-z0,* Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-01 5February 24, 20053/4.8 ELECTRICAL POWER SYSTEMSBASESlonger under the time constraint imposed while in ACTION Statements b.2 or c.2.The determination of the existence of a common cause failure that would affect theremaining diesel generator will require an evaluation of.the current failure and the applicability tothe remaining diesel generator. Examples that would not be a common cause failure include, butare not limited to:1. Preplanned preventative maintenance or testing; or2. An inoperable support system With no potential common mode failure for theremaining diesel generator; or3. An independently testable component with no potential common mode failure for theremaining diesel generator.'When one diesel generator is inoperable, there is an additional ACTION requirement (b.3and c.3) to verify that all required systems, subsystems, trains, compon~ents addevices, thatdepend on the remaining OPERABLE diesel generator as a source of emergency power, are alsoOPERABLE, and that the steam-driven auxiliary feedwater pump is OPERABLE. Thisrequirement is intended to provide assurance that a loss-of-offsite power event will not result in a.complete loss of safety function of critical systems during the period One of the diesel generatorsis inoperable. The term, verify, as used in this context means to administratively check byexamining logs or other information to determine if certain components are out-of-service formaintenance or other reasons. It does not mean to perform the Surveillance Requirements neededto demonstrate the OPERABILITY of the component.if one Mill~triie Uniit No iS3 diesl Nisinoperaible ini MODES 1 tlhroutghi 4, a 72hour allowed outa~ge time :is :provcided by.ACTQNStat~emt to~allowi restoratiori :of the dieselgenerator, provided" the requirements oi ACTION Statements bi~l, b.2, and b.l3 ar-e met. Thisallowed outage time can be extended to 14 days if the additional requirements contained inACTION Statement b.4 are also met. ACTION Statement b.4 requires verification that theMillstone Unit No. 2 diesel generators are OPERABLE as required by the applicable MillstoneUnit No. 2 Technical Specification (2 diesel generators in MODES 1 through 4, and 1 dieselgenerator in MODES 5 and 6) and the Millstone Unit No. 3 SBO diesel generator is available.The term verify, as used in this context, means to administratively check by examining logs orother information to determine if the required Millstone Unit No. 2 diesel generators 'and the.Millstone Unit No. 3 SBO diesel generator are out of service for maintenance or other reasons. Itdoes not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITYof the required Millstone Unit No. 2 diesel generators or availability of the Millstone Unit No. 3SBO diesel generator.When using the 14 day allowed outage time provision and the Millstone Unit No. 2 dieselgenerator requirements and/or Millstone Unit No. 3 SBO diesel generator requirements .are notmet, 72 hours is allowed for restoration of the required Millstone Unit No. 2 diesel generators andthe Millstone Unit No. 3 SBO diesel generator. If any of the required Millstone Unit No. 2 dieselgenerators and/or Millstone Unit No. 3 SBO diesel generator are not restored Within 72 hours, andone Millstone Unit No. 3 diesel generator is still inoperable, Millstone Unit No. 3 is required toshut down.MILLSTONE -UNIT 3 B 3/4 8-l a Amendment No.14-t-,24-0,Acknowledged by NRC letter dated 08/25/05 LBDCR 14-MP3-013October 16, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESThe 14 day allowed outage time for one inoperable Millstone Unit No. 3 diesel generatorwill allow perfonrmance of extended diesel generator maintenance and repair activities (e.g., dieselinspections) while the plant is operating. To minimize plant risk when using this extended allowedoutage time the following additional Millstone Unit No. 3 requirements must be met:1) The charging pump and charging pump cooling pump in operation shall be poweredfrom the bus not associated with the out of service diesel generator. In addition, thespare charging pump will be available to replace an inservice charging pump ifnecessary.2) The extended diesel generator outage shall not be scheduled when adverse orinclement weather conditions and/or unstable grid conditions are predicted orpresent.3) The availability of the Millstone Unit No. 3 SBO DG shall be verified by testperformance within 30 days prior to allowing a Millstone Unit No. 3 EDG to beinoperable for greater than 72 hours.4) All activity in the switchyard shall be closely monitored and controlled. No electivemaintenance within the switchyard that could challenge offsite power availabilityshall be scheduled.5) A contingency plan shall be available (OP 33 14J, Auxiliary Building EmergencyVentilation and Exhaust) to provide alternate room cooling to the charging and CCPpump area (24' 6" Auxiliary Building) in the event of a failure of the ventilationsystem prior to commencing an extended diesel generator outage.In addition, the plant configuration shall be controlled during the diesel generatormaintenance and repair activities to minimize plant risk consistent with the Configuration RiskManagement Program, as required by 10 CFR 50.65(a) (4).The OPERABILITY of the minimum specified A.C. and D.C.. power sources andassociated distribution systems during shutdown and REFUELING ensures that: (1) the facilitycan be maintained in the shutdown or REFUELING condition for extended time periods, and (2)sufficient instrumentation and control capability is available for monitoring and maintaining theunit status.The Surveillance Requirements for demonstrating the OPERABILITY of the dieselgenerators are in accordance with the recommendations of Regulatory Guides 1.9, "Selection ofDiesel Generator Set Capacity for Standby Power Supplies," March 10, 1971; 1.108, "PeriodicTesting of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear PowerPlants," Revision 1, August 1977; and 1.137, "Fuel-Oil Systems for Standby Diesel Generators,"Revision 1, October 1979. The surveillance frequencies for demonstrating OPERABILITY of thediesel generators are in accordance with the Surveillance Frequency Control Program.LCO 3.8.1.1 ACTION statement b.3 and c.3Required ACTION Statement b.3 and c.3 requires that all systems, subsystems, trains,components, and devices that depend on the remaining OPERABLE diesel as a source ofemergency power be verified OPERABLE.MILLSTONE -UNIT 3 B 3/4 8-lb Amendment No. 1-1-2., , LBDCR 12-MP3-010September 20, 20123/4.8 ELECTRICAL POWER SYSTEMSBASES3/4.8.1, 3/4.8.2, and 3/4.8.3 A.C. SOURCES, D.C. SOURCES, AND ONSITE POWERDISTRIBUTIONTechnical Specification 3.8.1.1 .b. 1 requires each of the diesel generator day tanks contain aminimum volume of 278' gallons. Technical Specification 3.8.1 .2.b.l requires a minimum volumeof 278 gallons be contained in the required diesel generator day tank. This capacity ensures that aminimum usable volume of 189 gallons is available. This volume permits operation of the dieselgenerators for approximately 27 minutes with the diesel generators loaded to the 2,000 hourrating of 5335 kw. Each diesel generator has two independent fuel oil transfer pumps. The shutofflevel of each fuel oil transfer pump provides for approximately 60 minutes of diesel generatoroperation at the 2000 hour rating. The pumps start at day tank levels to ensure the minimum levelis maintained. The loss of the two redundant pumps would cause day tank level to drop below theminimum value.Technical Specification 3.8.1.1i .b.2 requires a minimum volume of 32,760 gallons be contained ineach of the diesel generator's fuel storage systems. Technical Specification 3.8.1 .2.b.2 requires aminimum volume of 32,760 gallons be contained in the required diesel generator's fuel storagesystem. This capacity ensures that a minimum usable volume (29,180 gallons) is available topermit operation of each of the diesel generators for approximately three days with the dieselgenerators loaded to the 2,000 hour rating of 5335 kW. The ability to cross-tie the diesel generatorfuel oil supply tanks ensures that one diesel generator may operate up to approximately six days.Additional fuel oil can be supplied to the site within twenty-four hours after contacting a fuel oilsupplier.Suspending positive reactivity additions that could result in failure to meet the minimum SDM orboron concentration limit is required to assure continued safe operation. Introduction of coolantinventory must be from sources that have a boron concentration greater than that what would berequired in the RCS for minimum SDM or refueling boron concentration. This may result in anoverall reduction in RCS boron concentration, but provides acceptable margin to maintainingsubcritical operation. Introduction of temperature changes including temperature increases whenoperating with a positive MTC must also be evaluated to ensure they do not result in a loss ofrequired SDM.Suspension of these activities does not preclude completion of actions to establish a safeconservative condition. These actions minimize the probability of the occurrence of postulatedevents. It is further required to immediately initiate action to restore the required AC and DCelectrical power source and distribution subsystems and to continue this action until restoration isaccomplished in order to provide the necessary power to the unit Safety systems.Surveillance Requirements 4.8.1.1.2.a.6, 4.8.1.1.2.b.2, and 4.8.1.1.2.jThe Surveillances 4.8.1.l.2.a.6 and 4.8.l.1.2.b.2 verify that the diesel generators are capable ofsynchronaizing with the offsite electrical system and loaded to greater than or equal to continuousrating of the machine. A minimum time of 60 minutes is required to stabilize engine temperatures,wlhileMILLSTONE -UNIT 3MILSTOE UM 3B 3/4 8-ilc Amendment No. 9-7, -I4t-, -t-3-7, 4-94, 24-Q, 2-LBDCR 12-MIP3-010September 20, 20123/4.8 ELECTRICAL POWER SYSTEMSBASESminimizing the time that the diesel generator is connected to the offsite source. SurveillanceRequirement 4.8.1.1 .2.j requires demonstration that the diesel generator can start and runcontinuously at full load capability for an interval of not less than 24 hours, _ 2 hours of which areat a load equivalent to 110% of the continuous duty rating and the remainder of the time at a loadequivalent to the continuous duty rating of the diesel generator. The load band is provided toavoid routine overloading of the diesel generator. Routine overloading may result in morefr'equent teardown inspections in accordance with vendor recommendations in order to maintaindiesel generator OPERABILITY. The load band specified accounts for instrumentationinaccuracies, operational control capabilities, and human factor characteristics. The note (*)acknowledges that a mnomentatmy transient outside the load range shall not invalidate the test. Thesurveillance flequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.8.1 .1.2.a.5, 4.8.1.1 .2.b.1, 4.8.1.1.2.g.4.b, 4.8.1.1.2.g.5, and4.8.1.1.2.g.6.bSeveral diesel generator surveillance requirements specify that the emergency diesel generatorsare started from a standby condition. Standby conditions for a diesel generator means the dieselengine coolant and lubricating oil are being circulatced and temperatures are maintained withindesign ranges. Design ranges for standby temperatures are greater than or equal to the lowtemperature alann setpoints and less than or equal to the standby "keep-wanln" heater shutofftemperatures for each respective sub-system. The surveillance frequency is controlled under theSurveillance Frequency Control Program.Surveillance Requirement 4.8.1.1 .2.jThe existing "standby condition" stipulation contained in specification 4.8.1.1 .2.a.5 is supersededwhen performing the hot restart demonstration required by 4.8.1.1 .2.j.Any time the OPERABILITY of a diesel generator haes been affected by repair, maintenance, orreplacement activity, or by modification that could affect its interdependency, post maintenancetesting in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. The surveillancefrequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3B 3/4 8-1dMILLTO1SE -UNIT3 B3/4 -idAmendment No. 9-7-, 14-2, 4-3-7, 1-94, 4-0 LBDCR 12-MP3-010September 20, 2012ELECTRICAL POWER SYSTEMSBASESA.C. SOURCES. D.C. SOURCES, and ONSITE POWER DISTRIBUTION (Continued)The Surveillance Requirement for demonstrating the OPERABILITY of the station batt~eries arebased on the recommendations of Regulatory Guide 1.129, "Maintenance Testing andReplacement of Large Lead Storage Batteries for Nuclear Power Plants," February 1978, andIEEE Std 450-1975 & 1980, "IEEE Recolmmended Practice for Maintenance, Testing, andReplacement of Large Lead Storage Batteries for Generating Stations and Substations." Sections5 and 6 of IEEE Std 450-1980 replaced Sections 4 and 5 oflIEEE Std 450-1975. Guidance onbypassing weak cells, if required, is in accordance with section 7.4 of IEEE 450-2002. Thebalance of IEEE Std 450-1975 applies. The surveillance frequency is controlled under theSurveillance Frequency Control Program.Verifying average electrolyte temperature above the minimum for which the battery was sized,total battery terminal voltage on float charge, connection resistance values, and the performanceof battery service and discharge tests ensures the effectiveness of the charging system, the abilityto handle high discharge rates, and compares the battery capacity at that time with the ratedcapacity.Table 4.8-2a specifies the normal limits for each designated pilot cell and each connected cell forelectrolyte level, float voltage, and specific gravity. The limits for the designated pilot cells floatvoltage and specific gravity, greater than 2.13 volts and 0.015 below the manufacturer's fullcharge specific gravity or a battery charger current that had stabilized at a low val[ue, ischaracteristic of a charged cell with adequate capacity. The nonnal limits for each connected cellfor float voltage and specific gravity, greater than 2.13 volts and not more than 0.020 below themanufacturer's full charge specific gravity with an average specific gravity of all the connectedcells not more than 0.010 below the manufacturer's full charge specific gravity,.ensures theOPERABILITY and capability o~f the battery.with a battery cell's parameter outside the normal limit but within the allowable valuespecified in Table 4.8-2a is permitted for up to 7 days. During this 7-day period: (l)the allowablevalues for electrolyte level ensures no physical damage to the plates with an adequate electrontransfer capability; (2) the allowable value for the average specific gravity of all the cells, notmore than 0.020 below the manufacturer's recommended full charge specific gravity, ensures thatthe decrease in rating will be less than the safety margin provided in sizing; (3) the allowablevalue for an individual cell's specific gravity, ensures that an individual cell's specific gravity willnot be more than 0.040 below the manufacturer's full charge specific gravity and that the overallcapability of the battery will be maintained within an acceptable limit; and (4) the allowable valuefor an individual cell's float voltage, greater than 2.07 volts, ensures the battery's capability toperform its design function.If the required power sources or distribution systems are not OPERABLE in MODES 5 and 6,operations involving CORE ALTERATIONS, positive reactivity changes, movem-ent of recentlyirradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within theMIfLLSTONE -UNIT 3B348-AmnetNoB 3/4 8-2Amenchnent No. LB3DCR 10-MP3-003February 23, 2010ELECTRICAL POWER SYSTEMSBASESA.C. SOURCES. D.C. SOURCES. and ONSITE POWER DISTRIBUTION (Continued)previous 350 hours*), crane operation with loads over the fuel storage pooi, or operations with apotential for draining the reactor vessel are required to be suspended.3/4.8.4 DELETEDI*During fuel assembly cleaning evolutions that involve the handling or cleaning of twofuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part ofa critical reactor core within the previous 525 hours.MILLSTONE -UNIT 3B 3/4 8-3MILSTOE UNT 3B /4 -3Amendment No. , 89, -I-5-3, 4-7-, 49-2, REVERSE OF PAGE B 3/4 8-3INTENTIONALLY LEFT BLANK 06/28/063/4.9 REFUELING OPERATIONSBASES --. .. ..3/4.9.1 BORON CONCENTRATIONThe limitations on reactivity conditions during REFUELING ensure that: (1) the reactorwill remain subcritical during CORE ALTERATIONS, and (2) a uniform boron concentration ismaintained for reactivity control in the water volume having direct access to the reactor vessel,The value of 0.95 or less for Keff includes a 1% Ak/k conservative allowance for uncertainties.Similarly, the boron concentration value specified in the CORE OPERATING LIMITS REPORTincludes a conserx~ative uncertainty allowance of 50 ppm boron. The boron concentration,specified in the CORE OPERAT[NG LIMITS REPORT, provides for boron concentraitionmeasurement uncertainty between the spent fuel pool and the RWST. The locking closed of the.required valves during refueling operations precludes the possibility of uncontrolled borondilution of the filled portion of the RCS. This action prevents flow to the RCS of unborated waterby closing flow paths from sources of unborated water.MODE ZERO shall be the Operational MODE where all fuel assemblies have beenremoved from containment to the Spent Fuel Pool. Technical Specification Table 1.2 definesMODE 6 as "Fuel in the reactor vessel with the vessel head closure bolts less than fully tensionedor with the head removed." With no fuel in the vessel the definition for MODE 6 no longerapplies. The transition from MODE 6 to MODE ZERO occurs when the last fuel assembly of afull core off load has been transferred to the Spent Fuel Pool and has cleared the transfer canalwhile in transit to a storage location. This will:* Ensure Technical Specifications regarding sampling the transfer canal boron concentrationare observed (4.9.-1.1.2);.* Ensure that MODE 6 Technical Specification requirements are not relaxed prematurelyduring fuel movement in containment.Concerning ACTION a., suspension of CORE ALTERATIONS and positive reactivityadditions shall not preclude moving a component to a safe position. Operations that individuallyadd limited positive reactivity (e.g., temperature fluctuations from inventory addition ortemperature control fluctuations) but when combined with all other operations affecting corereactivity (e.g., intentional boration) result in overall net negative reactivity addition, are notprecluded by this action.MILLSTONE -UNIT 3B 3/4 9-1MiLLSONE -UNIT B 3/ 9-1Amendment No. , 60, 14-8, 41-9, 230 LBDCR No. 10-MP3-006March 9, 20103/4.9 REFUELING OPERATIONSBASES3/4.9.1.2 BORON CONCENTRATION [N SPENT FUEL POOLDuring normal Spent Fuel Pool operation, the spent fuel racks are capable of maintainingKeff at less than or equal to 0.95 in an unborated water environment. This is accomplished inRegion 1, 2, and 3 storage racks by the combination of geometry of the rack spacing, the use offixed neutron absorbers in some fuel storage regions, the limits on fuel burnup, fuel enrichmentand minimum fuel decay time, and the use of blocking devices in certain fuel storage locations.The boron requirement in the spent fuel pool specified in 3.9.1.2 ensures that in the eventof a fuel assembly handling accident involving either a single dropped or misplaced fuelassembly, the Keff of the Spent fuel storage racks will remain less than or equal to 0.95.3/4.9.2 INSTRUMENTATIONThe source range neutron flux monitors are used during refueling operations to monitorthe core reactivity condition. The installed source range-neutron flux monitors are part of theNuclear Instrumentation System (NIS). These detectors are located external to the reactor vesseland detect neutrons leaking from the core.There are two sets of source range neutron flux monitors:(1) Westinghouse source range neutron flux monitors, and(2) Gamma-Metrics source range neutron flux monitors.The Westinghouse monitors are the normal source range monitors used during refueling*activities. Gamma-Metrics source range neutron flux monitors are an acceptable equivalentcontrol room indication for the Westinghouse source range neutron flux Monitors in MODE 6,including CORE Alterations, as follows:with the core in place within the reactor vessel or,with the Gamma Metrics source range neutron flux monitor(s) coupled to the core.Reactor Engineering shall determine whether each monitor is coupled to the core.This limiting condition for operation requires two source range neutron flux. monitors beOPERABLE to ensure that redundant monitoring capability is available to detect changes in corereactivity. To be OPERABLE, each monitor must provide visual indication in the control room. Inaddition, at least one of the two monitors must provide an OPERABLE audible count ratefunction in the control room and containment.MILLSTONE -UNIT 3 B 3/4 9-la Amendment No. 42, 60, 4-58, -204,21-9, 2T3 LBDCR No. 1 0-MP3-006March 9, 20103/4.9 REFUEL[NG OPERATIONSBASESThe limiting condition for operation is satisfied .with either two Westinghouse sourcerange neutron flux monitors OPERABLE, or with any combination that contains oneOPERABLE Westinghouse source range neutron flux monitor (to provide audible indication) andone OPERABLE Gamma-Metrics source range neutron flux monitor that is coupled to the core.With only one Westinghouse source range neutron flux monitor OPERABLE and noGamma-Metrics source range neutron flux monitors oPERABLE, ACTION a. must be entered.With both Westinghouse source range neutron flux monitors inoperable and one or more Gamma-Metrics source range neutron flux monitors OPERABLE and coupled to the core, ACTIONb.must be entered, since the Gamma-Metrics source range neutron flux monitors are incapable ofproviding audible indication in the containment.Concemning ACTION a., with only one of the required source range neutron flux monitor"OPERABLE, redundancy has been lost.. Since these instruments are the only direct means ofmonitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant intothe RCS with borOn concentration less than required to meet the minimum boron concentration ofLCO 3.9.1.1 must be suspended immediately. Suspending positive reactivity additions that couldresult in failure to meet the minimum boron concentration limit is required to assure continuedsafe operation. Introduction of coolant inventory must be from sources that have a boronconcentration greater than that what would be required in the RCS for minimum refueling boronconcentration. This may result in an overall reduction in RCS boron concentration, but providesacceptable margin to maintaining subcritical operation. Performance of ACTION a. shallnotpreclude completion of movement of a component to a safe position.3/4.9.3 DECAY TIMEThe minimum requirement for reactor subcriticalityprior to movement of irradiated fuelassemblies in the reactor vessel ensures that sufficient time has elapsed to allow the radioactivedecay of the short-lived fission products. This decay time is consistent with the assumptions usedin the safety analyses.MILLSTONE -UNIT 3 B349lB 3/4 9-1b LBDCR No. 10-MP3-006March 9, 20103/4.9 REFUIELING OPERATIONSBASES3/4.9.4 CONTAINMENT BUILDING PENETRATIONSS The requirements on containment penetration closure and OPERABILITY ensure that arelease of radioactive material within containment to the environment will be minimized. TheOPERABILITY, closure restrictions, and administrative controls are sufficient to minimize therelease of radioactive material from a fuel element rupture based upon the lack of containmentpressurization potential during the movement of fuel within containment. The containment purgevalves are containment penetrations and must satisfy, all requirements specified for a containmentpenetration. ,:This specification is applicable during the movement of new and spent fuel assemblies within thecontainment building. The fuel handling accident analyses assume that during a fuel handlingaccident some of the fuel that is dropped and some of the fuel impacted upon is damaged.Therefore, the movement of either new or irradiated fuel can cause a fuel handling accident, andthis specification is applicable whenever new or irradiated fuel is moved within the containment.Containment penetrations, including the personnel access hatch doors and equipment accesshatch, can be open during the movement of fuel provided that sufficient administrative controlsare in place such that any 0f these containment penetrations can be closed within 30 minutes.Following a Fuel Handling Accident, each penetration, including the equipment access hatch, isclosed such that a containment atmosphere boundary can be established. However, if it isdetermined that closure of all containment penetrations would represent a significant radiologicalhazard to the personnel involved, the decision may be made to forgo the closure of the affectedpenetration(s). The containment atmosphere boundary is established when any penetration whichprovides direct access to the outside atmosphere is closed such that at least one barrier betweenthe containment atmosphere and the outside atmosphere is established. Additional actionsbeyond establishing the containment atmosphere boundary, such as installing flange bolts for theequipment access hatch or a containment penetration, are not necessary.Administrative controls for opening a containment penetration require that one or moredesignated persons, as needed, be available for isolation of containment from the outsideatmosphere. Procedural controls are also in place to ensure cables or hoses which pass through acontainment opening can be quickly removed. The location of each cable and hose isolationdevice for those cables and hoses which pass through a containment opening is recorded to ensuretimely closure of the containment boundary. Additionally, a closure plan is developed for eachcontainment opening which includes an estimated time to close the containment opening. A logof personnel designated for containment closure is maintained, including identification of whichcontainment openings each person has responsibility for closing. As necessary, equipment will bepre-staged to support timely closure of a containment penetration.MILLSTONE -UNIT 3 B349I mnmn o 3B 3/4 9-1cAmendment No. [ March 17, 20043/4.9 REFUELING OPERATIONSBASES3/4.9.4 CONTAINMENT BUILDING PENETRATIONS (Continued)The ability to close the equipment access hatch penetration within 30 minutes is verified eachrefueling outage prior to the first fuel movement in containment with the equipment access hatchopen. Prior to opening a containment penetration, a review of containment penetrations currentlyopen is performed to verify that sufficient personnel are designated such that all containmentpenetrations can be closed within 30 minutes. Designated personnel may have other duties,however, they must be available such that their assigned containment openings can be closedwithin 30 minutes. Additionally, each new work activity inside containment is reviewed toconsider its effect on the closure of the equipment access hatch, at least one personnel accesshatch door, and/or other open containment penetrations. The required number of designatedpersonnel are continuously available to perform closure of their assigned containment openingswhenever fuel is being moved within the containment.Controls for monitoring radioactivity within containment and in effluent paths from containmentare maintained consistent with General Design Criterion 64. Local area radiation monitors,effluent discharge radiation monitors, and containment gaseous and particulate radiation monitorsprovide a defense-in-depth monitoring of the containment atmosphere and effluent releases to theenvironment. These monitors are adequate to identify the need for establishing the containmentatmosphere boundary. When containment penetrations are open during a refueling outage underadministrative control for extended periods of time, routine grab samples of the containmentatmosphere, equipment access hatch, and personnel access hatch will be required.The containment atmosphere is monitored during normal and transient operations of the reactorplant by the containment structure particulate and gas monitor located in the upper level of theAuxiliary Building or by grab sampling. Normal effluent discharge paths are monitored duirirngplant operation by the ventilation particulate samples and gasmonitors in the Auxiliary Building.,Administrative controls are also in place to ensure that the containment atmosphereboundary is established if adverse weather conditions which could present a potential missilehazard threaten the plant. Weather conditions are monitored during fuel movement whenever acontainment penetration, including the equipment access hatch and personnel access hatch, isopen and a storm center is within the plant monitoring radius of 150 miles.The administrative controls ensure that the containment atmosphere boundary can bequickly established (i.e. within 30 minutes) upon determination that adverse weather conditionsexist which pose a significant threat to the Millstone Site. A significant threat exists when ahurricane warning or tornado warning is issued which applies to the Millstone Site, or if anaverage wind speed of 60 miles an hour or greater is recorded by plant meteorological equipmentat the meteorological tower. If the meteorological equipment is inoperable, information from theNational Weather Service can be used as a backup in determining plant wind speeds. Closure ofcontainment penetrations, including the equipment access hatch penetration and at least onepersonnel access hatch door, begin immediately upon determination that a significant threatexists.MILLSTONE -UNIT 3B 3/4 9-2MILLTON -NIT3 B3/49-2Amendment No, 4-9-7-, 219 LBDCR 04-MP3-013November 29, 20043/4.9 REFUELING OPERATIONSBASES3/4.9.5 DELETED3/4.9.6 DELETED3/4.9.7 DELETED3/4.9.8 RESIDUAL HEAT REMOVAL AND COOLANT CIRCULATION3/4.9.8.1 HIGH WATER LEVELBACKGROUN.DThe purpose of the Residual Heat Removal (RH-R) System in MODE 6 is to remove decay heatand sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to providemixing of borated coolant and to prevent boron stratification. Heat is removed fr'om the RCS bycirculating reactor coolant through the RHR heat exchanger(s), where the heat is transferred to theReactor Plant Component Cooling Water System. The coolant is then returned to the RCS via theRCS cold leg(s). Operation of the RHR system for normal cooldown or decay heat removal ismanually accomplished from the control room. The heat removal is manually accomplished fromthe control room. The heat removal rate is adjusted by controlling the flow of reactor coolantthrough the RHR heat exchanger(s) and the bypass. Mixing of the reactor coolant is maintainedby this continuous circulation of reactor coolant through the RHR system.MILLSTONE -UNIT 3B 3/4 9-2aAmendment No. 2-1-,Acknowledged by NRC Letter dated 04/12/06 06/28/063/4.9 REFUELING OPERATIONSBASES3/4.9.8.1 Ii-UGH WATER LEVEL (continued)APPLICABLE SAFETY ANALYSESIf the reactor coolant temperature is not maintained below 200°F, boiling of the reactor coolantcould result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of thereactor coolant could lead to a reduction in boron concentration in the coolant due to boronplating out on components near the areas of the boiling activity. The loss of reactor coolant andthe reduction of boron concentration in the reactor coolant would eventually challenge theintegrity of the fuel cladding, which is fission product barrier. One train of the RHR system isrequired to be operational in MODE 6, with the water level > 23 ft above the top of the reactorvessel flange to prevent this challenge. The LCO does permit deenergizing the RI-R pump forshort durations, under the conditions that the boron concentration is not diluted. This conditionaldeenergizing of the RHR pump does not result in a challenge to the fission product banrier.APPLICABILITYOne RI-R loop must be OPERABLE and in operation in MODE 6, with the water level _ 23 ftabove the top of the reactor vessel flange, to provide decay heat removal. The 23 ft level wasselected because it corresponds to the 23 ft requirement established for fuel movement inLCO 3.9.10, "Water Level -- Reactor Vessel." Requirements for the RH-R system in otherMODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5,Emergency Core Cooling Systems (ECCS). RHiR loop requirements in MODE 6 with the waterlevel < 23 ft are located in LCO 3.9.8.2, "Residual Heat Removal (RHR) and CoolantCirculation--Low Water Level."LIMITING CONDITION FOR OPERATIONThe requirement that at least one RHR loop be in operation ensures that: (1) sufficient coolingcapacity is available to remove decay heat an maintain the water in the reactor vessel below 140°Fas required during the REFUELING MODE, and (2) sufficient coolant circulation is maintainedthrough the core to minimize the effect of a boron dilution incident and prevent stratification.An OPERABLE RHR loop includes an RIIR pump, a heat exchanger, valves, piping, instrumentsand controls to ensure an OPERABLE flow path. An operating RI-R flow path should be capableof determining the low-end temperature. The flow path starts in one of the RCS hot legs and isreturned to the RCS cold legs.The LCO is modified by a Note that allows the required operating RHR loop to be removed fromoperation for up to 1 hour per 8 hour period, provided no operations are permitted that woulddilute the RCS boron concentration by introduction of coolant into the RCS with boronconcentration less than required to meet the minimaum boron concentration of LCO 3.9.1.1I.Boron concentration reduction with coolant at boron concentrations less than required to assurethe RCS boron concentration is maintained is prohibited because uniform concentrationdistribution cannot be ensured without forced circulation. This permits operations such as coremapping or alterations in the vicinity of the reactor vessel hot leg nozzles and RCS to RI-Risolation valve testing. During this 1 hour period, decay heat is removed by natural convection tothe large mass of water in the refueling cavity.MILLSTONE -UNIT 3B 3/4 9-3MILLTONE- UIT 3B 3/9-3Amendment No. 4-1-7-, _2--9-, 230 LBDCR 12-MP3-01i0September 20, 20123/4.9 REFUELING OPERATIONSBASES3/4.9.8.1 HIGH WATER LEVJEL (continued)ACTIONSRHR loop requirements are met by haying one RER loop OPERABLE and in operations, exceptas penmitted in the Note to the LCO.If RHR ioop requirements are not met, there will be no forced circulation to provide mixing toestablish uniform boron concentrations. Suspending positive reactivity additions that could resultin failure to meet the minimnum boron concentration limit is required to assure continued safeoperation. Introduction of coolant inventory must be from sources that have a boron concentrationgreater than that what would be required in the RCS for minimum refueling boron concentration.This may result in an overall reduction in RCS boron concentration, but provides acceptablemargin to maintaining subcritical operation.If RHR loop requirements are not met, actions shall be taken immediately to suspend loading ofirradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removalfrom the core occurs by natural convection to the heat sink provided by the water above the core.A minimumn refueling water level of 23 ft above the reactor vessel flange provides an adequateavailable heat sink. Suspending any operation that would increase decay heat load, such asloading a fuel assembly, is a prudent action under this condition.If RI-R loop requirements are not met, actions shall be initiated and continued in order to satisfyRI-R loop requirements. With the unit in MODE 6 and the refueling water level >_ 23 ft above thetop of the reactor vessel flange, corrective actions shall be initiated immediately.If RtRR loop requirements are not met, all containment penetrations providing direct access fromthe containment atmosphere to the outside atmosphere must be closed within 4 hours. With theRK-R loop requirements not met, the potential exists for the coolant to boil and release radioactivegas to the containment atmosphere. Closing containment penetrations that are open to the outsideatmosphere ensures dose limits are not exceeded.The Completion Time of 4 hours is reasonable, based on the low probability of the coolant boilingin that time.Surveillance RequirementThis Surveillance demonstrates that the RI-R loop is in operation and circulating reactor coolant.The flow rate is deternined by the flow rate necessary to provide sufficient decay heat removalcapability and to prevent thermal and boron stratification in the core. The surveillance frequencyis controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3B 3/4 9-4MILLTONE- UNT 3 3/49-4Amendment No. 44)-7, 2a-1-9-, 2 April 12, 1995.BASES3/4.9.8.2 LOW WATER LEVELBACKGROUNDThe purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from theReactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant,and to prevent boron stratification. Heat is removed from the RCS by circulating reactor coolantthrough the RHR heat exchangers where the heat is transferred to the Component Cooling WaterSystem. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHRSystem for normal cooldown decay heat removal is manually accomplished from the controlroom. The heat removal rate is adjusted by controlling the flow of reactor coolant through theRHR heat exchanger(s) and the bypass lines. Mixing of the reactor coolant is maintained by thiscontinuous circulation of reactor coolant through the RHR system.APPLICABLE SAFETY ANALYSESIf the reactor coolant temperature is not maintained below 200°F, boiling of the reactor coolantcould result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of thereactor coolant could lead to a reduction in boron concentration in the coolant due to the boronplating out on components near the areas of the boiling activity. The loss of reactor coolant andthe reduction of boron concentration in the reactor coolant will eventually challenge the integrityof the fuel cladding, which is a fission product barrier. Two trains of the RIIR System arerequired to be OPERABLE, and one train in operation, in order to prevent this challenge.LIMITING CONDITION FOR OPERATIONIn MODE 6, with the water leveI< 23 ft above the top of the reactor vessel flange, both RHRloops must be OPERABLE. Additionally, one loop of RUR must be in operation in order toprovide:a. Removal of decay heat;b. Mixing of borated coolant to minimize the possibility of criticality; andc. Indication of reactor cooling temperature.The requirement to have two RHIR loops OPERABLE when there is less than 23 feet of waterabove the reactor vessel flange ensures that a single failure of the operating RHR loop will notresult in a complete loss of residual heat removal capability. With the reactor vessel headremoved and at least 23. feet of water above the reactor pressure vessel flange, a large heat sink isavailable for core cooling. Thus, in the event of a failure of the operating RHR loop, adequatetime is provided to initiate emergency procedure to cool the core.MILLSTONE -UNIT 3"B34- mnmn o 0B 3/4 9-5Amendment No. 107 06/28/063/4.9 REFUELING OPERATIONS[BASES3/4.9.8.2 LOW WATER LEVEL (continued)An OPERABLE RHR loop consists of an RHR pump, a heat exchanger, valves, piping,instruments, and controls to ensure an OPERABLE flow path. An operating RHR flow pathshould be capable of determining the low end temperature. The flow path starts in one of the RCShot legs and is returned to the RCS cold legs.APPLICABILITYTwo RHR loops are required to be OPERABLE, and one RHR loop must be in operation inMODE 6, with the water level < 23 ft above the top of the reactor vessel flange, to proviide decayheat removal. Requirements for the RHR System in other MODES are covered by LCOs inSection 3.5, Emergency Core Cooling Systems (ECCS). RHR loop requirements in MODE 6with the water level _ 23 ft are located in LCO 3.9.8.1, "Residual Removal (RHR) AND CoolantCirculation--High WCater Level."ACTIONSa. If less than the required number of RI-R loops are OPERABLE, actions shall beimmediately initiated and continued until the RHR loop is restored to OPERABLE statusand to operation, or until _ 23 ft of water level is established above the reactor vesselflange. When the water level is _ 23 ft above the reactor vessel flange, the Applicabilitychanges to that of LCO 3.9.8.1, and only one RHIR loop is required to be OPERABLE andin operation. An immediate Completion Time is necessary for an operator to initiatecorrective action.b. If no RHR loop is in operation, there will be no forced circulation to provide mixing toestablish uniform boron concentrations. Suspending positive reactivity additions thatcould result in failure to meet the minimum boron concentration limit is required to assurecontinued safe operation. Introduction of coolant inventory must be from sources thathave a, boron concentration greater than that what would be required in the RCS forminimum refueling boron concentration. This may result in an overall reduction in RCSboron concentration, but provides acceptable margin to maintaining subcritical operation.If no RH-R loop is in operation, actions shall be initiated immediately, and continued, to restore.one RHR loop to operation. Since the unit is in ACTIONS 'a' and 'b' concurrently, therestoration of two OPERABLE RITR loops and one operating RH-R loop should be accomplishedexpeditiously.If no RtHR loop is in operation, all containment penetrations providing direct access from thecontainment atmosphere to the outside atmosphere must be closed within 4 hours. With the RHRloop requirements not met, the potential exists for the coolant to boil and release radioactive gasto the containment atmosphere. Closing containment penetrations that are open to the outsideatmosphere ensures that dose limits are not exceeded.MILLSTONE -UNIT 3B 3/4 9-6MILSTNE UIT B3/4-6Amendment No. 230 LBDCR 12-IvP3-010September 20, 20123/4.9 REFUELING OPERATIONSBASESThe Completion Time of 4 hours is reasonable, based on the low probability of the coolant boilingin that time.Surveillance RequirementThis Surveillance demonstrates that one RIIR loop is in operation and circulating reactor coolant.The flow rate is detennined by the flow rate necessary to provide sufficient decay heat removalcapability and to prevent thermal and boron stratification in the core. In addition, during operationof the RHR loop with the water level in the vicinity of the reactor vessel nozzles, the RHR pumpsuction requirements must be met. The surveillance frequency is controlled under theSurveillance Frequency Control Program.MILLSTONE -UNIT 3B 3/4 9-7MILLTON -NIT3 B3/49-7Amendment No. 4-05, 49-l-, 23-0 LIBDCR No. 06-MP3-026October 15, 2006+3/4.9 R FiFITFLFNG OPER ATiONSBASES3/4.9.10 AND 3/4.9.11 WATER LEVEL -REACTOR VES SEL AND STORAGE POOLThe restrictions on minimum water level ensure that sufficient water depth is available toremove at least 99% of the assumed iodine gap activity released from the rupture of an irradiatedfuel assembly. The minfimum water depth is consistent with the assumptions of the safetyanalysis.MILLSTONE -UNIT 313 3/4 9-8 Amendment No. 3?-9, -!-0-7, 4-58, 4-84-, -I-89,-20-., 24t-9NRC Verbal Ackn~owledgement: 07/05/07 LBDCR No. 07-MiP3-037July 12, 2007REFUELING OPERATIONSBASES3/4.9.13 SPENT FUEL POOL -REACTIVTYDuring normal spent fuel pool operation, the spent fuel racks are capable of maintainingKeff at less than or equal to 0.95 in an unborated water environment.Maintaining Keff~ at less than or equal to 0.95 is accomplished in Region 1 3-OUT-OF-4storage racks by the combination of geometry of the rack spacing, the use of fixed neutronabsorbers in the racks, a maximum nominal 5 weight percent fuel enrichment, and the use ofblocking devices in certain fuel storage locations, as specified by the interface requirementsshown in Figure 3.9-2.Maintaining Keff at less than or equal to 0.95 is accomplished in Region 1 4-OUT-OF-4storage racks by the combination of geometry of the rack spacing, the use of fixed neutronabsorbers in the racks, and the limits on fuel enrichment/fuel burnup specified in Figure 3.9-1.Maintaining Keff at less than or equal to 0.95 is accomplished in Region 2 storage racks bythe combination of geometry of the rack spacing, the use of fixed neutron absorbers in the racks,and the limits on fuel enrichment/fuel burnup and fuel decay time specified in Figure 3.9-3.Maintaining Keff at less than or equal to 0.95 is accomplished in Region 3 storage racks bythe combination of geometry of the rack spacing, and the limits on fuel enrichment/fuel burnupand fuel decay time specified in Figure 3.9-4 for assemblies used exclusively in the pre-uprate ](3411 Mwt) cores and Figure 3.9-5 for assemblies used in the post-update (3650 Mwt) cores.Fixed neutron absorbers are not credited in the Regioni 3 fuel storage racks.The limitations described by Figures 3.9-1, 3.9-2, 3.9-3, 3.9-4, and 3.9-5 ensure that the [reactivity of the fuel assemblies stored in the spent fuel pool are conservatively within theassumptions of the safety analysis.Administrative controls have been developed and instituted to verif~y that the fuelenrichment, fuel bumup, fuel decay times, and fuel interface restrictions specified in Figures3.9-1, 3.9-2, 3.9-3, 3.9-4, and 3.9-5 as well as restrictions specified in the Note on Figures 3.9-3and 3.9-5 are complied with.3/4.9.14 SPENT FUEL POOL -STORAGE PATTERNThe limitations of this specification ensure that the reactivity conditions of the Region 13-OUT-OF-4 storage racks and spent fuel pool keff will remain less than or equal to 0.95.The Cell Blocking Devices in the 4th location of the Region 1 3-OUT-OF-4 storageracks are designed to prevent inadvertent placement and/or storage of fuel assemblies in theblocked locations. The blocked location remains empty to provide the flux trap to maintainreactivity control for fuel assemblies in adjacent and diagonal locations of the STORAGEPATTERN.STORAGE PATTERN for the Region 1 storage racks will be established and expandedfrom the walls of the spent fuel pool per Figure 3..9-2 to ensure definition and control of theRegion 1 3-OUT-OF-4 Boundary to other Storage Regions and minimize the number ofboundaries where a fuel misplacement incident can occur.MILLSTONE -UNIT 3MILSTOE -UNI 3B 3/4 9-9 Amendment No. :39, 410-5, 4lOg, -8, 4189, 2O-REVERSE OF PAGE B 3/4 9-9INTENTIONALLY LEFT BLANK 3/4.10 SPECIAL TEST EXCEPTIONS July 30, 2002BASES3/4.10.1 SHUTDOWN MARGINThis speci~altest,.ex~ception provides that..a minimum amount, of control rodworth is immedia~tely..available for reactivity control, when~tests are performed.for control rod worth, measurement.. Thi~s..sPecial .test exception .is requi~red topermit the periodicvyeri~fication of the actual versus predicted core reactivitycondition occurring as.a result-of fuel .burnup or fuel cycling operations.3/4.10.2 GRouP HEIGHT, INSERTION, AND POWER DISTRIBUTION LIMITS.This special .test except~ion, permits ind~ividual control .rods to be positioned-outside of their normal.-group: heights. and i~nsertion limits during the performance.of such PHYSICS TESTS as those required to: (1) measure control rod. worth,and (2) determine the reactor stability index and damping factor under xenonoscillation, condi~tions.i " ..""-3/4.10.3 PHYSICS TESTSThis special test exception permits PHYSICS TESTS to be performed at lessthan or equal to 5% of RATED THERMAL POWER with. the RCS Tavg slightly lower thannormally allowed so that the fundamental nuclear characteristics of thecore and related instrumentation can be verified.. In order for various cha~rac-teristics t~o be accurately measured, it *is at times necessary to operateoutside the normal restrictions of these Technical Specifications. For instance,to measure the moderator temperature coefficient at BOL, it is necessary toposition the various control rods at heights which may not normally be allowedby Specification 3.1.3.6 which in turn may cause the RCS ITv to fall slightlybelow the minimum temperature of Specification 3.1.1.4.3/4.10.4 REACTOR COOLANT LOOPSThis special test exception permits reactor criticality under no flowconditions and is required to perform certain STARTUP and PHYSICS TESTS whileat low THERMAL POWER levels.3/4.10.5 DELETEDMILLSTONE -UNIT 3B 314 10-IMILLTON -NIT B /4 0-1Amendment No. 7J7, 207 Juiy 30, 200-2THIS PAGE INTENTIONALLY LEFT BLANKMILLTON -NIT B /4 0-2Amendment No. XJ7, 207~iMILLSTONE -UNIT 3B 3/4 10-2 November 28, 20003/4.11 DELETEDBASES3/4.11.1 -DELETED3/4.11.2 -DELETED3/4/11/3 -DELETEDMILLSTONE -UNIT 3 B341- mnmn o 8B 3/4 11-1Amendment No= 188 ZUUUJThis page intentionally left blankMILLSTONE -UNIT 3 B341- mnmn o 8B 3/4 11-2Amendment NOo 188 November 28, 2000This page intentionally left blankMILLSTONE -UNIT 3B 3/4 11-3MILL TON -NIT B /4 1-3Amendment No. , 188 REVERSE OF PAGE B 3/4 11-3INTENTIONALLY LEFT BLANK . Dominion Nuclea Connecticut, Inc.Rope Ferry Rd., Waterford, CT 06385omn nMailing Address: P.O. Box 128"Waterford, CT 06385dom. com FEB 2 32016U. S. Nuclear Regulatory Commission Serial No. 16-078Attention: Document Control Desk NSS&LIWEB R0Washington, DC 20555 Docket No. 50-33650-423License No. DPR-65,NPF-49 ':DOMINION NUCLEAR CONNECTICUT. INC.MILLSTONE POWER STATION UNITS 2 AND 3CHANGES TO TECHNICAL SPECIFICATION BASESIn accordance with the requirements of Millstone Power Station Unit 2 (MPS2)Technical Specification (TS) 6.23.d and Millstone Power Station Unit 3 (MPS3)TS 6.18.d, Dominion Nuclear Connecticut, Inc. (DNC) is providing the NuclearRegulatory Commission (NRC) with changes to the MPS2 and MPS3 TS Bases.DNC is submitting a complete copy of the TS Bases for both MPS2 and MPS3.These TS Bases are provided for information only. Any changes to the Basessections were made in accordance with the provisions of 10 CFR 50.59. Thesechanges have been reviewed and approved by the Facility Safety ReviewCommittee.Attachments 1 and 2 provide the TS Bases in their entirety for MPS2 and MPS3,respectively.If you have any questions or require additional information, please contact Mr.Thomas G. Cleary at (860) 444-4377.Sincerely, .-B. L. StanleyDirector -Nuclear Station and Licensing Serial No. 16-078Docket Nos. 50-336 and 50-423Changes to MPS2 and MPS3 TS BasesPage 2 of 2Attachments:1. Bases Pages for Millstone Power Station Unit 22. Bases Pages for Millstone Power Station Unit 3Commitments made in this letter: None.cc: U.S. Nuclear Regulatory CommissionRegion I2100 Renaissance Blvd. Suite 100King of Prussia, PA 19406-2713Richard V. GuzmanNRC Senior Project ManagerU.S. Nuclear Regulatory CommissionOne White Flint North, Mail Stop 08 C211555 Rockville PikeRockville, MD 20852-2738NRC Senior Resident InspectorMillstone Power Station Serial No. 16-078Docket No. 50-336ATTACHMENT IBASES PAGES FOR MILLSTONE POWER STATION UNIT 2DOMINION NUCLEAR CONNECTICUT, INC.MILLSTONE POWER STATION UNIT 2 August 1, 1975BASESFORSECTION 2.0SAFETY LIMITSANDLIMITING SAFETY SYSTEM SETTINGSY 2.1 SAFETY LIMITS May 1, 2002BASES2.1.1 REACTOR COREThe restrictions of this safety ]imit prevent overheating of the fuelcladding and possible cladding perforation which would result in the release Qffission products to the reactor coolant. Overheating of the fuel is preventedby maintaining the steady state peak linear heat rate at or less than the fuelcenterline melt linear heat rate limit. Centerline fuel melting will not occurfor this peak linear heat rate. Overheating of the fuel cladding is preventedby restricting fuel operation to within the nucleate boiling regime where theheat transfer coefficient is large and the cladding surface temperature isslightly above the coolant saturation temperature.Operation above the upper boundary of the nucleate boI-lIing regime couldresult in excessive cladding temperatures because of the onset of departurefrom nucleate boiling (DNB) and the resultant sharp reduction in heat transfercoefficient. DNB is not a directly measurable parameter during operation andtherefore THERMAL POWER and Reactor Coolant Temperature and Pressure have beenrelated to DNB through the HIP correlation. The HIP DNB correlation has beendeveloped to predict the DNB flux and the location of DNB for axially uniformand non-uniform heat flux distributions. The local DNB heat flux ratio, DNBR,defined as the ratio of the heat flux that would cause DNB at a particularcore location to the local heat flux, is indicative of the margin to DNB.The value of the DNBR during steady state operation, normal operationaltransients, and anticipated transients is limited to be no less than the DNBcorrelation limit. The correlation limit corresponds to a 95 percentprobability at a 95 percent confidence level (i.e., 95/95 limit),that DNB willnot occur and is chosen as an appropriate margin to DNB for all operatingconditions.The curves of Figure 2.1-1 show the loci of points of THERMAL POWER,Reactor Coolant System pressure and maximum cold leg temperature with fourReactor Coolant Pumps operating for which the minimum DNBR is no less than the95/95 limit for the DNB correlation. The limits in Figure 2.1-1 werecalculated for reactor coolant inlet temperatures less than or equal to 580°F.The dashed line at 580°F coolant inlet temperatures is not a safety limit;however, operation above 580°F is not possible because of the actuation of themain steam line safety valves which limit the maximum value of reactor inlettemperature. Reactor operation at THERMAL POWER levels higher than 111.6% ofRATED THERMAL POWER is prohibited by the high power level trip setpointspecified in Table 2.2-1. The area of saf~e operation is below and to the leftof these lines.Revised by NRC Letter A15689MILLSTONE -UNIT 2 B 2-1 Amendment No. 7, Jfl, 0803 October 6, 1980THIS PAGE INTENTIONALLY LEFT BLANKMILLSTONE UNIT 2B 2-2MILLTONE- UNT 2 2-2Amendment No. 61 LBDCR 04-MP2-016February 24, 2005SAFETY LIMITSBASES:The conditions for the Thermal Margin Safety Limit curves in figure 2.1-i to be valid areshown on the figure.The reactor protective system in combination with the Limiting Conditi~ons for Operation,is designed to prevent any anticipated combination of transient conditions for reactor coolantsystem temperature, pressure, and THERMAL POWER level that would result in a DNBR belowthe 95/95 limit for DNB correlation, and preclude the existence of flow instabilities.2.1.2 REACTOR COOLANT SYSTEM PRESSUREThe restriction of this Safety Limit protects~the integrity of the Reactor Coolant Systemfrom overpressurization and thereby prevents the release of radionuclides contained in the reactor.coolant fr-om reaching the containment atmosphere.The reactor pressure vessel and pressurizer are designled to Section III of the ASME Codefor Nuclear Power Plant Components which permits a maximum transient pressure of 110%(2750 psia) of design pressure. The Reactor Coolant System piping, valves and fittings, aredesigned to ANSI B3 1.7, Class I which permits a maximum transient pressure of 110% (2750psia) of component design pressure. The Safety Limit of 2750 psia is therefore consistent withthe design criteria and associated code requirements.The entire Reactor Coolant System is hydrotested at 3125 psia to demonstrate integrityprior to initial operation.MILLSTONE -UNIT 2B 2-3Amendment No. :g, gg, 64-, l-39, 26,Acknowledged by NRC letter dated 6/28/05 October 4, 20012.2 LIMITING SAFETY SYSTEM SETTINGSBASES:2.2.1t REACTOR TRIP SET POINTSThe Reactor Trip Setpoints specified in Table 2.2-il are the values at which the ReactorTrips are set for each parameter. The Trip Values have been selected to ensure that the reactorcore and reactor coolant system are prevented from exceeding their safety limits. Operation witha Trip Setpoint less conservative than its setpoint but within its specified Allowable 'Value isacceptable on the basis that each Allowable Value is equal to or less than the drift allowanceassumed to occur for each trip used in the accident analyses.Manual Reactor TripThe Manual Reactor Trip is a redundant channel to the automatic protectiveinstrumentation channels and provides manual reactor trip capability.Power Level-Hig~hThe Power Level-High trip provides reactor core protection against reactivity excursionswhich are too rapid to be protected by a Pressurizer Pressure-High or Thermal Margin/LowPressure trip.The Power Level-High trip setpoint is operator adjustable and can be set no higher than9.6% above the indicated THERMAL POWER level. Operator action is required to increase thetrip set'point as THERMvAL POWER is increased. The trip setpoint is automatically decreased asTHERMAL POWER decreases. The trip setpoint has a maximum value of 106.6% of RATEDTHERMAL POWER and a minimum setpoint of 14.6% of RATED THERMAL POWER.Adding to this maximum value the possible variation in trip point due to calibration andinstrument errors, the maximum actual steady-state THERMAL POWER level at which a tripwould be actuated is 111.6% of RATED THERMAL POWER, which is the value used in theaccident analyses.Reactor Coolant Flow-LowThe Reactor Coolant Flow-Low trip provides core protection to prevent DNB in the eventof a sudden significant decrease in reactor coolant flow.MILLSTONE -UNIT 2 B 2-4 kAmendment No. 6t-, 226,Revised by NRC Letter datedOctober 4, 2001 May 1, 2002LIMIINGSAFT YTMSTIGBASESReactor Coolant Flow-Low (Continued)The low-flow trip setpoint and Allowable Value have been derived in consideration of instrumenterrors and response times of equipment involved to maintain the DNBR above the 95/95 limit forthe DNB correlation under normal operation and expected transients."Pressurizer Pressure-HighThe pressurizer Pressure-High trip, backed up by the pressurizer code safety valves andmain steam line safety valves, provides reactor coolant system protection againstoverpressurization in the event of loss of load without reactor trip. This trip's setpoint isapproximately 100 psi below the nominal lift setting (2500 psia) of the pressurizer code safetyvalves and it~s concurrent operation with the power-operated relief valves avoids the undesirableoperation of the pressurizer code safety valves.Containment Pressure-HighThe Containment Pressure-High trip provides assurance that a reactor trip is initiatedconcurrently with a safety injection. The setpont for this trip is identical to the safety injectionsetpoint.Steam Generator Pressure-LowThe Steam Generator Pressure-Low trip provides protection against an excessive rate ofheat extraction from the steam generators and subsequent cooldown of the reactor coolant. Thetrip setting is sufficiently below the full-load operating point so as not to interfere with normaloperation, but still high enough to provide the required protection in the event of excessively highsteam flow.MILLSTONE -UNIT 2B 2-5Revised by NRC letter A15689Amendment No. 5-2, 641, 4-3-9, 2-2-6, February 20, 2003LBDCR 2-21-02LIMITING SAFETY SYSTEM SETTINGSBASES:Steam Generator Water Level -LowThe Steam Generator Water Level-Low Trip provides core protection by preventingoperation with the steam generator water level below the minimum volume required for adequateheat removal capacity and assures that the design pressure of the reactor coolant system will notbe exceeded.Local Power Density-HighThe Local Power Density-High trip, functioning from AXIAL SHAPE INDEXmonitoring, is provided to ensure that the peak local power density in the fuel which correspondsto fuel centerline melting will not occur as a consequence of axial power maldistributions. Areactor trip is initiated whenever the AXIAL SHAPE INDEX exceeds the allowable limits ofFigure 2.2-2. The AXIAL SHAPE INDEX is calculated from the upper and lower ex-coreneutron detector channels. The calculated setpoints are generated as a function of THERMALPOWER level. The trip is automatically bypassed below 15 percent power as sensed by thepower range nuclear instrument Level 1 bistable.The maximum AZIMUTHAL POWER TILT and maximum CEA misalignmentpermitted for continuous operation are assumed in generation of the setpoints. In addition, CEAgroup sequencing in accordance with the Specifications 3.1.3.5 and 3.1.3.6 is assumed. Finally,the maximum insertion of CEA banks which can occur during any anticipated operationaloccurrence prior to a Power Level-High trip is assumed.Thermal Margin/Low PressureThe Thermal Margin/Low Pressure trip is provided to prevent operation when the DNBRis below the 95/95 limit for the DNB correlation.MILLSTONE -UNIT 2B 2-6Amendment No. 3-s, 4t-, g-, 6-1-, 4-3-3,Corrected by letter dated 11/26/2003. LBDCR 14-MP2-009May 8, 2014LIMITING SAFETY SYSTEM SETTINGSBASES:Thermal Margin/Low Pressure (Continued)The trip is initiated whenever the reactor coolant system pressure signal drops beloweither 1865 psia or a computed value as described below, whichever is higher. The computedvalue is a function of the higher of AT power or neutron power, reactor inlet temperature, thenumber of reactor coolant pumps operating and the AXIAL SHAPE INDEX. The minimum valueof reactor coolant flow rate, the maximum AZIMUTHAL POWER TILT and the maximum CEAdeviation permitted for continuous operation are assumed in the generation of this trip function. Inaddition, CEA group sequencing in accordance with Specifications 3.1.3.5 and 3.1.3.6 isassumed. Finally, the maximum insertion of CEA banks which can occur during any anticipatedoperational~occurrence prior to a Power Level-High trip is assumed.Thermal Margin/Low Pressure trip setpoints are derived from the core safety limits. Asafety margin is provided which includes allowances for equipment response times, core power,RCS tempeiature, and pressurizer pressure measurement uncertainties, processing errors, and afurther allowance to compensate for the time delay associated with providing effectivetermination of the occurrence that exhibits the most rapid decrease in margin to the safety limit.Loss of TurbineA Loss of Turbine trip causes a direct reactor trip when operating above 15% of RATEDTHERMAL POWER as sensed by the power range nuclear instrument Level 1 bistable. This tripprovides turbine protection, reduces the severity of the ensuing transient and helps avoid thelifting of the main steam line safety valves during the ensuing transient, thus extending the servicelife of these valves. No credit was taken in the accident analyses for operation of this trip. Itsfunctional capability at the specified trip setting is required to enhancethe overall reliability of theReactor Protection System.The Wide Range Logarithmic Neutron Flux Monitor -Shutdown, Reactor ProtectionSystem Logic Matrices, Reactor Protection System Logic Matrix Relays, and Reactor TripBreakers flmctional units are components of the Reactor Protective System for whichOPERABILITY requirements are provided within the Technical Specifications (see TechnicalSpecification 3.3.1.1, "Reactor Protective Instrumentation). These functional units do not havespecific trip set-points or allowable values, similar to the manual reactor trip functional unit.However, these functional units are provided here for completeness and consistency with the RPSInstrumentation identified in Technical Specification 3.3.1.1.MILLSTONE -UNMT 2 B 2-7 Amendment No. 5-2, 4-39, -I-5-3, 22-6,.... , ..... September 25, 2003LIMITING SAFETY SYSTEM SETTINGSBASES:DELETED0)MILLSTONE -UNIT 2 -" ...... ....... -........ B 2-8......... ..... ............. ..... ............ -......E- KI2 B -_ ._ -A 64-2,--t ----.... " August 1, *1975...SECTIONS 3.0 AND 4.03LIMITING CONDITIONS FOR ORPEATION* ANDSURVEILLANCE REQUIREMENTS February 26, 19913/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS3/4.0 APPLICABILITYBASESSpecification 3.0.1 through 3.0.4 establish the general requirements applicable to LimitingConditions for Operation. These requirements are based on the requirements fdr LimitingConditions for Operation stated in the Code of Federal Regulations, 10OCFR5O.36(c)(2):"Limiting conditions for oper'ation are the lowest functional capability or performancelevels of equipment required for safe operation of the facility. 'When a limiting condition foroperation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow anyremedial action permitted by the technical specification until the condition can be met."Specification 3.0.1 establishes the Applicability statement within each individual specification asthe requirement for when (i.e., in which OPERATIONAL MODES or other specified conditions)conformance to the Limiting Conditions for Operation is required for safe operation of thefacility. The ACTION requirements establish those remedial measure that must be taken withinspecified time limits when the requirements of a Limiting Condition for Operation are not met.There are two basic types of ACTION requirements. The first specifies the remedial measuresthat permit continued operation of the facility which is not further restricted by the time limits ofthe ACTION requirements. In this case, conformance to the ACTION requirements provides anacceptable level of safety for unlimited continued operation as long as the ACTION requirementscontinue to be met. The second type of ACTION requirement specifies a time limit in whichconformance to the conditions of the Limiting Condition for Operation must be met. This timelimit is the allowable outage time to restore an inoperable system or component to OPERABLEstatus or for restoring parameters within specified limits. If these actions are not completedwithin the allowable outage time limits, a shutdown is required to place the facility in a MODE orcondition in which the specification no longer applies. It is not intended that the shutdownACTION requirements be used as an operational convenience which permits (routine) voluntaryremoval of a system(s) or component(s) from service in lieu of other alternatives that would notresult in redundrant systems or components being inoperable.The specific time limits of the ACTION requirements are applicable from the point in time it isidentified that a Limiting Condition for Operation is not met. The time limits of the ACTIONrequirements are also applicable when a system or component is removed from service forsurveillance testing or investigation of operational problems. Individual specifications may.include a specified time limit for the completion of a Surveillance Requirement when equipmentis removed from service. In this case, the allowable outage timeMILLSTONE -UNIT 2B 3/40-1MILLTONE- UIT 2B 3/0-IAmendment Nos. 61, 151 LBDCR 04-MP2-016February 24, 20053/4.0 APPLICABILITYBASES (Con't) 0 )limits of ACTION requirements are applicable when this limit expires if the surveillance has notbeen completed. When a shutdown is required to comply with ACTION requirements, the plantmay have entered a MODE in which a new specification becomes applicable. In this case, thetime limits of the ACTION requirements would apply from the point in time that~the newspecification becomes applicable if the requirements of the Limiting Condition for Operation arenot met.Specification 3.0.2 establishes that noncompliance with a specification exists when therequirements of the Limiting Condition for Operation are not met and the associated ACTIONrequirements have not been implemented within the specified time interval. The purpose of thisspecification is to clarify that (1) implementation of the ACTION requirements within thespecified time interval constitutes compliance with a specification and (2) completion of theremedial measures of the ACTION requirements is not required when compliance with a LimitingCondition of Operation is restored within the time interval specified in the associated ACTIONrequirements.Specification 3.0.3 establishes the shutdown ACTION requirements that must be implementedwhen a Limiting Condition for Operation is not met and the condition is not specificallyaddressed by the associated ACTION requirements. The purpose of thlis specification is to delineate the time limits for placing the unit in a safe operation defined by the LimitingConditions for Operation and its ACTION requirements. It is not intended to be used as anoperational convenience which permits (routing) voluntary removal of .redundant systems orcomponents from service in lieu of other alternatives that would not result in redundant systemsor components being inoperable. This time permits the operator to coordinate the reduction inelectrical generation with the load dispatcher to ensure the stability and availability of theelectrical grid. The time limits specified to reach lower MODES of operation permit the shutdownto proceed in a controlled and orderly manner that is well within the specified maximumcooldown rate and within the cooldown capa~bilities of the facility assuming only the minimumrequired equipment is OPERABLE. This reduces thermal stresses on components of the primarYcoolant system and the potential for a plant upset that could challenge safety systems underconditions for which this specification applies.If remedial measure permitting limited continued operation of the facility under the provisions ofthe ACTION requirements are completed, the shutdown may be terminated. The time limits ofthe ACTION requirements are applicable from the point in time it is identified that a LimitingCondition for Operation is not met. Therefore, the shutdown may be terminated if the ACT[ONrequirements have been met or the time limits of the ACTION requirements have not expired,thus providing an allowance for the completion of the required ACTIONS.0 "MILLSTONE -UNIT 2 B 3/4 0-2 Amendment Nos. 6-2, 4-5--,Acknowledged by NRC letter dated 6/28/05 February 26, 1991APPLICABILITYBASES (Con't)The time limits of Specification 3.0.3 allow 37 hours for the plant to be in the COLDSHUTDOWN MODE when a shutdown is required duiing the POWER MODE of operation. Ifthe plant is in a lower MODE of operation when a shutdown is required, the time limit forreaching the next lower MODE of operation applies. However, if a lower MODSE of operation isreached in less time than allowed, the total allowance time to reach COLD SHUTDOWN, orother applicable MODE, is not reduced. For example, if HOT STANDBY is reached in 2 hours,the time allowed to reach HOT SHUTDOWN is the next 11 hours because the total time to reachHOT SHUTDOWN is not reduced from the allowable limit of 13 hours. Therefore, if remedialmeasures are completed that would permit a return to POWER operation, a penalty is not incurredby having to reach a lower MODE of operation in less than the total time allowed.The same principle applies with regard to the allowable outage time limits of the ACTIONrequirements, if compliance with the ACTION requirements for one specification results in entlyinto a MODE or condition of operation for another specification in which the requirements of theLimiting Condition for Operation are not met. If the new specification becomes applicable in lesstime than specified, the difference may be added to the allowable outage time limits of the secondspecification. However, the allowable outage time limits of ACTION requirements for a higherMODE of operation may not be used to extend the allowable outage time that is applicable whena Limiting Condition for 'Operation is not met in a lower MODE of operation.The shutdown requirements of Specification 3.0.3 do not apply in MODES 5 and 6, because theACTION requirements of individual specifications define the remedial measures to be taken.Specification 3.0.4 establishes limitations on MODE changes when a Limiting Condition forOperation is not met. It precludes placing the facility in a higher MODE of operation when therequirements for a Limiting Condition for Operation are not met and continued noncompliance tothese conditions would result in a shutdown to comply with the ACTION requirements if achange in MODES were permitted. The purpose of this specification is to ensure that facilityoperation is not initiated or that higher MODES of operation are not entered wheni correctiveaction is being traken to obtain compliance with a specification by restoring equipment toOPERABLE status or parameters to specified limits. Compliance with ACTION requirementsthat permit continued operation of the facility for an unlimited period of time provides anacceptable level of safety for continued operation without regard to the status of the plant before.or after a MODE change. Therefore, in this case, entry into an OPERATIONAL MODE or otherspecified condition may be made in accordance 'with the provision of the ACTION requirements.The provisions of this specification should not, however, be interpreted as endorsing the failure toexercise good practice in restoring systems or components to OPERABLE status before plantstartup.MILLSTONE -UNIT 2B 3/4 0-3MILLTON -NIT2 B3/40-3Amendment Nos. 62, 15 l LBDCR 04-MP2-016February 24, 2005APPLICABILITYBASES (Con't) 0 :When a shutdown is required to comply with ACTION requirements, the provisions ofSpecification 3.0.4 do not apply because they would delay placing the facility in a lower MODEof operation.Specification 3.0.5 delineates what additional conditions must be satisfied to permit operation tocontinue, consistent with the ACTION statements for power sources, when a normal oremergency power source in not OPERABLE. It specifically prohibits operation when onedivision is inoperable because its normal or emergency power source is inoperable and a system,subsystem, train, component or device in another division is inoperable for another reason.The provisions of this specification permit the ACTION statements associated withindividual systems, subsystems, trains, components, or devices to be consistent with the ACTIONstatements of the associated electrical power source. It allows operation to be governed by thetime limits of the ACTION statement associated with the Limiting Condition for Operation forthe normal or emergency power source, not the individual ACTION statements for each system,subsystem, train, component or device that is determined to be inoperable solely because of theinoperability of its normal emergency power source.For example, Specification 3.8.1.1 requires in part that two emergency diesel generators be OPERABLE. The ACTION statement provides for a 72-hour out-of-service time when oneemergency diesel generator is not OPERABLE. If the definition of OPERABLE were appliedwithout consideration of Specification 3.0.5, all systems, subsystems, trains, components anddevices supplied by the inoperable emergency power source would also be inoperable. Thiswould dictate invoking the applicable ACTION statement for each of the applicable LimitingConditions for Operation. However, the provisions of Specification 3.0.5 permit the time limitsfor continued operation to be consistent with the ACTION statement for the inoperableemergency diesel generator instead, provided the other specified conditions are satisfied. In thiscase, this would mean that the corresponding normal power source must be OPERABLE, and allredundant systems, subsystems, trains, components, and devices must be OPERABLE, orotherwise satisfy.Specification 3.0.5 (i.e., be capable of performing their design function and haveat least one normal or one emergency power source OPERABLE). If they, are not satisfied,ACTION is required in accordance with this specification.As a further example, Specification 3.8.1.1 requires in part that two physicallyindependent circuits between the offsite transmission network and the onsite Class 1 E distributionsystem be OPERABLE. The ACTION statement provides a 24-hour out-of-service time whenboth required offsite circuits are not OPERABLE. If the definition of OPERABLE were appliedwithout consideration of Specification 3.0.5, all systems, subsystems, trains, components anddevices supplied by the inoperable normal power sources, both of the offsite circuits, would alsobe inoperable. This would dictate invoking the applicable ACTION statements for each of theapplicable LCOs. However, the provisions of Specification 3.0.5 permit the time limits forcontinued operation toVMILLSTONE -UNIT 2 B 3/4 0-4 Amendment Nos. 7:4, 4-54-,Acknowledged by NRC letter dated 6/28/05 LB DCR 04-MP2-016February 24, 2005BASES (Can't)be consistent with the ACTION statement for the inoperable normal power sources instead,provided the other specified conditions are satisfied. In this case, this would mean that for onedivision the emergency power source must be OPERABLE (as must be the components suppliedby the emergency power source) and all redundant systemas, subsystems, trains, components anddevices in the other divisions must be OPERABLE, or likewise satisfy Specification 3.0.5 (i.e., belcapable of performing their design functions and have an emergency power source OPERABLE).In other words, both emergency power sources must be OPERABLE and all redundant systems,subsystems, trains, components and devices in both divisions must also be OPERABLE. If theseconditions are not satisfied, ACTION is required in accordance with this specification.In MODES 5 and 6 Specification 3.0.5 is not applicable, and thus 'the individual ACTIONstatements for each applicable Limiting Condition for Operation in these MODES must beadhered to.Specification 3.0.6 establishes the allowance for restoring equipment to service underadministrative controls when it has been removed from service or declared inoperable to complywith ACTIONS. The sole purpose of this Specification is to' provide an exception to LCO 3.0.2(e.g., to not comply with the applicable Required ACTION(s)) to allow the performance ofsurveillance requirements to demonstrate:a. The OPERABILITY of the equipment being returned to service; orb. The OPERABILITY of other equipment.The administrative controls ensure the time the equipment is returned to service in conflict withthe requirements of the ACTIONS is limited to the time absolutely necessary to perform theallo~ved surveillance requirements. The Specification does not provide time to perform any otherpreventive or corrective maintenance.An example of demonstrating the OPERABILITY of equipment being returned to service isreopening a containment isolation valve that has been closed to comply with the RequiredACTIONS andTnust be reopened to perform the surveillance requirements.An example of demonstrating the OPERABILITY of other equipment is taking an inoperablechannel or trip system out of the tripped condition to prevent the trip function from occurringduring the performance of a surveillance requirement on another channel in the other trip system.A similar example of demonstrating the OPERABILITY of other equipment is taking an-inoperable channel or trip system out of the tripped condition to permit the logic to function andindicate the appropriate response during the performance of a surveillance requirement on anotherchannel in the same trip system.MILLSTONE -UNIT 2 B 3/4 0-5 Amendment No. 4-54, 4-52, 30,Acknowledged by NRC letter dated 6/28/05 October 15, 2002BASES (Con't).9OSpecification 4.0.1l through 4.0.5 establish the general requirements applicable to SurveillanceRequirements. These requirements are based on the Surveillance Requirements stated in theCode of Federal Regulations, 10OCFR50.3 6(c)(3):"Surveillance requirements are requirements relating to test, calibration, or inspection toensure that the necessary quality of systems and components is maintained, that facility operationwill be within safety limits, and that the limiting conditions of operation will be met.".Specification 4.0.1 establishes the requirement that surveillances must be met during theOPERATIONAL MODES or other conditions for which the requirements of the LimitingConditions for Operation apply unless otherwise stated in an individual SurveillanceRequirements. The purpose of this specification is to ensure that surveillances are performed toverify the OPERABILITY of systems and components and that parameters are within specifiedlimits to ensure safe operation of the facility when the plant is in a MODE or other specifiedcondition for which the associated Limiting Conditions for Operation are applicable. Failure tomeet a Surveillance within the specified surveillance interval, in accordance with Specification4.0.2 constitutes a. failure to meet a Limiting Condition for Operation.Systems and components are assumed to be OPERABLE when the associated SurveillanceRequirements have been met. Nothing in this Specification, however, is to be construed asimplying that systems or components are OPERABLE when either:a. The system or components are known to be inoperable, although still meeting theSurveillance Requirements or 9.b. The requirements of the Surveillance(s) are known to be not met between requiredSurveillance performances.Surveillance Requirements do not have to be performaed when the facility is in an OperationalMode or other specified conditions for which the requirements of the associated LimitingCondition for Operation do not apply unless otherwise specified. The Surveillance Requirementsassociated with a Special Test Exception are only applicable when the Special Test Exception isused as an allowable exception to the requirements of a specification.Unplanned events may satisfy the requirements (including applicable acceptance criteria) for agiven Surveillaiice Requirement. In this case, the unplanned event may be credited as fulfillingthe performance of the Surveillance Requirement. This allowance includes those SurveillanceRequirements whose performance is normally precluded in a given Mode or other specifiedcondition.Surveillance Requirements, including Surveillances invoked by ACTION requirements, do nothave to be performed on inoperable equipment because the ACTIONS define the remedialmeasures that apply. Surveillances have to be met and performed in accordance with Specification4.0.2, prior to returning equipment to Operable status.Upon completion of maintenance, appropriate post maintenance testing is required to declareequipment OPERABLE. This includes ensuring applicable Surveillances are not failed and theirmost recent performance is in accordance with Specification 4.0.2. Post maintenance testing maynot beMILLSTONE -UNIT 2B 3/4 0-5aAmendment No. 30, 271 LBDCR No. 04-MP2-016February 24, 2005BASES (Can't)possible in the current MODE or other specified conditions in the Applicability due to thenecessary unit parameters not having been established. In these situations, the equipment may beconsidered OPERABLE provided testing has been satisfactorily completed to the extent possibleand the equipment is not otherwise believed to be incapable of performing its function. This willallow operation to proceed to a MODE or other specified condition where other necessary postmaintenance tests can be completed. -..Some examples of this process are:a. Auxiliary feedwater (AFW) pump turbine maintenance during refueling thatrequires testing at steam pressure > 800 psi. However, if other appropriate testing.is satisfactorily completed, the AFW System can be considered OPERABLE. Thisallows startup and other necessary testing to proceed until the plant reaches the..steam pressure required to perform the testing.b. High pressure safety injection (HPSI) maintenance during shutdown that requiressystem functional tests at a specified pressure. Provided other appropriate testing issatisfactorily completed, startup can proceed with HPSI considered OPERABLE.This allows operation to reach the specified pressure to complete the necessary"post maintenance testing.Specification 4.0.2 This specification establishes the limit for which the specified time interval forSurveillance Requirements may be extended. It permits an allowable extension of the formal.surveillance interval to facilitate surveillance scheduling and consideration of plant operatingconditions that may not be suitable for conducting the surveillance; e.g., transient conditions or .other ongoing surveillance or maintenance activities. It also provides flexibility to accommodatethe length of a fuel cycle for surveillances that are performed at each refueling outage and arespecified with an 18-month surveillance interval. It is not intended that this provision be usedrepeatedly as a convenience to extend surveillance intervals beyond that specified forsurveillances that are not performed during refueling outages. The limitation of Specification4.0.2 is based on engineering judgment and the recognition that the most probable result of anyparticular surveillance being performed is the verification of conformance with the Surveillance;Requirements. This provision is sufficient to ensure that the reliability ensured throughsurveillance activities is not significantly degraded beyond that obtained from the specified.surveillance interval.Specification 4.0.3 establishes the flexibility to defer declaring affected equipment inoperable oran affected variable outside the specified limits when a Surveillance has not been completedwithin the specified surveillance interval. A delay period of up to 24 hours or up to the limit of thespecified siurveillance interval, whichever is greater, applies from the point in time that it isdiscovered that the Surveillance has not been performed in accordance with Specification 4.0.2,and not at the time that the specified surveillance interval was not met.This delay period provides adequate time to complete Surveillances that have been missed. Thisdelay period permits the completion of a Surveillance before complying with ACTIONrequirements or other remedial measures that mnight preclude completion of the Surveillance.MILLSTONE -UNIT 2 B 3/4 0-Sb Amendment No. 23-0, 2-7-1-,Acknowledged by NRC letter dated 6/28/05 LBDCR 04-MP2-016February 24, 2005BASES (Con't)0:The basis for this delay period includes consideration of unit conditions, adequate planning,availability of personnel, the time required to perform the Surveillance, the safety significance ofthe delay in completing the required Surveillance, and the recognition that the most probableresult of any particular Surveillance being performed is the verification of conformance with therequirements.When a Surveillance. with a surveillance interval based not on time intervals, but upon specifiedunit conditions, operating situations, or requirements of regulations, (e.g., prioft0 enteringMODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified byapproved exemptions, etc.) is discovered to not have been performed when specified,Specification 4.0.3 allows for the full delay period of up to the specified surveillance interval toperform the Surveillance. However, since there is not a time interval specified, the missedSurveillance should be performed at the first reasonable opportunity.Specification 4.0.3 provides a time limit for, and allowances for the performance of, Surveillancesthat become applicable as a consequence of MODE changes imposed by ACTION requirements.Failure to comply with specified surveillance intervals for the Surveillance Requirements isexpected to be an infrequent occurrence. Use of the delay period established by Specification4.0.3 is a flexibility which is not intended to be used as an operational convenience to extendSurveillance intervals. While up to 24 hours or the limit of the specified surveillance interval isprovided to perform the missed Surveillance, it is expected that the missed Surveillance will beperformed at the first reasonable opportunity. The determination of the first reasonableopportunity should include consideration of the impact on plant risk (from delaying theSurveillance as well as any plant configuration changes required or shutting the plant down to d :perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, *planning, availability of personnel, and the time required to perform the Surveillance. This riskimpact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and itsimplementation guidance, NRC Regulatory Guide 1. 182, "Assessing and Managing Risk BeforeMaintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses consideration*of temporary and aggregate risk impacts, determination of risk management action thresholds,and risk management action up to and including plant shutdown. The missed Surveillance shouldbe treated as an emergent cofidition as discussed in the Regulatory Guide. The risk evaluationmay use quantitative, qualitative, or blended methods. The degree of depth and rigor of theevaluation should be commensurate with the importance of the component. Missed Surveillancesfor important components should be analyzed quantitatively. If the results of the risk evaluationdetermine the risk increase is significant, this evaluation should be used to determine the safestcourse of action- All missed Surveillances will be placed in the licensee's Corrective ActionProgram.If a Surveillance is not completed within the allowed delay period, then the equipment isconsidered inoperable or the variable is considered outside the specified limits and the entry intothe ACTION requirements for the applicable Limiting Condition for Operation beginsimmediately upon expiration of the delay period. If a Surveillance is failed within the delayperiod, then the equipment is inoperable, or the variable is outside the specified limits and entryinto the ACTION requirements for the applicable Limiting Condition for Operation beginsimmediately upon the failure of the Surveillance.Completion of the Surveillance within the delay period allowed by this Specification, or withinthe Allowed Outage Time of the applicable ACTIONS, restores compliance with Specification4.0. l. 0:MILLSTONE -UNIT 2 B 3/4 0 -6 Amendment No. 2-7-1-,Acknowledged by NRC letter dated 6/28/05 -June 19, 2007LBDCR 07-MP2-0143/4.0 APPLICABILITYBASES (Con't)Specification 4.0.4 establishes the requirement that all applicable surveillances must be metbefore entr}, into and OPERATIONAL MODE or other condition of operation specified in theApplicability statement. The purpose of this specification is to ensure that system and componentOPERABILITY requirements or parameter limits are met before entry into a MODE or conditionfor which these systems and components ensure safe operation of the facility. This provisionapplies to changes in OPERATIONAL MODES or other specified conditions associated withplant shutdown as well as startup.Under the provisions of this specification, the applicable Surveillance Requirements must beperformed within the specified surveillance interval to ensure that the Limiting Conditions forOperation are met during initial plant startup or following a plant outage.When a shutdown is required to comply with ACTION requirements, the provisions ofSpecification 4.0.4 do not apply because this would delay placing the facility in a lower MODE ofoperation.Specification 4.0.5 establishes the requirement that inservice testing of ASME Code Class 1, 2,and 3 pumps and valves shall be performed in accordance with a periodically updated version ofthe ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OM Code) andapplicable Addenda as required by 10 CFR 50.55a(f). These requirements apply except whenrelief has been provided in writing by the Commission.This specification includes a clarification of the frequencies for performing the inservice testingactivities required by the ASME OM Code and applicable Addenda. This clarification isprovided to ensure consistency in surveillance intervals throughout the Technical Specificationsand to remove any ambiguities relative to the frequencies for performing the required inservicetesting activities.Under the terms of this specification, the more restrictive requirements of the TechnicalSpecifications take precedence over the ASME OM Code and applicable Addenda. Therequirements of Specification 4.0.4 to perform surveillance activities before entry into anOPERATIONAL MODE or other specified condition takes precedence over the ASME OM Codeprovision which allows pumps and valves to be tested up to one week after return to normaloperation.MILLSTONE -UNIT 2B3/0-AmnetNo---IB 3/4 0-7Amendment No. 4-54 REVERSE OF PAGE B 3/4 0-7INTENTI.ONALLY LEFT BLANK September 25, 20033/4.1 REACTIVITY CONTROL SYSTEMSBASES3/4.1.1 REACTIVITY CONTROL SYSTEMS3/4.1.1.1 SHUTDOWN MARGINA sufficient SHUTDOWN MARGIN ensures that 1) the reactor can be made subcritical from alloperating conditions, 2) the reactivity transients associated with postulated accident conditionsare controllable within acceptable limits, and 3) the reactor will be maintained sufficientlysubcritical to preclude inadvertent criticality in the shutdown condition.SHUTDOWN MARGIN requirements vary throughout core life as a function of fuel depletion,RCS boron concentration, and RCS Tavg The most restrictive conditiori occurs at EOL, with Tavat no load operating temperature, and is associated with a postulated steam line break accident andresulting uncontrolled RCS cooldown. In the analysis of this accident, the minimumSHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT is initiallyrequired to control the reactivity transient. Accordingly, the SHUTDOWN MARGIN required bySpecification 3.1.1.1 is based upon this limiting condition and is consistent with FSAR accidentanalysis assumptions. For earlier periods during the fuel cycle, this value is conservative. TheSHUTDOWN MARGIN is verified by performing a reactivity balance calculation, consideringthe listed reactivity effects:a. RCS boron concentration;b. CEA positions;c. RCS average temperature;d. Fuel burnup based on gross thermal energy generation;e. Xenon concentration;f. Samarium concentration; andg. Isothermal temperature coefficient (ITC).Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcriticaland the fuel temperature will be changing at the same rate as the RCS temperature.3/4.1.1.2 REACTIVITY BALANCEReactivity balance is used as a measure of the predicted versus measured core reactivity duringpower operation. The periodic confirmation of core reactivity is necessary to ensure that DesignBasis Accident (DBA) and transient safety analyses remain valid. A large reactivity differencecould be the result of unanticipated changes in fuel, control element assembly (CEA) worth, oroperation at conditions not consistent with those assumed in the predictions of core reactivity, andcould potentially result in a loss of SHUTDOWN MARGIN (SDM) or violation of acceptablefuel design limits. Comparing predicted versus measured core reactivity validates the nuclearmethods used in the safety analy sis and supports the SDM demonstrations (LCO 3.1.1.1,"SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought safely to cold,subcritical conditions.The normalization of predicted RCS boron concentration to the measured value is typicallyperformed after reaching RATED THERMAL POWER following startup from a refuelingoutage, with the CEAs in their normal positions for power operation. The normalization isperformed at BOC conditions, so that coreMILLSTONE -UNIT 2B3/4 1-1MILLTON -NIT2 B3/41-1Amendment No. 39, 4-48, 8-, 280 September 9, 20043/4.1 REACTIVITY CONTROL SYSTEMSBASES3/4.1.1 REACTIVITY CONTROL SYSTEMS (Continued)3/4.1.1.2 REACTIVITY BALANCE (Continued)reactivity relative to predicted values can be continually monitored and evaluated as coreconditions change during the cycle.When measured core reactivity is within +1% Ak/k of the predicted value at steady state thermalconditions, the core is considered to be operating within acceptable design limits.The limits on core reactivity must be maintained during MODES 1 and 2 because a reactivitybalance must exist when the reactor is critical or producing THERMAL POWER. ThisSpecification does not apply in MODES 3 ,4 and 5 because the reactor is shut down and thereactivity balance is not changing.In MODE 6, fuel loading results in a continually changing core reactivity. Boron concentrationrequirements (LCO 3.9.1, "Boron Concentration") ensure that fuel movements are performedwithin the bounds of the safety analysis.3/4.1.1.3 BORON DILUTIONA minimum flow rate of at least 1000 GPM provides adequate mixing, prevents stratification andensures that reactivity changes will be gradual during reductions in Reactor Coolant Systemboron concentration. The 1000 GPM limit is the minimum required shutdown cooling flow tosatisfy the boron dilution accident analysis. This 1000 GPM flow is an analytical limit. Plantoperating procedures maintain the minimum shutdown cooling flow at a higher value toaccommodate flow measurement uncertainties. While the plant is operating in reduced inventoryoperations, plant operating procedures also specify an upper flow limit to prevent vortexing in theshutdown cooling system. A flow rate of at least 1000 GPM will circulate the full ReactorCoolant System volume in approximately 90 minutes. With the RCS in mid-loop operation, theReactor Coolant System volume will circulate in approximately 25 minutes. The reactivitychange rate associated with reductions in Reactor Coolant System boron concentration will bewithin the capability for operator recognition and control.A maximum of two charging pumps capable of injecting into the RCS when RCS cold legtemperature is < 300°F ensures that the maximum inadvertent dilution flow rate assumed in theboron dilution analysis is not exceeded.MILLSTONE -UNIT 2 B 3/4 1-la Amendment No. 4-39, 4.4&, 8-5, 2,80,283 LBDCR 09-MP2-017September 15, 2009REACTIVITY CONTROL SYSTEMSBASES3/4.1.1.3 BORON DILUTION (Continued~)A charging pump can be considered to be not capable of injecting into the RCS by use of any ofthe following methods and the appropriate administrative controls.1. Placing the motor circuit breaker in the open position.2. Removing the charging pump motor overload heaters from the charging pump circuit.3. Removing the charging pump motor controller from the motor control center.4. Placing a charging pump control switch in the Pull-To-Lock (PTL) position.3/4.1.1.4 MODERATOR TEMPERATURE COEFFICIENT (MTC)The limitations on MTC are provided to ensure that the assumptions used in the accident andtransient analyses remain valid through each fuel cycle. The surveillance requirements formeasurement of the MTC during each fuel cycle are adequate to confirm the MTC value sincethis coefficient changes slowly due principally to the reduction in RCS boron concentrationassociated with fuel burnup. The confirmation that the measured MTC value is within its limitprovides assurance that the coefficient will be maintained within acceptable values throughouteach fuel cycle.3/4.1.1.5 MINIMUM TEMPERATURE FOR CRITICALITYThe MTC is expected to be slightly negative at operating conditions. However, at thebeginning of the fuel cycle, the MTC may be slightly positive at operating conditions and since itwill become more positive at lower temperatures, this specification is provided to restrict reactoroperation when Tav is significantly below the normal operating temperature..3/4.1.2 DELETED3/4.1.3 MOVEABLE CONTROL ASSEMBLIESThe specifications of this section ensure that (1) acceptable power distribution limits aremaintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effectsof a CEA ejection accident are limited to acceptable levels.The ACTION statements which permit limited variations from the basic requirements areaccompanied by additional restrictions which ensure that the original criteria are met.MILLSTONE -UNIT 2 B 3/4 1-2 Amendment No. -3~, 3g, 3-39, 4&,2N-l-, 28-, Page B 3/4 1-3 has been removed from Technical Specifications September 25, 2003BASES3/4.1.3 MOVEABLE CONTROL ASSEMBLIES (Continued)A CEBA may become misaligned, yet remain trippable. In this condition, the CEA can stillperform its required function of adding negative reactivity should a reactor trip be necessary. Ifone or more CEAs (regulating or shutdown) are misaligned by > 10 steps and < 20 steps buttrippable, or one CEA is misaligned by >20 steps but trippable, continued operation in MODES 1and 2 may continue, provided, within 1 hour, the power is reduced to < 70% RATED THERMALPOWER, and within 2 hours CEA alignment is restored. If negative reactivity insertion isrequired to reduce THERMAL POWER, boration shall be used. Regulating CEA alignment canbe restored by either aligning the misaligned CEA(s) to within 10 steps of all other CEAs in itsgroup or aligning the misaligned CEA's group to within 10 steps of the misaligned CIBA. ARegulating CEA is considered fully inserted when either the Dropped Rod indication or lowerElectrical Limit indication lights on the core mimic display are illuminated. A Regulating CEA isconsidered to be fully withdrawn when withdrawn > 176 steps. Shutdown CIBA alignment canonly be restored by aligning the misaligned CIBA(s) to within 10 steps of its group.Xenon redistribution in the core starts to occur as soon as a CIBA becomes misaligned. ReducingTHERMAL POWER ensures acceptable power distributions are maintained. For smallmisalignments (< 20 steps) of the CEAs, there is:a. A small effect on the time dependent long term power distributions relative tothose used in generating LCOs and limiting safety system settings (LSSS)set-points;b. A negligible effect on the available SHUTDOWN MARGIN; andc. A small effect on the ejected CIBA worth used in the accident analysis.With a large CIBA misalignment ( > 20 steps), however, this misalignment would cause distortionof the core power distribution. This distortion may, in turn, have a significant effect on the timedependent, long term power distributions relative to those used in generating LCOs and LSSSsetpoints. The effect on the available SHUTDOWIN MARGIN and the ejected CEA worth usedin the accident analysis remain small. Therefore, this condition is limited to a single CEBAmisalignment, while still allowing 2 hours for recovery.In both cases, a 2 hour time period is sufficient to:a. Identifyr cause of a misaligned CIBA;b. Take appropriate corrective action to realign the CEAs; andc. Minimize the effects of xenon redistribution.If a CIBA is untrippable, it is not available for reactivity insertion during a reactor trip. With anuntrippable CIBA, meeting the insertion limits of LCO 3.1.3.5 and LCO 3.1.3.6 does not ensurethat adequate SHUTDOWN MARGIN exists. With one or more CIBAs untrippable the plant istransitioned to MODE 3 within 6 hours.MILLSTONE -UNIT 2B 3/4 1-4MILLTONE- UNT 2 3/41-4Amendment No. 3-8, 4-t-9,280 LBDCR 14-MP2-016September 4, 2014BASES3/4.1.3 MOVEABLE CONTROL ASSEMBLIES (Continued),The CEA motion inhibit permits CEA motion within the requirements. of LCO 3.1.3.6,"Regulating Control Element Assembly (CEA) Insertion Limits," and the CEA deviation circuitprevents regulating CEAs from being misaligned from other CEAs in the group. With the CEAmotion inhibit inoperable, a time of 6 hours is allowed for restoring the CEA motion inhibit toOPERABLE status, or placing and maintaining the CEA drive switch in either the "off' or"manual" position, fully withdrawing all CEAs in group 7 to < 5% insertion. Placing the CEAdrive switch in the "off' or "manual" position ensures the CEAs will not move in response toReactor Regulating System automatic motion commands. Withdrawal of the CEAs to thepositions required in the Required ACTION B.2 ensures that core perturbations in local bumup,peaking factors, and SHUTDOWN MARGIN will not be more adverse than the Conditionsassumed in the safety analyses and LCO setpoint determination. Required ACTION B.2 ismodified by a Note indicating that performing this Required ACTION is not required when inconflict with Required ACTIONS A.1 or C. 1.Continued operation is not allowed in the case of more than one CEA misaligned fromany other CEA in its group by >20 steps, or one or more CEAs untr-ippable. This is because thesecases are indicative of a loss of SHUTDOWN MARGIN and power distribution changes, and aloss of safety function, respectively.OPERABILITY of the CEA position indicators (Specification 3.1.3.3) is required todetermine CEA positions and thereby ensure compliance with the CEA alignmaent and insertionlimits and ensures proper operation of the CEA Motion Inhibit and CEA deviation block circuit.The CEA "Full In" and "Full Out" limit Position Indicator channels provide an additionalindependent means for determining the CEA positions when the CEAs are at either their fullyinserted or fully withdrawn positions. Therefore, the ACTION statements applicable toinoperable CEA position indicators permit continued operations when the positions of CEAs withinoperable position indicators can be verified by the "Full In" or "Full Out" limit PositionIndicator channels.CEA positions and OPERABILITY of the CEA position indicators are required to beverified at the frequency specified in the Surveillance Frequency Control Program with morefrequent verifications required if ani automatic monitoring channel is inoperable. The surveillancefrequency is controlled under the Surveillance Frequency Control Program.The maximum CEA drop time permitted by Specification 3.1.3.4 is the assumed CEAdrop time used in the accident analyses. Measurement with Tavg > 51 5°F and with all reactorcoolant pumps operating ensures that the measured drop times will be representative of insertiontimes experienced during a reactor trip at operating conditions.MILLSTONE -UNIT 2 B 3/4 1-4a Amendment No. -t-33, 24-6, 29-g, September 25, 2003REACTIVITY CONTROL SYSTEMSBASES3/4.1.3 MOVEABLE CONTROL ASSEMBLIES (Continued)The LSSS setpoints and the power distribution LCOs were generated based upon a coreburnup which would be achieved with the core operating in an essentially unroddedconfiguration. Therefore, the CEA insertion limit specifications require that during MODES 1and 2, the CEAs be nearly fully withdrawn. The amount of CEA insertion permitted by the LongTerm Steady State Insertion Limits of Specification 3.1.3.6 will not hav~e a significant effect uponthe unrodded burnup assumption but will still provide sufficient reactivity control. The TransientInsertion Limits of Specification 3.1.3.6 are provided to ensure that (1) acceptable powerdistribution limits are maintained, (2) the minimum SHUTDOWN MARGIN is maintained, and(3) the potential effects of a CEA ejection accident are limited to acceptable levels; however, longterm operation at these insertion limits could have adverse effects on core power distributionduring subsequent operation in an unrodded configuration. The PDIL alarm, CEA Motion Inhibitand CEA deviation circuit are provided by the CEAPDS computer.The control rod drive mechanism requirement of specification 3.1.3.7 is provided toassure that the consequences of an uncontrolled CEA withdrawal from subcritical transient willstay within acceptable levels. This specification assures that reactor coolant system conditionsexist which are consistent with the plant safety analysis prior to energizing the control rod drivemechanisms. The accident is precluded when conditions exist which are inconsistent with thesafety analysis since deenergized drive-mechanisms cannot withdraw a CEA. The drivemechanisms may be energized with the boron concentration greater than or equal to the refuelingconcentration since, under these conditions, adequate SHUTDOWN MARGIN is maintained,even if all CEAs are fully withdrawn from the core.MILLSTONE -UNIT 2B 3/4 1-5MILLTONE- UNT 2 3/41-5Amendment No. 3-&, 446, 24-6, 280 REVERSE OF PAGE B 3/4 1-5INTENTIONALLY LEFT BLANK LBDCR 04-MP2-016February 24, 20053/4.2 POWER DISTRIBUTION LIMvITSBASES3/4.2.1 LINEAR HEAT RATEThe limitation on linear heat rate ensures that in the event of a LOCA, the peaktemperature of the fuel cladding will not exceed 2200°F.Either of the two core power distribution monitoring systems, the Excore DetectorMonitoring System and the Incore Detector Monitoring System, provide adequate monitoring ofthe core power distribution and are capable of verifying that the linear heat rate does not exceedits limits. The Excore Detector Monitoring System perfonus this function by continuouslymonitoring the AXIAL SHAPE INDEX with two OPERABLE excore neutron flux detectors andverifying that the AXIAL SHAPE INDEX is maintained within the allowable limits specified inthe CORE OPERATING LIMITS REPORT using the Power Ratio Recorder. The power[dependent limits of the Power Ratio Recorder are less than or equal to the limits specified in theCORE OPERATING LIMITS REPORT. In conjunction with the use of the excore monitoring [system and in establishing the AXIAL SHAPE INDEX limits, the following assumptions aremade: 1) the CEA insertion limits of Specifications 3.1.3.5 arid 3.1.3.6 are satisfied, 2) theAZIIMUTHAL POWER TILT restrictions of Specification 3.2.4 are satisfied, and 3) the TOTALTINRODDED INTEGRATED RADIAL PEAKING FACTOR does not exceed the limits ofSpecification 3.2.3.The Incore Detector Monitoring System continuously provides a direct measure of thepeaking factors and the alarms which have been established for the individual incore detectorsegments ensure that the peak linear heat rates will be maintained within the allowable limitsspecified in the CORE OPERATING LIMITS REPORT. The setpoints for these alarms includeallowances, set in the conservative direction. The Incore Detector Monitoring System is not usedto monitor linear heat rate below 20% of RATED THERMAL POWER.. The accuracy of theneutron flux infonnation from the incore detectors is not reliable at THERMAL POWER < 20%RATED THERMAL POWER.3/4.2.3 ANT) 3/4.2.4 TOTAL UNIRODDED INTEGRATED RADIAL PEAKING FACTORS FTrANT) AZIMUTHAL POWER TILT -T~qThe limitations on Far and Tq are provided to 1) ensure that the assumptions used in theanalysis for establishing the Linear Heat Rate and Local power Density -High LCOs and LSSSsetpoints remain valid during operation at the various allowable CEA group insertion limits, and,2) ensure that the assumptions used in the analysis establishing the DNB Margin LCO, andThermal Margin/Low Pressure LSSS setpoints remain valid during operation at thevarious allowable CEA group insertion limits. If F'r or Tq exceed their basic limitations,operation may continue under the additional restrictions imposedMILLSTONE -UNIT 2 B 3/4 2-1 Amendment No. g3g, 5-2,4-2-2,1439, 448, 4-5-5~,-1-94,-2-30,220g,Acknowledged by NRC letter dated 6/28/05 LBDCR 14-MP2-016September 4, 2014POWER DISTRIBUTION LIMITSBASESby the ACTION statements since these additional restrictions provide adequate provisions toassure that the assumptions used in establishing the Linear Heat Rate, Thermal Margin!LowPressure and Local Power Density -High LCOs and LSSS setpoints remain valid. AnAZIMUTHAL POWER TILT > 0.10 is not expected and i~fit should occur, subsequent operationwould be restricted to only those operations required to identify the cause of this unexpected tilt.Core power distribution is a concern any time the reactor is critical. The Total IntegratedRadial Peaking Factor -FTr LCO, however, is only applicable in MODE 1 above 20% of RATEDTHERMAL POWER. The reasons that this LCO is not applicable below 20% of RATEDTHERMAL POWER are:a. Data from the incore detectors are used for determining the measured radialpeaking factors. Technical Specification 3.2.3 is not applicable below 20% ofRATED THERMAL POWER because the accuracy of the neutron fluxinformation from the incore detectors is not reliable at THERMAL POWER< 20% RATED THERMAL POWER.b. When core power is below 20% of RATED THERMAL POWER, the core isoperating well below its th~ermal limits, and the Local Power Density (fuel pellet.melting) and Thermal Margin/Low Pressure (DN-B) trips are highly conservative.The surveillance requirements for verifying that FTr and Tq are within their limits provideassurance that the actual values ofFTr and Tq do not exceed the assumed values. Thesesurveillance frequencies are controlled under the Surveillance Frequency Control Program.Verifying FTr after each fuel loading prior to exceeding 70% of RATED THERMAL POWERprovides additional assurance that the core was properly loaded. '"3/4.2.6 DNB MARGINThe limitations provided in this specification ensure that the assumed margins to DNB aremaintained. The limiting values of the parameters in this specification are those assumed as theinitial conditions in the accident and transient analyses; therefore, operation must be maintainedwithin the specified limits for the accident and transient analyses to remain valid.MILLSTONE -UNIT 2 B 3/4 2-2 Amendment No. , 4-,--22, -3~9, 55,-2--0, O LBDCR 14-MP2-016September 4, 20143/4.3 INSTRUMENTATIONBASES3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES(ESF' INSTRUMENTATIONThe OPERABILITY of the protective and ESF instrumentation systems and bypassesensure that 1) the associated ESF action and/or reactor trip will be initiated when the parametermonitored by each channel or combination thereof exceeds its setpoint, 2) the specifiedcoincidence logic is maintained, 3) sufficient redundancy is maintained to permit a channel to beout of service for testing or maintenance, and 4) sufficient system functional capability isavailable for protective and ESE purposes from diverse parameters.The OPERABILITY of these systems is required to provide the overall reliability,redundance and diversity assumed available in the facility design for the protection and mitigationof accident and transient conditions. The integrated operation of each of these systems isconsistent with the assumptions used in the accident analyses.ACTION Statement 2 of Tables 3.3-1 and 3.3-3 requires an inoperable Reactor ProtectionSystem (RPS) or Engineered Safety Feature Actuation System (ESFAS) channel to be placed inthe bypassed or tripped condition within 1 hour. The inoperable channel may remain in thebypassed condition for a maximum of 48 hours. While in the bypassed condition, the affectedfunctional unit trip coincidence will be 2 out of 3. After 48 hours, the channel must either bedeclared OPERABLE, or placed in the tripped condition. If the channel is placed in the trippedcondition, the affected functional unit trip coincidence will become 1 out of 3. One additionalchannel may be removed from service for up to 48 hours, provided one of the inoperable channesis placed in the tripped condition.Plant operation with an inoperable pressurizer high pressure reactor protection channel inthe tripped condition is restricted because of the potential inadvertent opening of both pressurizerpower operated relief valves (PORVs) if a second pressurizer high pressure reactor protectionchannel failed while the first channel was in the tripped condition. This plant operating restrictionis contained in the Technical Requirements Manual.The reactor trip switchgear consists of eight reactor trip circuit breakers, which areoperated in four sets of two breakers (four channels). Each of the four trip legs consists of tworeactor trip circuit breakers in series. The two reactor trip circuit breakers within a trip leg areactuated by separate initiation circuits. For example, if a breaker receives an open signal in tripleg A, an identical breaker in trip leg B will also receive an open signal. This arrangement ensuresthat power is intenrupted to both Control Element Drive Mechanism buses, thus preventing a tripof only half of the control element assemblies (a half trip). Any one inoperable breaker in achannel will make the entire channel inoperable.The surveillance requirements specified for these systems ensure that the overall systemfunctional capability is maintained comparable to the original design standards. TheseJsurveillance frequencies are controlled under the Surveillance Frequency Control Program.The surveillance testing verifies OPERABILITY of the RPS by overlap testing of the fourinterconnected modules: measurement channels, bistable trip units, RPS logic, and reactor tripcircuit breakers. When testing the measurement channels or bistable trip units that provide anautomatic reactor trip function, the associated RPS channel will be removed from service,MILLSTONE -UNIT 2 B 3/4 3-1 Amendment No.4-67-, 4-1-gg 4-98, 2-2-5, 2-82,Azkncl ...... N.., C lcttDz" 1 at- d 6/28,-f/'05I LBDCR 06-MP2-036October 12, 20063/4.3 INSTRUMENTATIONBASES3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES(ESF) INSTRUMENTATION (continued')declared inoperable, and ACTION Statement 2 of Technical Specification 3.3.1.1 entered. Whentesting the RPS logic (matrix testing), the individual RPS channels will not be affected. Each ofthe parameters within each RPS channel supplies three contacts to make up the 6 different logicladders/matrices (AB, AC, AD, BC, BD, and CD). During matrix testing, only one logic matrix istested at a time. Since each RPS channel supplies 3 different logic ladders, testing one laddermatrix at a time will not remove an RPS channel from the overall logic matrix. Therefore, matrixtesting will not remove an RPS channel from service or make the RPS channel inoperable. It isnot necessary to enter an ACTION Statement for any of the parameters associated with each RPSchannel while performling matrix testing. This also applies when testing the reactor trip circuitbreakers since this test will not remove an RPS channel from service or make the RPS channelinoperable.ACTION Statements for the RP'S logic matrices and RIPS logic matrix relays are required to beentered during matrix testing as these functional units become inoperable when the "HOLD"button is depressed during testing.The RIPS bypasses and their allowable values are addressed in footnotes to Table 3.3-1. They are Inot otherwise addressed as specific table entries.0The RPS automatic bypass removal features must function as a backup to manual actions for allsafety related trips to ensure the trip functions are not operationally bypassed when the safetyanalysis assumes the functions are available.The RPS automatic bypass removal feature of all four operating bypass channels must beOPERABLE for each RIPS function with an operating bypass in the MODES addressed in thespecific LCO for each function. All four bypass removal channels must be OPERABLE to ensurethat none of the four RP'S channels are inadvertently bypassed.ACTION Statements 7 and 8 apply to the RPS bypass removal feature only. If the bypass enablefunction is failed so as to prevent entering a bypass condition, operation may continue.ACTION Statement 7 applies to one automatic bypass removal channel inoperable. If the bypassremoval channel for any operating bypass cannot be restored to OPERABLE status, theassociated RIPS channel may be considered OPERABLE only if the bypass is not in effect.Otherwise, the affected RP'S channel must be declared inoperable, as in ACTION Statement 2,and the bypass either removed or the bypass removal channel repaired. The allowed outage timesare the same as for ACTION Statement 2.MILLSTONIE.-UNIIT2 B 3/4 3-la Amendment No. 2-2--, 3, 245-, 2-82, LBDCR 14-MiP2-016September 4, 20143/4.3 INSTRUMENTATIONBASES3/4.3.1 AND 3/4.3.2 PROTECTIVE ANT) ENGINEERED SAFETY FEATUIRES(ESE) INSTRUMENTATION (continued)ACTION Statement 8 applies to two inoperable automatic bypass removal channels. If the bypassremoval channels cannot be restored to OPERABLE status, the associated RPS channel may beconsidered OPERABLE only if the bypass is not in effect. Otherwise, the affected RPS channelsmust be declared inoperable, and the bypass either removed or the bypass removal channelrepaired. Also, ACTION Statement 8 provides for the restoration of the one affected automatictrip channel to OPERABLE status within the allowed outage time specified under ACTIONStatement 2.ACTION Statements 7 and 8 contain the term "disable the bypass channel." Compliance withACTION Statements 7 or 8 is met by placing or verifying the Zero Mode Bypass Switch(es) in"Off." No further action (i.e., key removal, periodic verification, etc.) is required. These switchesare administratively controlled via station procedures; therefore the requirements of ACTIONStatements 7 and 8 are continuously met.SR 4.3.1.1.2 and SR 4.3 .2.1.2 specify a CHANNEL FUNCTIONAL TEST of the bypass functionand automatic bypass removal once within 92 days prior to each reactor startup. The total bypassfunction shall be demonstrated OPERABLE periodically during CHANNEL CALIBRATIONtesting of each channel affected by bypass operation. The surveillance frequency is controlledunder the Surveillance Frequency Control Program. The CHANNEL FUNCTIONAL TEST issimilar to the CHANNEL FUNCTIONAL TESTS already required by SR 4.3.1.1.1 and SR4.3.2.1.1, except the CHANNEL FUNCTIONAL TEST is applicable only to bypass functionsand is performed once within 92 days prior to each startup. The MPS2 RPS is an analog systemwhile the design of the MIPS2 ESFAS includes both an analog portion and a digital portion. Withrespect to the analog portion of the systems, a successful test of the required contact(s) of achannel relay may be perfonnted by the verification of the change of state of a single contact of therelay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This isacceptable because all of the other required contacts of the relay are verified by other TS tests atleast once per refueling interval with applicable extensions. Proper operation of bypasspermissives is critical during plant startup because the bypasses must be in place to allow startupoperation and must be removed at the appropriate points during power ascent to enable certainreactor trips. Consequently, the appropriate time to verify bypass removal functionOPERABILITY is just prior to start-up. The allowance to conduct this test within 92 days ofstartup is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFASExtended Test Interval Evaluation," which is referenced in NUREG-1432 and is applicable toMIPS2. Once the operating bypasses are removed, the bypasses must not fail in such a way that theassociated trip function gets inadvertently bypassed. This feature is verified by the trip functionCHANNEL FUNCTIONAL TESTS SR 4.3.1.1.1 and SR 4.3.2.1.1. Therefore, further testing ofthe bypass function after startup is unnecessary.MILLSTONE -UNIT 2 B343l mnmn oB 3/4 3-1bAmendment No. LBDCR 14-MIP2-016September 4, 20143/4.3 TINSTRUMENTATIONBASES3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES(ESF) INSTRUMENTATION (continued)The ESFAS includes four sensor subsystems and two actuation subsystems for each of thefunctional units identified in Table 3.3-3. Each sensor subsystem includes measurement channelsand bistable trip units. Each of the four sensor subsystem channels monitors redundant andindependent process measurement channels. Each sensor is monitored by at least one bistable.The bistable associated with each ESFAS Function will trip when the monitored variable exceedsthe trip setpoint. When tripped, the sensor subsystems provide outputs to the two actuationsubsystems.The two independent actuation subsystems each compare the four associated sensor, subsystemoutputs. If a trip occurs in two or more sensor subsystem channels, the two-out-of-four automaticactuation logic will initiate one train of ESFAS. An Automatic Test Inserter (ATI), for which theautomatic actuation logic OPERABILITY requirements of this specification do not apply,provides automatic test capability for both the sensor subsystems and the actuation subsystems.The provisions of Specification 4.0.4 are not applicable for the CI-ANNEL FUNCTIONALTEST of the Engineered Safety Feature Actuation System automatic actuation logic associatedwith Pressurizer Pressure Safety Injection, Pressurizer Pressure Containment Isolation, SteamGenerator Pressure Main Steam Line Isolation, and Pressurizer Pressure Enclosure BuildingFiltration for entry into MODE 3 or other specified conditions. After entering MODE 3,pressurizer pressure and steam generator pressure will be increased and the blocks of the ESFactuations on low pressurizer pressure and low steam generator pressure will be automaticallyremoved. After the blocks have been removed, the CHANNEL FUNCTIONAL TEST of the ESFautomatic actuation logic can be performed. The CHANNEL FUNCTIONAL TEST of the ESFautomatic actuation logic must be perfonrned within 12 hours after establishing the appropriateplant conditions, and prior to entry into MODE 2.The periodic measurement of response time provides assurance that the protective and ESF actionfunction associated with each channel is completed within the time limit assumed in the accidentanalyses. These surveillance frequencies are controlled under the Surveillance Frequency ControlProgram. No credit was taken in the analyses for those channels with response times indicated asnot applicable. The Reactor Protective and Engineered Safety Feature response times arecontained in the Millstone Unit No. 2 Technical Requirements Manual. Changes to the TechnicalRequirements Manual require a 10OCFR5O.59 review as well as a review by the Site OperationsReview Cormnittee.MILLSTONE -UNIT 2 B343i mnmn oB 3/4 3-1eAmendment No. LBDCR 04-MP2-016February 24, 2005INSTRUMENTATIONBASES3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESF)INSTRUMENTATION (Continued)SRAS LOGIC MODIFICATIONACTION Statement 4 of Table 3.3-3, which applies only to the SRAS logic, specifies thatduring surveillance testing the second inoperable channel must also be placed in the bypassedcondition. For the SRAS logic, placing the second inoperable channel in the tripped condition (asin ACTION Statement 2) could result in the false generation of a SRAS signal due to anadditional failure which causes a trip signal in either of the remaining channels at the onset of aLOCA. The false generation of the SRAS signal leads to unacceptable consequences for LOCAmitigation.With ACTION Statement 4, during the two-hour period when two channels are bypassed,no additional failure can result in the false generation of the SRAS signal. However, an additionalfailure that prevents a trip of either of the two remaining channels may prevent the generation of atrue SRAS signal while in this ACTION Statement. If no SRAS is generated at the appropriatetime, operating procedures instruct the operator to ensure that the SRAS actuation occurs whenthe refueling water storage tank level decreases. Due to the limited period of vulnerability, andthe existence of operator requirements to manually initiate an SPAS if an automatic initiationdoes not occur, this risk is considered acceptable.STEAM GENERATOR BLOWDOWN ISOLATIONAutomatic isolation of steam generator blowdown will occur on low steam generatorwater level. An auxiliary feedwater actuation signal will also be generated at this steam generatorwater level. Isolation of steam generator blowdown will conserve steam generator waterinventory following a loss of main feedwater.SENSOR CABINET POWER SUPPLY AUCTIONEERINGThe auctioneering circuit of the ESFAS sensor cabinets ensures that two sensor cabinetsdo not de-energize upon loss of a D.C. bus, thereby resulting in the false generation of an SRAS.Power source VA-10 provides normal power to sensor cabinet A and backup power to sensorcabinet D. VA-40 provides normal power to sensor cabinet D and backup power to cabinet A.Power sources VA-20 and VA-30 and sensor cabinets B and C are similarly arranged.If the normal or backup power source for an ESFAS Sensor Cabinet is lost, two sensorcabinets would be supplied from the same power source, but would still be operating with nosubsequent trip signals present. However, any additional failure associated with this powersource would result in the loss of the two sensor cabinets, consequently generating a false SPAS.The 48-hour ACTION Statement ensures that the probability of a ACTION Statement and anadditional failure of the remaining power source, while in this ACTION Statement is sufficientlysmall.MILLSTONE -UNIT 2 B 3/4 3-2 Amendment No. 4-5-7, 4-7-9, -226, 5,Acknowledged by NRC letter dated 6128105 LBDCR 09-MP2-013July 7, 2009BASES(Continued)3/4.3.3 MONITORING INSTRUMENTATION3/4.3.3.1 RADIATION MONITORING INSTRUMENTATIONThe OPERABILITY of the radiation monitoring channels ensures that 1) the radiationlevels are continually measured in the areas served by the individual channels and 2) the alarm orautomatic action is initiated when the radiation level trip setpoint is exceeded.The analyses for a Steam Generator Tube Rupture, Waste Gas System Failure, Cask Tipand Fuel Handling Accident credit the control room ventilation inlet duct radiation monitors withclosure of the Unit 2 control room isolation dampers. In the event of a single failure in eitherchannel (1 per train), the control room isolation dampers automatically close. The response timetest for the control room isolation dampers includes signal generation time and damper closure.The response time for the control room isolation dampers is maintained within the applicablefacility surveillance procedure.The containment airborne radiation monitors (gaseous and particulate) provide earlyindication of leakage from the Reactor Coolant System as specified in Technical Specification3.4.6.1.MILLSTONE -UNIT 2B 3/4 3-2aAmendment No. 4-5-7-, 4-7-9, -2~--, 30, 2-28-, 284, LBDCR 14-MP2-016September 4, 2014REACTOR COOLANT SYSTEMBASES3/4.4.3 RELIEF VALVES (Continued)discovered to be inoperable, or if both block valves are discovered to be inoperable at the sametime. In the event of a loss of feedwater, the PORVs would be used to remove core heat. In orderto minimize the consequences of a loss of feedwater while two block valves are inoperable,Required Action e. 1 requires that LCO 3.7.1.2, "Auxiliary Feedwater Pumps," be verified to bemet within 1 hour. The inoperability of two block valves during the 8 hour allowed outage timehas been shown to be acceptable based on the infrequent use of the Required Actions and thesmall incremental effect on plant risk (Ref. 1).SURVEILLANCE REQUIREMENT 4.4.3.1 .C requires operating each PORV through onecomplete cycle of full travel at conditions representative of MODES 3 or 4. This is nonnallyperfonned in MODE 3 or 4 as the unit is descending in power to commence a refueling outage.This test will normally be a static test, whereby a P0RV will be exposed to MODE 3 or 4temperatures, the block valve closed, and the PORV tested to verifyr it strokes through onecomplete cycle of full travel. PORV cycling demonstrates its function. SURVEILLANCEREQUIREMENT 4.4.3.1 .C is consistent with the NRC staff position outlined in Generic Letter90-06, which requires that the PORV stroke test be performed at conditions representative ofMODE 3 or 4. The surveillance frequency is controlled under the Surveillance Frequency ControlProgram. Testing in the manner described is also consistent with the guidance in NI-REG 1482,"Guidelines for Inservice Testing at Nuclear Power Plants," Section 4.2.10, that describes thePORVs function during reactor startup and shutdown to protect the reactor vessel and coolantsystem from low-temperature overpressurization conditions, and indicates they should beexercised before system conditions warrant vessel protection. If post maintenance retest iswarranted, the affected valve(s) will be stroked under amabient conditions while in Mode 5, 6, ordefueled. A Hot Functional Test is required to be performed in MODE 4 prior to entry intoMODE 3. The actual stroke time in the open? and close direction will be measured, recorded andcompared to the test results obtained during pre-installation testing to assess acceptability of theaffected valve(s).SURVEILLANCE REQUIREMENT 4.4.3.2 verifies that a block valve(s) can be closed ifnecessary. This SURVEILLANCE REQUIREMENT is not required to be performed with theblock valve(s) closed in accordance with the ACTIONS of TS 3.4.3. Opening the block valve(s)in this condition increases the risk of an unisolable leak from the RCS since the PORV(s) isalready inoperable.REFERENCE1. WCAP-16 125-NP-A, "Justification for Risk-Infonned Modifications to Selected TechnicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2 B 3/4 4-2b Amendment No. 2a2, 3-7-, 5, 66, 8-,444,1---2-1-, 4-3g, 94 LBDCR 14-MVP2-001May 20, 2014REACTOR COOLANT SYSTEMBASES3/4.4.4 PRESSURIZERAn OPERABLE pressurizer provides pressure control for the reactor coolant systemduring operations with both forced reactor coolant flow and with natural circulation flow. Theminimum water level in the pressurizer assures the pressurizer heaters, which are required toachieve and maintain pressure control, remain covered with water to prevent failure, which occurs*if the heaters are energized uncovered. The maximum water level in the pressurizer ensures thatthis parameter is maintained within the envelope of operation assumed in the safety analysis. Themaxfimum water level also ensures that the RCS is not a hydraulically solid system and that asteam bubble will be provided to accommodate pressure surges during operation. The steambubble also protects the pressurizer code safety valves and power operated relief valve againstwater relief. With pressurizer water level not within the limit, action must be taken to restore theplant to operation within the bounds of the safety analyses. To achieve this status, the unit must bebrought to at least HOT STANDBY with the reactor trip breakers open within 6 hours and inHOT SHUTDOWN within the following 6 hours. This takes the plant out of the applicableMODES and restores the plant to operation within the bounds of the safety analyses. Therequirement that a minimum number of pressurizer heaters be OPERABLE enhances thecapability of the plant to control Reactor Coolant System pressure and establish and maintainnatural circulation.If two required groups of pressurizer heaters are inoperable, restoring at least one group ofpressurizer heaters to OPERABLE status is required within 24 hours. The Condition is modifiedby a Note stating it is not applicable if the second group of required pressurized heaters isintentionally declared inoperable. The Condition is not intended for voluntary removal ofredundant systems or components from service. The Condition is only applicable if one group ofrequired pressurized heaters is inoperable for any reason and the second group of requiredpressurized heaters is discovered to be inoperable, or if both groups of required pressurizedheaters are discovered to be inoperable at the same time. If both required groups of pressurizerheaters are inoperable, the pressurizer heaters may not be available td help maintain subcooling inthe RCS loops during a natural circulation cooldown following a loss of offsite power. Theinoperability of two groups of required pressurizer heaters during the 24 hour allowed outage timehas been shown to be acceptable based on the infrequent use of the Required Action and the smallincremental effect on plant risk (Ref. 1).The requirement for two groups of pressurizer heaters, each having a capacity of 130 kW,is met by verifying the capacity of the pressurizer proporlional heater groups 1 and 2. Since thepressurizer proportional heater groups 1 and 2 are supplied from the emergency 480V electricalbuses, there is reasonable assurance that these heaters can be energized during a loss of off'sitepower to maintain natural circulation at HOT STANDBY.REFERENCE1. WCAP- 161 25-NP-A, "Justification for Risk-Infonrmed Modifications to Selected TechnicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2 B3442 mnmn oB 3/4 4-2cAmendment No. I NSTRUMENTAT IONJuly 13, 1g99BASES3/4.3.3.2 -DELETED3/4.3.3.3 -DELETED3/4.3.3.4 -DELETED3/4.3,3.5 REMOTE SHUTDOWN INSTRUMENTATIONThe OPERABILITY of the remote shutdown instrumentation ensures thatsufficient -capability is available to permit shutdown and maintenance of HOTSHUTDOWN of the facility from locations outside of the control room. Thiscapability is required in the event control room habitability is lost and isconsistent with General Design Criteria 19 of 10 CFR 50.MILLSTONE -UNIT 2e 3/4 3-3MILLTON -NIT2 B3/43-3Amendment N~o XF, 237 November 3, 1995INSTRUMENTATI ONBASES3/4.3.3.6 DELETED3_/4.3.3.7 DELETED3L/4.3.3,8 Accident Monitoring InstrumentationThe OPERABILITY of the accident monitoring instrumentation ensures thatsufficient information is available on selected plant parameters to monitor andassess these variables during and following an accident. This capability isconsistent with the recommnendations of NUREG-0578, "TMI-2 Lessons LearnedTask Force Status Report and Short-Term Reconvnendations".0:IMILLSTONE -UNIT 201 .B 3/4 3-4191 November 28, 2000THIS PAGE INTENTIONALLY LEFT BLANKOMILLSTONE -UNIT 2B 3/4 3-5MILLTON -N~t2 B3/43-5Amendment No. 4-04, 5, 250 LBDCR 04-MP2-0 11December 8, 2005INSTRUMENTATIONBASES3/4.3.3.9 -DELETED3/4.3.3.10 -DELETED3/4.3.4 -DELETEDMILLSTONE- UNIT 2B 3/4 3-6MILSTOE -UXIT B /4 -6Amendment No. 4-04, 24-5, 5, 84, May 1, 20023/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATIONThe plant is designed to operate with both Reactor Coolant System (RCS) loops andassociated reactor coolant pumps (RCPs) in operation, and maintain the DNBR above the 95/95limit for the DN-B correlation during all normal operations and anticipated transients. In MODES1 and 2, both RCS loops and associated RCPs are required to be OPERABLE and in operation.In MODE 3 , a single RCS loop with one RCP and adequate steam generator secondarywater inventory provides sufficient heat removal capability. However, both RCS loops with atleast one RCP per loop are required to be OPERABLE to provide redundant paths for decay heatremoval. In addition, as a minimum, one RCS loop must be in operation. Any exceptions to theserequirements are contained in the LCO Notes.In MODE 4, one RCS loop with onae RCP and adequate steam generator secondary waterinventory, or one shutdown cooling. (SDC) train provides sufficient heat removal capability.However, two loops or trains, consisting of any combination of RCS loops or SDC trains, arerequired to be OPERABLE to provide redundant paths for decay heat removal. In addition, as aminimum, one RCS loop or SDC train must be in operation. Any exceptions to these requirementsare contained in the LCO Notes.In MODES 3 and 4 , an OPERABLE RCS loop consists of the RCS loop, associatedsteam generator, and at least one RCP. The steam generator must have sufficient secondary waterinventory for heat removal.In MODE 5, with the RCS loops filled, the SDC trains are the primary means of heatremoval. One SDC train provides sufficient heat removal capability. However, to provideredundantpaths for decay heat removal either two SDC trains are required to be OPERABLE, orone SDC train is required to be OPERABLE and both steam generators are reqtiired to haveadequate steam generator secondary water inventory. In addition, as a minimum, one SDC trainmust be in operation. Any exceptions to these requirements are contained in the LCO Notes.By maintaining adequate secondary water inventory and makeup capability, the steamgenerators will be able to support natural circulation in the RCS loops. In addition, the ability topressurize and control RCS pressure is necessary to support RCS natural circulation. If thepressurizer steam bubble has been collapsed and the RCS has been depressurized or drainedsufficiently that voiding of the steam generator U-tubes may have occurred, the RCS loops shouldbe considered not filled unless ana evaluation is performed to verify the ability of the RCS tosuppornt natural circulation. If the RCS loops are considered not filled, the RCS must be refilled,pressurized, and the RCPs bumped (unless a vacuum fill of the RCS was performed) before theRCS loops can be considered filled.In MODE 5, with the RCS loops not filled, the SDC trains are the only means of heatremoval. One SDC train provides sufficient heat removal capability. However, to provideredundant paths for decay heat removal, two SDC trains are required to be OPERABLE. Inaddition, as a mininmumn, one SDCMILLSTONE -UNIT 2 B 3/4 4-1 Revised by NRC Letter A15689Amendment No. &O, 6-6, 69, 9, 24--I8,2n19, LBDCR 15-MP2-003March 26, 20153/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued')train must be in operation. Any exceptions to these requirements are contained in the LCO Notes.An OPERABLE SDC train, for plant operation in MODES 4 and 5, includes a pump, heatexchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path and todetermine RCS temperature. The flow path starts at the RCS hot leg and is returned to the RCScold legs.In MODE 4, an OPERABLE SDC train consists of the following equipment:1. An OPERABLE SDC pump (low pressure safety injection pump);2. The associated SDC heat exchanger from the same facility as the SDC pump;3. The associated reactor building closed cooling water loop from the same facility asthe SDC pump;4. The associated service water loop from the same facility as the SDC pump; and5. All valves required to support SDC System operation are in the required positionor are capable of being placed in the required position.In MODE 4, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchangers,2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headersand 2 SW headers are required to support the SDC heat exchangers, consistent wvith therequirements of Technical Specifications 3.7.3.1 and 3.7.4.1.In MODE 5, an OPERABLE SDC ti-ain consists of the following equipment:1. An OPERABLE SDC pump (low pi'essure safety injection pump);2. The associated SDC heat exchanger fr'om the same facility as the SDC pump;3. An: RBCCW pump, powered from the same facility as the SDC pump, andRBCCW heat exchanger capable of cooling the associated SDC heat exchanger;4. A SW pump, powered from the same facility as the SDC pump, capable ofsupplying cooling water to the associated RBCCW heat exchanger; and5. All valves required to support SDC System operation are in the required positionor are capable of being placed in the required positionMILLSTONE -UNIT 2 B 3/4 4-la Rovisod. ,by1:rr NR Lot. ^tcrM5GSAmendment No. 5-0, 66, 69-9, 4--, 2-i-s, LBDCR 06-MP2-030September 14, 20063/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued)In MODE 5, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchangers,2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCWheaders are required to provide cooling to the SDC heat exchangers, but only 1 SW header isrequired to support the SDC trains. The equipment specified is sufficient to address a singleactive failure of the SDC System and associated support systems.In addition, twvo SDC trains can be considered OPERABLE, with only one 125-volt D.C.bus train OPERABLE, in accordance with Limiting Condition for Operation (LCO) 3.8.2.4. 2-SI-306 and 2-SI-657 are b~oth p.ow..r~ed:. from.the~same 125.-volt D.C. bus, on Facility I. Should.these.~e~ikndr~&i w~P~oidnkneb lge to c o ol thf RCS:.-:ttowever~a ldesignated': operator.isqas~signed~ toTeposi~ti~orrth~e al~e as ness'ary in thd: &v~rit*125-volt D.C. power is lost. Consistent with the bases for LCO 3.8.2.4, the 125-volt D.C. supportsystem operability requirements for both trains of SDC are satisfied in MODE 5 with at least one125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied.The operation of one Reactor Coolant Pump or one shutdown cooling pump providesadequate..flow t stratificati~on _anproduce~graduat reacti~v4iy changes.....during boron concentration reductions in the Reactor Coolant System. The reactivity change rateassociated with boron reductions will, therefore, be within the capability of operator recognitionand control. :The restrictions on starting a Reactor Coolant Pump in MODE 4 with one or more RCScold legs < 275°F and in MODE 5 are provided to prevent RCS pressure transients, caused byenergy additions from the secondary system, which could exceed the limits of Appendix G to10 CFR Part 50. The RCS will be protected against overpressure transients and will not exceedthe limits of Appendix G by:1. Restricting pressuriz'er water volume to ensure sufficient steam volume is available toaccommodate the insurge;:2. Restricting pressurizer pressure to establish an initial pressure that will ensure systempressure does not exceed the limit; and3. Restricting primary-to secondary system delta-T to reduce the energy addition from thesecondary system.If these restrictions are met, the steam bubble in the pressurizer is sufficient to ensure theAppendix G limits will not be exceeded. No credit has been taken for PORV actuation to limitRCS pressure in the analysis of the energy addition transient.MILLSTONE -UNIT 2 B 3/4 4-lb Amendment No. -50, 66, 69, 41-39, 2---8, :28Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-030September 14, 20063/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued)The limitations on pressurizer water level, pressurizer pressure, and primary to secondary delta-T.are necessary to ensure the validity of the analysis of the energy addition due to starting an RCP.The values for pressurizer water level and pressure can be obtained from control roomindications. The. primary to secondary system delta-T can be obtained from Shutdown Cooling(SDC) System outlet temperature and the saturation temperature for indicated steam generatorpressure. If there is no indicated steam generator pressure, the steam generator shell temperatureindicators can be used. If these indications are not available, other appropriate instrumentationcan be used.Th~e ROP starting:gi--riiriavalu~s for pressui'izer water level; pressurizer-pressure, and primairy toadjusted for instrument uncertainty. The values for these parameters contained in the proceduresthat will be used to start an RCP have been adjusted to compensate for instrument uncertainty.The value of RCS cold leg temperature (_< 2750F ) used to determine if the RCP start criteriaapplies, will be obtained from SDC return temperature if SDC is in service. If SDC is not inservdc~e,_oranatural..cireculation~is.nccurrng, .RCS~cold ieg.temp eraturewiUlbenuse~cL .................Average Coolant Temperature (Tavg) values are derived under the following 3 plantconditions, using the designated formula as appropriate for use in Unit 2 operating procedures.* RCP Operation: (Tcold1 + Tcold2 + ThotI + Thot2) / 4 = TvNatural circulation only flow: (Tcodld + Tcold2 + Thotl + Thot2) / 4 =Tv*SDC flow greater than 1000 gpm: (SDCoutiet +/- SDC1inlt) / 2 =Tavg(exception: Tavg is not expected to be calculated by this definition during the initialportion of the initiation phase of SDC. The transition point from loop temperatureaverage to SDC system average during cooldowns is when T3 51 Y decreases belowLoop Tcold) ...During operation with one or more Reactor Coolant Pumps (RCPs) providing forced flowand during natural circulation conditions, the, loop Resistance Temperature Detectors (RTDs)represent the inlet and outlet temperatures of the reactor and hence the average temperature of thewater that the reactor is exposed to. This holds during concurrent RCP/SDC operation also.MILLSTONE -UNIT 2 B 3/4 4-1c Amendment No. 50, 66, 69, 4-3~9, l-, 248,249,Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-030September 14, 20063/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued)During Shutdown Cooling (SDC) only operation, there is no significant flow past the loo1pRTDs. Core inlet and outlet termperatures are accurately measured during those conditions byusing T351lY, SDC return to RCS temperature indication, and T351 X, RCS to SDC temperatureindication. The average of these two indicators provides a temperature that is equivalent to theaverage RCS temperature in the core.During the transition from Steam Generator (SG) and SDC heat removal to SDC only heatremoval, actual core average temperature results from a mixture of both SDC flow and loop flow"from T~his ,m.ch~e t!ime co~oling :is .in iti~ated.u~ntil!.$S.Gcalculatedck However, the .average o~f t~he ,stil;toappropriate, fo r use."Thi-s; .'provides a straightforward process for determining Tavg.During some transient conditions, such as heatups on SDC, the value calculated by thisaverage definition will be slightly higher than the actual core aiverage. During other transients,such as cooldowns where SG heat removal~is Still taking place causing some natural circulationconditions. For the purpose of determining MODE changes and technical specificationapplicability, these transient condition results are conservative.The Notes in LCOs 3.4.1.2, 3.4.1.3, 3.4.1.4, and 3.4.1.5 permit a limited period of operationwithout RCPs and shutdown cooling pumps. All RCPs and shuitdown cooling pumps may beremoved from operation for _< 1 hour per 8 hour period. This means thatnatural circulation hasbeen established. When in natural circulation,-a reduction in boron concentration with coolant atboron concentrations less than required to assure the SDM of LCO 3.1.1.1t is maintained isprohibited because an even concentration distribution throughout the RCS cannot be ensured.Core outlet temperature is to be maintained at least 10°F below the saturation temperature so thatno vapor bubble may form and possibly cause a natural circulation flow obstruction.Concerning TS 3.4.1.2, ACTION b.; 3.4.1.3, ACTION c.; 3.4.1.4, ACTION b.; and 3.4.1.5,ACTION b., if two required loops or trains are inoperable or a required loop or train is not inoperation except during conditions permitted by the note in the LCO section, all operationsinvolving introduction of coolant into the RCS with boron concentration less than requiredtomeet the minimum SDM of LCO 3.1.1.1 must be suspended and action to restore one RCS loop orSDC train to OPERABLE status and operation must be initiated. The required margin tocriticality must not be reduced in this type of operation. Suspending the introduction of coolantinto the RCS of coolant with boron concentration less than required to meet the minimum SDMo~fLCO 3.1. 1.1 is required to assure continued safe operation. With coolant added without forcedcirculation, unmixed coolant could be introduced to the core, however coolant added with boronMILLSTONE -UNIT 2 B 3/4 4-1d Amendment No. gO, 66, 69, 4-3-9, 8,248, 249, ,Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-030September 14, 20063/44SEACOSOLATSSEBASES3/4A. 1 COOLANT LOOPS AND COOLANT CIRCULATION (continued)concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.The immnediate completion time~s reflect the, importance of decay heat removal. The ACTION torestore must continue until one ioop or train is restored to operation.*Technical Specification 3.4.1.6 limits the number of reactor co~olant pumps that may be*operational during MODE 5. This will limit the pressure drop across the core when the pumps areoperated during low-temperature conditions. Controlling the pressure drop across the core. willmaintain maximum RCS pressure within the maximum allowable pressure as calculated in CodeCase.No.,,,N-I14. ..Limi~ting two rea~cto~r-..coo1!ptrp~!s. .Qpop..r~tatw~h~e.n.theiRC.S cold-..{.e.. "not exce~eded. .'.Surveillanee, 4,;#:4A 6-.supportw:this-requirement. ... .. ..3/4.4.2 SAFETY VALVESThe pressurizer code safety valves operate toprevent the RCS from being, pressurized.above its Safety Limit of 2750 psia. Each safety valve is designed to relieve 296,000 lbs per hourof saturated steam at the valve setpoint. The relief capapcty of a ingles.~fety valve is adequate to_relieve any overpressure condition which could occur during shutdown. If any pressurizer codesafety valve is inoperable, and cannot be restored to OPERABLE status, the ACTION statementrequires the plant to be shut down and cooled down such that Technical Specification 3.4.9.3 willbecome applicable and require the Low Temperature Overpressure Protection System to be placedin service to provide overpressure protectionMILLSTONE -UNIT 2B 3/4 4-1eAmendment No. 93-,Acknowledged By NRC July 5, 2007 LBDCR 04-MP2-016February 24, 20053/4.4 REACTOR COOLANT SYSTEMBASESDuring operation, all pressurizer code safety valves must be OPERABLE to prevent theRCS from being pressurized above its safety limit of 2750 psia. The combined relief capacity ofthese valves is sufficient to limit the Reactor Coolant System pressure to within its Safety Limit of2750 psia following a complete loss of turbine generator load while operating at RATEDTHIERMAL POWER and assuming no reactor trip until the first Reactor Protective System tripsetpoint (§Pressurizer Pressure-High) is reached (i.e., no credit is taken for a direct reactor trip onthe loss of turbine) and also assuming no operation of the pressurizer power operated relief valveor steam dumrp valves.3/4.4.3 RELIEF VALVESThe power operated relief valves (PORVs) operate to relieve RCS pressure below thesetting of the pressurizer code safety valves. These relief valves have remotely operated blockvalves to provide a positive shutoff capability should a relief valve become inoperable. Theelectrical power for both the relief valves and the block valves is capable of being supplied froman emergency power source to ensure the ability to seal this possible RCS leakage path.The PORVs are also used for low temperature overpressure protection when the RCS iscooled down to or below 2750F. This is covered by Technical Specification 3.4.9.3 and discussedin the respective Bases section. The discussion below only addresses the PORVs in MODES 1, 2and 3.With the PORV inoperable and capable of being manually cycled, either the PORV mustbe restored, or the flow path isolated within 1 hour. The block valve should be closed, but thepower must be maintained to the associated block valve, since removal of power would render theblock valve inoperable. Although the PORV mnay be designated inoperable, it may be able to bemanually opened and closed and in this manner can be used to perform its function. PORVinoperability may be due to seat leakage, instrumentation problems, aiutomatic control problems,or other causes that do not prevent manual use and do not create a possibility for a small breakLOCA. Operation of the plant may continue with the PORV in this inoperable condition for alimited period of time not to exceed the next refueling outage, so that maintenance can beperfolrmed on the PORVs to eliminate the degraded condition. The PORVs should normally beavailable for automatic mitigation of overpressure events when the plant is at power.Quick access to the PORV for pressure control can be made when power remaints on the closedblock valve.If one block valve is inoperable, then it must be restored to OPERABLE status, or the associatedPORV prevented from opening automatically. The prime irnportance for the capability tomaintain closed the block valve is to isolate a stuck open PORV. Therefore, if the block valvecannot be restored to OPERABLE status within 1 hour, the required ACTION is to prevent theassociated PORV from automatically opening for an overpressure event and to avoid the potentialfor a stuck open PORV at a time that the block valve is inoperable. This may be accomplished byMILLSTONE -UNIT 2 B 3/4 4-2 Amendment No. O, 46,469., 9, 2---8,Acknowledged by NRC letter dated 6128105 LBDCR 14-MP2-001May 20, 20143/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.3 RELIEF VALVES (Continued)various methods. These methods include, but are not limited to, placing the NORMVAL/ISOLATEswitch at the associated Bottle Up Panel in the "ISOLATE" position or pulling the control powerfuses for the associated PORV control circuit.Although the block valve may be designated inoperable, it may be able to be manually openedand closed and in this manner can be used to perform its function. B lock valve inoperability maybe due to seat leakage, instrumentation problems, or other causes that do not prevent manual useand do not create a possibility for a small break LOCA. This condition is only intended to permitoperation of the plant for a limited pei'iod of time. The block valve should normally be availableto allow PORV operation for automatic mitigation of overpressure events. The block valves mustbe returned to OPERABLE status prior to entering MODE 3 after a refueling outage.If two PORVs are inoperable and not capable of being manually cycled, it is necessary to isolatethe flow path by closing and removing the power to the associated block valves within 1 hour andto restore at least one PORV within 8 hours. The Condition is modified by a Note stating it is notapplicable if the second PORV train is intentionally declared inoperable. The Condition does notapply to voluntamy¢ removal of redundant systems or components from service. The Condition isapplicable if one PORV is inoperable for any reason and the second PORV is discovered to beinoperable, or if both PORVs are discovered to be inoperable at the same time.In the event of a loss of feedwater, the PORVs would be used to remove core heat. In order tominimize the consequences of a loss of feedwater while two PORVs are inoperable, RequiredAction c.3 requires that LCO 3.7.1.2, "Auxiliary Feedwater Pumps," be met to ensure AFEW isavailable. The inoperability of two PORVs during the 8 hour allowed outage time has been shownto be acceptable based on the infrequent use of the Required Action and the Small incrementaleffect on plant risk (Ref. 1). If one PORV is restored and one PORV remains inoperable, then theplant will be in Condition b. with the time clock started at the original declaration of having twoP ORVs inoperable.If two block valves are inoperable, it is necessary to .restore at least one block valve toOPERABLE status within 8 hours. The Condition is modified by a Note stating it is notapplicable if the second block valve is intentionally declared inoperable. The Condition does notapply to voluntary removal of redundant systems or components fr'Qm service. The Condition isonly applicable if one block valve is inoperable for any reason and the second block valve isMILLSTONE -UNIT 2 B 3/4 4-2a Amendment No. 2, 3-, 66, 9-7,I-8-, 2-l8, 2461-LBDCR 14-MP2-001May 20, 2014REACTOR COOLANT SYSTEMBASES.3/4.4.3 RELIEF VALVES (Continued)discovered to be inoperable, or if both block valves are discovered to be inoperable at the sametime. In the event of a loss of feedwater, the PORVs would be used to remove core heat. In orderto minimize th~e consequences of a loss of feedwater while two block valves are inoperable,Required Action e. 1 requires that LCO 3.7.1.2, "Auxilia1iy Feedwater Pumps," be verified to bemet within 1 hour. The inoperability of two block valves during the 8 hour allowed outage timehas been shown to be acceptable based on the infrequent use of the Required Actions and thesmall incremental effect on plant risk (Ref. 1).SURVEILLANCE REQUIREMENT 4.4.3.l.c requires operating each PQRV through onecomplete cycle of full travel at conditions representative of MODES 3 or 4. This is normnallyperformed in MODE 3 or 4 as the unit is descending in power to colmmence a refueling outage.This test will normally be a static test, whereby a PORV will be exposed to MODE 3 or 4temperatures, the block valve closed, and the PORV tested to verify it strokes through onecomplete cycle of full travel. PORV cycling demonstrates its function. The Frequency of18 months is based on a typical refueling cycle and industry accepted practice. SURVEILLANCEREQUIREMENT 4.4.3.1 .c is consistent with the NRC staff position outlined in Generic Letter90-06, which requires that the 18-month PORV stroke test be performed at conditionsrepresentative of MODE 3 or 4. Testing in the manner described is also consistent with theguidance in NUREG 1482, "Guidelines for Inservice Testing at Nuclear Power Plants," Section4.2.10, that describes the PORVs function during reactor startup and shutdown to protect thereactor vessel and coolant system from low-temperature overpressurization conditions, andindicates they should be exercised before system conditions warrant vessel protection. If postmaintenance retest is warranted, the affected valve(s) will be stroked under amabient conditionswhile in Mode 5, 6, or defueled. A Hot Functional Test is required to .be performed in MODE 4prior to entry into MODE 3. The actual stroke time in the open and close direction will bemeasured, recorded and compared to the test results obtained during pre-installation testing toassess acceptability of the affected valve(s).SURVEILLANCE REQUIREMENT 4.4.3.2 verifies that a block valve(s) can be closed ifnecessary. This SURVEILLANCE REQUIREMENT is not required to be perform~ed with theblock valve(s) closed in accordance with the ACTIONS of TS 3.4.3. Opening the block valve(s)in this condition increases the risk of an unisolable leak fr'om the RCS since the PORV(s) isalready inoperable.REFERENCE1. WCAP-16 125-NP-A, "Justification for Risk-Informed Modifications to Selected TechnicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -U/NIT 2 B 3/4 4-2b Amendment No. -22, .3-7, g-2, 66, 89,-14-1, -t2-1, 3-, -t94 LBDCR 14-MiP2-001Mlay 20, 2014REACTOR COOLANT SYSTEMBASES3/4.4.4 PRESSURIZERAn OPERABLE pressurizer provides pressure control for the reactor coolant systemduring operations with both forced reactor coolant flow and with natural circulation flow. Theminimum water level in the pressurizer assures the pressurizer heaters, which are required toachieve and maintain pressure control, remain covered with water to prevent failure, which occursif the heaters are energized uncovered. The maximum water level in the pressurizer ensures thatthis parameter is maintained within the envelope of operation assumed in the safety analysis. Themaximum water level also ensures that the RCS is not a hydraulically solid system and that asteam bubble will be provided to accommodate pressure surges during operation. The steambubble also protects the pressurizer code safety valves and power operated relief valve againstwater relief. With pressurizer water level not within the limit, action must be taken to restore theplant to operation within the bounds of the safety analyses. To achieve this status, the unit must bebrought to at least HOT STANDBY with the reactor trip breakers open within 6 hours and inHOT S1{UTDOWN within the following 6 hours. This takes the plant out of the applicableMODES and restores the plant to operation within the bounds of the safety analyses. Therequirement that a minimum number of pressurizer heaters be OPERABLE enhances thecapability of the plant to control Reactor Coolant System pressure and establish and maintainnatural circulation.If two required groups of pressurizer heaters are inoperable, restoring at least one group ofpressurizer heaters to OPERABLE status is required within 24 hours. The Condition is modifiedby a Note stating it is not applicable if the second grohp of requi-ed pressurized heaters isintentionally declared inoperable. The Condition is not intended for voluntary removal ofredundant systems or components from service. The Condition is only applicable if one group ofrequired pressurized heaters is inoperable for any reason and the second group of requiredpressurized heaters is discovered to be inoperable, or if both groups of required pressurizedheaters are discovered to be inoperable at the same time. If both required groups of pressurizerheaters are inoperable, the pressurizer heaters may not be available to help maintain subcooling inthe RCS loops during a natural circulation c ooldown following a loss of' offsite power. Theinoperability of two groups of required pressurizer heaters during the 24 hour" allowed outage timaehas been shown to be acceptable based on the infrequent use of the Required Action and the smallincremental effect on plant risk (Ref. 1).The requirement for two groups of pressurizer heaters, each having a capacity of 130 kW,is met by verifying the capacity of the pressurizer proportional heater groups 1 and 2. Since thepressurizer proportional heater groups 1 and 2 are supplied fr'om the emergency 480V electricalbuses, there is reasonable assurance that these heaters can be energized during a loss of offsitepower to maintain natural circulation at HOT STANDBY.REFERENCE1. WCAP-1 6125-NP-A, "Justification for Risk-Informed Modifications to Selected TechnicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2B /42AmnetNoB 3/4 4-2cAmendment No. LBDCR 14-MP2-001May 20, 2014REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITYLCOThe LCO requires that steam generator (SG) tube integrity be maintained. The LCO alsorequires that all SG tubes that satisfy the plugging criteria be plugged in accordance with theSteam Generator Program.During a SG inspection, any inspected tube that satisfies the Steam Generator Programplugging criteria is removed from service by plugging. If a tube was determined to satisfy theplugging criteria but was not plugged, the tube may still have tube integrity.In the context of this Specification, a SG tube is defined as the entire length of the tube,including the tube wall between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.A SG tube has tube integrity when it satisfies the SG performance criteria. The SGperformance criteria are defined in Specification 6.26, "Steam Generator Program," anddescribe acceptable SG tube performance. The Steam Generator Program also provides theevaluation process for determining conformance with the SG performance criteria. There arethree SG perfolniance criteria: structural integrity, accident induced leakage, and operationalLEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.The structural integrity performance criterion provides a mar'gin of safety against tubeburst or collapse under nonanal and accident conditions, and ensures structural integrity of the SGtubes under all anticipated transients included in the design specification. Tube burst is defined as,"The gross structural failure of the tube wall. The condition typically corresponds to an unstableopening displacement (e.g., opening area inc~reased in response to constant pressure) accompaniedby ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse isdefined as, "For the load displacement curve for a given structure, collapse occurs at the top of theload versus displacement curve where the slope of the curve becomes zero." The structuralintegrity performance criterion provides guidance onassessing loads that have a significant effecton burst or collapse. In that context, the term "significant" is defined as "An accident loadingcondition other than differential pressure is considered significant when the addition of such loadsin the assessment of the structural integrity performance criterion could cause a lower structurallimit or limiting burst/collapse condition to be established." For tube integrity evaluations, exceptfor circumnferential degradation, axial thermaal loads are classified as secondary loads. Forcircumferential degradation, the classification of axial thermal loads as primalmy or secondaryloads will be evaluated on a case-by-case basis. The division between primary and secondaryclassifications will be based on detailed analysis and/or testing.MILLSTONE -UNIT 2 B3442 mnmn oB 3/4 4-2dAmendment No. LBDCR 14-MVP2-001May 20, 2014REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)LCO (Continued)Structural integrity requires that the primary membrane stress intensity in a tube notexceed the yield strength for all ASME Code, Section III, Service Level A (normal operatingconditions) and Service Level B (upset or abnormaal conditions) transients included in the designspecification. This includes safety factors and applicable design basis loads based on ASMECode, Section III, Subsection NB (Reference 4) and Draft Regulatory Guide 1.121 (Reference 5).The accident induced leakage performance criterion ensures that the primary to secondaiy'LEAKAGE caused by a design basis accident, other than a SGTR, is within the accident analysisassumptions. The accident analysis assumes that accident induced leakage does not exceed 150GPD per SG. The accident induced leakage rate includes any primary to secondary LEAKAGEexisting prior to the accident in addition to primary to secondary LEAKAGE induced during theaccident.The operational LEAKAGE performance criterion provides an observable indication ofSG tube conditions during plant operation. The limit on operational LEAKAGE is contained inLCO 3.4.6.2, "Reactor Coolant System Operational LEAKAGE," and limits primary' to secondaryLEAKAGE through any one SG to 75 gallons per day. This limit is based on the assumption thata single crack leaking this amount would not propagate to a SGTR under the stress conditions of aLOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, thecracks are very small, and the above assumption is conservative.APPLICABILITYSteam generator tube integrity is challenged when the pressure differential across thetubes is large. Large differential pressures across SG tubes can only be experienced duringMODES 1, 2, 3, and 4.RCS conditions are far less challenging during MODES 5 and 6 than during MODES 1, 2,3, and 4. During MODES 5 and 6, primary to secondary differential pressure is low, resulting inlower stresses and reduced potential for LEAKAGE.ACTIONSThe ACTIONS are modified by a NOTE clarifying that the ACTIONS may be enteredindependently for each SG tube. This is acceptable because the ACTIONS provide appropriateconmpensatory actions for each affected SG tube. Complying with the ACTIONS may allow forcontinued operation, and subsequent affected SG tubes are governed by subsequent ACTIONentry and application of associated ACTIONS.MILLSTONE -UNIT 2B 3/4 4-2eAmendment No. LBDCR 14-MP2-001May 20, 2014REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)ACTIONS (Continued)a.1 and a.2ACTION a. applies if it is discovered that one or more SG tubes examined in an inserviceinspection satisfy the tube plugging criteria but were not plugged in accordance with the SteamGenerator Program as required by TS 4.4.5.2. An evaluation of SG tube integrity of the affectedtube(s) must be made. Steam generator tube integrity is based on meeting the SG perfonmancecriteria described in the Steam Generator Progr'am. The SG plugging criteria define limits on SGtube degradation that allow for flaw growth between inspections while still providing assurancethat the SG performance criteria will continue to be met. In order to determine if a SG tube thatshould have been plugged has tube integrity, an evaluation must be completed that demonstratesthat the SG performance criteria will continue to be met until the next refueling outage or SG tubeinspection. The tube integrity determination is based on the estimated condition of the tube at thethne the situation is discovered and the estimated growth of the degradation prior to the next SGtube inspection. If it is determined that tube integrity is not being maintained, ACTION b. applies.A Completion Time of 7 days is sufficient to complete the evaluation while minimizingthe risk of plant operation with a SG tube that may not have tube integrity.If the evaluation determines that the affected tube(s) have tube integrity, ACTION a.2allows plant operation to continue until the next refueling outage or SG inspection provided theinspection intearval continues to be supported by an operational assessment that reflects theaffected tube(s). However, the affected tube(s) must be plugged prior to entering HOTSHUTDOWN following the next refueling outage or SG inspection. This Completion Time is,acceptable since operation until the next inspection is supported by the operational assessment.b.1 and b.2If the ACTIONS and associated Completion Times of ACTION a. are not met or if SGtube integrity is not being maintained, the reactor must be brought to HOT STANDBY within6 hours and COLD SHUTDOWN within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reachthe desired plant conditions from full power conditions in an orderly manner and withoutchallenging plant systems.MIILLSTOKE -UITh2 B/4 mnmn oB 3/4 4-2f LBDCR 14-MIP2-001May 20, 2014REACTOR. COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)SURVEILLANCE REQUIREMENTSTS 4.4.5.1During shutdown periods the SGs are inspected as required by this SR and the SteamGenerator Program. NEI 97-06, Steam Generator Progr'am Guidelines (Ref. 1), and its referencedEPRI Guidelines, establish the content of the Steam Generator Program. Use of the SteamGenerator Program ensures that the inspection is appropriate and consistent with acceptedindustry practices.During S G inspections a condition monitoring assessment of the S G tubes is performed.The condition monitoring assessment determines the "as found" condition of the SG tubes. Thepurpose of the. condition monitoring assessment is to ensure that the SG performance criteria havebeen met for the previous operating period.The Steam Generator Program determnines the scope of the inspection and the methodsused to determine whether the tubes contain flaws satisfying the tube plugging criteria. Inspectionscope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a fuanction ofexisting and potential degradation locations. The Steam Generator Program also specifies theinspection methods to be used to find potential degradation. Inspection methods are a function ofdegradation morphology, non-destructive examination (NDE) technique capabilities, andinspection locations.The Steam Generator Program defines the Frequency of TS 4.4.5.1. The Frequency isdetermined by the operational assessment and other limits in the SG examination guidelines(Reference 6). The Steam Generator Program uses infonnation on existing degradations andgrowth rates to determine an inspection Frequency that provides reasonable assurance that thetubing will meet the SG performance criteria at the next scheduled inspection. In addition,Specification 6.26 contains prescriptive requirements concerning inspection intervals to provide.added assurance that the SG performance criteria will be met between scheduled inspections. Ifcrack indications are found in any SG tube, the maximum inspection interval for all affectedand potentially affected SGs is restricted by Specification 6.26 until subsequent inspectionssupport extending the inspection interval.Tx/ArT T VTC'NTTP _ T ThTTT ) D1 "21A AO,-r A nnchln~pij 1'J 0 O ~IIJ. -- J.£ .L LBDCR 14-MiP2.-001May 20, 2014REACTOR COOLANT SYSTEMBASES314.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)SURVEILLANCE REQUIREMENTS (Continued)TS 4.4.5.2During a SG inspection, any inspected tube that satisfies the Steam Generator Programplugging criteria is removed fr'om service by plugging. The tube plugging criteria delineated inSpecification 6.26 are intended to ensure that tubes accepted for continued service satisfy the SGperfonnmace criteria with allowance for error in the flaw size measurement and for future flawgrowth. In additioni, the tube plugging criteria, in conjunction with other elements of the SteamGenerator Program, ensure that the SG performance criteria will continue to be met until the nextinspection of the subject tube(s). Reference 1 provides guidance for performing operationalassessments to verify that the tubes remaining in service will continue to meet the SGperformance criteria.The Frequency of prior to entering MODE 4 following a SG inspection ensures that theSurveillance has been completed and all tubes meeting the plugging criteria are plugged prior tosubjecting the SG tubes to significant primary to secondary pressure differential.BACKGROUNDSG tubes are small diameter, thin walled tubes that carry primary coolantt thr-ough theprimary to secondary heat exchangers. The SG tubes have a number of imnportant safety functions.SG tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, arerelied on to maintain the primary system's pressure and inventory. The SG tubes isolate theradioactive fission products in the primary coolant from the secondary system. In addition, as partof the RCPB, the SG tubes are unique in that they act as the heat transfer surface between theprimnaly and secondary systems to remove heat from the system. Thtis Specificationaddresses only the RCPB integrity function of the SG. The SG heat removal function is addressedby LCO. 3.4.1.1, "RCS STARTUP AND POWER OPERATION," LCO 3.4.1.2, "RCS HOTSTANDBY," LCO 3.4.1.3, "RCS HOT SHUTDOWN," and LCO 3.4.1.4, "RCS COLDSHUTDOWN-LOOPS FILLED."SG tube integrity means that the tubes are capable of performing their intended RCPBsafety function consistent with the licensing basis, including applicable regulatory requirements.SG tubing is subject to a variety of degradation mechanisms. Steam generator tubes mayexperience tube degradation related to corrosion phenomena, such as wastage, pitting,intergranular attack, and stress corrosion cracking, along with other mechanically inducedphenomena such as denting and wear. These degradation mechanisms can impair tube integrity ifthey are not managed effectively. The SG performance criteria are used to manage SG tubedegradation.MILLSTONE -UNIT 2 B3442 mnmn oB 3/4 4-2hAmendment No. LBDCR 14-MP2-001May 20, 2014REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GEN~ERATOR TUBE INTIEGRITY (Continued)BACKGROUND (Continued)Specification 6.26, "Steam Generator (SG) Program," requires that a program beestablished and implemented to ensure that SG tube integrity is maintained. Pursuant toSpecification 6.26, tube integrity is maintained when the SG performance criteria are met. Thereare three SG performance criteria: structural integrity, accident induced leakage, and operationalLEAKAGE. The SG performance criteria are described in Specification 6.26. Meeting the SGperformance criteria provides reasonable assurance of maintaining tube integrity at normal andaccident conditions.The processes used to meet the SG performance criteria are defined by the SteamGenerator Program Guidelines (Reference 1).APPLICABLE SAFETY ANALYSESThe steam generator tube rupture (SGTR) accident is the limiting design basis event forSG tubes and avoiding an SGTR is the basis for this Specification. The analysis of a SGTR eventassumes a bounding primary to secondary LEAKAGE rate equal to the operational LEAKAGErate limits in LCO 3.4.6.2, "'RCS Operational LEAKAGE," plus the leakage rate associated witha double-ended rupture of a single tube. The accident analysis for a SGTR assumies thecontaminated secondary fluid is released to the atmosphere via safety valves or atmospheric dumpvalves.The analysis for design basis accidents and transients other than a SGTR assume the SGtubes retain their structural integrity (i.e., they are assumed not to rupture). In these analyses, thesteam discharge to the atmosphere is based on the total primary to secondary LEAKAGE fromany one SG of 150 gpd or from all SGs of 300 gpd as a result of accident induced conditions. Foraccidents that do not involve fuel damage, the primamy coolant activity level of DOSEEQUIVALENT 1-131 is assumed to be equal to the LCO 3.4.8, "RCS Specific Activity" limits.For accidents that assume fuel damage, the primary coolant activity is a function of the amount ofactivity released from the damaged fuel. The dose consequences of these events are within thelimits of GDC 19 (Reference 2), 10 CFR 50.67 (Reference 3) or the NRC approved licensingbasis (e.g., a small fraction of these limits).Steam Generator tube integrity satisfies Criterion 2 of 10 CER 50.36(c)(2)(ii).MILLSTONE -UNIT 2B3442AmnetNoB 3/4 4-2iAmendment No. LBDCR 14-.MP2-01lMay 20, 2014REACTOR COOLANT SYSTEMBASES3/14.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)REFERENCES1. NEI 97-06, "Steam Generator Program Guidelines."2. 10 CFR 50 Appendix A, GDC 19.3. 10 CER 50.67.4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.5. Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam Generator Tubes,"August 1976.6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines."MILLSTONE -UNIT 2B3/42AmnetNoB 3/4 4-2jAmendment No. August 08, 200707-MP2-0 12REACTOR COOLANT SYSTEMIBASES3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.1 LEAKCAGE DETECTION SYSTEMSThe RCS leakage detection systems requir~ed by this specification are provided to monitorand detect leakage fr~om the Reactor Coolant Pressure Boundary. These detection systems areconsistent with the recommendations of Regulatory Guide 1.45, "Reactor Coolant PressureBoundaiyz Leakage Detection Systems."Action c provides a 72 hour allowed outage time (AOT) when both the containment atmosphereparticulate radioactivity mnonitoring channels are inoperable and containment sump levelmonitoring system is inoperable. The 72 hour AOT is appropriate since additional actions will betaken during this limited time period to ensure RCS leakage, in excess of the unidentified leakageTS limit of 1 gpm (TS 3.4.6.2), will be readily detectable. This will provide reasonable assurancethat any significant reactor coolant pressure boundaiy* degradation is detected soon afteroccurrence to minimize the potential for propagation to a gross failure. This is consistent with therequirements of General Design Criteria (GDC) 30 and also Criterion 1 of 10 CFR 50.36(d)(2)(ii)which requires installed instrumentation to detect, and indicate in the control room, a significantabnormal degradation of the reactor coolant pressure boundary. The RCS water inventorybalance calculation determines the magnitude of RCS unidentified leakage by use of0instrumentation readily available to the control room operators.. However, the proposedadditional actions will not restore the continuous monitoring capability nonnally provided by theinoperable equipment.The RCS water inventory balance is capable of identifying a one gpmnRCS leak rate. Thecontainment grab samples will also indicate an increase in RCS leak rate which would then bequantified by the RCS water inventory balance. Since these additional actions are sufficient toensure RCS leakage is within TS limits, it is appropr'iate to provide a limited time period to restoreat least one of the TS-required leakage monitoring systems.MILLSTONE -UNIT 2 B 3/4 4-3 Amendment No. t, 38,-22-8, August 08, 200707-MP2-0 12REACTOR COOLANT SYSTEMBASES3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGELCORCS operational LEAKAGE shall be limited to:a PRESSURE BOUNDARY LEAKAGENo PRESSURE BOUNDARY LEAKAGE is allowed, being indicative of materialdeterioration. LEAKAGE of this type is unacceptable as the leak itself could cause furtherdeterioration, resulting in higher LEAKAGE. Violation of this LCO could result incontinued degradation of the RCPB. LEAKAGE past seals and gaskets is notPRESSUREBOUNDARY LEAKAGE.b UNIDENTIFIED LEAKAGEOne gallon per minute (gpm) of UNIDENTIFIED LEAKAGE is allowed as a reasonableminimum detectable amount that the containment air monitoring and containment sumplevel monitoring equipment can detect within a reasonable time period. Violation of thisLCO could result in continued degradation of the RCPB, if the LEAKAGE is from thepressure boundary.c Primary to Secondary_ LEAKAGE through-Any-One Steam GeneratorThe limit of 75 gallons per day per Steam Generator (SG) is based on the operationalLEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines(Reference 4) and the accident analysis described in the FSAR (Reference 3). The SteamGenerator Program operational LEAKAGE performance criterion in NEI 97-06 states,"The RCS operational primary to secondary leakage through any one SG shall be limitedto 150 gallons per day." The limit is based on operating experience with SG tubedegradation mechanisms that result in tube leakage. The operational leakage rate criterionin conjunction with the implementation of the Steam Generator Program is an effectivemeasure for minimizing the frequency of steam generator tube ruptures. The main steamline break (MSLB) accident analysis assumes a primary to secondary leakage of 150gallons per day per 8G.MILLSTONE -UNIT 2 B3443 mnmn oB 3/4 4-3aAmendment No. LBDCR 09-MP2-004May 28, 2009 .::.REACTOR. COOLANT SYSTEMBASES3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGELCO (Continued)d IDENTIFIED LEAKAGEUp to 10 gpm of IDENTIFIED LEAKAGE is considered allowable because LEAKAGEis from known sources that do not interfere with detection of UNIDENTIFIEDLEAKAGE and is well within the capability of the RCS makeup system. IDENTIFIEDLEAKAGE includes LEAKAGE to the containment from specifically known and locatedsources, but does not include PRESSURE BOUNDARY LEAKAGE or CONTROLLEDLEAKAGE. Violation of this LCO could result in continued degradation of a componentor system.The IDENTIFIED LEAKAGE and UNIDENTIFIED LEAKAGE limits listed in LCO 3.4.6.2only apply to the RCPB within the containment. Leakage outside of the second isolation valve forcontainment,, which is included in the RCS Leak Rate Calculation, is not considered RCSLEAKAGE and can be subtracted from RCS UNIDENTIFIED LEAKAGE. The definitions forIDENTIFIED LEAKAGE and UNIDENTIFIED LEAKAGE are provided in the technical .specifications definitions section, Definition 1.14.APPLICABILITY -...In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS ispressurized.'In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is farlower, resulting in lower stresses and reduced potentials for LEAKAGE.ACTIONSa UNIDENTIFIED LEAKAGE or IDENTIFIED LEAKAGE in excess of the LCO limitsmust be reduced to within limits within 4 hours. This Completion Time allows time toverify leakage rates and either identify UNIDENTIFIED LEAKAGE or reduceLEAKAGE to within limits before the reactor must be shut down. This action is necessaryto prevent further deterioration of the RCPB.MILLSTONE -UNIT 2 B 3/4 4-3b Amendment No. ,l Auagust 08, 200707-MP2-0 12REACTOR COOLANT SYSTEMBASES3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGEACTIONS (Continued)b If any PRESSURE BOUNDARY LEAKAGE exists, or primary to secondary LEAKAGEis not within limits, or if UNIDENTIFIED or IDENTIFIED LEAKAGE cannot bereduced to within limits within 4 hours, the reactor must be brought to lower pressureconditions to reduce the severity of the LEAKAGE and its potential consequences. Itshould be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARYLEAKAGE. The reactor must be brought to HOT STANDBY within 6 hours and COLDSHUTDOWN within 36 hours. This action reduces the LEAKAGE and also reduces thefactors that tend to degrade the pressure boundary.The allowed Completion Times are reasonable, based on operating experience, to reachthe required plant conditions from full power conditions in an orderly manner and withoutchallenging plant systems. In COLD SHUTDOWN, the pressure stresses acting on thereactor coolant pressure boundary are much lower, and further deterioration is much lesslikely.SURVEILLANCE REQUIREMENTS4.4.6.2.1Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the RCPB ismaintained. PRESSURE BOUNDARY LEAKAGE would at first .appear as UNIDENTIFIEDLEAKAGE and can only be positively identified by inspection. UNIDENTIFIED LEAKAGEand IDENTIFIED LEAKAGE are determined by performance of an RCS water inventorybalance.The RCS water inventory balance must be performed with the reactor at steady state operatingconditions (stable temperature, power level, pressurizer and makeup tank levels, makeup andletdown, and RCP seal leakoff flows). The Surveillance is modified by two Notes. Note 1 statesthat this SR is not required to be performed until 12 hours after establishing steady stateOperation. The 12 hour allowance provides sufficient time to collect and process all necessarydata after stable plant conditions are established.MILLSTONE -UNIT 2 B3443 mnmn oB 3/4 4-3cAmendment No. August 08, 200707-MP2-0 12REACTOR COOLANT SYSTEMBASES03/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGESURVEILLANCE REOUIREMENTS (Continued)Steady state operation is required to perform a proper water inventory balance since calculationsduring maneuvering are not useful. For RCS operational LEAKAGE determination by waterinventory balance, steady state is defined as stable RCS pressure, temperature, power level,pressurizer and makeup tank levels, makeup and letdown, and RCP seal leakoff flows.An early warning of PRESSURE BOUNDARY LEAKAGE or UNIDENTIFIED LEAKAGE isprovided by the automatic systems that monitor the containment atmosphere radioactivity and thecontainment sump level. These leakage detection systems are specified inl LCO 3.4.6.1, "LeakageDetection Systems."Note 2 states that this SR is not applicable to primary to secondary LEAKAGE becauseLEAKAGE of 75 gallons per day cannot be measured accurately by an RCS water inventorybalance.The 72 hour Frequency is a reasonable interval to trend LEAKAGE and recognizes theimportance of early leakage detection in the prevention of accidents.4.4.6.2.2/This SR verifies that primary to secondary LEAKAGE is less than or equal to 75 gallons per daythrough any one SG. Satisfying the primary to secondary LEAKAGE limit ensures that theoperational LEAKAGE performance criterion in the Steam Generator Program is met. If this SRis not met, compliance with LCO* 3.4.5, "Steam Generator Tube Integrity," should be evaluated.*The 75 gallons per day limit is measured at room temperature as described in Reference 5. TheOperational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practicalto assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should beconservatively assumed to be from one SG.The Surveillance is modified by a Note which states that the Surveillance is not required to beperformed until 12 hours after establishment of steady state operation. For RCS primary tosecondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature,power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal leakoffflows.MILLSTONE -UNIT 2 B 3/4 4-3d Amendment No. LBDCR 14-MP2-016September 4, 2014REACTOR COOLANT SYSTEMBASES3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGESUIRVEILLANCE REOUIREMENTS (Continued)The frequency specified in the Surveillance Frequency Control Program is a reasonable intervalto trend primary to secondary LEAKAGE and recognizes the importance of early leakagedetection in the prevention of accidents. The primary to secondary LEAKAGE is determinedusing continuous process radiation monitors or radiochemical grab sampling in accordance withthe EPR[ guidelines (Reference 5).BACKGROUNhDComponents that contain or transport the coolant to or from the reactor core make up the reactorcoolant system (RCS). Component joints are made by welding, bolting, rolling, or pressureloading, and valves isolate connecting systems from the RCS.During plant life, the joint and valve interfaces can produce varying amounts of reactor coolantLEAKAGE, through either nonnal operational wear or mechanical deterioration. The purpose ofthe RCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGEfrom these sources to amounts that do not compromise safety. This LCO specifies the types andamounts of LEAKAGE.10 CFR 50, Appendix A, GDC 30 (Reference 1), requires mneans for detecting and, to the extentpractical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Reference2) describes acceptable methods for selecting leakage detection systems.The safety significance of RCS LEAKAGE varies widely depending on its source, rate, andduration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containmentarea is necessary. Quickly separating the IDENTIFIED LEAKAGE from the UNIIDENTIFIEDLEAKAGE is necessary to provide quantitative information to the. operators, allowing them totake colTective action should a leak occur detrimental to the safety of the facility and the public.A limited amount of leakage inside containment is expected from auxiliary systems that cannot bemade 100% leaktight. Leakage fronl these systems should be detected, located, and isolated from~.the containment atmosphere, if possible, to not interfere with RCS LEAKAGE detection.This LCO deals with protection of the reactor coolant pressure boundary (RCPB) fromdegradation and the core from inadequate cooling, in addition to preventing the accident analysisradiation release assumptions from being exceeded. The consequences of violating this LCOinclude the possibility of a loss of coolant accident (LOCA).MILLSTONE -UNIT 2 B/43 mnmn oB 3/4 4-3eAmendment No. August 08, 200707-MP2-012REACTOR COOLANT SYSTEMBASES3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGEAPPLICABLE SAFETY ANALYSES -OPERATIONAL LEAKAGEExcept for primary to secondary LEAKAGE, the safety analyses do not address operationalLEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA;the amount of leakage can affect the probability of such an event. The safety analysis for an eventresulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGEfrom any one steam generator (SG) of 150 gpd or from all SGs of 300 gpd as a result of accidentinduced conditions. The LCO requirement to limit primary to secondary LEAKAGE through anyone SG to less than or equal to 75 gallons per day is significantly less than the conditions assumedin the safety analysis.Primary to secondary LEAKAGE is a factor in the dose releases outside containment resultingfrom a main steam line break (MSLB) accident. To a lesser extent, other accidents or transientsinvolve secondary steam release to the atmosphere, such as a steam generator tube rupture(SGTR). The leakage contaminates the secondary fluid. The FSAR (Reference 3) analysis for SGTR assumes the contaminated secondary fluid is onlybriefly released via safety valves or atmospheric dump valves.The MSLB is the more limiting accident for MPS2 control room dose. The safety analysis for theMSLB accident assumes 150 gpd primary to secondary.LEAKAGE is through~the affectedgenerator and 150 gpd from the intact SG as an initial condition. The dose consequences resultingfrom the MSLB accident are well within the limits defined in 10 CER 50.67 or the staff approvedlicensing basis (i.e., a small fraction of these limits).The RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).MILLSTONE -UNIT 2 B 3/4 4-3f Amendment No. l March 18, 2008" LBDCR 08-MP2-013REACTOR COOLANT SYSTEMBASES3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGEREFERENCES110 CFR 50, Appendix A, GDC 30.2 Regulatory Guide 1.45, May 1973.3 ESAR, Section 144 NEI 97-06, "Steam Generator Program Guidelines."5 EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."3/4.4.7 DELETE3/4.4.8 SPECIFIC ACTIVITYBACKGROUNDThe maximum dose that an individual at the exclu~sion .a~reaboundary can receive for 2 hoursfollowing an accident, or at the low population zone outer boundary for the radiological releaseduration, is specified in 10 CFR 50.67 (Ref. 1). Doses to control room occupants must be limitedper GDC 19. The limits on specific activity ensure that the offsite and Control Room Envelope(CRE) doses are appropriately limited during :analyzed transients and accidents.The RCS specific activity LCO limits the allowable concentration of radionuclides in the reactorcoolant. The LCO limits are established to minimize the dose consequences in the event of asteam line break (SLB) or steam generator tube rupture (SGTR) accident.The LCO contains specific activity limits for both DOSE EQUIVALENT 1-131 and DOSEEQUIVALENT XE-133. The allowable levels are intended to ensure that offsite and CRE dosesmeet the appropriate acceptance criteria in the Standard Review Plan (Ref. 2).MILLSTONE -UNIT 2B 3/4 4-4MILLTON -NIT2 B3/44-4Amendment No. 44--5, -194, 2-66, March 18, 2008LBDCR 08-MP2-013REACTOR COOLANT SYSTEMBASES3/4.4.8 SPECIFIC ACTIVITY (continued)APPLICABLE SAFETY ANALYSESThe LCO limits on the specific activity of the reactor coolant ensure the resulting offsite and CREdoses meet the appropriate SRP acceptance criteria following a SLB or SGTR accident. Thesafety analyses (Refs. 3 and 4) assume the specific activity of the reactor coolant is at the LCOlimits, and an existing reactor coolant steam generator (SG) tube leakage rate of 150 gpd exists.The~safety analyses assume the specific activity of the secondary coolant is at its limit of 0.1 igCi/gm DOSE EQUIVALENT I- 131 from LCO 3.7.1.4, "Activity."The analyses for the SLB and SGTR accidents establish the acceptance limits for RCS specificactivity. Reference to these analyses is used to assess changes to the unit that could affect RCSspecific activity, as they relate to the acceptance limits.The safety analyses consider two cases of reactor coolant iodine specific activity. One caseassumes specific activity at 1.0 jiCi/gm DOSE EQUIVALENT 1- 131 with a concurrent largeiodine spike that increases the rate of release of iodine from the fuel rods containing claddingdefects to the primary coolant immediately after a SLB (by a factor of 500), or SGTR (by a factorof 335), respectively. The second case assumes the initial reactor coolant iodine activity at 60.0pCi/gm DOSE EQUIVALENT I- 131 due to an iodine spike caused by a reactor or an RCStransient prijor to the accident. In both cases, the noble gas specific activity is assumed to be 1100p.tCi/gm DOSE EQUIVALENT XE-133....The SGTR analysis assumes a rise in pressure in the ruptured SG causes radioactivelycontaminated steam to discharge to the atmosphere through the atmospheric dump valves or the.main steam safety valves. The atmospheric discharge stops when the turbine bypass to thecondenser removes the excess energy to rapidly reduce the RCS pressure and close the valves.The unaffected SG removes core decay heat by venting steam until the cooldown ends and theShutdown Cooling (SDC) system is placed in service.The SLB radiological analysis assumes that offsite power is lost at the same time as the pipe breakoccurs outside containment. The affected SG blows down completely and steam is venteddirectly to the atmosphere. The unaffected SG removes core decay heat by venting steam to theatmosphere until the cooldown ends and the SDC system is placed in service.Operation with iodine specific activity levels greater than 1 giCi/gm but less than or equal to 60.0pCi/gm is permissible for up to 48 hours while efforts are made to restore DOSE EQUIVALENT1-131 to within the 1 [iCi/gm LCO limit. Operation with iodine specific activity levels greaterthan 60 jiCi/gm is not permissible.MILLSTONE -UNIT 2 B3444B 3/4 4-4a March 18, 2008LBDCR 08-MP2-013REACTOR COOLANT SYSTEMBASES3/4.4.8 SPECIFIC ACTIVITY (continued)APPLICABLE SAFETY ANALYSES (continued)The RCS specific activity limits are also used for establishing standardization in radiationshielding and plant personnel radiation protection practices.RCS spedific activity satisfies Criterion 2 of 10 CFR 50.3 6(c)(2)(ii).LCOThe iodine specific activity in the reactor coolant is limited to 1.0 pCi/gm DOSE EQUIVALENTI-131, and the noble gas specific activity in the reactor coolant is limited to 1 100 pCi/gm DOSEEQUIVALENT XE-133. The limits on specific activity ensure that offsite and CRE doses willmeet the appropriate SRP acceptance criteria (Ref. 2).The SLB and SGTR accident analyses (Refs. 3 and 4) show that the calculated doses are withinacceptable limits. Operation with activities in excess of the LCO may result in reactor coolantradioactivity levels that could, in the event of an SLB or SGTR, lead to doses that exceed the SRPacceptance criteria (Ref. 2).APPLICABILITYIn MODES 1, 2, 3, and 4, operation within the LCO limits for DOSE EQUIVALENT 1-13 1 andDOSE EQUIVALENT XE- 133 is necessary to limit the potential consequences of a SLB orSGTR to within the SRP acceptance criteria (Ref. 2).In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS andsteam generators are depressurized, and primary to secondary leakage is minimal. Therefore, themonitoring of RCS specific activity is not required.MILLSTONE -UNIT 2 B3444B 3/4 4-4b March 18, 2008LBDCR 08-MP2-013REACTOR COOLANT SYSTEMBASES3/4.4.8 SPECIFIC ACTIVITY (continued)ACTIONSa. and b.With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples at intervals of fourhours must be taken to demonstrate that the specific activity is _< 60 jiCi/gm. Four hours isrequired to obtain and analyze a sample. Sampling is continued every four hours to provide atrend.The DOSE EQUIVALENT I-131 must be restored to within limit within 48 hours. Thecompletion time of 48 hours is acceptable since it is expected that, if there were an iodine spike,the normal coolant iodine concentration would be restored within this time period. Also, there isa low probability of a SLB or SGTR occurring during this time period.A statement in ACTION b. indicates the provisions of LCO 3.0.4 are not applicable. Thisexception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTIONS a. andb- while the DOSE EQUIVALENT I-131 LCO is not met. This exception is acceptable due to thesignificant conservatism incorporated into the RCS specific activity limit, the low probability ofan event which is limiting due to exceeding this limit, and the ability to restore transient-specificactivity excursions while the plant remains at, or proceeds to, power operation.c..__If the required action and completion time of ACTION b. is not met, or if the DOSEEQUIVALENT 1-131 is > 60 jpCi/gm, the reactor must be brought to HoT STANDBY (MODE 3)within 6 hours and COLD SHUTDOWN (MODE 5) within 36 hours. The allowed completiontimes are reasonable, based on operating experience, to reach the required plant conditions fromfull power conditions in an orderly manner and without challenging plant systems.MILLSTONE -UNIT 2 B3444B 3/4 4-4c LBDCR 14-MP2-016September 4, 2014REACTOR COOLANT SYSTEMBASES3/4.4.8 SPECIFIC ACTIVTY (continued)ACTIONS (continued)d__.With the RCS DOSE EQUIVALENT XE-133 greater than the LCO limit, DOSE EQUIVALENTXE-133 must be restored to within limit within 48 hours. The allowed completion time of 48hours is acceptable since it is expected that, if there were a noble gas spike, the normal coolantnoble gas concentration would be restored within this time period. Also, there is a low probabilityof a SLB or SGTR occurring during this time period.A statement in ACTION d. indicates the provisions of LCO 3.0.4 are not applicable. Thisexception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTION d. whilethe DOSE EQUIVALENT XE-133 LCO is not met. This exception is acceptable due to thesignificant conservatism incorporated into the RCS specific activity limit, the low probability ofan event which is limiting due to exceeding this limit, and the ability to restore transient-specificactivity excursions while the plant remains at, or proceeds to, POWER OPERATION.e_.If the required action and completion time of ACTION d. is not met, the reactor must be, broughtto HOT STANDBY (MODE 3) within 6 hours and COLD SHUTDOWN (MODE 5) within 36hours. The allowed completion times are reasonable, based on operating experience, to reach therequired plant conditions from full power conditions in an orderly manner and withoutchallenging plant systems.*SURVEILLANCE REQUIREMENTS4.4.8.1Surveillance Requirement 4.4.8.1 requires performing a gamma isotopic analysis as a measure ofthe noble gas specific activity of the reactor coolant. This measurement is the sum of the degassedgamma activities and the gaseous gamma activities in the sample taken. This SurveillanceRequirement provides an indication of any increase in the noble gas specific activity. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.Trending the results of this Surveillance Requirement allows proper remedial action to be takenbefore reaching the LCO limit under normal operating conditions.MILLSTONE -UNIT 2 B3444B 3/4 4-4d LBDCR 14-MP2-016September 4, 2014REACTOR COOLANT SYSTEMBASES3/4.4.8 SPECIFIC ACTIVITY (continued).SURVEILLANCE REQUIREMENTS (continued)4.4.8.1 (continued)Due to the inherent difficulty in detecting Kr-85 in a reactor coolant sample due to masking fromradioisotopes with similar decay energies, such as F-18 and 1-134, it is acceptable to include theminimum detectable activity for Kr-85 in the Surveillance Requirement 4.4.8.1 calculation. If aspecific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE- 133 is notdetected, it should be assumed to be present at the minimum detectable activity.A Note modifies the Surveillance Requirement to allow entry into and operation in MODE 4,MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows theSurveillance Requirement to be performed in those MODES, prior to entering MODE 1.4.4.8.2This Surveillance Requirement is performed to ensure iodine specific activity remains within theLCO limit during normal operation and following fast power changes when iodine spiking ismore apt to occur. The frequency specified in the Surveillance Frequency Control Program isadequate to trend changes in the iodine activity level. The frequency of between 2 and 6 hoursafter a power change __ 15% RTP within a 1 hour period is established because the iodine levelspeak during this time following iodine spike initiation; samples at other times would provideinaccurate results.The Note modifies this Surveillance Requirement to allow entry into and operation in MODE 4,MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows theSurveillance Requirement to be performed in those MODES, prior to entering MODE 1.REFERENCES1. 10CFR 50.67.2. Standard Review Plan (SRP) Section 15.0.1 "Radiological Consequence Analyses UsingAlternate Source Terms."3. FSAR, Section 14.1.5.4. FSAR, Section 14.6.3.MILLSTONE -UNIT 2 B3444B 3/4 4-4e March 18, 2008LBDCR 08-MP2-013REACTOR COOLANT SYSTEMBASES3/4.4.9 PRESSURE/TEMPERATURE LIMITS*All components in the Reactor Coolant System are designed to with-stand the effects ofcyclic loads due to system temperature and pressure changes. These cyclic loads are introducedby normal load transients, reactor trips, and startup and shutdown operations. The variouscategories of load cycles Used for design purposes are provided in Section 4.0 of the FSAR.During startup and shutdown, the rates of temperature and pressure changes are limited so that themaximum specified heatup and cooldown rates are consistent with the design assumptions andsatisfy the stress limits for cyclic operation. In addition, during heatup, and cooldown evolutions,the RCS ferriticmaterials transition between ductile and-brittle (non-ductile) behavior. Toprovide adequate protection, the pressure/temperature limits were developed in accordance withthe 10CFR5O Appendix G requirements to ensure the margins of safety against non-ductile failureare maintained during all normal and anticipated operational occurrences. These pressure!temperature limits are provided in Figures 3.4-2a and 3.4-2b and the heatup and cooldown ratesare contained in Table 3.4-2.During heatup, the thermal gradients in the reactor vessel wall produce thermal stresseswhichvary from compressive at the inner wall~to tensile at the outer wall. These thermallyinduced compressive stresses at the inside wall tend to alleviate the tensile stresses induced by theinternal pressure. Therefore, a pressure-temperature curve based on steady state conditions (i.e.,no thermal stresses) represents a lower bound of all similar curves for finite heatup rates when theinner wall of the vessel is treated as the governing location.The heatup analysis also covers the determination of pressure-temperature limitations forthe case in which the outer wall of the vessel *becomes the controlling location. The thermalgradients established during heatup produce tensile stresses at the outer wall of the vessel. Thesestresses are additive to the pressure induced tensile stresses which are already present. Thethermally induced* stresses at the outer wall of the vessel are tensile and are dependent on both therate of heatup and the time along the heatup ramp; therefore, a lower bound curve similar to thatdescribed for the heatup of the inner wall cannot be defined. Subsequently, for the cases in whichthe outer wall of the vessel becomes the stress controlling location, each heatup rate ofinterest must be analyzed on an individual basis.MILLSTONE -UNIT 2 B3445AedetN.2lgB 3/4 4-5Amendment No. 2-t4, July 1, 1998REACTOR COOLANT SYSTEMBASESThe heatup and cooldown limit curves (Figures 3.4-2a and 3.4-2b) are composite curveswhich were prepared by determining the most conservative case, with either the inside or outsidewall controlling, for any heatup or cooldown rates of up to the maximums described in TechnicalSpecification 3.4.9.1, Table 3.4-2. The heatup and cooldown curves were prepared based uponthe most limiting value of the predicted adjusted reference temperature at the end of the serviceperiod indicated on Figures 3.4-2a and 3.4-2b.Verification that RCS pressure and temperature conditions are within the limits of Figures3.4-2a and 3.4-2b and Table 3.4-2, at least once per 30 minutes, is required when undergoingplanned changes of___ 10°F or _> 100 psi. This frequency is considered reasonable since thielocation of interest during cooldown is over two inches (i.e. 1/4 t location) from the interface withthe reactor coolant. During heatup the location of interest is over six inches from .the interfacewith the reactor coolant. This c~ombined with the relatively large heat retention capability of thereactor vessel ensures that small temperature fluctuations such as those expected during normalheatup and cooldown evolutions do not challenge the structural integrity of the reactor vesselwhen monitored on a 30 minute frequency. The 30 minute time interval permits assessment andcorrection for minor deviations within a reasonable time.During RCS heatup and cooldown the magnitude of the stresses across the reactor vesselwall are controlled by restricting the rate of temperature change and the system pressure, TheRCS pressure/temperature limits are provided in Figures 3.4-2a and 3.4-2b, and the heatup andcooldown rates are contained in Table 3.4-2. The following guidelines should'be used tO ensurecompliance with the Technical Specification lim~its. _1. When changing RCS temperature, with any reactor coolant pumps in operation, the rateof temperature change is calculated by using RCS loop cold leg temperature indications.This also applies during parallel reactor coolant pump and shutdown cooling (SDC) pumpoperation because the RCS loop cold leg temperature is the best indication of thetemperature of the fluid in contact with the reactor vessel wall. Even though SDC returntemperature may be belowRCS cold leg temperature, the mixing of a large quantity ofRCS cold leg water and a small quantity of SDC return water will result in the temperatureof the water reaching the reactor vessel wall being very close to RCS cold legtemperature.2. When changing RCS temperature via natural circulation, the rate of temperature change iscalculated by using RCS loop cold leg temperature indications.3. When changing RCS temperature with only SDC in service, the rate of temperaturechange is calculated by using SDC return temperature indication.MILLSTONE -UNIT 2B 3/4 4-6MILLTON -NIT2 B3/44-6Amendment No. 94, 4-t--3, 4--70, 218 July 1, 1998REACTOR COOLANT SYSTEMBASES4. During the transition from natural circulation flow, to forced flow with SDC pumps, therate of temperature change is calculated by using RCS loop cold leg temperatureindications. SDC return temperature should be used to calculate the rate of temperaturechange after SDC is in service, RBCCW flow has been established to the SDC heatexchanger(s), and SDC return temperature has decreased below RCS cold legtemperature.5. During the transition from parallel reactor coolant pump and SDC pump operation, therate of temperature change is calculated by using RCS loop cold leg temperatureindications until all reactor coolant pumps are secured. SDC return temperature should beused to calculate the rate of temperature change after all reactor coolant pumps have beensecured.6. The temperature change limits are for a continuous one hour period. Verification ofoperation within the limit must compare the current RCS water temperature to the valuethat existed one hour before the current time. If the maximum temperature increase ordecrease, during this one hour period, exceeds the Technical Specification limit,appropriate action should be taken.7. When a new, more restrictive temperature change limit is approached, it will be necessaryto adjust the current temperature change rate such that as soon as the new rate applies, thetotal temperature change for the previous one hour does not exceed the new morerestrictive rate.The same principle applies when moving from one temperature change limit curve toanother. If the new curve is above the current curve (higher RCS pressure for a givenRCS temperature), the new curve will reduce the temperature change limit, it will benecessary to first ensure the new more restrictive temperature change limit will not beexceeded by looking at the total RCS temperature change for the previous one hour timeperiod. If the magnitude of the previous one hour temperature change will exceed thenew limit, RCS temperature should be stabilized to allow the thermal stresses to dissipate.This may require up to a one hour soak before RCS pressure may be raised within thelimits of the new curve.If the new curve is below the current curve (lower.RCS pressure for a given RCStemperature), the new curve will allow a higher temperature change limit. All that isnecessary is to lower RCS pressure, and then apply the new higher temperature changelimit.8. When performing evolutions that may result in rapid and significant temperature swings(e.g. placing SDC in service or shifting SDC heat exchangers), the total temperaturechange limit for the previous one hour period must not be exceeded. If a significanttemperature change is anticipated, and an RCS heatup or cooldown is in progress, theplant should be stabilized for up to one hour, before performing this type of evolution.Stabilizing the plant for up to one hour will allow the thernal stresses, from any previousRCS temperature change, to dissipate. This will allow rapid RCS temperature changes upto the applicable Technical Specification temperature change limit.MILLSTONE -UNIT 2B344.6AmnetNo21B 3/4 4-6aAmendment No. 21 8 LBDCR 05-MP2-003December 27, 2005REACTOR COOLANT SYSTEMBASESThe reactor vessel materials have been tested to determine their initial RTNDT; the resultsof these tests are shown in Table 4.6-1 of the Final Safety Analysis Report. Reactor operation andresultant fast neutron irradiation will cause an increase in the RTNDT. Therefore, an adjustedreference temperature, based upon the fluence, can be predicted using the methods described inRevision 2 to Regulatory Guide 1.99.The heatup and cooldown limit curves shown on Figures 3.4-2a and 3.4-2b includepredicted adjustments for this shift in RTNDT at the end of the applicable service period, as well asadjustments for possible uncertainties in the pressure and temperature sensing instruments. Theadjustments include the pressure and temperature instrument and loop uncertainties associatedwith the main control board displays, the pressure drop across the core (RCP operation), and theelevation differences between the location of the pressure transmitters and the vessel beltlineregion. In addition to these curve adjustments, the LTOP evaluation includes adjustments due tovalve stroke times, PORV circuitry reaction times, and valve discharge backpressure.The actual shift in RTNDT of the vessel material is established periodically duringoperation by removing and evaluating, in accordance with 1OCFR5O Appendix H, reactor vesselmaterial irradiation surveillance specimens installed near the inside wall of the reactor vessel inthe core area. Since the neutron spectra at the irradiation samples and vessel inside radius aresimilar, the measured transition shift for a sample can be correlated to the adjacent section of thereactor vessel. The heatup and cooldown curves must be recalculated when the ARTNDTdetermined from the surveillance capsule exceeds the calculated ARTNDT for the equivalentcapsule radiation exposure.The pressure-temperature limit lines shown on Figures 3.4-2a and 3.4-2b for reactorcriticality have been provided to assure compliance with the minimum temperature requirementsof Appendix G to 10 CFR 50 for reactor criticality. For inservice leak and hydrostatic testing, useof the heatup curve on Figure 3.4-2a and associated rates provide a conservative limit in lieu of acurve developed specifically for inservice leak and hydrostatic testing. Therefore, a separate leakand hydrostatic curve is not explicitly included on Figure 3.4-2a.The maximum RTNDT for all reactor coolant system pressure-retaining materials, with theexception of the reactor pressure vessel, has been determined to be 50°F. The Lowest ServiceTemperature limit is based upon this RTNDT since Article NB-2332 (Summer Addenda of 1972)of Section III of the ASME Boiler and Pressure Vessel Code requires the Lowest ServiceTemperature to be RTNDT + I1000F for piping, pumps and valves. Below this temperature, thesystem pressure must be limited to a maximum of 20% of the system's hydrostatic test pressure of3125 psia. Operation of the RCS within the limits of the heatup and cooldown curves will ensurecompliance with this requirement.MILLSTONE -UNIT 2 B 3/4 4-6b Amendment No. 2-18,Acknaowledged by NRC letter dated12/I19/06 LBDCR 06-MP2-041November 2, 2006REACTOR COOLANT SYSTEMBASESIncluded in this evaluation is consideration of flange protection in accordance with10 CFR 50, Appendix G. The requirement makes the minimum temperature RTNDT plus 90°F forhydrostatic test and RTND.T plus. 1200F fornonmal operation when the pressure .exceeds 20 percentof the preservice system hydrostatic test pressure. Since the flange region RTNDT has beencalculated to be 30°F,. the minimum flange pressurization temperature during normal operation is1 500F (163°F with instrument uncertainty) when the pressure exceeds 20% of the preservicehydrostatic pressure. Operation of the RCS Within the limits of the heatup and cooldown curveswill ensure compliance with this requirement.To establish the minimum boltup temperature, ASME Code Section XI, Appendix G,requires thet.ernperature~of the flange and-adjiacent, shell .-ad~head. reg~ion!s .shall! be. abo-ve -the.results in a minimum boltup temperature of 43°F. For additional conservatism, a minimum boltuptemperature of 70°F is specified on thie heatup and cooldown curves. The head and vessel flangeregion temperature must be greater than 700F, whenever any reactor vessel stud is tensioned.The Low Temperature Overpressure Protection (LTOP) System provides a physicalbarrier :againshtexceeding the IOC-FR50 Appendix G pressure/temaperature.-limits during, lowtemperature RCS operation either With a steam bubble in the pressurizer or during water solidconditions. This system consists of either two PORVs with a pressure setpoint 415 psia, or anRCS vent of sufficient size. Analysis has confirmed that the design basis mass addition transientdiscussed below will be mitigated by operation of the PORVs or by establishing an RCS vent ofsufficient size.The LTOP System is required to be OPERABLE when RCS cold leg temperature is at orbelow 2750F (Technical Specifidation 3.4.9.3). However, if the RCS is in MODE 6 and thereactor vessel head has been removed, a Vent of sufficient sizehas beenestablished such that RCSpressurization is not possible. Therefore, an LTOP System is not required (TechnicalSpecification 3.4.9.3 is not applicable).Adjusted Referenced Temperature (ART) is the RTNDT adjusted for radiation effects plusa margin term r-equired by Revision 2 of Regul~atory Guide 1.99. The LTOP System' is armed at atemperature which exceeds the limiting l/4t ART plus 50°F as required by ASME Section XI,Appendix G. For the operating period up to 54 EFPY, the limiting 1/4t ART is 175°F whicliresults in a minimum LTOP System enable temperature of at least 271 0F when corrected forinstrument uncertainty. The current value of 2750F will be retained.MILLSTONE.- UNIT 2 B 3/4 4-7 Amendment No. g0, :70, 94, -1-, 66,2-72,Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-041November 2, 2006REACTOR COOLANT SYSTEMBASESThe mass input analysis performed to ensure the LTOP System is capable of protecting thereactor vessel assumes that all pumps capable of injecting into the RCS start, and then one PORVfails to actuate (single active failure). Since the PORVs have limited relief capability, certain.administrative restrictions have been implemented to ensure that the mass input transient will notexceed the relief capacity of a PORV. The analysis has determinied two PORVs (assuming onePORV fails) are-sufficient if the mass addition transient is limited to the inadvertent start of onehigh pressure safety injection (HPSI) pump and two charging pumps when RCS temperature is ator below 2750F and above 190°F, and the inadvertent start of one charging pump When RCStemperature is at or below 190°F..The_ LTOP analysis assumes .oly...one PQRV open due. to. sin~gle a~civ.e:fai ue_,of the otherAppendix during owwttemperaiurecope~ation. ::'if-he-RGS i}s-;.*:-depressurized and vented through at least a 2.2 square inch vent,, the peak RCS pressure, resultingfrom the maximum mass input transient allowed by Technical specification 3.4.9.3, will notexceed 300 psig (SDC System suction side design pressure).When the RCS is at or below 190°F, additional pumping capacity can be. made capable ofin~ cingj .o ~h ..Q _b~y es~tablis~h~in!g an .R.C .S .ve~ntof _a~t.lea~s~t2.2..s~qu.a~re_.in~ches._ ._R~em ovin~g the_.pressurizer manway cover, pressurizer vent port cover or a pressurizer safety relief valve willresult in a passive vent of at least 2.2 square inches. Additionailmethods to establish the requiredRCS vent are acceptable, provided the proposed Vent has been evaluated to ensure the flowcharacteris'tics are equivalent to one of these.Establishing a pressurizer steam bubble of sufficient size will be sufficient to protect thereactor vessel from the energy addition transient associated with the start of an RCP, provided therestrictions contained in Technical Specification 3.4.1.3 are met. These restrictions limit the heatinput from. the secondary, syistem. They also ensure sufficient Steam *volume. exists in thepressurizer to accommodate thie insurge. No credit for PORV actuation Wvas assumed in the LTOPanalysis, of the energy addition transient.The restrictions apply only to the start of the first RCP. Once at least. one RCP is running,equilibrium is achieved between the primary and secondary temperatures, elimina~tipng anysignificant energy addition associated with the start of the second RCP.The LTOP restrictions are based on RCS cold leg temperature. This temperature Will bedetermined by using RCS cold leg temperature indication when RCPs are running, or naturalcirculation if it is occurring. Otherwise, SDC return temperature indication will be used.MILLSTONE -UNIT 2 B 3/4 4-7a Amendment No. S,Acknowledged By NRC July 5, 2007 LBDCR 09-MP2-017September 15, 2009REACTOR COOLANT SYSTEMBASESRestrictions on RCS makeup pumping capacity are included in Technical Specification3.4.9.3. These restrictions are based on balancing the requirements for LTOP and shutdown risk.For shutdown risk reduction, it is desirable to have maximum makeup capacity and to maintainthe RCS full (not vented). However, for LTOP it is desirable to minimize makeup capacity andvent the.RCS.. To satisfy these competing requirements, makeup pumps can be made not capableof injecting, but available at short notice.A charging~pump can be considered to be not capable of injecting into the RCS by use ofany of the following methods and the, appropriate administrative controls.1. Placing the motor circuit breaker in the open position.2. Removing the charging pump motor overload heaters from the charging pump circuit.3. Removing the charging pump motor controller from the motor control center.4. Placing a charging pump control switch in the. Pull-To-Lock (PTL) position.A HPSI pump can be considered to be not capable of injecting into the RCS by use of anyof the following methods and the appropriate administrative controls.1. Racking down the motor circuit breaker from the power supply circuit.2. Shutting and tagging the discharge valve with the key lock on the control panel(2-SI-654 or 2-SI-656).3. .Placing the pump control switch in the pull-to-lock position and removing the breakercontrol power fuses.4. Placing the pump control switch in the position and shutting the dischargevalve with the key lock on the control panel (2-SI-654 or 2-SI-656).These methods to prevent charging pumps and UPSI pumps from injecting into the RCS,when combined with the appropriate administrative controls, meet the requirement for twoindependent means to prevent pump injection as a result of a single failure or inadvertent singleaction.These methods prevent inadvertent pump injections while allowing manual actions torapidly restore the makeup capability if conditions require the use of additional charging or HPSIpumps for makeup in the event of a loss of RCS inventory or reduction in SHUTDOWNMARGIN.MILLSTONE -UNIT 2B 3/4 4-7bMILLTON -NIT B /4 -7bAmendment No. 2-28, -7-, 242-, LBDCR 05-MP2-003December 27, 2005REACTOR COOLANT SYSTEMBASESIf a loss of RCS inventory or reduction in SHUTDOWN MARGIN event occurs, theappropriate response will be to correct the situation by starting RCS makeup pumps. If the loss ofinventory or SHUTDOWN MARGIN is significant, this may necessitate the use of additionalRCS makeup pumps that are being maintained not capable of injecting into the RCS inaccordance with Technical Specification 3.4.9.3. The use of these additional pumps to restoreRCS inventory or SHUTDOWN MARGIN will require entry into the associated ACTIONstatement. The ACTION statement requires immediate action to comply with the specification.The restoration of RCS inventory or SHUTDOWN MARGIN can be. considered to be part of theimmediate actioni to restore the additional RCS makeup pumps to a not capable of injecting status.While recovering RCS inventory or SHUTDOWN MARGIN, RCS pressure will be maintainedbelow the Appendix G limits. After RCS inventory or SHUTDOWN MARGIN has beenrestored, the additional pumps should be immediately made not capable of injecting and theACTION statement exited.An exception to Technical Specification 3.0.4 is specified for Technical Specification3.4.9.3 to allow a plant cooldown to MODE 5 if one or both PORVs are inoperable. MODE 5conditions may be necessary to repair the PORV(s).3/4.4.10 DELETEDMILLSTONE -UNIT 2B 3/4 4-7cAmendment No. 248-, 3, 24-3, -264,Acknowledged by NRC letter dated12/119/06 May 8, 2002.BASES3/4.4.11 DELETEDMILLSTONE -UNIT 2B 314 4-BMILLTON -NIT2 B3/44-8 Amendment No. 266 REVERSE OF PAGE B 3/4 4-8INTENTIONALLY LEFT BLANK September 3, 19983/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES3/4.5.1 SAFETY INJECTION TANKSThe OPERABILITY of each of the RCS SITs ensures that a sufficient volume of borated waterwill be immediately forced into the reactor core through each of the cold legs in the event the RCSpressure falls below the pressure of the SITs. This initial surge of water into the core provides theinitial cooling mechanism during large RCS pipe ruptures.The limits on SIT volume, boron concentration and pressure ensure thaf the assumptions used forSIT injection in the accident analysis are met.If the boron concentration of one SIT is not within limits, it must be returned to within the limitswithin 72 hours. In this condition, ability to maintain subcriticality or minimum boronprecipitation time may be reduced, but the reduced concentration effects on core subcriticalityduring reflood are minor. Boiling of the ECCS water in the core during reflood concentrates theboron in the saturated liquid that remains in the core. In addition, the volume of the SIT is stillavailable for injection. Since the boron requirements are based on the average boronconcentration of the total volume of three SITs, the consequences are less severe than they wouldbe if a SIT were not available for injection. Thus, 72 hours is allowed to return the boronconcentration to within limits.If one SIT is inoperable, for a reason other than boron concentration or the inoperability of waterlevel or pressure channel instrumentation, the SIT must be returned to OPERABLE status within24 hours. In this condition, the required contents of three SITs cannot be assumed to reach thecore during a LOCA as is assumed in Appendix K to 1OCIFR50.Reference 1 provides a series of deterministic and probabilistic analysis findings that support 24hours as being either "risk beneficial" or "risk neutral" in comparison to shorter periods forrestoring the SIT to OPERABLE status. Reference 1 discusses recent best-estimate analysis thatconfirmed that for large-break LOCAs, core melt can be prevented by either operation of oneLPSI pump or the operation of one HPSI piunp and a single SIT. Reference 1 also discussesplant-specific probabilistic analysis that evaluated the risk-impact of the 24 hour recovery periodin comparison to shorter recovery periods.If the SIT cannot be restored to OPERABLE status within the associated completion time, theplant must be brought to a MODE in which the LCO does not apply. To achieve this' status, theplant must be brought to at least MODE 3Reference1 CE NPSD-994, "CEOG Joint Applications Report on Safety Injection Tank AOT/SITExtension," April 1995.MILLSTONE -UNIT 2B 3/4 5-1MILSTOE -UNI 2 3/4-l Amendment No. 64-, 7-2;, 59, 24--7, 220 September 9, 20043/4.5 EMERGENCY CORE COOLING SYSTEMS (EGGS)BASES3/4.5.1 SAFETY INJECTION TANKS (continued)within 6 hours and pressurizer pressure reduced to < 1750 psia within 12 hours. The allowedcompletion times are reasonable, based on operating experience, to reach the required plantcondition from full power conditions in an orderly manner and without challenging plant systems.If more than one SIT is inoperable, the unit is in a condition outside the accident analyses.Therefore, LCO 3.0.3 must be entered immediately.LCO 3.5.1 .a requires that each reactor coolant system safety injection tank shall be OPERABLEwith the isolation valve open and the power to the valve operator removed.This is to ensure that the valve is open and cannot be inadvertently closed. To meet LCO 3.5.1.arequirements, the valve operator is considered to be the valve motor and not the motor controlcircuit. Removing the closing coil while maintaining the breaker closed meets the intent of theTechnical Specification by ensuring that the valve cannot be inadvertently closed.Removing the closing coil and verifying that the closing coil is removed (Per SR 4.5.1 .e) meetsthe Technical Specification because it prevents energizing the valve operator to position the valvein the close direction.noOpeninga ialthe otnbreakersi ein lieu of removing the closing coil, to remove power to the valve operator isO i1. Millstone Unit 2 Safety Evaluation Report (SER) Docket No. 50-336, dated May 10,1974, requires two independent means of position indication.2. Surveillance Requirement 4.5.1 .a requires the control/indication circuit to be energized, toverify that the valve is open.3. Technical Specification 3/4.3.2, Engineered Safety Feature Actuation SystemInstrumentation, requires these valves to open on a SIAS signal.Opening the breaker would eliminate the ability to satisfy the above three items.3/4.5.2 and 3/4.5.3 EGGS SUBSYSTEMSThe OPERABILITY of two separate and independent EGGS subsystems ensures that sufficientemergency core cooling capability will be available in the event of a LOCA assuming the loss ofone subsystem through any single failure consideration. Either subsystem operating inconjunction with the safety injection tanks is capable of supplying sufficient core cooling to limitthe peak cladding temperatures within acceptable limits for all postulated break sizes rangingfrom the double ended break of the largest RCS cold leg pipe downward.MILLSTONE -UNIT 2 B 3/4 5-2 Amendment No. 6t1-, :h3 59, N-1-7, 20,-2-3, 283 LBDCR 04-MP2-016February 24, 20053/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued)Each Emergency Core Cooling System (ECCS) subsystem required by Technical Specification3.5.2 for design basis accident mitigation includes an OPERABLE high pressure safety injection(HIPSI) pump and a low pressure safety injection (LPSI) pump. Each of these pumps requires anOPERABLE flow path capable of taking suction from the refueling water storage tank (RWST)on a safety injection actuation signal (SIAS). Upon depletion of the inventory in the RWST, asindicated by the generation of a Sump Recirculation Actuation Signal (SPAS), the suction for theHPSI pumps will automatically be transferred to the contaimnent sump. The SRAS will alsosecure the LPSI pumps. The ECCS subsystems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) asdesign basis accident mitigation equipment.Flow from the charging pumps is no longer required for design basis accident mitigation. Theloss of coolant accident analysis has been revised and no credit is taken for charging pump flow.As a result, the charging pumps no longer meet the first three criteria of 10OCFR 50.36 (c)(2)(ii) asdesign basis accident mitigation equipment required to be controlled by Technical Specifications.In addition, risk evaluations have been performed to demonstrate that the charging system is notrisk significant as defined in 1OCFR 50.3 6(c)(2)(ii) Criterion 4. However, the charging system iscredited in the PRA model for mitigating two beyond design basis events, Anticipated TransientsWithout Scram (ATWS) and Complete Loss of Secondary Heat Sink. On this basis, therequirements for charging pump OPERABILITY will be retained in Technical Specification3.5.2. Consistent with the surveillance requirements, only the charging pump will be included indetermining ECCS subsystem OPERABILITY.As a result of the risk insight, the charging pump will be included as an Emergency Core CoolingSystem subsystem required by Technical Specification 3.5.2. That is, an. ECCS subsystem willinclude one OPERABLE charging pump. The charging pump credited for each ECCS subsystemmust meet the surveillance requirements specified in Section 4.5.2. Consistent with the riskinsights, automatic start of the charging pump is not required for compliance to TS 3.5.2. Thus,Section 4.5.2 does not specify any testing requirements for the automatic start of the creditedcharging pump. Similarly, since the ECCS flow path is not credited in the riskevaluation, thereare no charging flow path requirements included in TS 3.5.2.The requirements for automatic actuation of the charging pumps and the associated borationsystem components (boric acid pumps, gravity feed valves, boric acid flow path valves), whichalign the boric acid storage tanks to the charging pump suction on a SIAS have been relocated tothe Technical Requirements Manual. These relocated requirements do not affect theOPERABILITY of the charging pumps for Technical Specification 3.5.2MILLSTONE -UNIT 2 B 3/4 5-2a Amendment No. 6-t-, 7-2, 4-5-9, 1-, 2-, 36,Acknowledged by NRC letter dated 6/28/05 LBDCR i4-MP2-016September 4, 20143/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued)Surveillance Requirement 4.5.2.a verifies the correct alignment for manual, power operated, andautomatic valves in the ECCS flow paths to provtide assurance that the proper flow paths will existfor ECCS operation. This surveillance does not apply to valves that are locked, sealed, orotherwise secured in position; since these valves were verified to be in the correct position prior tolocking, sealing, or securing. A valve that receives an actuation signal is allowed to be in anonaccident position provided the valve automatically repositions within the proper stroke time.This surveillance does not require any testing or valve manipulation. Rather, it involvesverification that those valves capable of being mispositioned are in the correct position. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.5.2.b verifies proper valve position to ensure that the flow path fromthe ECCS pumps to the RCS is maintained. Misalignment of these valves could render bothECCS trains inoperable. Securing these valves in position by removing power to the valveoperator ensures that the valves cannot be inadvertently misalig-ned or change position as theresult of an active failure. The surveillance frequency is controlled under the SurveillanceFrequency Control Program.Surveillance Requirements 4.5.2.c and 4.5.2.d, which address periodic surveillance testing of the ECCS pumps (high pressure and low pressure safety injection pumps) to detect gross degradation 0-caused by impeller structural damage or other hydraulic component problems, is required by theASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OM Code). Thistype of testing may be accomplished by measuring the pump developed head at only one point ofthe pump characteristic curve. This verifies both that the measured performance is within anacceptable tolerance of the original pump baseline performance and that the performance at thetest flow is greater than or equal to the perfonnance assumed in the unit safety analysis. Thesurveillance requirements are specified in the Inservice Testing Program. The ASME OM Codeprovides the activities and frequencies necessary to satisfy the requirements.Surveillance Requirement 4.5 .2.e, which addresses periodic surveillance testing of the chargingpumps to detect gross degradation caused by hydraulic component problems, is required by theASMIfE OM Code. For positive displacement pumps, this type of testing may be accomplished bycomparing the measured pump flow, discharge pressure and vibration to their respectiveacceptance criteria. Acceptance criteria are verified to bound the assumptions utilized in accidentanalyses. This verifies both that the measured performance is within an acceptable tolerance ofthe original pump baseline performance and that the performance at the test point is greater thanor equal to the performance assumed for mitigation of the beyond design basis events. Thesurveillance requirements are specified in the Inservice Testing Program. The ASIME OM Codeprovides the activities and frequencies necessary to satisfy the requirements.MILLSTONE -UNIT 2 B 3/4 5-2b Amendment No. 45-, 6-1-, 7-, 4-l-9, 8-5,4-t6,24al-7, -220, 2, 2a34, 2 LBDCR 14-MP2-016September 4, 20143/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued)Surveillance Requirements 4.5.2.f, 4.5.2.g, and 4.5.2.h demonstrate that each automatic ECCSflow path valve actuates to the required position on, an actual or simulated actuation signal (SIASor SRAS), that each ECCS pump starts on receipt of an actual or simulated actuation signal(SIAS), and that the LPSI pumps stop on receipt of an actual or simulated actuation signal(SRAS). This surveillance is not required for valves that are locked, sealed, or otherwise securedin the required position under administrative controls. The surveillance frequency is controlledunder the Surveillantce Frequency Control Program. The actuation logic is tested as part of theEngineered Safety Feature Actuation System (ESFAS) testing, and equipment perfonnance ismonitored as part of the Inservice Testing Program.Surveillance Requirement 4.5.2.i verifies the high and low pressure safety injection valves listedin Table 4.5-1 will align to the required positions on an SIAS for proper. ECCS performance. Thesafety injection valves have stops to position them properly so that flow is restricted to a rupturedcold leg, ensuring that the other cold legs receive at least the required minimum flow. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.5 .2.j addresses periodic inspection of the containment sump toensure that it is unrestricted and stays in proper operating condition. The surveillance fr'equency iscontrolled under the Surveillance Frequency Control Program.Surveillance Requirement 4.5.2.k verifies that the Shutdown Cooling (SDC) System openpermissive interlock is OPERABLE to ensure the SDC suction isolation valves are preventedfrom being remotely opened when RCS pressure is at or above the SDC suction design pressureof 300 psia. The suction piping of the SDC pumps (low pressure safety injection pumps) is theSDC component with the limiting design pressure rating. The interlock provides assurance thatdouble isolation of the SDC System from the RCS is preserved whenever RCS pressure is at orabove the design pressure. The surveillance frequency is controlled under the SurveillanceFrequency Control Program.MILLSTONE -UNIT 2 B 3/4 5-2c Amendment No. 4-5, 4-59, Ig-, 2-1-5,2-46, -220, 22g, 24--6, 28g3 LBDCR 04-MP2-016February 24, 20053/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES314.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continuedOnly one EGGS subsystem is required by Technical Specification 3.5.3 for design basis accidentmitigation. This ECGS subsystem requires one OPERABLE I-PSI pump and an OPERABLEflow path capable of taking suction from the RWST on a SIAS. Upon depletion of the inventoryin the RWST, as indicated by the generation of a SRAS, the suction for the I!WSI pump willautomatically be transferred to the containment sump. This ECCS subsystem satisfies Criterion 3of 10 CFR 50.36(c)(2)(ii) as design basis accident mitigation equipment.Surveillance Requirement 4.5.3.1 specifies the surveillance requirements of TechnicalSpecification 3.5.3 that are required to demonstrate that the required EGGS subsystem ofTechnical Specification 3.5.3 is OPERABLE. The required ECCS subsystem of TechnicalSpecification 3.5.3 does not include any LPSI components. LPSI components are not requiredwhen Teclnical Specification 3.5.3 is applicable to allow the LPSI components to be used forSDC System operation.In MODE 4 the automatic safety injection signal generated by low pressurizer pressure and highcontainment pressure and the automatic sump recirculation actuation signal generation by lowrefueling water storage tank level are not required to be OPERABLE. Automatic actuation in dMODE 4 is not required because adequate time is available for plant operators to evaluate plant 0conditions and respond by manually operating engineered safety features components. Since themanual actuation (trip pushbuttons) portion of the safety injection and sump recirculationactuation signal generation is required to be OPERABLE in MODE 4, the plant operators can usethe manual trip pushbuttons to rapidly position all components to the required accident position.Therefore, the safety injection and sump recirculation actuation trip Pushbuttons satisfy therequirement for generation of safety injection and sump reciixculation a~ctuation signals inMODE 4.In MODE 4, the OPERABLE U-IPSI pump is not required to start automatically on a SIAS.Therefore, the pump control switch for this OPERABLE pump may be placed in the pull-to-lockposition without affecting the OPERABILITY of the pump. This will prevent the pump fromstarting automatically, which could result in overpressurization of the Shutdown Cooling System.Only one H-PSI pump may be OPERABLE in MODE 4 with RCS temperatures less than or equalto 275°F due to the restricted relief capacity with Low-Temperature Oveirpressure ProtectionSystem. To reduce shutdown risk by having additional pumping capacity readily available, aHPSI pump may be made inoperable but available at short notice by shutting its discharge valvewith the key lock on the control panel.MILLSTONE -UNIT 2 B 3/4 5-2d Amendment No. 4-5, 4-1-g, -,O-2-2-, -,Acknowledged by NRC letter dated 6/28/05 LBDCR 10-MP2-016May 16, 20113/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES:3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued)The provision in Specification 3.5.3 that Specifications 3.0.4 and 4.0.4 are not applicable for entryinto MODE 4 is provided to allow for connecting the HPSI pump breaker to the respective powersupply or to remove the tag and open the discharge valve, and perform~ the subsequent testingnecessary to declare the inoperable HPSI pump OPERABLE. Specification 3.4.9.3 requires allHPSI pumps to be not capable of injecting into the RCS when RCS temperature is at orbelow I90°F. Once RCS temperature is above 190°F one HPSI pump can be capable of injectinginto the RCS. However, sufficient time may not be available to ensure one HPSI pump isOPERABLE prior to entering MODE 4 as required by Specification 3.5.3. Since Specifications*3.0.4 and 4.0.4 prohibit a MODE change in this situation, this exemption will allow Millstone* Unit No. 2 to enter MODE 4, take the steps necessary to make the HPSI pump capable of"injecting into the RCS, arid then declare the pump OPERABLE. If it is necessary to use thisexemption during plant heatup, the appropriate ACTION statement of Specification 3.5.3 shouldbe entered as soon as MODE 4 is reached.3/4.5.4 REFUELING WATER STORAGE TANX (RWST)The OPERABILITY of the RWST as part of the ECCS ensures that a sufficient supply of boratedwater is available for injection by the ECCS in the event of a LOCA. A minimum usable volumeof 370,000 gallons is required for ECCS injection above the earliest or highest level of SRASinitiation accounting for indicator accuracy. The limits on RWST minimum volume and boronconcentration ensure that 1) sufficient water is available within containment to permitrecirculation cooling flow to the core, anid 2) after a LOCA the reactor will remain subcritical inthe cold condition following mixing of the RWST and the RCS water volumes. Small breakLOCAs assume that all control rods are inserted, except for the control element assembly (CEA)of highest worth, which remains withdrawn from the core. Large break LOCAs assume that allCEAs remain withdrawn from the core.MILLSTONE -UNIT 2 B 3/4 5-2e Amendment No. 28-3-,Acknowledged by NRC letter dated 6/28/05 LBDCR 05-MP2-001February 10, 2005EMERGENCY CORE COOLING SYSTEMSBASES3/45.5 TRISODIUM PHOSPHATE (TSP)BACKGROUNDTrisodium phosphate (TSP) is placed on the floor or in the sump of the containment building toensure that iodine, which may be dissolved in the recirculated reactor cooling water following aloss of coolant accident (LOCA), remains in solution. TSP also helps inhibit stress corrosioncracking (SCC) of austenitic stainless steel components in containment during the recirculationphase following an accident.Fuel that is damaged during a LOCA will release iodine in several chemical forns to the reactorcoolant and to the containment atmosphere. A portion of the iodine in the containmentatmosphere is washed to the sump by containment sprays. The emergency core cooling water isborated for reactivity control. This borated water causes the sump solution to be acidic. In a lowpH (acidic) solution, dissolved iodine will be converted to a volatile form. The yolatile iodinewill evolve out of solution into the containment atmosphere, significantly increasing the levels ofairborne iodine. The increased levels of airborne iodine in containment contribute to theradiological releases and increase the consequences from the accident due to containmentatmosphere leakage.After a LOCA, the components of the core cooling and containment spray systems will beexposed to high temperature borated water. Prolonged exposure to the core cooling watercombined with stresses imposed on the components can cause SCC. The SCC is a function ofstress, oxygen and chloride concentrations, pH, temperature, and alloy composition of thecomponents. High temperatures and low pH, which would be present after a LOCA, tend topromote SCC. This can lead to the failure of necessary safety systems or components.Adjusting the pH of the recirculation solution to levels above 7.0 prevents a significant fraction ofthe dissolved iodine from converting to a volatile form. The higher pH thus decreases the level ofairborne iodine in containment and reduces the radiological consequences from containmentatmosphere leakage following a LOCA. Maintaining the solution pH above 7.0 also reduces theoccurrence of SCC of austenitic stainless steel components in containment. Reducing SCCreduces the probability of failure of components.MILLSTONE -UNIT 2 B 3/4 5-3 Amendment No. a-!-7g,Acknowledged by NRC letter dated12/!19/06 LBDOR 05-MP2-001February 10, 2005EMvERGENCY CORE COOLING SYSTEMSBASES3/4.5.5 TRISODIUM PHOSPIHATE (TSP)BACKGROUND (continued)TSP is employed as a passive form of pHI control for post LOCA containm-ent spray and corecooling water. Baskets of TSP are placed on the floor or in the sump of the containment buildingto dissolve from released reactor coolant water and containment sprays after a LOCA.Recirculation of the water for core cooling and containment sprays then provides mixing toachieve a uniform solution pH. The hydrated form (45- 57% moisture) of TSP is used because ofthe high humidity in the containment building during normal operation. Since the TSP ishydrated, it is less likely to absorb large amounts of water from the humid atmosphere and willundergo less physical and chemical change than the anhydrous form of TSP.APPLICABLE SAFETY ANALYSESThe LOCA radiological consequences analysis takes credit for iodine retention in the sumpsolution based on the recirculation water pH being _> 7.0. The radionuclide releases from thecontainment atmosphere and the consequences of a LOCA would be increased if the pH of therecirculation water were not adjusted to 7.0 or above.LIMITING CONDITION FOR OPERATIONThe TSP is required to adjust the pH of the recirculation water to > 7.0 after a LOCA. A pH >7.0is necessary to prevent significant.amounts of iodine released from fuel failures and dissolved inthe recirculation water from converting to a volatile fonnl and evolving into the containmentatmosphere. Higher levels of airborne iodine in contaimnlent may increase the release ofradionuclides and the consequences of the accident. A pH > 7.0 is also necessary to prevent SCCof austenitic stainless steel components in containment. SeCCincreases the probability of failureof components.The required amount of TSP is based upon the extreme cases of Water volume and pH possible inthe containment sump after a large break LOCA. The minimum required volume is the volume ofTSP that will achieve a sump solution pH of > 7.0 when taking into consideration the maximumpossible sump water volume and the minimum possible pH. The amount of TSP needed in thecontainment building is based on the mass of TSP required to achieve the desired pH. However, a.required volume is specified, rather than mass, since it is not feasible to weigh the entire amountof TSP in containment. The minimum required volume is based on the manufactured density ofTSP. Since TSP can have a tendency to agglomerate from high humidity in the containmentbuilding, the density may increase and the volume decrease during normal plant operation. Dueto possible agglomeration and increase in density, estimating the minimum volume of TSP incontaimnent is conservative with respect to achieving a minimum required pH.MVILLSTONE -UNIT 2 B 3/4 5-4 Amendment No.Acknowledged by NRC letter dated12/19/06 LBDCR 14-MIP2-016September 4, 2014EMERGENCY CORE COOLING SYSTEMSBASES '3/4.5.5 TRISODIUM PHOSPHATE (TSP') (continued)APPLICABILITYIn MODES 1, 2, and 3, the RCS is at elevated temperature and pressure, providing an energypotential for a LOCA. The potential for a LOCA results in a need for the ability to control the pHof the recirculated coolant.In MODES 4, 5, and 6, the potential for a LOCA is reduced or nonexistent, and TSP is notrequired.ACTIONSIf it is discovered that the TSP in the containment building sump is not within limits, action mustbe taken to restore the TSP to within limits. During plant operation the containment sump is notaccessible and corrections may not be possible.The completion time of 72 hours is allowed for restoring the TSP within limits because 72 hoursis the same time allowed for restoration of other ECCS components. LIf the TSP cannot be restored within limits within the 72 hour completion time, the plant must bebrought to a MODE inl which the LCO does not apply. The specified completion times forreaching MODES 3 and 4 were chosen to allow reaching the specified conditions from full powerin an orderly manner without challenging plant systems.SURVEILLANCE REQUIREMENTS ..Surveillance Requirement 4.5.5.1Periodic determination of the volume of TSP in containment must be performed due to thepossibility of leaking valves and components in the containment building that could causedissolution of the TSP during normal operation. This periodic surveillance is required todetermine visually that a minimum of 282 cubic feet is contained in the TSP baskets. Thisrequirement ensures that there is an adequate volume of TSP to adjust the pH of the post LOCAsump solution to a value _> 7.0. The surveillance frequency is controlled under the SurveillanceFrequency Control Program.MILLSTONE -UNIT 2 B 3/4 5-5 Amcndmcnt,.,,, N,,y I'LR " lott.e. d..LLVI LBDCR 14-MrP2-016September 4, 2014EMERGENCY COPE COOLING SYSTEMSBASES3/4.5.5 TRISODITUM PHOSPHATE (TSP') (continued)Surveillance Requirement 4.5.5.2Testing must be performed to ensure the solubility and buffering ability of the TSP after exposureto the containment environment. Passing this test verifies the TSP is active and providesassurance that the stored TSP will dissolve in borated water at postulated post-LOCAtemperatures. This test is performed by submerging a sample of 0 .6662 +/- 0.0266 grams of TSPfrom one of the baskets in containment in 250 +/- 10 milliliters of water at a boron concentration of2482 +/- 20 ppm, and a temperature of 77+/-+ 5°F. Without agitation, the solution is allowed to standfor four hours. The liquid is then decanted, mixed, and the pH measured. The pH must be > 7.0.The TSP sample weight is based on the minimum required TSP mass of 12,042 pounds, which atthe manufactured density corresponds to the minimum volume of 223 f& (The minimumTechnical Specification requirement of 282 ft3 is based on 223 ft3 of TSP for boric acidneutralization and 59 ft3 of TSP for neutralization of hydrochloric and nitric acids.), and themaximum sump water volume (at 77°F) following a LOCA of 2,046,441 liters, normalized tobuffer a 250 +/- 10 milliliter sample. The boron concentration of the test water is representative ofthe maximum possible concentration in the sump following a LOCA. Agitation of the testsolution is prohibited during TSP dissolution since an adequate standard for the agitation intensitycannot be specified. The dissolution time of four hours is necessary to allow time for the dissolvedTSP to naturally diffuse through the sample solution. In the containmnent sump following aLOCA, rapid mixing will occur, significantly decreasing the actual amount of time before therequired pH is achieved. The solution is decanted after the four hour period to remove anyundissolved TSP prior to mixing and pH measurement. Mixing is necessary for proper operationof the pH instrument. The surveillance frequency is controlled under the Surveillance Frequency [Control Program ...MILLSTONE -UNIT 2 B 3/4 5-6 Amznmon N...÷,T.........d.e by, RC ........r dated REVERSE OF PAGE B 3/4 5-6INTENTIONALLY LEFT BLANK LBDCR 05-MP2-029December 9, 20083/4.6 CONTAINMENT SYSTEMSBASES3/4.6.1 PRIMARY CONTAINMENT3/4.6.1. 1 CONTAINMENT INTEGRITYPrimary CONTAINMENT INTEGRITY ensures that the release of radioactive materialsfrom the containment atmosphere will be restricted to those leakage paths and associated leakrates assumed in the accident analyses. Thisrestriction, in conjunction with the leakage ratelimitation, will limit the SITE BOUNDARY radiation doses to within the limits of 10 CFR 50.67during accident conditions.Primary CONTAINMENT INTEGRITY is required in MODES 1 through 4. This requiresan OPERABLE containment automatic isolation valve system. In MODES 1, 2, and 3 this issatisfied by the automatic containment isolation signals generated by low pressurizer pressure andhigh containment pressure. In MODE 4 the automatic containment isolation signals generated bylow pressurizer pressure and high containment pressure are not required to be OPERABLE.Automatic actuation of the containment isolation system in MODE 4 is not required becauseadequate time is available for plant operators to evaluate plant. conditions and respond bymanually operating engineered safety features components. Since the manual actuation (trippushbuttons) portion of the containment isolation system is required to be OPERABLE in MODE4, the plant operators can use the manual pushbuttons to rapidly position all automaticcontainment isolation valves to the required accident position. Therefore, the containmentisolation trip pushbuttons satisfy the requirement for an OPERABLE containment automaticisolation valve system in MODE 4.3/4.6.1.2 CONTAINMENT LEAKAGEThe limitations on containment leakage rates ensure that the total containment leakagevolume will not exceed the value assumed in the accident analyses at thlepeak accident pressureof Pa. As an added conservatism, the measured overall integrated leakage rate is further limited to< 0.75 La during performance of the periodic tests to account for possible degradation of thecontainment leakage barriers between leakage tests.The surveillance testing for measuring leakage rates is in accordance with theContainment Leakage Rate Testing Program.The Millstone Unit No. 2 FSAR contains a list of the containment penetrations that havebeen identified as secondary containment bypass leakage paths.3/4.6.1.3 CONTAINMENT AIR LOCKSThe limitations on closure and leak rate for the containment air locks are required to meetthe restrictions on CONTAINMENT INTEGRITY and leak rate given in Specifications 3.6.1.1andMILLSTONE -UNIT 2B3/4 6-1MILLTON -NIT2 B3/46-1Amendment No. 41-24, 34, April 14, 19993/4.6 CONTAINMENT SYSTEMSBASES3.6.1.2. The limitations on the air locks allow entry and exit into and out of the containmentduring operation and ensure through the surveillance testing that air lock leakage will not becomeexcessive through continuous usage.The ACTION requirements are modified by a Note that allows entry and exit to performrepairs on the affected air lock components. This means there may be a short time during whichthe containment boundary is not intact (e.g., during access through the OPERABLE door). Theability to open the OPERABLE door, even if it means the containment boundary is temporarilynot intact, is acceptable due to the low probability of an event that could pressurize thecontainment during the short time in which the OPERABLE door is expected to be open. Aftereach entry and exit, the OPERABLE door must be immediately closed.ACTION a. is only applicable when one air lock door is inoperable. With only one air lockdoor inoperable, the remaining OPERABLE air lock door must be verified closed within 1 hour.This ensures a leak tight containment barrier is maintained by use of the remaining OPERABLEair lock door. The 1 hour requirement is consistent with the requirements of TechnicalSpecification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, the remainingOPERABLE air lock door must be locked closed within 24 hours and' then verified periodically toensure an acceptable containment leakage boundary is maintained. Otherwise, a plant shutdown isrequired.ACTION b. is only applicable when the air lock door interlock mechanism is inoperable.With only the air lock interlock mechanism inoperable, an OPERABLE air lock door must beverified closed within 1 hour. This ensures a leak tight containment is maintained by use of anOPERABLE air lock door. The 1 hour requirement is consistent with the requirements ofTechnical Specification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, anOPERABLE air lock door must be locked closed within 24 hours and then verified periodically toensure an acceptable containment leakage boundary is maintained. Otherwise, a plant shutdown isrequired. In addition, entry into and exit from containment under the control of a dedicatedindividual stationed at the air lock to ensure that only one door is opened at a time (i.e., theindividual performs the function of the interlock) is permitted.ACTION c. is applicable when both air lock doors are inoperable, or the air lock isinoperable for any other reason excluding the door interlock mechanism. With both air lock doorsinoperable or the air lock otherwise inoperable, an evaluation of the overall containment leakagerate per Specification 3.6.1.2 shall be initiated immediately, and an air lock door must be verifiedclosed within 1 hour. An evaluation is acceptable since it is overly conservative to immediatelydeclare the containment inoperable if both doors in the air Jock have failed a seal test or if overallair lock leakage is not within limits. In many instances (e.g., only one seal per door has failed),containment remains OPERABLE, yet only 1 hour (per Specification 3.6.1.1) would be providedto restore the air lock to OPERABLE status prior to requiring a plant shutdown. In addition, evenwith both doors failing the seal test, the overall containment leakage rate can still be withinlimits.The 1 hour requirement is consistent with the requirements of Technical Specification3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, the air lock and/or at least one airlock door must be restored to OPERABLE status within 24 hours or a plant shutdown is required.MILLSTONE -UNIT 2B 3/4 6-1aMILLTON -NIT B /4 -laAmendment No. 34, 267 June 7, 2002CONTAINMENT SYSTEMSBASESContinuedSurveillance Requirement 4.6.1 .3.1 verifies leakage through the containment air lock iswithin the requirements specified in the Containment Leakage Rate Testing Program. Thecontainment air lock leakage results are accounted for in the combined Type B and C containmentleakage rate. Failure of an air lock door does not invalidate the previous satisfactory overall airlock leakage test because either air lock door is capable of providing a fission product barrier inthe event of a design basis accident.MILLSTONE -UNIT 2AmnetNo26B 3/4 6-lbAmendment No. 267 July 25, 2003CONASNENESSTMBASES3/4.6.1.4 INTERNAL PRESSUREThe limitations on containment internal pressure ensure that the containment peakpressure does not exceed the design pressure of 54 psig during MSLB or LOCA conditions.The maximum peak pressure is obtained from a MSLB event. The limit of 1.0 psig forinitial positive containment pressure will limit the total pressure to less than the design pressureand is consistent with the accident analyses.3/4.6.1.5 AIR TEMPERATUREThe limitation on containment air temperature ensures that the containment airtemperature does not exceed the worst case combined LOCA/MvSLB air temperature profile andthe liner temperature of 289°F. The containment air and liner temperature limits are consistentwith the accident analyses.The temperature detectors used to monitor primary containment air temperature arelocated on the 38 ft. 6 in. floor elevation in containment. The detectors are located approximately6 feet above the floor, on the southeast and southwest containment walls.3/4.6.1.6 DELETED%MILLSTONE -UNIT 2B 3/4 6-2Amendment No. 2-5, -3, 1-39, 204,-2-09, 9, 278 LBDCR 14-MIP2-001May 20, 2014CONTAINMENT SYSTEMSBASES314.6.2 DEPRESSURIZATION ANTD COOLING SYSTEMS3/4.6.2.1 CONTATNMENT SPRAY AND COOLING SYSTEMSThe OPERABILITY of the containment spray system ensures that contaimnentdepressurization and cooling capability will be available in the event of a LOCA. The pressurereduction and resultant lower containment leakage rate are consistent with the assumptions usedin the accident analyses.The OPERABILITY of the containment cooling system ensures that 1) the containmentair temperature will be maintained within limits during normal operation, and 2) adequate heatremoval capacity is available when operated in conjunction with the containment spray systemduring post-LOCA conditions.To be OPERABLE, the two trains of the containment spray system shall be capable oftaking a suction from the refueling water storage tank on a containmenat spray actuation signal andautomatically transferring suction to the containment surnp on a sump recirculation actuationsignal. Each containment spray train flow path fr'om the containmrent sump shall be via anOPERABLE shutdown cooling heat exchanger.'The containment cooling system consists of two containment cooling trains. Eachcontainment cooling train has two containment air recirculation and cooling units. For the purposeof applying the appropriate ACTION statement, the loss of a single containment air recirculationand cooling unit will make the respective containment cooling train inoperable.Either the containmrent spray system or the containment cooling system is sufficient tomitigate a loss of coolant accident. The containmaent spray system is nmore effective than thecontainment cooling system in reducing thetemperature of superheated steam inside containmentfollowing a mafin steam line break. Because of this, the containment spray system is required tomitigate a main steam line break accidenat inside cdntainmaent, In addition, the containment spraysystem provides a mechanism for removing iodine fr-om the containment atmosphere. Therefore,at least one train of containment spray is required to be OPERABLE when pressurizer pressure is> 1750 psia, and the allowed outage time for one train of containment spray reflects the dualfunction of containment spray for heat removal and iodine removal.With one containment spray train inoperable, the inoperable containment spray train mustbe restored to OPERABLE status within 72 hours. In this Condition, the remaining OPERABLEspray and cooling trains are adequate to perform the iodine removal and containment coolingfunctions. The 72 hours allowed outage time takes into account the redundant heat removalcapability afforded by the Contafinment Spray System and reason~able time for repairs.MILLSTONE -UNIT 2 B 3/4 6-3 Anmendment No. 2-5, 6-, o2---0, 4-l-, 2-s, -6, LBDCR 14-MIP2-001May 20, 2014CONTAINMENT SYSTEMSBASES3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued)With one required containment cooling train inoperable, the inoperable containmentcooling train must be restored to OPERABLE status within 7 days. The components in thisdegraded condition are capable of providing greater than 100% of the heat removal needs (for thecondition of one containment cooling train inoperable) after an accident.With one containmaent spray train and one containment cooling train inoperable, one*required containment spray train or one required containment cooling train must be restored toOPERABLE status within 48 hours. The components in this degraded condition provide iodineremoval capabilities and are capable of providing at least 100% of the heat removal needs after anaccident. The 48 hour allowed outage time was developed taking into account the redundant heatremoval capabilities afforded by combinations of the Containment Spray System andContainment Cooling System, the iodine removal function of the Containment Spray System, andthe low probability of a DBA occurring during this period.With two required containment spray trains inoperable, at least one of the requiredcontainment spray trains must be restored to OPERABLE status within 24 hours. Both trains ofcontainment cooling must be OPERABLE or be in H-OT SI{UTD OWN within the next 12 hours.The Condition is modified by a Note stating it is not applicable if the second containment spray train is intentionally declared inoperable. The Condition does not apply to voluntaiy removal ofredundant systems or components fr'om service. The Condition is only applicable if one train isinoperable for any reason and the second train is discovered to be inoperable, or if both trains arediscovered to be inoperable at the same time. In addition, LCO 3.7.6.1, "Control RoomEmergency Ventilation System," mnust be verified to be met within 1 hour. The components in thisdegraded condition are capable of providing :greater than 100% of the heat removral needs after anaccident. The allowed outage time is based on Reference 1 which demonstrated that the 24 hourallowed outage time is acceptable based on the redundant heat removal capabilities afforded bythe Containment Cooling System, the~iodine removal capability of the Control Room EmergencyAir Cleanup System, the infrequent use of the Required Action, and the small incremental effecton plant risk.With two required containment cooling trains inoperable, one of the required containmentcooling trains mustbe restored to OPERABLE status within 48 hours. The components in thisdegraded condition provide iodine removal capabilities and are capable of providing at least100% of the heat removal needs after an accident. The 48 hour allowed outage time wasdeveloped taking into account the redundant heat removal capabilities afforded by combinationsof the Containment Spray System and Containment Cooling System, the iodine removal functionof the Containment Spray System, and the low probability of a DBA occurring during this period.MILLSTONE -UNIT 2 B 3/4 6-3a Amendment No. -l-0, 24-&-, 293~6, 2L7-8, LBDCR 14-MvP2-016September 4, 2014CONTAINMENT SYSTEMSBASES3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued)Surveillance Requirement 4.6.2.1.1 .a verifies the correct alignment for manual, poweroperated, and automatic valves in the Contailnment Spray System flow paths to provide assurancethat the proper flow paths will exist for contaimnent spray operation. This surveillance does notapply to valves that are locked, sealed, or otherwise secured in position, since these valves wereverified to be in the correct position prior to locking, sealing, or securing. A valve that receives anactuation signal is allowed to be in a nonaccident position provided the valve automaticallyrepositions within the proper stroke time. This surveillance does not require any testing or valvemanipulation. R~ather, it involves verification that those valves capable of being mispositioned arein the correct position. The surveillance frequency is controlled under the Surveillance FrequencyControl Program.Surveillance Requirement 4.6.2.1.1 .b, which addresses periodic surveillance testing of thecontainment spray pumps to detect gross degradation caused by impeller structural damage orother hydraulic component problems, is required by the ASME OM Code. This type of testingmay be accomplished by measuring the pump developed head at only one point of the pumpcharacteristic curve. This verifies both that the measured perfonnance is within an acceptabletolerance of the original pump baseline performaance and that the performance at the test flow isgreater than or equal to the performance assumed in the unit safety analysis. The surveillancerequirements are specified in the Inservice Testing Program. The ASME~ OM Code provides theactivities and frequencies to satisfy the requirements.Surveillance Requirements 4.6.2.1.1l.c and 4.6.2.1.1.d demonstrate that each automaticcontainment spray valve actuates to the required position on an actual or simulated actuationsignal (CSAS or SRAS), and that each containmaent spray pump starts..on receipt of an actual orsimulated actuation signal (CSAS). This surveillance is not required for valves that are locked,sealed, or otherwise secured in the required position under administrative controls. Thesesurveillance frequencies are controlled under the Surveillance Frequency Control Program. Theactuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS)testing, and equipment performance is monitored as part of the Inservice Testing Program.MILLSTONE -UNIT 2 B 3/4 6-3b Amendment No. , 24g, 3, 7-S, LBDCR 14-MP2-01I6September 4, 2014CONTAINMENT SYSTEMSBASES3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued)Surveillance Requirement 4.6.2. 1.1.e requires verification that each spray nozzle isunobstructed following maintenance that could cause nozzle blockage. Normal plant operationand maintenance activities are not expected to trigger performance of this surveillancerequirement. However, activities, such as an inadvertent spray actuation that causes fluid flowthrough the nozzles, a major configuration change, or a loss of foreign material control whenworking within the respective system boundary may require surveillance performance. Anevaluation, based on the specific situation, will determnine the appropriate method (e.g., visualinspection, air or smoke flow test) to verify' no nozzle obstruction.Surveillance Requirement 4.6.2.1 .2.a demonstrates that each containment air recirculationand cooling unit can be operated in slow speed for > 15 minutes to ensure OPERABILITY andthat all associated controls are functioning properly. It also ensures fan or motor failure can bedetected and corrective action taken. The surveillance frequency is controlled under theSurveillance Frequency Control Program.Surveillance Requirement 4.6.2.1.2.b demonstrates a cooling water flow rate of> 500gpm to each containment air recirculation and cooling unit to provide assurance a cooling waterflow path through the cooling unit is available. The surveillance frequency is controlled under theSurveillance Frequency Control Program.Surveillance Requirement 4.6.2.1 .2.c demonstrates that each containment air recirculationand cooling unit starts on receipt of an actual or simulated actuation signal (SIAS). Thesurveillance frequency is controlled under the Surveillance Frequency Control Program. Theactuation logic is tested as part of the Engineered Safety~ Feature Actuation System (ESFAS)testing, and equipment perfonrmance is monitored as part of the Inservice Testing Program.REFERENCE1. WCAP- 161 25-NP-A, "Justification for Risk-Informed Modifications to Selected TechnicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UJNJIT 2 B 3/4 6-3c Amendment No. 0, 24-4, 2-36, 7-8, LBDCR 14-MP2-001May 20, 2014CONTAINMENT SYSTEMSBASES314.6.3 CONTAINMENT IS OLATION VALVESThe Technical Requirements Manual contains the list of containment isolation valves(except the containment air lock and equipment hatch). Any changes to this list will be reviewedunder 10CFR50.59 and approved by the committee(s) as described in the QAP Topical Report.The OPERABILITY of the containment isolation valves ensures that the containmentatmosphere will b~e isolated from the outside enviromnent in the event of a release of radioactivematerial to the containment atmosphere or pressurization of the containment. Containmentisolation within the time limnits specified ensures that the release of radioactive material to theenvironment will be consistent with the assumptions used in the analyses for a LOCA.The containment isolation valves are used to close all fluid (liquid and gas) penetrationsnot required for operation of the engineered safety feature systems, to prevent the leakage ofradioactive materials to the enviromnent. The fluid penetrations which may require isolation afteran accident are categorized as Type P, 0, or N. The penetration types for each containmentisolation valve are listed in PSAR Table 5.2-11, Containment Structure Isolation ValveInformation.Type P penetrations are lines that connect to the reactor coolant pressure boundary(Criterion 55 of 10OCFR5O, Appendix A). These lines are provided with two containment isolationvalves, one inside containment, and one outside containment.Type 0 penetrations are lines that are open to the containment internal atmosphere(Criterion 56 of 10CFR5O, Appendix A). These lines are provided with two containment isolationvalves, one inside containment, and one outside containment ... "Type N penetrations are lines that neither connect to the reactor coolant pressure boundarynor are open to the contaimnent internal atmospher~e, but do form a closed system within thecontainment structure (Criterion 57 of IOCFR50, Appendix A). These lines are provided withsingle containment isolation valves outside containment. These valves are either remotelyoperated or locked closed manual valves.With one or more penetration flow paths with one containment isolation valve inoperable,the inoperable valve must be restored to OPERABLE status or the affected penetration flow pathmust be isolated. The method of isolation must include the use of at least one isolation barrier thatcarmot be adversely affecte~d by a single active failure. Isolation barriers that meet this criterionare a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A checkvalve may not be used to isolate the affected penetration.MILLSTONE -UNIT 2 B 3/4 6-3d Amendment No. 2-10, , -6, 7,2g8-, LBDCRI14-MiP2-016September 4, 2014CONTAINMENT SYSTEMSBASES314.6.3 CONTAINMENT ISOLATION VALVES (Continued)If the containment isolation valve on a closed system becomes inoperable, the rem~ainingbarrier is a closed system since a closed system is an acceptable alternative to an automatic valve.However, ACTIONS must still be taken to meet Technical Specification ACTION 3.6.3.1 .d andthe valve, not normally considered as a containment isolation valve, and closest to thecontainment wall should be put into the closed position. No leak testing of the alternate valve isnecessary to satisfy the ACTION statement. Placing the manual valve in the closed positionsufficiently deactivates the penetration for Technical Specification compliance. Closed systemisolation valves applicable to Technical Specification ACTION 3.6.3.1 .d are included in FSARTable 5.2-11, and are the isolation valves for those penetrations credited as General DesignCriteria 57, (Type N penetrations). The specified time (i.e., 72 hours) of Technical SpecificationACTION 3.6.3.l.d is reasonable, considering the relative stability of the closed system (hence,reliability) to act as a penetration isolation boundary and the relative importance of supportingcontainment OPERABILITY during MODES 1, 2, 3, aind 4. In the event the affected penetrationis isolated in accordance with 3.6.3.1 .d, the affected penetration flow path must be verified to beisolated on a periodic basis, (Surveillance Requirement 4.6.1t.1 .a). This is necessary to assure leaktightness of containment and that containment penetrations requiring isolation following anaccident are isolated. The surveillance frequency is controlled under the Surveillance FrequencyControl Program.[OFor the purposes of meeting this LCO, neither the containment isolation valve, nor anyalternate valve on a closed system have a leakage limit associated with valve OPERABILITY.Containment isolation valves may be opened on an intennittent basis provided appropriateadministrative controls are established. The position of the NRC concerning acceptableadministrative controls is contained in Generic Letter 91-08, "Removal of Component Lists fromTechnical Specifications," and includes the following considerations:(1) stationing an operator, who is in constant communication with the control room, at thevalve controls,(2) instructing this operator to close these valves in an accident situation, and(3) assuring that environmental conditions will not preclude access to close the valve and thatthis action will prevent the release of radioactivity outside the containment.The appropriate administrative controls, based on the above considerations, to allowcontainment isolation valves to be opened are contained in the procedures that will be used tooperate the valves. Entries should be placed in the Shift Manager Log when these valves areopened and closed. However, it is not necessary to log into any Technical Specification ACTIONStatement for these valves, provided the appropriate administrative controls have beenestablished.MILLSTONE -UNIT 2 B 3/4 6-3e Amendment No. 21-O, 2-5~, -236, 2-g, gt LBDCR 14-MvlP2-001May 20, 2014CONTAINMENT SYSTEMSBASES3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued)If a containment isolation valve is opened while operating in accordance with Abnormalor Emergency Operating Procedures (AOPs and EOPs), it is not necessaiy to establish a dedicatedoperator. The AOPs and EOPs provide sufficient procedural control over the operation of theconatainment isolation valves.Opening a closed containment isolation valve bypasses a plant design feature thatprevents the release of radioactivity outside the containment. Therefore, this should not be donefrequently, and the time the valve is opened should be minimized. As a general guideline, a closedcontainment isolation valve should not be opened longer than the time allowed to restore thevalve to OPERABLE status, as stated in the ACTION statement for LCO 3.6.3.1 "ContainmentIsolation Valves."A discussion of the appropriate administrative controls for the containment isolationvalves, that are expected to be opened during operation in MODES 1 through 4, is presentedbelow.Manual contaimnent isolation valve 2-SI-463, safety injection tank (SIT) recirculationheader stop valve, is opened to fill or drain the SITs and for Shutdown Cooling System (SDC)boron equalization. While 2-SI-463 is open, a dedicated operator, in continuous commcrunicationwith the control room, is required.When SDC is initiated, SDC suction isolation remotely operated valves 2-SI-652 and2-SI-651 (inside containment isolation valve) and manual valve 2-SI-709 (outside containmentisolation valve) are opened. 2-SI-65 1 is normally operated from the cbnitrol room. While inMODES 1, 2 or 3, 2-SI-65 1 is closed with manual disconnect switch NSI65 1 locked open tosatisfy Appendix R requirements. It does not receive an automatic contailnment isolation closuresignal, but is interlocked to prevent opening if Reactor Coolant System (RCS) pressure is greaterthan approximately 275 psia. When 2-SI-65 1 is opened fr'om the control room, either one of thetwo required licensed (Reactor Operator) control room operators can be credited as the dedicatedoperator required for administrative control. It is not necessary to use a separate dedicatedoperator.When valve 2-SI-709 is opened locally, a separate dedicated operator is not required toremain at the valve. 2-SI-709 is opened before 2-SI-651. Therefore, opening 2-SI-709 will notestablish a connection between the RCS and the SDC System. Opening 2-SI-651 will connect theRCS and SDC System. If a problem then develops, 2-SI-651 can be closed from the control room.MILLSTONE -UNIT 2 B 3/4 6-3f Amendment No.24-0, 2-4,-2-36, 2-7-g, 2g3,......l.... by, NR ...C letter ae6//5 LBDCR 14-MP2-001May 20, 2014CONTAINMENT SYSTEMSBASES3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued)The administrative controls for valves 2-SI-651 and 2-SI-709 apply only duringpreparations for initiation of SDC, and during SDC operations. They are acceptable because RCSpressure and temperature are significantly below normal operating pressure and temperaturewhen 2-SI-651 and 2-SI-709 are opened, and these valves are not opened until shortly before SDCflow is initiated. The penetration flowpath can be isolated from the control room by closing either2-SI-652 or 2-SI-651, and the manipulation of these valves, during this evolution, is controlled byplant procedures.The pressurizer auxiliary, spray valve, 2-CH-5 17, can be used as an alternate method todecrease pressurizer pressure, or for boron precipitation control following a loss of coolantaccident. When this valve is opened from the control room, either one of the two required licensed(Reactor Operator) control room operators can be credited as the dedicated operator required foradministrative control. It is not necessary to use a separate dedicated operator.The exception for 2-CH-517 is acceptable because the fluid that passes through this valvewill be collected in the Pressurizer (reverse flow firom the Pressurizer to the charging system isprevented by check valve 2-CH-43 1), and thle penetration associated with 2-CH-5 17 is openduring accident conditions to allow flow from the charging pumaps. Also, this valve is normally 9,.:operated from the control room, under the supervision of the licensed control room operators, inaccordance with plant procedures.A dedicated operator is not required when opening remotely operated valves associatedwith Type N fluid penetrations (Criterion 57 of 10OCFR5O, Appendix A). Operating these valvesfr'om the control room is sufficient. The main steam isolation valves (2-MS-64A and 64B),atmospheric steam dump valves (2-MS-1 90A and 190B), and the containmaent air recirculationcooler RBCCW discharge valves (2-RB-28.2A-D).are examples of remotely operatedcontaim~aent isolation valves associated with Type N fluid penetrations.MSIV bypass valves 2-MS-65A and 65B are remotely operated MOVs, but while inMODE 1, they are closed with power to the valve motors removed via lockable disconnectswitches located at their respective MCC to satisfy' Appendix "R" requirements.Local operation of the atmospheric steam dump valves (2-MS-i190A and t 90B), or otherremotely operated valves associated with Type N fluid penetrations, will require a dedicatedoperator in constant communication with the control room, except when operating in accordancewith AOPs or EOPs. Even though these valves can not be classified as locked or sealed closed,the use of a dedicated operator will satisfy administrative control requirements. Local operation ofthese valves with a dedicated operator is equivalent to the operation of other manual (locked orsealed closed) containment isolation valves with a dedicated operator.MILLSTONE -UNIT 2 B 3/4 6-3g Amendment No. 21-i-, 2-6, 7-3, 2-7-8, LBDCR 14-MP2-001May 20, 2014CONTAINMENT SYSTEMSBASES3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued)The main steam supplies to the turbine driven auxiliary feedwater pump (2-MS-201 and2-MS-202) are remotely operated valves associated with Type N fluid penetrations. These valvesare maintained open during power operation. 2-MS-20 1 is maintained energized, so it can beclosed fr'om the control room, if necessary, for containment isolation. However, 2-MS-202 isdeenergized open by removing power to the valve's motor via a lockable disconnect switch tosatisfy Appendix R requirements. Therefore, 2-MS-202 cannot be closed irmmediately fr-om thecontrol room, if necessary, for containment isolation. The disconnect switch key to power for 2-MS-202 is stored in the Unit 2 control room, and can be used to re-power the valve at the MCC;this will allow the valve to be closed fr'om the control room. It is not necessary to maintain adedicated operator at 2-MS-202 because this valve is already in the required accident position.Also, the steam that passes through this valve should not contain any radioactivity. The steamgenerators provide the barrier between the containment and the atmosphere. Therefore, it wouldtake an additional structural failure for radioactivity to be released to the environment thr-ough thisvalve.Steam generator chemical addition valves, 2-F W-15A and 2-F W-15B, are opened to addchemicals to the steam generators using the Auxiliary Feedwater System (AFW). When either2-F W-15A or 2-F W-15B is opened, a dedicated operator, in continuous communication with thecontrol room, is required. Operation of these valves is expected during plant startup andshutdown.The bypasses around the main steam supplies to the turbine dr'iven auxiliary feedwaterpump (2-MS-201 and 2-MS-202), 2-MS-458 and 2-MS-459, are opened to drain water from thesteam supply lines. When either 2-MS-458 or 2-MS-459 is opened, a dedicated operator, incontinuous communication with the control room, is required. Operatlion of these valves isexpected during plant startup.The containment station air header isolatioin, 2-SA- 19, is opened to supply station air tocontainment. When 2-SA-1 9 is opened, a dedicated operator, in continuous communication withthe control room, is required. Operation of this valve is only expected for maintenance activitiesinside conatahnment.The backup air supply master stop, 2-IA-5 66, is opened to supply backup air to 2-CH-5 17,2-CH-5 18, 2-CH-5 19, 2-EB-88, and 2-EIB-89. When 2-IA-566 is opened; a dedicated operator, incontinuous communication with the control room, is required. Operation of this valve is onlyexpected in response to a loss of the normal air supply to the valves listed.MILLSTONE -UNIT 2 B 3/4 6-3h Amendment No. 4-0, 1-, 2-l-6, 7-,2-7 g 2 -83 LBDCR 14-MIP2-001May 20, 2014CONTAINMENT SYSTEMSBASES:3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued)The nitrogen header drain valve, 2-S1-045, is opened to depressurize the containment sideof the nitrogen supply header stop valve, 2-8I-312. When 2-SI-045 is opened, a dedicatedoperator, in continuous communication with the control room, is required. Operation of this valveis only expected after using the high pressure nitrogen system to raise SIT nitrogen pressure.The containment waste gas header test connection isolation valve, 2-GR-63, is opened tosample the drain tank for oxygen and nitrogen. When 2-GR-63 is opened, a dedicatedoperator, in continuous communication with the control room, is required. Operation of this valveis expected during plant startup and shutdown.The upstream vent valves for the steam generator atmospheric dump valves, 2-MS-369and 2-MS-3 71, are opened during steam generator safety valve set point testing to allow steamheader pressure instrumentation to be placed in service. When either 2-MS-3 69 or 2-MS-3 71 isopened, a dedicated operator in continuous communication with the control room is required.The detennination of the appropriate administrative controls for these containmentisolation valves included an evaluation of the expected enviromnental conditions. This evaluationhas concluded environmental conditions will not preclude access to close the valve, and thisaction will prevent the release of radioactivity outside of contaimntent through the respectivepenetration.The containment purge supply and exhaust isolation valves are required to be sealedclosed during plant operation since these valves have not been demonstr'ated capable of closingduring a LOCA or steam line break accident. Such a denmonstration would require justification ofthe mechanical OPERABILITY of the purgevyalves and consideration of the appropriateniess ofthe electrical override circuits. Maintaining these valves closed during plant operations ensuresthat excessive quantities of radioactive materials will not be released via the containment purgesystem. The containment purge supply and exhaust isolation valves are sealed closed by isolatinginstrument air and removing power from the valves, This is accomplished by closing theinstrument air isolation valves and pulling the control power fuses for. each of the valves. Theassociated instrument air isolation valves and fuse blocks are then locked. This is consistent withthe guidance contained in NUREG-0737 Item II.E.4.2 and Standard Review Plan 6.2.4,"Containment Isolation System," Item II.f.Surveillance Requirement 4.6.3.l.a verifies the isolation time of each power operatedautomatic containment isolation valve is within limits to demonstrate OPERABILITY. Theisolation time test ensures the valve will isolate in a time period less than or equal to that assumedin the safety analysis. The isolation time and surveillance frequency are in accordance with theInservice Testing Progr'am.MILLSTONE -UNIT 2 B 3/4 6-3i Amendment No. 2-3, 9 LBDCR 14-MP2-016September 4, 2014CBNASES NSSTMBASES3/4.6.4 COMBUSTIBLE GAS CONTROLSurveillance Requirement 4.6.3.1 .b demonstrate that each automatic containmentisolation valve actuates to the isolation position on an actual or simulated containment isolationsignal [containment isolation actuation signal (CIAS) or containment high radiation actuationsignal (containment purge valves only)]. This surveillance is not required for valves that arelocked, sealed, or otherwise secured in the required position under admninistrative controls. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program. Theactuation logic is tested as part of the Engineered Safety Feature Actuation System (ES FAS)testing, and equipment performance is monitored as part of the Inservice Testing Program.The OPERABILITY of the equipment and systems required for control of hydrogen gasensures that this equipment will be available to maintain the hydrogen concentration withincontaimnent below its flammable limit during post-LOCA conditions.The post-incident recirculation systems are provided to ensure adequate mixing of thecontainment atmosphere following a LOCA. This mixing action will prevent localizedaccumulations of hydrogen from exceeding the flammable limit.MILLSTONE -UNIT 2B 3/4 6-4Amendment No .-2~-3-3,Ackncw~gccl y NRC1011(31dAt REVERSE OF PAGE B 3/4 6-4INTENTIONALLY LEFT BLANK LBDCR 14-MiP2-001May 20, 2014CONTAINMENT SYSTEMSBASES3/4.6.5 SECONDARY CONTAIN~MENT3/4.6.5.1 ENCLOSURE BUILDING FILTRATION SYSTEMThe OPERABILITY of the Enclosure Building Filtration System ensures thatcontainment leakage occurring during LOCA conditions into the annulus will be filtered throughthe filters and charcoal adsorber trains prior to discharge to the atmosphere. Thisrequirement is necessary to meet the assumptions used in the accident analyses and limit the SITEBOUNDARY radiation doses to within the limits of 10 CFR 50.67 during LOCA conditions.With one Enclosure Building Filtration System Train inoperable, the inoperable train mustbe restored to OPERABLE status within 7 days. The components in this degraded condition arecapable of providing 100% of the iodine removal needs after a DBA. The 7 day allowed outagetune is based on consideration of such factors as the availability of the OPERABLE redundantEnclosure Building Filtration System Train and the low probability of a DBA occurring duringthis period.If two Enclosure Building Filtration System Trains are inoperable, at least one EnclosureBuilding Filtration System Train must be returned to OPERABLE status within 24 hours. TheCondition is modified by a Note stating it is not applicable if the second Enclosure BuildingFiltration System train is intentionally declared inoperable. The Condition does not apply tovoluntary removal of redundant systems or components from service. The Condition is onlyapplicable if one train is inoperable for any reason and the second train is discovered to beinoperable, or if both trains are discovered to be inoperable at the same time. In addition, at leastone train of containment spray must be verified to be OPERABLE within 1 hour. In the event ofan accident, containmaent spray reduces the potential radioactive release from the containment,which reduces the consequences of the inoperable Enclosure Building. Filtration System Trains.The allowed outage time is based on Reference 1 which demonstrated that the 24 hour allowedoutage time is acceptable based on the infrequent use of the Required Actions and the smallincremental effect on plant risk.The laboratory testing requirement for the charcoal sample to have a removal efficiency of> 95% is more conservative than the elemental and organic iodine removal efficiencies of 90%and 70%, respectively, assumed in the DBA analyses for the EBFS charcoal adsorbers in theMillstone Unit 2 Final Safety Analysis Report. A removal efficiency acceptance criteria of 95%will ensure the charcoal has the capability to perform its intended safety function throughout thelength of an operating cycle.MILLSTONE -UNIT 2 B3465AedetN.2~B 3/4 6-5Amendment No. gO8, LBDCR 14-MiP2-016September 4, 2014CONTAINMENT SYSTEMSBASES3/4.6.5.1 ENCLOSURE BUILDING FILTRATION SYSTEM (Continued)Surveillance Requirement 4.6.5.1 .b.l dictates the test frequency, method and acceptancecriteria for the EBFS trains (cleanup trains). These criteria all originate in the Regulatory Positionsections of Regulatory Guide 1.52, Rev. 2, March 1978 as discussed below:Section C.5 .a requires a visual inspection of the cleanup system be made before the followingtests, in accordance with the provisions of section 5 of AINSI N5 10-1975:* in-place air flow distribution test* DOP test* activated carbon adsorber section leak testSection C.5 .c requires the in-place Dioctyl phthalate (DOP) test for HiEPA filters to section 10 ofANSI N5 10-1975. The HEPA filters should be tested in place (1) initially, (2) at the frequencyspecified in the Surveillance Frequency Control Program, and (3) following painting, fire, orchemical release in any ventilation zone communicating with the system. The testing is to confirma penetration of less than or equal to 1 %* at rated flow. QSection C.5.d requires the charcoal adsorber section to be leak tested with a gaseous halogenatedhydrocarbon refrigerant, in accordance with section 12 of ANSI N5 10-1975 to ensure that bypassleakage through the adsorber section is less than or equal to 1%.** Adsorber leak testing shouldbe conducted (1) initially, (2) at the frequency specified in the Surveillance Freqluency ControlProgram, (3) following removal of an adsorber sample for laboratorytesting if the integrity of theadsorber section is affected, and (4) following painting, fire, or chemical release in any ventilationzone communicating with the system.REFERENCE1. WCAP-16 125-NP-A, "Justification for Risk-Informed Modifications to Selected TechnicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.* Means that the lIEPA filter will allow passage of less than or equal to 1% of the test concentrationinjected at the filter inlet from a standard DOP concentration injection.** Means that the charcoal adsorber sections will allow passage of less than or equal to 1% of theinjected test concentration around the charcoal adsorber sections.MILLSTONE -UNIT 2 B 3/4 6-5a Amendment No. 2Og, " LBDCR 14-MIP2-001May 20, 2014CONTAINMENT SYSTEMSBASES3/4.6.5.2 ENCLOSURE BUILDINGThe OPERABILITY of the Enclosure Building ensures that the releases of radioactivematerials fr'om the primary containment atmosphere will be restricted to those leakage paths andassociated leak rates assumed in the accident analyses. This restriction, in conjunction withoperation of the Enclosure Building Filtration System, will limit the SITE BOUNDARY radiationdoses to within the limits of 10 CFR 50.67 during accident conditions.One Enclosure Building Filtration SysteLn tr'ain is required to establish a negative pressureof 0.25 inches W.G. in the Enclosure Building Filtration Region within one minute after anEnclosure Building Filtration Actuation Signal is generated. The one minute time requirementdoes not include the time necessary for the associated emergency diesel generator to start andpower Enclosure Building Filtration System equipment.To enable the Enclosure Building Filtration System to establish the required negativepressure in the Enclosure Building, it is necessary to ensure that all Enclosure Building accessopenings are closed. For double door access openings, only one door is required to be closed andlatched, except for nornal passage. For single door access openings, that door is required to beclosed and latched, except for nonnal passage.If a required door that is designated to automatically close and latch is not capable ofautomatically closing and latching, the door shall be maintained closed and latched, or personnelshall be stationed at the door to ensure that the door is closed and latched after each trafisitthrough the door. Otherwise, the access opening (door) should be declared inoperable andappropriate technical specification ACTION statement entered.MILLSTONE -UNIT 2 B346S mnmn o 0gB 3/4 6-5bAmendment No. -a@8, [ REVERSE OF PAGE B 314 6-5bINTENTIONALLY LEFT BLANKK May 7, 20033/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVESThe OPERABILITY of the main steam line code safety valves (MSSVs) ensures that thesecondary system pressure will be limited to within 110% of the design pressure during the mostsevere anticipated system operational transient. The Loss of Electrical Load with Turbine Tripand the single main steam isolation valve (MSIV) closure event were evaluated at various powerlevels with a corresponding number of inoperable MSSVs. The limiting anticipated systemoperational transient is the closure of a single MSIV.The specified valve lift settings an~d relieving capacities are in accordance with the requirementsof Section III of the ASME Boiler and Pressure Vessel Code, 1971 Edition. The total ratedcapacity of the main steam line code safety valves is 12.7 x 106 lbs/hr. This is sufficient to relievein excess of 100% steam flow at RATED THERMAL POWER.The LCO requires all MSSVs to be OPERABLE. An alternative to restoring the inoperableMSSV(s) to OPERABLE status is to reduce power so that the available MSSV relieving capacitymeets ASME Code requirements for the power level. POWER OPERATION is allowed withinoperable MSSVs as specified within the limitations of the ACTION requirements.Less than the full number of OPERABLE MSSVs requires limitations on allowable THERMALPOWER and adjustment to the Power Level-High trip setpoint in accordance with ACTIONS a. 1and a.2. The 4 hours provided for ACTION a. 1 is a reasonable time period to reduce power leveland is based on the low probability of an event occurring during this period that would requireactivation of the MSSVs. ACTION a.2 provides for 36 hours to reduce the Power Level-High tripsetpoint. This time for ACTION a.2 is based on a reasonable time to correct the MSSVinoperability, the time required to perform the" power reduction, operating experience in resettingall channels of a protective function, and on the low probability of the occurrence of a transientthat could resulf in steam generator overpressure during this period.As described in Section 2.2.1 of the BASES, during a power reduction the Power Level-High tripsetpoint automatically tracks TI-ERMAL POWER downward so that it remains a fixed incrementabove the current power level, subject to a minimum value. Therefore, during short term reducedpower evolutions e.g., MSSV testing, it is permissible to only reduce THERMAL POWER inaccordance with ACTION a. 1 (the protective function of ACTION a.2 is automatically provideddue to the nature of the Power Level-High trip setpoint), provided that the MSSV testing can becompleted within the 36 hours provided for ACTION a.2.MILLSTONE -UNIT 2B 3/4 7-1MILLTONE- UIT 2B 3/7-IAmendment No. 5-2, 6-1-, 4-, 275 LBDCR 04-MP2.-016February 24, 20053/.7PLNS SSTM0BASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVES (Continued)The OPERABILITY of the MSSVs is defined as the ability to open within the setpointtolerances, relieve steam generator overpressure. and reseat when pressure has been reduced. Thelift setpoints for the MSSVs are listed in Table 4.7-1. This table allows a + 3% setpoint tolerance(allowable value) on the lift setting for OPERABILITY to account for drift over a cycle. EachMSSV .is demonstrated OPERABLE, with lift settings as shown in Table 4.7-1, in accordancewith Specification 4.0.5. A footnote to Table 4.7-1 requires that the lift setting be restored towithin 4- 1% of the setpoint (trip setpoint) following testing to allow for drift. While the liftsettings are being restored to a tolerance of+ 1-%, the MSSV will remain OPERABLE with liftsettings out of tolerance by as much as +- 3%.MILLSTONE -UNIT 2B 3/4 7-laAmendment No. 6-t-, 2-1-1-, 2t-5-,Acknowledged by NRC letter dated 6/28/05 LBDCR 11-MP2-013August 25, 20113/4.7 PLANT SYSTEMSBASES3/4.7.1.2 AUXILIARY FEEDWATER PUMPSThe OPERABILITY of the auxiliary feedwater pumps ensures that the Reactor CoolantSystem can be cooled down to less than 3 00°F from nornal operating conditions in the event of atotal loss of off-site power.The FSAR Chapter 14 Loss of Normal Feedwater: QON-F) analysis evaluates the eventoccurring with and without offsite power available, and a single active failure. This analysis hasdetermined that one motor driven AFW pump is not sufficient to meet the acceptance criteria.Therefore, two AFW pumps (two motor-driven AFW pumps, or one-motor driven AMW pumpand the steam-driven AFW pump) are required to meet the acceptance criteria for this moderatefrequency event. To meet the requirement of two AFW pumps available for mitigation, all threepumps must be OPERABLE to accommodate the failure of one pump. This is consistent with thelimiting cQndition for operation and ACTION statements of Technical Specification 3.7.1.2.Although not part of the bases of Technical Specification 3.7.1.2, the less conservativeFSAR Chapter 10 Best Estimate Analysis of the LONF event was performed to demonstrate thatone motor-driven AEW pump is adequate to remove decay heat, prevent steam generator drout,maintain Reactor Coolant System (RCS) subcooling, and prevent pressurizer level fromexceeding acceptable limits. This best estimate analysis is performed to demonstrate theautomatic start of both motor driven AFW pumps on low steam generator level satisfies theautomatic AFW initiation requirements of NUiREG-0737 Item lI.E. 1.2. Automatic start of theturbine driven AFW pump is not required. From this best estimate analysis of the LONE event, anevaluation was performed to demonstrate that a single motor-driven AEW pump has sufficientcapacity to reduce the RCS temperature to 3 00°F (in addition to decay heat removal) where theShutdown Cooling System may be placed into operation for continued cooldown. As a result ofthese evaluations, one motor-driven AEW pump (or the steam-driven AFW pump which hastwice the capacity of a motor-driven AFW pump) can meet the requirements to remove decayheat, prevent steam generator dryout, maintain RCS subcooling, prevent the pressurizer fromexceeding acceptable limits, and reduce RCS temperature to 3 00°3F.+The Auxiliary Feed Water (AFW) system is OPERABLE when the MFW pumps and flowpaths required to provide MFW to the steam generators are OPERABLE. Technical Specification3.7. 1.2 requires three MFW pumps to be OPERABLE and provides ACTIONS to addressinoperable AMW pumps. The MFW flow path requirements are separated into MFW pump suctionflow path requirements, MFW pump discharge flow path to the common discharge headerrequirements, and common discharge header to the steam generators flow path requirements.There are two MFW pump suction flow paths from the Condensate Storage Tank to theMFW pumps. One flow path to the turbine driven MFW pump, and one flow path to both motordriven MFW pumps. There are three MFW pump discharge flow paths to the common dischargeheader, one flow path from each of the three MFW pumps. There are two MFW discharge flowpaths from the common discharge header to the steam generators, one flow path to each steamgenerator. With 2-F W-44 open (normal position), the discharge from any MFW pump will besupplied to both steam generators through the associated MFW regulating valves.MILLSTONE -UN[T 2 B 3/4 7-2 Amendment No. g2, 64-, 6-3, 44-t, 2, 36,'2-4, LBD CR 04-MP2-016February 24, 2005PLANT SYSTEMSBASES3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued)2-F W-44 should remain open when the AFW system is required to be OPERABLE(MODES 1, 2, and 3). Closing 2-F W-44 places the plant in a configuration not considered as aninitial condition in the Chapter 14 accident analyses. Therefore, if 2-F W-44 is closed while theplant is operating in MODES 1, 2, or 3, two AEW pumps should be considered inoperable and theappropriate ACTION requirement of Technical Specification 3.7.1.2 entered to limit plantoperation in this configuration.A flow path may be considered inoperable as the result of closing a manual valve, failureof an automatic valve to respond correctly to an actuation signal, or failure of the piping. In thecase of an inoperable automatic AFW regulating valve (2-F W-43A or B), flow pathOPERABILITY can be restored by use of a dedicated operator stationed at the associated bypassvalve (2-F W-56A or B) as directed by OP 2322. Failure of the common discharge header pipingwill cause both discharge flow paths to the steam generators to be inoperable.An inoperable suction flow path to the turbine driven AFW pump will result in oneinoperable AFW pump. An inoperable suction flow path to the motor driven AFW pumps willresult in two inoperable MFW pumps. The ACTION requirements of Technical Specification3.7.1.2 are applicable based on the number of inoperable AFW pumps.An inoperable pump discharge flow path from an MFW pump to the common dischargeheader will cause the associated AFW pump to be inoperable. The ACTION requirements ofTechnical Specification 3.7.1.2 for one MFW pump are applicable for each affected pumpdischarge flow path.MFW must be capable of being delivered to both steam generators for design basisaccident mitigation. Certain design basis events, such as a main steam line break or steamgenerator tube rupture, require that the affected steam generator be isolated, and the RCS decayheat removal safety function be satisfied by feeding and steaming the unaffected steam generator.If a failure in an MFW discharge flow path from the common discharge header to a steamgenerator prevents delivery of MFW to a steam generator, then the design basis events may not beeffectively mitigated. In this situation, the ACTION requirements of Technical Specification 3.0.3are applicable and an immediate plant shutdown is appropriate.Two inoperable AFW System discharge flow paths from the common discharge header toboth steam generators will result in a complete loss of the ability to supply MFW flow to the steamgenerators. In this situation, all three MFW pumps are inoperable and the ACTION requirementsof Technical Specification 3.7.1.2. are applicable. Immediate corrective action is required.However, a plant shutdown is not appropriate until a discharge flow path from the commondischarge header to one steam generator is restored.MILLSTONE -UNIT 2 B 3/4 7-2a Amendment No. ,Acknowledged by NRC letter dated 6/28/05 November 10, 2005LBDCR 04-MP2-0133/4.7 PLANT SYSTEMSBASES3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued)If the turbine-driven auxiliary feedwater train is inoperable due to an inoperable steamsupply in MODES 1, 2, and 3, or if the turbine-driven auxiliary feedwater pump is inoperablewhile in MODE 3 immediately following REFUIEL1INJQ action must be taken to restore theinoperable equipment to an OPERABLE status within 7 days. The 7 day allowed outage time isreasonable, based on the following:a. For the inoperability of the turbine-driven auxiliary feedwater pump due aninoperable steam supply, the 7 day allowed outage time is reasonable since theauxiliary feedwater system design affords adequate redundancy for the steamsupply line for the turbine-driven pump.b. For the inoperability of a turbine-driven auxiliary feedwater pump while in MODE3 immediately subsequent to a refueling, the 7 day allowed outage time isreasonable due to the minimal decay heat levels in this situation.c. For both the inoperability of the turbine-driven pump due to an inoperable steamsupply and an inoperable turbine-driven auxiliary feedwater pump while in MODE3 immediately following a refueling outage, the 7 day allowed outage time isreasonable due to the availability of redundant OPERABLE motor driven auxiliaryfeedwater pumps, and due to the low probability of an event requiring the use ofthe turbine-driven auxiliary feedwater pump.When one steam supply to the turbine-driven auxiliary feedwater pump is inoperable, theturbine-driven auxiliary feedwater pump is inoperable. In this case, although the turbine-drivenauxiliary feedwater pump with a single oper~able steam supply is capable of perfonning its safetyfunction in the absence of a single failure, the turbine-driven auxiliary feedwater pump isconsidered inoperable due to the lack of redundancy with respect to steam supplies.The required ACTION dictates that if the 7 day allowed outage time is reached the unitmust be in at least HOT STAND)BY within the next 6 hours and in HOT SHUTDOWN within thefollowing 12 hours.The allowed time is reasonable, based on operating experience, to reach the requiredconditions from full power conditions in an orderly manner and without challenging plantsystems.MILLSTONE -UNIT 2 B 3/4 7-2b Amendment No. g2, 6-1-, 63-, 2-l44,-2-36,2g3-2, LB3DCR 14-MIP2-016September 4, 20143/4.7 PLANT SYSTEMSBASES 03/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued')A Note limits the applicability of the inoperable equipment condition b. to when the unithas not entered MODE 2 following a REFUELING..Required ACTION b. allows one auxiliaryfeedwater pump to be inoperable for 7 days vice the 72 hour allowed outage time in requiredACTION c. This longer allowed outage time is based on the reduced decay heat followingREFUELING and prior to the reactor being critical.With one of the auxiliary feedwater PUmps inoperable in MODE 1, 2, or 3 for reasons other thanACTION a. or b., ACTION must be taken to restore the inoperable equipment to OPERABLEstatus within 72 hours. This includes the loss of both steam supply lines to the turbine-drivenauxiliary feedwater pump. The 72 hour allowed outage time is reasonable, based on redundantcapabilities afforded by the auxiliary feedwater system, time needed for repairs, and the lowprobability of a DBA occurring during this time period. Two auxiliary feedwater pumps and flowpaths remain to supply feedwater to the steam generators.If all three AFW pumps are inoperable in MODE 1, 2, or 3, the unit is in a seriouslydegraded condition with no safety related means for conducting a cooldown, and only limitedmeans for conducting a cooldown with non-safety related equipment. In such a condition, the unitshould not be perturbed by any action, including a power change that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW pumpto OPERABLE status. Required ACTION e. is modified by a Note indicating that all requiredMODE changes or power reductions are suspended until one MFW pump is restored toOPERABLE status. Ina this case, LCO 3.0,3 is not applicable because it could force the unit into aless safe condition.During periodic surveillance testing. of the turbine driven AFW pump, valve 2-CN-27A isclosed and valve 2-CN-28 is opened to prevent overheating the water being circulated. In thisconfiguration, the suction of the turbine driven AFW pump is aligned to the Condensate StorageTank via the motor driven AFW pump suction flow path, and the pump minimum flow is directedto the Condensate Storage Tank by the turbine driven AFW pump suction path upstream of2-CN-27A in the reverse direction. During this surveillance, the suction path to the motor drivenAFW pump suction path remains OPERABLE, and the turbine driven AFW suction path isinoperable. In this situation, the ACTION requirements of Technical Specification 3.7.1.2 for oneMFW pump are applicable. The surveillance frequency is controlled under the SurveillanceFrequency Control Program.IMILLSTONE -UNIT 2 B3472 mnmn o 8-B 3/4 7-2cAmendment No. -2gg, LBDCR 14-MP2-016September 4, 20143/4.7 PLANT SYSTEMSBASES3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued)Surveillance Requirement 4.7.1I.2.a verifies the correct alignment for manual, power operated,and automatic valves in the Auxiliary Feedwater (AFW) System flow paths (water and steam) toprovide assurance that the proper flow paths will exist for AFW operation. This surveillance doesnot apply to valves that are locked, sealed, or otherwise secured in position, since these valveswere verified to be in the correct position prior to locking, sealing, or securing. A valve thatreceives an actuation signal is allowed to be in a nonaccident position provided the valveautomatically repositions within the proper stroke time. This surveillance does not require anytesting or valve manipulation. Rather, it involves verification that those valves capable of beingmispositioned are in the correct position. The surveillance frequency is controlled under theSurveillance Frequency Control Progr'am.Surveillance Requirement 4.7.1.2.b, which addresses periodic surveillance testing of theAFW pumps to detect gross degradation caused by impeller structural damage or other hydrauliccomponent problems, is required by the ASMIE Code for Operations and Maintenance of NuclearPower Plants (ASME GM Code). This type of testing may be accomplished by measuring thepump developed head at only one point of the pump characteristic curve. This verifies both thatthe measured performance is within an acceptable tolerance of the original pump baselineperformance and that the performance at the test flow is greater than or equal to the perfonnanceassumed in the unit safety analysis. The surveillance requirements are specified in the InserviceTesting Program. The ASME GM Code provides the activities and frequencies necessary tosatisfy the requirements. This surveillance is modified to indicate that the test can be deferred forthe steam driven AFW pump until suitable plant conditions are established. This deferral isrequired because steam pressure is not sufficient to perform the test until after MODE 3 isentered. Once the unit reaches 800 psig, 24 hours would be allowed for completing thesurveillance. However, the test, if required, must be performed prior to entering MODE 2.Surveillance Requirements 4.7.1.2.c and 4.7.1 .2.d demonstrate that each automatic AFWvalve actuates to the required position on an actual or simulated actuation signal (AF WAS) andthat each AFW pump starts on receipt of an actual or simulated actuation signal (AF WAS). Thissurveillance is not required for valves that are locked, sealed, or Otherwise secured in the requiredposition under administrative controls. The surveillance frequency is controlled under theSurveillance Frequency Control Program. The actuation logic is tested as part of the EngineeredSafety Feature Actuation System (ESFAS) testing, and equipment performance is monitored aspart of the Inservice Testing Program. These surveillances do not apply to the steam driven AFWpump and associated valves which are not automatically actuated.MILLSTONE -UNIT 2 B3472 mnmn oB 3/4 7-2dAmendment No. November 10, 2005LBDCR 04-MP2-0133/.7PLNS SSTM0BASES3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued)Surveillance Requirement 4.7.1 .2.e demonstrates the AIEW System is properly aligned byverifyiing the flow path to each steam generator prior to entering MODE 2, after 30 cumulativedays in MODE 5, MODE 6, or a defueled condition. OPERABILITY of the AFW flow pathsmust be verified before sufficient core heat is generated that would require operation of the AFWSystem during a subsequent shutdown. To further ensure AEW System alignment, theOPERABILITY of the flow paths is verified following extended outages to determine that nomisalignmaent of valves has occurred. The frequency is reasonable, based on engineeringjudgment, and other administrative controls to ensure the flow paths are OPERABLE.3/4.7.1.3 CONDENSATE STORAGE TANKThe OPERABILITY of the condensate storage tank with the minimum water volumeensures that sufficient water is available for cooldown of the Reactor Coolant System to less than300°F in the event of a total loss of off-site power. The minimum water volume is sufficient tomaintain the RCS at HOT STANDBY conditions for 10 hours with steam discharge toatmosphere. The contained water volume limit includes an allowance for water not usable due todischarge nozzle pipe elevation above tank bottom, plus an allowance for vortex formation. ib3/4.7.1.4 ACTIVTYThe limitations on secondary system specific activity ensure that the resultant off-siteradiation dose will be limited to a small fractionMILLSTONE -UNIT 2 B 3/4 7-2e Amendment No. . LBDCR 04-MP2-016February 24, 2005PLANT SYSTEMSBASES..3/4.7.1i.4 ACTIVITY (Continued)of 10 CFR Part 100 limits in the event of a steam line rupture. The dose calculations for anassumed steam line rupture include the effects of a coincident 1.0 GPM primary to Secondary tube -.leak in the steam generator of the affected steam line and a concurrent loss of offsite electricalpower. These values are consistent with theassumptions used in the accident analyses.3/4.7.1.5 MAIN STEAM. LINE IsoLATIoN VALVESThe OPERABILITY of the main steam line isolation valves ensures, that no *more than onesteam generator will blowdown in the event of a steam line rupture. This restriction is *required to1I) minimize te p~ositi.ve Teactivity ffe tfth'e Ractor, Coklant;,Siystem-.o-ol[down i.sso~5iated.with the blowdown, and:2) -limiti-the!pr~es~sure-rise:w~ithin-coigtginmehtiin:he- eve-nt--th, steoan l~inerupture occurs within conitainment. fTheOP'ERABILITY of the maini steam valves withinthe closure times of the surveillance requiremenats are consistent with the assumptions used in theaccident analyses.The ability of the main steam line isolation valves (MSIVs) to close is verified after theplant has been heated up. Since it is necessary to establish a high Reactor Coolant Systemtemperature before the surveillance test can be performed, on exception to TechnicalSpecification 4.0.4 has been added to SR 4.7.1.5 to allow entry into MODE 3. This is necessary toallow plant startup to proceed with equipment that is believed to be OPERABLE; but that Cannotbe verified by performance of the surveillance test until the appropriate plant conditions havebeen established. After entering MODE 3 and establishing the necessary plant conditions(Tavg > 51 50F), the MSIVs will be declared inoperable if SR 4.7.1.5 has not been performedwithin the required frequency, plus 25%, in accordance with Technical Specifications 4.0:2 and4.0.3. The ACTION statement for MODES 2 and 3 Would thenbe entered. However, the requiredACTIONS can be deferred for up to 24 hours (Technical Specification 4.0.3) to allowperformance of SR 4.7.1.5. If the surveillance test is not performed within this 24 hour timeperiod, the requirements of the ACTION statement for MODES 2 and 3 apply, and the MSIV(s) [must be either restored to OPERABLE status or closed. Closing the MSIV(s) put the valve(s) inthe required accident condition. However, the MSIV(s) may be opened to perform SR 4.7.1.5. Ifthe MSIV(s) carmnot be closed, the plant must be shut down to MODE 4.3/4.7.1.6 MAMN FEEDWATER ISOLATION COMIPONENTS (MFICS)Feedwater isolation response time ensures a rapid isolation of feed flow to the steam.generators via the feedwater regulating valves, feedwater bypass Valves, and: as backup, feedpump discharge valves. :The response time includes signal generation time and valve stroke. Feedline block valves also receiveMILLSTONE -UNIT 2 'B 3/4 7-3 Amendment No. 4-88, 24-9,Acknowledged by NRC letter dated 6/28/05 LBDCR 07-MP2-03 1August 8, 2007PLANT SYSTEMSBASESa feedwater isolation signal Since the steam line break accident analysis credits them in preventionof feed line volume flashing in some cases. Feedwater pumps are assumed to trip immediatelywith an MSI signal.3/4.7.1.7 ATMOSPHERIC DUMP VALVESThe atmospheric dump valve (ADV) lines provide a method to maintain the unit* in HoTSTANDBY, and to replace or supplement the condenser steam dump valves to cool the unit toShutdown Cooling (SDC) entry conditions. Each ADV line contains an air operated.ADV, and anuipstream manual isolation Vcalve. The manual isolation valves are normally open; anid the ADVSclosed. The ADVs, which are normally operated from the main control* room, can be operated*locally using a manual handwheel.An ADV is, ..if the manual iso~latin val~ve-,iS,,pen and .if~tocal:-mranual..of theADN.c~an bed u ;9:4 t: eroxc~nrolole4;0r~easeofgstamn .t t~he *atospere. If:the manual isolation valve is closed the ADV line is inoperable The considerable: time and effortrequired to open the valve Wvould challenge the timing of critical operator act~ions and establishedoperator dose limits. This is consistent with the LOCA analysis and Steam Generator TubeRupture analysis which credits local manual operation of the ADV lines for accident mitigation.3/4.7.1.8 STEAM GENERATOR BLOWDOWN ISOLATION VALVESThe steam generator blowdown isolation valves will isolate steam generator blowdown on*low steam generator water level; An auxiliary feedwater actuation signal will also be generated at*this steam generator water level. Isolation of steam generator: blowdown will conserve steamgenerator water inventory following, a loss of main feedwater. The steam generator blowdownisolation valves will also*close automatically upon receipt of a containment isolation signal or ahigh radiation signal (steam generator blowdown or condenser air ejector discharge).3/4.7.2 DELETED...3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER sYSTEMThe OPERABILITY of the Reactor Building Closed Cooling Water*(RBCCw) Systemensures that sufficient cooling capacity is available for continued operation of vital componentsand Engineered Safety Feature equipment during normal and accident conditions. The redundantcooling capacity of this system, assuming a single failure, is consistent with the ass usedin the accident analyses...The RBcCW loops areredundant of each other to the degree that each has separate controls andpower supplies and the operation of one does not depend on the other. In the event of a'designbasis accident,: one RBCCW ioop is required to provide the minimum heat removal capabilityassumed in the safety analysis for the systems to. which it supplies cooling water. To enSure thisrequirement is met, two RBCCW loops must be OPERABLE, and independent to the extent"necessary to ensure that a single failure will not result in the unavailabilityMILLSTONE -UNIT 2 B 3/4 7-3a Amendment No. 2N-l9, &224, 226,24m6,-~2-8,-2-7-2, January 10, 2002PTSCR 2-18-01May 1, 2002PLANT SYSTEMSBASESof both RBCCW loops. At least one RBCCW ioop will operate assuming the worst single activefailure occurs following a design basis accident coincident with a loss of offsite power, or theworst single passive failure occurs during post-loss of coolant accident long tenn cooling. Systemdesign is assumed to mitigate the single active failure. System design or operator action isassumed to mitigate the passive failure.The RBCCW System has numerous cross connection points between the redundant loops, withmanual valve isolation capability. When these valves are opened, the two system ioops are nolonger independent. The loss of independence will result in one large RBCCW loop. This mayadversely impact the ability of the RBCCW System to mitigate the design basis events if a singlefailure, active or passive, occurs. Opening the manual cross-connection valves during normaloperation should be evaluated to ensure system stability, minimum component cooling flowrequirements, and the ability to mitigate the design basis events coincident with a single failureare maintained. Continuous operation with cross-connection valves open is acceptable if theconfiguration has been evaluated and protection against a single failure can be demonstrated.(Several system configurations that have been evaluated and determined acceptable forcontinuous plant operation are identified below). If opening a cross-connection valve will result ina plant configuration that does not provide adequate protection against a single failure, thefollowing guidance app lies. If only the manual cross-connect valves have been opened, and theR.BCCW System is in a normal configuration otherwise, with all system equipment OPERABLE,one RBCCW loop should be considered inoperable and the ACTION requirements of TechnicalSpecification 3.7.3.1 applied. If the RBCCW System is not in a normal configuration otherwiseand/or not all equipment is OPERABLE, both RBCCW loops should be considered inoperableand the ACTION requirements of Technical Specification 3.0.3 applied.The loss of loop independence is equivalent to the situation w!here one loop is inoperable.If one loop is inoperable, the remaining OPERABLE loop will be able to meet all design basisaccident functions, assuming an additional single failure does not occur. If the loops are notindependent, the remaining single large OPERABLE loop will be able to meet all design basisaccident functions, assuming a single failure does not occur. Operation in a plant configurationwhere protection against a single failure can not be shown is acceptable provided the time periodin that configuration is limited to less than the Technical Specification specified allowed outagetrine. It is acceptable to operate in the off normal plant configurations identified in the ACTIONrequirements for the time periods specified due to the low probability of occurrence of a designlbasis event concurrent with a single failure during this limited trime period. The allowed outagetime for one inoperable RBCCW loop provides an appropriate lrimit for continued operation withonly one OPERABLE RBCCW loop, and can be applied to a plant configuration where only loopindependence has been compromised. The loop determined to be inoperable should be the loopthat results in the most adverse plant configuration with respect to the availability of accidentmitigation equipment. Restoration of loop independence within the trime constraints of theallowed outage time is required, or a plant shutdown is necessary.MILLSTONE -UNIT 2 B 3/4 7-3b Revised by NRC Letter A 15689Amendment No. LIBDCR 14-MIP2-016September 4, 2014PLANT SYSTEMSBASES3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER SYSTEM (Continued)It is acceptable to operate with the RBCCW pump minimum flow valves (2-RB-107A, 2-RB-l07B, 2-RiB-107C), RBCCW pump sample valves (2-RB-56A, 2-RiB-56B, and 2-RB-56C),and the RBCCW pump radiation monitor stop valves (2-RIB-39, 2-RB-4t,and 2-RB-43) open. Anactive single failure will not adversely impact both RBCCW loops with these valves open. Inaddition, protection against a passive single failure after the initiation of post-loss of coolantaccident long term cooling is achieved by manually closing these accessible valves, as directed bythe emergency operating procedures. In addition, operation with RBCCW chemical additionvalves (2-RB-50A and 2-RB-50B) open during chemical addition evolutions is acceptable sincethese normally closed valves are opened to add chemicals to the RBCCW and then closed asdirected by nonnal operating procedures. Therefore, operation with these valves open does notaffect OPERABILITY of the RBCCW loops.Surveillance Requirement 4.7.3.1 .a verifies the correct alignment for manual, poweroperated, and automatic valves in the RBCCW System flow paths to provide assurance that theproper flow paths exist for RBCCW operation. This surveillance does not apply to valves that arelocked, sealed, or otherwise secured in position, since thlese valves were verified to be in thecorrect position prior to locking, sealing, or securing. A valve that receives an actuation signal isallowed to be in a nonaccident position provided the valve automatically repositions within theproper stroke time. This surveillance does not require any testing or valve manipulation. Rather, itinvolves verification that those valves capable of being mispositioned are in the correct position.The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.7.3.1 .b and 4.7.3.1 .c demonstrate that each automaticRBCCW valve actuates to the required position on an actual or simulated actuation signal and thateach RBCCW pump starts on receipt of an actual or simulated actuation signal. This Surveillanceis not required for valves that are locked, sealed, or otherwise secured in the required positionunder administrative controls. These surveillance frequencies are controlled under theSurveillance Frequency Control Program. The actuation logic is tested as part of the EngineeredSafety Feature Actuation System (ESFAS) testing; and equipment performance is monitored aspart of the Inservice Testing Program.3/4.7.4 SERVICE WATER SYSTEMThe OPERABILITY of the Service Water (SW) System ensures that sufficient coolingcapacity is available for continued operation of vital components and Engineered Safety Featureequipment during normal and accident conditions. The redundant cooling capacity of this system,assuming a single failure, is consistent with the assumptions used in the accident analyses.MILLSTONE -UNIT 2 B 3/4 7-3c Amendment No. -249, g22, 36,2-3&, 2a7-3 February 13, 2003PLANT SYSTEMSBASES3/4.7.4 SERVICE WATER SYSTEM (continued)The SW loops are redundant of each other to the degree that each has separate controls and powersupplies and the operation Of one does not depend on the other. In the event of a design basis accident, oneSW loop is required to provide the minimum heat removal capability assumed in the safety analysis for thesystems to which it supplies cooling water. To ensure this requirement is met, two SW loops must beOPERABLE, and independent to the extent necessary to ensure that a single failure will not result in theunavailability of both SW loops. At least one SW loop will operate assuming the worst single active failureoccurs following a design basis accident coincident with a loss of offsite power, or the worst single passivefailure occurs post-loss of coolant accident long term cooling. System design is assumed to mitigate thesingle active failure. System design or operator action is assumed to mitigate paissive failure.The SW System has numerous cross connection points between the redundant loops, with manualvalve isolation capability. When these valves are opened, the two system loops are no longer independent.The loss of independence will result in one large SW loop. This may adversely impact the ability of theSW System to mitigate the design basis events if a single failure, active or passive, occurs. Opening themanual cross-connection valves during normal operation should be evaluated to ensure system stability,minimum component cooling flow requirements, and the ability to mitigate the design basis eventcoicident with a single failure are maintained. Continuous operation with cross-connection valves open isacceptable if the configuration has been evaluated and protection against a single failure can bedemonstrated. (SeVeral system configurations that have been evaluated and determined acceptable forcontinuous plant operation are identified below). If opening a cross-connection valve will result in a plantconfiguration that does not provide adequate protection against a single failure, the following guidanceapplies: If only the manual cross-connect valves have been opened, and the SW System is in a normalconfiguration otherwise, with all system equipment OPERABLE, one SW loop should be consideredinoperable and the ACTION requirements of Technical Specification 3.7.4.1 applied. If the SW System isnot in a normal configuration otherwise and/or not all equipment is OPERABLE, both SW loops should beconsidered inoperable and the ACTION requirements of Technical Specification 3.0.3 applied.The loss of loop independence is equivalent to the situation where one loop is inoperable. If oneloop is inoperable, the remaining OPERABLE loop will be able to meet all design basis accident functions,assuming an additional single failure does not occur. If the loops are not independent, the remaining singlelarge OPERABLE loop will be able to meet all design basis accident functions, assuming a single failuredoes not occur. Operation in a plant configuration where protection against a single failure can not beshown is acceptable provided the time period in that configuration is limited to less then the TechnicalSpecification specified allowed outage time. It is acceptable to operate in the off normal plantconfigurations identified in the ACTION requirements for the time periods specified due to the lowprobability of occurrence of a design basis event concurrent with a single failure during this limited timeperiod. The allowed outage time for one inoperable SW loop provides an appropriate limit for continuedoperation with only one OPERABLE SW loop, and can be applied to a plant configuration where onlyloop independence has been compromised. The loopMILLSTONE -UNIT 2B3473AmnetNo23B3/4 7-3dAmendment No. 273 REVERSE OF PAGE B314 7-3dINTENTIONALLY LEFT BLANK LBDCR I4-MiP2-016September 4, 2014PLANT SYSTEMSBASES3/4.7.4 SERVICE WATER SYSTEM (Continued)determined to be inoperable should be the ioop that results in the most adverse plant configurationwith respect to the availability of accident mitigation equipment. Restoration of ioopindependence within the time constraints of the allowed outage time is required, or a plantshutdown is necessary.-Branch lines are supplied to isolation valves in the intake for lubrication to the circulatingwater pump bearings (2-S W-298 and 2-S W-299), and alternate supply connections (2-S W-84A,and 2-S W-84B). The flow restricting orifices in these lines ensure that safety related loadscontinue to receive minimum required flow during a LOCA (in which the lines remain intact), orduring a seismic event (when the lines break) even with the valves open. Therefore, operationwith these valves open does not affect OPERABILITY of the SW loops.Surveillance Requirement 4.7.4.1 .a verifies the correct alignment for manual, poweroperated, and automatic valves in the Service Water (SW) System flow paths to provide assurancethat the proper flow paths exist for SW operation. This surveillance does not apply to valves thatare locked, sealed, or otherwise secured in position, since these valves were verified to be in thecorrect position prior to locking, sealing, or securing. A valve that receives an actuation signal isallowed to be in a nonaccident position provided the valve automatically repositions within theproper stroke time. This surveillance does not require any testing or valve manipulation. Rather, itinvolves verification that those valves capable of being mispositioned are in the correct position.The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.7.4.1l.b and 4.7.4.l.c demonstrate that each automatic SWvalve actuates to the required position on an actual or simulated actuation signal and that each SWpump starts on receipt of an actual or simulated actuation signal. This surveillance is not requiredfor valves that are locked, sealed, or otherwise secured in the required position underadministrative controls. These surveillance frequencies are controlled under the SurveillanceFrequency Control Program. The actuation logic is tested as part of the Engineered Safety FeatureActuation System (ESFAS) testing, and equipment performance is monitored as part of theInservice Testing Program..3/4.7.5 DELETEDMILLSTONE -UNIT 2B 3/4 7-4MILLTON -NIT2 B3/47-4Amendment No. 2g-36, June 25, 2007LBDCR 07-MP2-013PLANT SYSTEMSBASES 03/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEMThe OPERABILITY of the Control Room Emergency Ventilation System ensures that1) the ambient air temperature does not exceed the allowable temperature for continuous dutyrating for the equipment and instrumentation cooled by this system and 2) the control room willremain habitable for operations personnel during and following all credible accident conditions.The OPERABILITY of thiis system in conjunction with control room design provisions isbased on limiting the radiation exposure to personnel occupying the control room. For allpostulated design basis accidents, the radiation exposure to personnel occupying the control roomshall be 5 rem TEDE or less consistent with the requirements of 10 CFR 50.67The Control Room Envelope (CRIB) is the area within the confines of the GRE boundary thatcontains the spaces that control room occupants inhabit to control the unit during normal andaccident conditions. This area encompasses the control room, and other non-critical areasincluding adjacent support offices, and utility rooms. The GRE is protected during normaloperation, natural events, and accident conditions. The GRE boundary is the combination ofwalls, floor, ceiling, ducting, valves, doors, penetrations and equipment that physically form theCRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakageof unfiltered air into the GRE will not exceed the inleakage assumed in the licensing basisaanalysis of design basis accident (DBA) consequences to GRE occupants. The GRE and boundary are defined in the Control Room Envelope Habitability Program.In order for the control room emergency ventilation systems to be considered OPERABLE, theGRE boundary must be maintained such that the GRE occupant dose from a large radioactiverelease does not exceed the calculated dose in the licensing basis consequence analyses for DBAs,and that GRE occupants are protected from hazardous chemicals and smoke.TS LCO 3.7.6.1 is modified by a footnote allowing the GRE boundary to be opened intermittentlyunder administrative controls. This footnote only applies to openings in the GRE boundary thatcan be rapidly restored to the design condition, such as doors, hatches, floor plugs, and accesspanels. For entry and exit through doors, the administrative control of the opening is performedby the person(s) entering or exiting the area. For other openings, these controls should beproceduralized and consist of stationing a dedicated individual at the opening Who is incontinuous communication with the operators in the GRE. This individual will have a method torapidly close the opening and to restore the GRE boundary to a condition equivalent to the designcondition when a need for GRE isolation is indicated.MILLSTONE -UNIT 2 B 3/4 7.-4a Amendment No. 22S, 2-36, 7-3,4ng4, LBDCR 14-MIP2-001May 20, 2014PLANT SYSTEMSBASES3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)ACTIONS a. 1, b. 1, b.2, b.3, c. 1, c.2 and c.3 of this specification are applicable at all timesduring plant operation in MODES 1, 2, 3, and 4. ACTIONS d.1, d.2, and e.1 are applicable inMODES 5 and 6, or when recently irradiated fuel assemblies are being moved. The control roomemergency ventilation system is required to be OPERABLE during fuel handling involvinghandling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core withinthe previous 300 hours).With one Control Room Emergency Ventilation (CREV) train inoperable except due to aninoperable CREV boundary, action must be taken to restore OPERABLE status within 7 days. Inthis Condition, the remaining OPERABLE CREV subsystem is adequate to perform control roomradiation protection function. However, the overall reliability is reduced because a single failurein the OPERABLE CREV train could result in loss of CREV function. The 7 day allowed outagetime is based on the low probability of a DBA occunring during this time period, and the ability ofthe remaining train to provide the required capability.If both CREV trains are inoperable in MODE 1, 2, 3, or 4 for reasons other than aninoperable control room boundary (i.e., Condition c), at least one CREV train must be returned toOPERABLE status within 24 hours. The Condition is modified by a Note stating it is notapplicable if the second CREV train is intentionally declared inoperable. The Condition does notapply to voluntary removal of redundant systems or components from service. The Condition isonly applicable if one train is inoperable for any reason and the second train is discovered to beinoperable, or if both trains are discovered to be inoperable at the same time. During the periodthat the CREV trains are inoperable, action must be initiated to implement mitigating actions tolessen the effect on control room (CR) occupants from potential hazai'ds while both trains of.CREV are inoperable. In the event of a DBA, the mitigating actions will reduce the consequencesof radiological exposures to the CR occupants.Specification 3.4.8, "Reactor Coolant System Specific Activity," allows limitedoperation with the reactor coolant system (RCS) activity significantly greater than the LCOlimit. This presents a risk to the plant operator during an accident when all CREV trains areinoperable. Therefore, it must be verified within 1 hour that LCO 3.4.8 is met. This RequiredAction does not require additional RCS sampling beyond that normnally required by LCO 3.4.8.At least one CREV train must be returned to OPERABLE status within 24 hours. Theallowed outage time is based on Reference 1 whtich demonstrated that the 24 hour allowed outagetime is acceptable based on the infrequent use of the Required Actions and tlhe small incrementaleffect on plant risk.MILLSTONE -UNIT 2 B 3/4 7-4b Amendment No. 2-g, 2-36, 5, -24, -54,2g4, LBDCR 14-Mv~P2-001May 20, 2014PLANT SYSTEMSBASES3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)If the control room boundary is in~operable in MODES 1, 2, 3, and 4, the CREV trainscannot perfonn their intended functions. Actions must be taken to restore an OPERABLE controlroom boundary within 90 days. During the period that the control room boundary is inoperable,appropriate compensatory measures (consistent with the intent of GDC 19) should be utilized toprotect contr~ol room operators from potential hazards such as radioactive contamination, toxicchemicals, smoke, temperature and relative humidity, and physical security. Preplarned measuresshould be available to address these concerns for intentional and unintentional entry into thecondition. The 90 days allowed outage time is reasonable based on the low probability of a DBAoccurring during this time period, and the use of compensatory measures. The 90 days allowedoutage time is a typically reasonable time to diagnose, plan and possibly repair, and test mostproblems with the control room boundary.In MODE 5 or 6, or during movement of recently irradiated fuel assemblies, if RequiredAction d. 1 cannot be completed within the required allowed outage time, the OPERABLE CREVtrain must be immediately placed in the recirculation mode of operation. This action ensures thatthe remaining train is OPERABLE, that no failures preventing automatic actuation will occur, andthat any active failure will be readily detected. iAn alternative to Required Action d. 1 s to immediately suspend activities that couldresult in-a release of radioactiv;ity that might require isolation of the control room. This places theunit in a condition that minimizes the accident risk. This does not preclude the movement of fuelassemblies to a safe position.When in MODES 5 and 6, or during movement of recently irr-adiated, fuel assemblies,with two CREV trains inoperable, action muist be taken immediately to suspend activities thatcould result in a release of radioactivity that might require isolation of the control roomJ Thisplaces the unit in a condition that minimizes the accident risk. This does not preclude themovement of fuel to a safe position.The control room radiological dose calculations use the conservative minimum acceptableflow of 2250 cfm based on the flowrate surveillance requirement of 2500 cfm 4+ 10%.MILLSTONE -UNIT 2 B 3/4 7-4c Amendment No. 2-, 2--6, -2A-5, 2a4g,-2-54, 84, LBDCR 14-MP2-001May 20, 2014PLANT SYSTEMSBASES3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)Currently there are some situations where the CREV System may not automatically starton an accident signal, without operator action. Under most situations, the emergency filtrationfans will start and the CREV System will be in the accident lineup. However, a failure of a supplyfan (F21A or B) or an exhaust fan (F31lA or B), will require operator action to return to a full trainlineup. Also, if a single emergency bus does not power up for one train of the CREV System, theopposite train filter fan will automatically start, but the required supply and exhaust fans will notautomatically start. Therefore, operator action is required to establish the whole train lineup. Thisaction is specified in the Emergency Operating Procedures. The radiological dose calculations donot take credit for CREV System cleanup action until 1 hour into the accident to allow foroperator action.When the CREV System is checked to shift to the recirculation mode of operation, thiswill be performed from the nonnal mode of operation, and from the smoke purge mode ofoperation.If the unfiltered inleakage of potentially contaminated air past the CRE boundaiy and intothe CR3 can result in CRE occupant radiological dose greater than the calculated dose of thelicensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequateprotection of CRE occupants from hazardous chemicals or smoke, the CRE boundary isinoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.During the period that the CRE boundary is considered inoperable, action must beinitiated to implement mitigating actions to lessen the effect on CRE occupants from the potentialhazards of a radiological or chemical event or a challenge from smoke. Actions must be takenwithin 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CREoccupant radiological exposures will not exceed the calculated dose of the licensing basisanalyses of DBA consequences, and that CRE occupants are protected from hazardous chemicalsand smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of theinoperable CRE boundary) should be preplanned for implementation upon entry into thecondition, regardless of whether entry is intentional or unintentional. The 24 hour allowed outagetime is reasonable based on the low probability of a DBA occurring during this time period, andthe use of mitigating actions. The 90 day allowed outage time is reasonable based on thedetermination that the mitigating actions will ensure protection of CRE occupants withinanalyzed limits while limiting the probability that CRE occupants will have to implementprotective measures that may adversely affect their ability to control the reactor and maintain it ina safe shutdown condition in the event of a DBA. In addition, the 90 day allowed outage time is areasonable time to diagnose, plan and possibly repair, and test most problems with the CR3boundary.MILLSTON~E -UNIT 2 B3474 mnmn oB 3/4 7-4dAmendment No. LBDCR 14-MIP2-016September 4, 2014PLANT SYSTEMSBASES I13/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)Irmrediate action(s), in accordance with the LCO Action Statements, means that therequired action should be pursued without delay and in a controlled manner.Surveillance Requirement 4.7.6.1 .c. 1 dictates the test frequency, methods and acceptancecriteria for the Control Room Emergency Ventilation System trains (cleanup trains). These criteriaall originate in the Regulatory Position sections of Regulatory Guide 1.52, Rev. 2, March 1978 asdiscussed below.Section C.5 .a requires a visual inspection of the cleanup system be made before the followingtests, in accordance with the provisions of section 5 of ANSI N510-1975:* in-place air flow distribution testo DOP testo activated carbon adsorber section leak testSection C.5 .c requires the in-place Dioctyl phthalate (DOP) test for IT]EPA filters to conform tosection 10 of ANSI N510-1975. The HEPA filters should be tested in place (1) initially, (2) at thefrequency specified in the Surveillance Frequency Control Program, and (3) following painting,fire, or chemical release in any ventilation zone communicating with the system. The testing is toconfirm a penetration of less than or equal to 1%* at rated flow.Section C.5 .d requires the charcoal adsorber section to be leak testedwvith a gaseous halogenatedhydrocarbon refrigerant, in accordance with. section 12 of ANSI N5 10-1975 to ensure that bypassleakage through the adsorber section is less than or equal to 1%. ** Adsorber leak testing shouldbe conducted (1) initially, (2) at the frequency specified in the Surveillance Frequency ControlProgram, (3) following removal of an adsorber sample for laboratoiy testing if the integrity of theadsorber section is affected, and (4) following painting, fire, or chemical release in any ventilationzone communicating with the system.* Means that the HIEPA filter will allow passage of less than or equal to 1% of the testconcentration injection at the filter inlet from a standard DOP concentration injection.*

• Means that the charcoal adsorber sections will allow passage of less than or equal to 1% of theinjected test concentration around the charcoal adsorber section.MILLSTONE -UNIT 2 B 3/4 7-4e Amendment No.

LBDCR 14-MP2-001May 20, 2014PLANT SYSTEMSBASES3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)The ACTION requirements to immediately suspend various activities (COREALTERATIONS, irradiated fuel movement, etc.) do not preclude completion of the movement ofa component to a safe position.Technical Specification 3.7.6.1 provides the OPERABILITY requirements for the ControlRoom Emergency Ventilation Trains. If a Control Room Emergency Ventilation Train emergencypower source or normal power source becomes inoperable in MODES 1, 2, 3, or 4 therequirements of Technical Specification 3.0.5 apply in determining the OPERABILITY of theaffected Control Room Emergency Ventilation Train. If a Control Room Emergency VentilationTrain emergency power source or normal power source becomes inoperable in MODES 5 or 6 theguidance provided by Note "**~" of this specification applies in determining the OPERABILITYof the affected Control Room Emergency Ventilation Train. If a Control Room EmergencyVentilation Train emergency power source or normal power source becomes inoperable while notin MODES 1, 2, 3, 4, 5, or 6 the requirements of Technical Specification 3.0.5 apply indetermining the OPERABILITY of the affected Control Room Emergency Ventilation Train.Surveillance Requirement 4.7.6.1.h verifies the OPERABILITY of the CRE boundary bytesting for -unfiltered air inleakage past the CRE boundary and into the CRE. The details of thetesting are specified in the Control Room Envelope Habitability Program.*Means that the HF-EPA filter will allow passage of less than or equal to 1% of the testconcentration injection at the filter inlet from a standard DOP concentration injection.** Means that the charcoal adsorber sections will allow passage of less than or equal to 1% of theinjected test concentration around the charcoal adsorber section.MILLSTONE -UNIT 2 B3474 mnmn oB 3/4 7-4fAmendment No. ] LBDCR 14-MIP2-001~May 20, 2014PLANT SYSTEMSBASES3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)The GRE is considered habitable when the radiological dose to GRE occupants calculatedin the licensing basis analyses of DBA consequences is no more than 5 remn TEDE and the GREoccupants are protected from hazardous chemicals and smoke. This SR verifies that the unfilteredair inleakage into the GRE is no greater than the flow rate assumed in the licensing basis analysesof DB3A consequences. When unfiltered air inleakage is greater than the assumed flow rate,ACTION c. must be entered. ACTION c. allows time to restore the GRE boundary toOPERABLE status provided mitigating actions can ensure that the GRE remains within thelicensing basis habitability limits for the occupants following an accident. Compensatorymeasures are discussed in Regulatory Guide 1.196, which endorses, with exceptions, NEI 99-03.These compensatory measures may also be used as mitigating actions as required by ACTION c.Temporary analytical methods may also be used as compensatory measures to restoreOPERABILITY. Options for restoring the GRE boundary to OPERABLE status include changingthe licensing basis DBA consequence analysis, repairing the GRE boundary, or a combination ofthese actions. Depending upon the nature of the problem and the corrective action, a full scopeinleakage test may not be necessary to establish that the GRE boundary has been restored toOPERABLE status.REFERENCE !1. WCAP- 16 125-NP-A, "Justification for Risk-Informed Modifications to Selected TeclmicalSpecifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2 B 3/4 7-4g 10O LBDCR 11-MP2-010August 23, 2011PLANT SYSTEMSBASES3/4.7.7 DELETED3/4.7.8 SNUBBERSAll snubbers are required OPERABLE to ensure that the structural integrity of the reactorcoolant system and all other safety related systems is maintained during and following a seismicor other event initiating dynamic loads. Snubbers excluded from this inspection program are thoseinstalled on nonsafety-related systems and then only if their failure or failure of the system onxWhich they are installed would have no adverse effect on any safety-related system.MILLSTONE -UNIT 2B 3/4 7-5Amendment No. 141, 3-5, 96, 4-1-6, LW2: LBDCR 11-MP2-010August 23, 2011PLANTSYSTM0BASES3/4.7.9 DELETEDMILLSTONE -UNIT 2B 3/4 7-6Amendment No.. 1-t, 2_,-, %, -t-l-, 49-1-,-244 LBDCR 13-MP2.-004May 2, 2013PLANT SYSTEMSBASES3/4.7.10 DELETED3/4.7.11 ULTIMATE HEAT SINKBACKGROUNDThe ultimate heat sink (UI-{S) for Millstone Unit No. 2 is Long Island Sound. The LongIsland Sound is connected to the Atlantic Ocean and provides the required 30 day supply of water.It serves as a heat sink for both safety and non-safety-related cooling systems. Sensible heat isdischarged to the UtIIS via the service water (SW) and circulating water (CW) systems.The basic performance requirement is that a 30 day supply of water be available, and thatthe design basis temperatures of safety related equipment not be exceeded.Additional information on the design and operation of the system, along with a list ofcomponents served, can be found in References 1, 2, and 3.APPLICABLE SAFETY ANALYSESThe U-FIS is the sink for heat removed from the reactor core following all accidents andanticipated operational occurrences in which the unit is cooled down and placed on shutdowncooling system (SDC) operation. With UHIS as the normal heat sink for condenser cooling via theCW System, unit operation at full power is its maximum heat load. Its maximum post accidentheat load occurs < 1 hour after a design basis loss of coolant accident (LOCA). Near this time, theunit switches from injection to recirculation and the containment cooling system is required toremove the core decay heat ...The operating limits are based on conservative heat transfer analyses for the worst caseLOCA. References 1, 2, and 3 provide the details of the assumptions used in the analysis, whichinclude worst expected meteorological conditions, conservative uncertainties when calculat~ingdecay heat, and worst case single active failure (e.g., single failure of a man-made structure).The limitations on the temperature of the UHIS ensure that the assumption for temperatureused in the analyses for cooling of safety related components by the SW system are satisfied.These analyses ensure that under normal operation, plant cooldown, or accident conditions, allcomponents cooled directly or indirectly by SW will receive adequate cooling to perform theirdesign basis functions.The UJIS satisfies Criterion 3 of 10 CFR 50.3 6(c)(2)(ii).M'VILLSTON\E -UNIT 2 B 3/4 7-7 Amendment No. 4-t4-, 1I94I-, 1-, 24-7-, 25~7, 214I~A gx...... 1 byI,- l./t-r dat+cd-12,'l9/'0 LBDCR 14-MP2-016September 4, 2014PLAINT SYSTEMSBASES3/4.7.11 ULTIMATE HEAT SINK (Continued)LCOThe UIHS is required to be OPERABLE and is considered OPERABLE if it contains asufficient volume of water at or below the maximum temperature that would allow the SWSystem to operate for at least 30 days following the design basis LOCA without the loss of netpositive suction head (NPSHJ), and without exceeding the maximum design temperature of theequipment served by the SW System. To meet this condition, the UJIS temperature should notexceed 800F during normal unit operation.While the use of any supply side SW temperature indication is adequate to ensurecompliance with the analysis assumptions, precision instruments installed at the inlet to thereactor building closed cooling water (RBCCW) heat exchangers will normally be used.Therefore, instrument uncertainty need not be factored into the surveillance acceptance criteria.All in-service instruments must be within the limit. If all of the precision instruments are out ofservice, alternative instruments that measure SW supply side temperature will be used. In thiscase, an appropriate instrument uncertainty will be subtracted from the acceptance criteria.Since Long Island Sound temperature changes relatively slowly and in a predictable fashion according to the tides, it is acceptable to monitor this temperature at the frequency0specified in the Surveillance Frequency Control Program when there is ample (>5°F) margin tothe limit. When within 5°F of the limit, the temperature shall be monitored every 6 hours toensure that tidal variations are appropriately captured.APPLICABILITYIn MODES 1, 2, 3, and 4, the UIIS is required to support the OPERABILITY of theequipment serviced by the UIH-S and required to be.OPERABLE in these MODES.In MODE 5 or 6, the OPERABILITY requirements of the UIIS are determined by thesystems it supports.ACTIONIf the U911 is inoperable, the unit must be placed in a MODE in which the LCO does notapply. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hoursand in COLD SHUTDOWN within the following 30 hours.The allowed outage times are reasonable, based on operating experience, to reach therequired unit conditions from full power conditions in an orderly manner and without challengingunit systems.MILLSTONE -UNIT 2B3/7-B 3/4 7-8 LBDCR 13-MP2-004May 2, 2013PLANT SYSTEMSBASES3/4.7.11 ULTIMATE HEAT SINK (Continued)SURVEILLANCE REQUIREMENTSThis surveillance requirement verifies that the UTIS is capable of providing a 30 daycooling water supply to safety related equipment without exceeding its design basis temperature.This surveillance requirement verifies that the water temperature of the UHIS is < 80°F.REFERENCES1. FSAR, Sections 6.3, 6.4, 6.5, and 6.6 addressing Containment Systems.2. FSAR, Sections 9.3, 9.4, and 9.5 addressing Water Systems.3. FSAR, Section 14.6, Decrease in Reactor Coolant Inventory.MILLSTONE -UNIT 2B3/79B 3/4 7-9 REVERSE OF PAGE B 3/4 7-9INTENTIONALLY LEFT BLANK : LBDCR 11-MP2-012December 21, 20113/4.8 ELECTRICAL POWER SYSTEMSBASESThe OPERABILITY of the A.C. and D.C. power sources and associated distributionsystems during operation ensures that sufficient power will be available to supply the safetyrelated equipment required for 1) the safe shutdown of the facility and 2) the mitigation andcontrol of accident conditions within the facility. The minimum specified independent andredundant A.C. and D.C. power sources and distribution systems satisfy the requirements ofGeneral Design Criteria 17 of Appendix "A" to 10 CFR 50.The required circuits between the offsite transmission network and the onsite Class 1Edistribution system (Station Busses 24C, 24D, and 24E) that satisfy Technical Specification3.8.1.1 .a (MODES 1, 2, 3, and 4) consist of the following circuits from the switchyard to theonsite electrical distribution system:a. Station safeguards busses 24C and 24D via the Unit 2 Reserve Station ServiceTransformer; andb. Station bus 24E via the Unit 3 Reserve Station Service Transformer or Unit 3Normal Station Service Transformer (energized with breaker 1 5G-13T-2 (13T) andassociated disconnect switches open) and bus 34A or 34B.When taking credit for the Unit 3 Normal Station Service Transformer as a second offsitecircuit, breaker 13T and its associated disconnect switches are required to be open. This removesthe potential for a single failure (that of breaker 13T) to cause a simultaneous loss of both offsitecircuits. Should the other offsite circuit (i.e., the Unit 2 Reserve Station Service Transformer)already be inoperable, the requirement for maintaining breaker 1 3T and its associated disconnectswitches open is no longer applicable.If the plant configuration will not allow Unit 3 to supply power to Unit 2 from the Unit 3Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer within 3hours, Unit 2 must consider the second offsite source inoperable and enter the appropriateACTION statement of Technical Specification 3.8.1.1 for an inoperable offsite circuit.This is consistent with the GDC 17 requirement for two offsite sources. Each offsitecircuit is required to be available in sufficient time following a loss of all onsite alternating currentpower supplies and the other offsite electric power circuit to assure that specified acceptable fueldesign limits and design conditions of the reactor coolant pressure boundary are not exceeded.The first source is required to be available within a few seconds to supply power to safety relatedequipment following a loss of coolant accident. The second source is not required to be available*immediately and no accident is assumed to occur concurrently with the need to use the secondsource. However, the second source is required to be available in sufficient time to assure thereactor remains in a safe condition The 3 hour time period is based on the Millstone Unit No. 2Appendix R analysis. This analysis has demonstrated that the reactor will remain in a safecondition (i.e., the pressurizer will not empty) if charging is restored within 3 hours.MILLSTONE -UNIT 2B 3/4 8-1MILSTOE UNT 2B /4 -1Amendment No. 4-l-, 4-92, 3-1-, LBDCR 11-MP2-012December 21, 20113/4.8 ELECTRICAL POWER !BASESIn MODES 1 through 4 (Technical Specification 3.8.1 .1), the Unit 2 Normal StationService Transformer can be used as the second offsite source after the main generator disconnectlinks have been removed and the backfeed lineup established.The required circuit between the offsite transmission network and the onsite Class lEdistribution system (Station Busses 24C, 24D, and 24E) that satisfies Technical Specification3.8.1 .2.a (MODES 5 and 6) consists of the following circuit from the switchyard to the onsiteelectrical distribution system:a. Station safeguards bus 24C or 24D via the Unit 2 Reserve Station ServiceTransformer; orb. Station safeguards bus 24C or 24D via the Unit 2 Normal Station ServiceTransformer and bus 24A or 24B after the main generator disconnect links havebeen removed and the back~feed lineup established; orc. Station bus 24E via the Unit 3 Reserve Station Service Transformer or Unit 3Normal Station Service Transformer and bus 34A or 34B.When the plant is operating with the main generator connected to the grid, the output ofthe main generator will normally be used to supply the onsite Class lE distribution sYstem.During this time the required offsite circuits will be in standby, ready to supply power to theonsite Class lE distribution system if the main generator is not available. When shut down, onlyone of the offsite circuits will normally be used to supply the onsite Class lE distribution system.The other offsite circuit, if required, will be in standby. Verification of the required offsite circuitsconsists of checking control power to the breakers (breaker indicating lights), proper breakerposition for the current plant configuration, and voltage indication as appropriate for the currentplant configuration.The ACTION requirements specified for the levels of degradation of the power sourcesprovide restriction upon continued facility operation commensurate with the level of degradation.The OPERABILITY of the power sources are consistent with the initial condition assumptions ofthe accident analyses and are based upon maintaining at least one of each of the onsite A.C. andD.C. power sources and associated distribution systems OPERABLE during accident conditionscoincident with an assumed loss of offsite power and single failure of the other onsite A.C.source............ MILLSTONE- UNIT 2 "B 3/4 8:-2 ......--MILSTOE -UNI 2 3/4~2.... Amendment No:4-148; 4-9W2g34-, LBDCR 07-MP2-009" March 29, 20073/4.8 ELECTRICAL POWER SYSTEMSBASESTechnical Specification 3.8.1.1 ACTION Statements b and c provide an allowance toavoid unnecessary testing of the other OPERABLE diesel generator. If it can be determined thatcause of the inoperable diesel generator does not exist on the OPERABLE diesel generator,Surveillance Requirement 4.8.1.1 .2.a.2 does not have to be performed. If the cause ofinoperability exists on the other OPERABLE diesel generator, the other OPERABLE dieselgenerator would be declared inoperable upon discovery, ACTION Statement e would be entered,and appropriate ACTIONS will be taken. Once the failure is corrected, the common cause failureno longer exists, and the required ACTION Statements (b, c, and e) will be Satisfied.If it cannot be determined that the cause of the inoperable diesel generator does not existon the remaining diesel generator, performance of Surveillance Requirement 4.8.1i.1 .2.a.2, withinthe allowed time period, suffices to provide assurance of continued OPERABILITY of the dieselgenerator. If the inoperable diesel generator is restored to OPERABLE status prior to thedetermination of the impact on the other diesel generator, evaluation will continue of the possiblecommon cause failure. This continued evaluation is no longer under the time constraint imposedwhile in ACTION Statement b or c.The determination of the existence of a common cause failure that would affect theremaining diesel generator will require an evaluation of the current failure and the applicability tothe remaining diesel generator. Examples that would not be a common cause failure include, butare not limited to:1. Preplanned preventive maintenance or testing, or2. An inoperable support system with no potential common mode failure for theremaining diesel generator, or3. An independently testable component with no potential common mode failure for theremaining diesel generator.If one Millstone Unit No. 2 diesel generator is inoperable in MODES 1 though 4,ACTION Statements b.3 and c.3 require verification that the steam-driven auxiliary feedwaterpump is OPERABLE (MODES I; 2, and 3 only). If the steam-driven auxiliary feedwater pump isinoperable, restoration within 2 hours is required or a plant shutdown to MODE 4 will benecessary. This requirement is intended to provide assurance that a loss of offsite power eventwill not result in degradation of the auxiliary feedwater safety function to below accidentmitigation requirements during the period one of the diesel generators is inoperable. The termverify, as used in this context, means to administratively check by examining logs or otherinformation to determine if the steam-driven auxiliary feedwater pump is out of service formainten~ance or other reasons. It does not mean to perform Surveillance Requirements needed todemonstrate the OPERABILITY of the steam-driven auxiliary feedwater pump.MILLSTONE -UNIT 2 B 3/4 8-3 Amendment No. 4-8, +/-9-2,, 23-1-, 248,-2-6, LBDCR 07-MP2-009March 29, 20073/4.8 ELECTRICAL POWER SYSTEMS 9 BASESIf one Millstone Unit No. 2 diesel generator is inoperable in MODES 1 through 4, a 72hour allowed outage time is provided by ACTION Statement b.5 to allow restoration of the dieselgenerator, provided the requirements of ACTION Statements b. I, b.2, and b.3 are met. Thisallowed outage time can be extended to 14 days if the additional requirements contained inACTION Statement b.4 are also met. ACTION Statement b.4 requires verification that theMillstone Unit No. 3 diesel generators are OPERABLE as required by the applicable MillstoneUnit No. 3 Technical Specification (2 diesel generators in MODES 1 through 4, and 1 dieselgenerator in MODES 5 and 6) and the Millstone Unit No. 3 SBO0 diesel generator is available.The term verify, as used in this context, means to administratively check by examining logs orother information to determine if the required Millstone Unit No. 3 diesel generators and theMillstone Unit No. 3 SBO diesel generator are out of service for maintenance or other reasons. Itdoes not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITYof the required Millstone Unit No. 3 diesel generators or availability of the Millstone Unit No. 3SBO diesel generator.When using the 14 day allowed outage time provision and the Millstone Unit No. 3 dieselgenerator and/or the Millstone Unit No. 3 SBO diesel generator requirements are not met, 72hours is allowed for restoration of the required Millstone Unit No. 3 diesel generators and theMillstone Unit No. 3 SBO diesel generator. If any of the required Millstone Unit No. 3 diesel :generators and/or the Millstone Unit No. 3 SBO diesel generator are not restored within 72. hours,l i, ,and one Millstone Unit No. 2 diesel generator is still inoperable, Millstone Unit No. 2 is required.....to shut down.The 14 day allowed outage time for one inoperable Millstone Unit No. 2 diesel generatorwill allow performance of extended diesel generator maintenance and repair activities (e.g., dieselinspections) while the plant is operating. To minimize plant risk when using this extendedallowed outage time the following additional requirements must be met:1. The extended diesel generator maintenance outage shall not be scheduled whenadverse or inclement weather conditions and/or unstable grid conditions are predictedor present.2. The availability of the Millstone Unit No. 3 SBO DG shall be verified by testperformance within the previous 30 days prior to allowing a Millstone Unit No. 2diesel generator to be inoperable for greater than 72 hours.3. All activity in the switchyard shall be closely monitored and controlled. No electivemaintenance within the switchyard that could challenge offsite power availabilityshall be scheduled.MILLSTONE -UNIT 2 B 3/4 8-4 Amendment No. 4-8, 40-2-, ;3-i-, 948, I ".j,6-1-, 77, LBDCR 07-MvP2-009March 29, 20073/4.8 ELECTRICAL POWER SYSTEMSBASESIn addition, the plant configuration shall be controlled during the diesel generator-maintenance and repair activities to minimize plant risk consistent with a Conafiguration RiskManagement Program, as required by 10 CFR 50.65(a) (4).Diesel Generator TestingAn engine prelube period is allowed prior to engine start for all diesel generator testing.This 'will minimize wear on moving parts that do not get lubricated when the engine is notrunning.When specified in the surveillance tests, the diesel generators must be started from astandby condition. Standby condition for a diesel generator means the diesel engine coolant andoil are being circulated and temperature is being maintained consistent with manufacturerrecommendations.SR 4.8.1.l.2.a.2This surveillance helps to ensure the availability of the standby electrical power supply tomitigate design basis accidents and transients and to maintain the unit in a safe shutdowncondition. It verifies the ability of the diesel generator to start from a standby condition andachieve steady state voltage and frequency conditions. The time for voltage and speed(frequency) to stabilize is periodically monitored and the trend evaluated to identify' degradationof governor or voltage regulator performance when testing in accordance with the requirements ofthe surveillance.This surveillance is modified by two notes. Note 1 allows the use of a modified startbased on recommnendations of the manufacturer to reduce stress and wear on diesel engines.When using a modified start, the starting speed of the diesel generators is limited, wanmup islimited to this lower speed, and the diesel generators are gradually accelerated to synchronousspeed prior to loading. If a modified start is not used, the 15 second start requirement of SR4.8.l.I.2.d applies. Note 2 states that SR 4.8.1.1.2;d, ainore rigorous test, may be perfornned inlieu of 4.8.1.l.2.a.During performance of SR 4.8.1.1.2.a.2, the diesel generator shall be started by using oneof the following signals:1. Manual;2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;3. Simulated safety injection actuation signal alone; or4. simulated loss of power alone.MILLSTONE -UNIT 2 B3485AedetN.mB 3/4 8-5Amendment No. g7-7, [ LBDCR 14.-MIP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESThe surveillance frequency is controlled under the Surveillance Frequency Control Program.SR 4.8.1.1 .2.a.3This surveillance verifies that the diesel generators are capable of synchronizing with theoffsite electrical system and accepting loads greater than or equal to the equivalent of themaximum expected accident loads. A minimum run time of 60 minutes is required to stabilizeengine temperatures, while minimizing the time that the diesel generator is connected to theoffsite source. Although no power factor requirements are established by this surveillance, thediesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 valueis the design rating of the machine, while 1.0 is an operational limitation.This surveillance is modified by five Notes. Note 1 indicates that diesel engine runs forthis surveillance may include gradual loading, as recommended by the manufacturer, so thatmechanical stress and wear on the diesel engine are minimized. Note 2 states that momentarytransients because of changing bus loads do not invalidate this test. Similarly, momentary powerfactor transients above the limit will not invalidate the test. Note 3 indicates that this surveillanceshould be conducted on only one diesel generator at a time in order to avoid common causefailures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisiterequirement for performance of this surveillance. A successful diesel generator start must precedethis test to credit satisfactory performance. Note 5 states that SR 4.8.1.1 .2.d, a more rigorous test,may be performed in lieu of 4.8.1.1.2.a.The surveillance frequency is controlled under the Surveillance Frequency Control Program.SR 4.8.l.1.2.b.1Microbiological fouling is a major cause of fuel' oil degradation. There are numerousbacteria that can grow in fuel oil and cause fouling, but all must have a water environment inorder to survive. Removal of water from the three fuel storage tanks at the frequency specified inthe Surveillance Frequency Control Program eliminates the necessary environment for bacterialsurvival. This is the most effective means of controlling microbiological fouling. In addition, iteliminates the potential for water entrainment in the fuel oil during EDG operation. Water maycome from any of several sources, including condensation, rain water, contaminated fuel oil, andfrom breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulatedwater minimizes fouling and provides data regarding the watertight integrity of the fuel oilsystem. This surveillance is for preventative maintenance. The presence of water does notnecessarily represent failure of this surveillance provided the accumulated water is removedduring performance of the surveillance.MILLSTONE -UNMT 2 B3486Aed~n o -7B 3/4 8-6Amendment No. ggg, LBDCR April 3, 20123/4.8 ELECTRICAL POWER SYSTEMSBASESSR 4.8.1.1.2.b.2This surveillance requires testing of the new and stored fuel oil in accordance with theDiesel Fuel Oil Testing Program, as defined in Section 6 of the Technical Specifications.The tests listed below are a means of determining whether new fuel oil is of theappropriate grade and has not been contaminated with substances that would have an immediate,detrimental impact on diesel engine combustion. If results from these tests are within acceptablelimits, the fuel oil may be added to the storage tanks without concern for contaminating the entirevolume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the newfuel to the storage tank(s), but in no case is the time between receipt of new fuel and conductingthe tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows(more restrictive State of Connecticut and/or equipment limits may apply):a. Sample the new fuel oil in accordance with ASTM D4057,b. Verify in accordance with the tests specified in ASTM D975-81 that the samplehas an absolute specific gravity at 60/60°F of 0.83 and < 0.89, or an API gravityat 60°F of> 270 and < 390, a kinematic viscosity at 40°C of> 1.9 centistokes and <4.1 centistokes (alternatively, Saybolt viscosity, STJS at 100°F of> 32.6 bit< 40.1)and a flash point _> 125°F, andc. Verify that the new fuel oil has a clear and bright appearance with proper colorwhen tested in accordance with ASTM D4176 or a water and sediment contentwithin limits when tested in accordance with ASTM D2709 or D1796.Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does notrepresent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish thatthe other properties specified in Table 1 of ASTM D975-8:1 are met for new fuel oil when testedin accordance with ASTM D975-81, except that the analysis for sulfur may be performed inaccordance with ASTM D 1552 or ASTM D2622. The 31 day period is acceptable because thefuel oil properties of interest, even if they were not within stated limits, would not have animnmediate effect on DG operation.This surveillance ensures the availability of high quality fuel oil for the diesel generators.Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly tooxidation. The presence of particulate does not mean the fuel oil will not burn properly in a dieselengine. The particulate can cause fouling of filters and fuel oil injection equipment, however,which can cause engine failure. Particulate concentrations should be determined in accordancewith ASTM D2276-78, Method A, every 92 days. This method involves a gravimetricMILLSTONE -UNIT 2B3/8-AmnetNo 7,B 3/4 8-7Amendment No. 7--7, LBDCR 14-MP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESdeternination of total particulate concentration in the fuel oil and has a limit of 10 rag/I. It isacceptable to obtain a field sample for subsequent laboratory testing in lieu of fied testing.The frequency of this test takes into consideration fuel oil degradation trends that indicatethat particulate concentration is unlikely to change significantly between surveillance intervals.SR 4.8.1.1.2.c.2Under accident and loss of offsite power conditions, loads are sequentially connected tothe bus by the automatic load sequencer. The sequencing logic controls the permissive andstarting signals to motor breakers to prevent overloading of the diesel generators due to highmotor starting currents. The load sequence time interval tolerances ensure that sufficient timeexists for the diesel generator to restore frequency and voltage prior to applying the next load andthat safety analysis assumptions regarding Engineered Safety Features (ESE) equipment timedelays are not violated.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.This surveillance is modified by a Note. The reason for the Note is that performing thesurveillance would remove a required offsite circuit from service, perturb the electricaldistribution system, and challenge safety systems. This restriction from normally perforning thesurveillance in MODE 1, 2, 3, or 4 is further amplified to allow the surveillance to be performedfor the purpose of reestablishing OPERABILITY (e.g. post work testing following correctivemaintenance, corrective modification, deficient or incomPlete surveillance testing, and otherunanticipated OPERABILITY concerns) provided an assessment detertnines plant safety ismaintained or enhanced. This assessment shall, as a minimum, consider the potential outcomesand transients associated with a failed surveillance, a successful surveillance, and a perturbationof the offsite or onsite system when they are tied together or operated independently for thesurveillance; as well as the operator procedures available to cope with these outcomes. Theseshall be measured against the avoided risk of a plant shutdown and start up to determine that plantsafety is maintained or enhanced when the surveillance is performed in MODE 1, 2, 3, or 4. Riskinsights or deterninistic methods may be used for this assessment.MILLSTONE -UNIT 2 B3488AedetN.2--B 3/4 8-8Amendment No. LBDCR 14-MiP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESSR 4.8.1 .3.2.c.3Each diesel generator is provided with an engine overspeed trip to prevent damage to theengine. Recovery from the transient caused by the loss of a large load could cause diesel engineoverspeed, which, if excessive, might result in a trip of the engine. This surveillance demonstratesthe diesel generator load response characteristics and capability to reject the largest single loadwithout exceeding a predetermined frequency limit. The single largest load for each dieselgenerator is identified in the FSAR (Tables 8.3-2 and 8.3-3).This surveillance may be accomplished by either:a. Tripping the diesel generator output breaker with the diesel generator carryinggreater than or equal to its associated single largest post-accident load whileparalleled to offsite power or while solely supplying the bus; orb. Tripping the equivalent of the single largest post-accident load with the dieselgenerator solely supplying the bus.The time, voltage, and frequency tolerances specified in this surveillance are based on therepneduring load sequence intervals. The 2.2 seconds seiidi qa o4%o h .second load sequence interval associated with sequencing of the largest load (Safety Guide 9).The voltage and frequency spe~cified are consistent with the design range of the equipmentpowered by the diesel generator. SR 4.8.1.1.2.c.3.a corresponds to the maximum frequencyexcursion, while SR 4.8.1.1.2.c.3.b and SR 4.8.1.1.2.c.3.c are steady state voltage and frequencyvalues to which the system must recover following load rejection.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.This surveillance is modified by a Note to ensure that the diesel generator is tested underload conditions that are as close to design basis conditions as practical. When synchronized withoffsite power, testing should be performed at a power factor of_< 0.9 lagging. This power factor isrepresentative of the inductive loading a diesel generator would see based on the motor rating ofthe single largest load. It is within the adjustment capability of the Control Room Operator basedon the use of reactive load indication to establish the desired power factor. Under certainconditions, however, the note allows the surveillance to be conducted at a power factor other than_<0.9. These conditions occur when grid voltage is high, and the additional field excitation neededto get the power factor to _ 0.9 results in voltages on the emergency buses that are tooMILLSTON'E -UNIT 2 B3489AedetN.2~B 3/4 8-9Amendment No. 7-7, LBDCR 14-MIP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASEShigh. Under these conditions, the power factor should be maintained as close as practicable to 0.9while still maintaining acceptable voltage limits on the emergency buses. In other circumstances,the grid voltage may be such that the diesel generator excitation levels needed to obtain a powerfactor of 0.9 may not cause unacceptable voltages on the emergency buses, but the excitationlevels are in excess of those recommended for the diesel generator. In such cases, the power factorshall be maintained as close as practicable to 0.9 lagging without exceeding the diesel generatorexcitation limits.SR 4.8.1.1.2.c.4This surveillance demonstrates the diesel generator capability to reject a rated loadwithout overspeed tripping. A diesel generator rated load rejection may occur because of a systemfault or inadvertent breaker tripping. This surveillance ensures proper engine generator loadresponse under the simulated test conditions. This test simulates the loss of the total connectedload that the diesel generator experiences following a rated load rejection and verifies that thediesel generator will not trip upon loss of the load. While the diesel generator is not expected toexperience this transient during an event, this response ensures that the diesel generator is notdegraded for future application, including reconnection to the bus if the trip initiator can becorrected or isolated.This surveillance is performed by tripping the diesel generator output breaker with thediesel generator carrying the required load while paralleled to offsite power.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.This surveillance is modified by a Note to ensure that the diesel generator is tested underload conditions that are as close to design basis conditions as practical. When synchronized withoffsite power, testing should be performed at a power factor of < 0.83 lagging. This power factoris representative of the inductive loading a diesel generator would see under design basis accidentconditions. Under certain conditions, however, the note allows the surveillance to be conducted ata power factor other than < 0.83. These conditions occur when grid voltage is high, and theadditional field excitation needed to get the power factor to < 0.83 results in voltages on theemergency buses that are too high. Under these conditions, the power factor should be maintainedas close as practicable to 0.83 while still maintaining acceptable voltage limits on the emergencybuses. In other circumstances, the grid voltage may be such that the diesel generator excitationlevels needed to obtain a power factor of 0.83 may not cause unacceptable voltages on theemergency buses, but the excitation levels are in excess of those recommended for the dieselMILLSTON"E -UNIT 2B3/8-0AedntN.27B 3/4 8-10Amendment No. LBDCR 14-MiP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESgenerator. In such cases, the power factor shall be maintained as close as practicable to 0.83lagging without exceeding the diesel generator excitation limits.SR 4.8.1 .1 1.2 .c.5In the event of a design basis accident coincident with a loss of offsite power, the dieselgenerators are required to supply the necessary power to ESF systems so that the fuel, RCS, andcontainment design limits are not exceeded. This surveillance demonstrates the diesel generatoroperation during a loss of offsite power actuation test signal in conjunction with an ESF actuationsignal, including shedding of the nonessential loads and energization of the emergency buses andrespective loads from the diesel generator. It further demonstrates the capability of the dieselgenerator to automatically achieve the required voltage and speed (frequency) within thespecified time. The diesel generator auto-start time of 15 seconds is derived from requirements ofthe accident analysis to respond to a design basis large break LOCA. The surveillance should becontinued for a minimum of 5 minutes in order to demonstrate that all starting transients havedecayed and stability has been achieved. The requirement to verify the connection of pernanentand auto-connected loads is intended to satisfactorily show the relationship of these loads to thediesel generator loading logic. In certain circumstances, many of these loads cannot actually beconnected or loaded without undue hardship or potential for undesired operation. In lieu of actualdemonstration of connection and loading of loads, testing that adequately shows the capability ofthe diesel generator system to perform these functions is acceptable. This testing may include anyseries of sequential, overlapping, or total steps so that the entire connection and loading sequenceis verified.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram. *..For the purpose of this testing, .the diesel generators must be started from a standbycondition. Standby condition for a diesel generator means the diesel engine coolant and oil arebeing circulated and temperature is being maintained consistent with manufacturerrecormmendations.This surveillance is modified by a Note. The reason for the Note is that performing thesurveillance would remove a required offsite circuit from service, perturb the electricaldistribution system, and challenge safety systems. This restriction from normally performing thesurveillance in MODE 1 2, 3, or 4 is further amplified to allow portions of the surveillance to beperformed for the purpose of reestablishing OPERABILITY (e.g. post work testing followingcorrective maintenance, corrective modification, deficient or incomplete surveillance testing, andMILLSTOYNE -UNIT 2B318-1AedntN.27B 3/4 8-11Amendment No. LBDCR 14-MP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESother unanticipated OPERABILITY concerns) provided an assessment detennines plant safety ismaintained or enhanced. This assessment shall, as a minimum, consider the potential outcomesand transients associated with a failed partial surveillance, a successful partial surveillance, and aperturbation of the offsite or onsite system when they are tied together or operated independentlyfor the partial surveillance; as well as the operator procedures available to cope with theseoutcomes. These shall be measured against the avoided risk of a plant shutdown and start up todetermine that plant safety is maintained or enhanced when portions of the surveillance areperformed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for theassessment.SR 4.8.l. 1.2.c.6This surveillance demonstrates that diesel generator noncritical protective functions (e.g.,high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ESFactuation test signal. During this time, the critical protective functions (engine overspeed,generator differential current, low lube oil pressure [2 out of 3 logic], and voltage restraintovercurrent) remain available to trip the diesel generator andlor output breaker to avert substantialdamage to the diesel generator unit. An EDG Emergency Start Signal (Loss of Power signal orSIAS) bypasses the EDG mechanical trips in the EDG control circuit, except engine overspeed,and switches the low lube oil trip to a 2 of 3 coincidence. The loss of power to the emergency bus,based on supply breaker position (A302, A304, and A505 for Bus 24C; A410, A4tl, and A505for Bus 24D), bypasses the EDG electrical trips in the breaker control circuit except generatordifferential current and voltage restraint over current. The noncritical trips are bypassed duringdesign basis accidents and provide an alarm on an abnormal engine condition. This alarmprovides the operator with sufficient time to react appropriately. The diesel generator availabilityto mitigate the design basis accident is more critical than protecting the engine against minorproblems that are not inrmediately detrimental to emergency operation of the diesel generator.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.This surveillance is modified by a Note. The reason for the Note is that perfonning thesurveillance would remove a required offsite circuit from service, perturb the electricaldistribution system, and challenge safety systems. This restriction from normally performing thesurveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to beperformed for the purpose of reestablishing OPERABILITY (e.g. post work testing followingcorrective maintenance, corrective modification, deficient or incomplete surveillance testing, andother unanticipated OPERABILITY concerns) provided an assessment detennines plant safety isMILLSTONE -UNIT 2B3/812AedntN.7,B 3/4 8-I2Amendment No. -7-7-, LBDCR September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESmaintained or enhanced. This assessment shall, as a minimum, consider the potential outcomesand transients associated with a failed partial surveillance, a successful partial surveillance, and aperturbation of the offsite or onsite system when they are tied together or operated independentlyfor the partial surveillance; as well as the operator procedures available to cope with theseoutcomes. These shall be measured against the avoided risk of a plant shutdown and startup todetermine that plant safety is maintained or enhanced when portions of the surveillance areperformed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for theassessment.SR 4.8.1.1 .2.c.7This surveillance demonstrates the as designed operation of the standby power sourcesduring loss of the offsite source. This test verifies all actions encountered from the loss of offsitepower, including shedding of the nonessential loads and energization of the emergency buses andrespective loads from the diesel generator. It further demonstrates the capability of the dieselgenerator to automatically achieve the required voltage and speed (frequency) within thespecified time. The diesel generator auto-start time of 15 seconds is derived from requirements ofthe accident analysis to respond to a design basis large break LOCA. The surveillance should becontinued for a minimum of 5 minutes in order to demonstrate that all starting transients havedecayed and stability has been achieved. The requirement to verify the connection and powersupply of permanent and auto-connected loads is intended to satisfactorily show the relationshipof these loads to the diesel generator loading logic. In certain circumstances, many of these loadscannot actually be connected or loaded without undue hardship or potential for undesiredoperation. In lieu of actual demonstration of connection and loading of loads, testing thatadequately shows the capability of the diesel generator system to perform these functions isacceptable. This testing may include any series of sequential, overlapping, or total steps so thatthe entire connection and loading sequence is verified.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.This surveillance is modified by two Notes. The reason for Note 1 is that performing thesurveillance would remove a required offsite circuit from service, perturb the electricaldistribution system, and challenge safety systems. This restriction from normally perfonning thesurveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to beperformed for the purpose of reestablishing OPERABILITY (e.g. post work testing followingcorrective maintenance, corrective modification, deficient or incomplete SUlrveillance testing, andother unanticipated OPERABILITY concerns) provided an assessment determines plant safety isMILLSTONE -UNIT 2 B3481 mnmn o 7-B 3/4 8-13Amendment No. LBDCR 14-MP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESmaintained or enhanced. This assessment shall, as a minimum, consider the potential outcomesand transients associated with a failed partial surveillance, a successful partial surveillance, and aperturbation of the offsite or onsite system when they are tied together or operated independentlyfor the partial surveillance; as well as the operator procedures available to cope with theseoutcomes. These shall be measured against the avoided risk of a plant shutdown and start up todetermine that plant safety is maintained or enhanced when portions Of the surveillance areperformed in MODE 1, 2, 3, or 4. Risk insights or detenninistic methods may be used for theassessment.Surveillance Note 2 specifies that the start of the diesel generator from a standbycondition is not required if this surveillance is performed in conjunction with SR 4.8.l.l.2.c.5.Since this test is normally performed in conjunction with SR 4.8.1.1.2.c.5, the proposed note willexclude the requirement to start fr'om a standby condition to minimize the time to perfonn thistest. This will reduce shutdown risk since plant restoration, and subsequent equipment availabilitywill occur sooner. In addition, it is not necessary to test the ability of the EDG to auto start from astandby condition for this test since that ability will have already been verified by SR4.8.1.1.2.c.5, which will have just been performed if the note's exclusion is to be utilized. If thistest is to be performed by itself, the EDG is required to start from a standby condition.SR 4.8.1.1.2.c.8This surveillance demonstrates that the diesel generator automatically starts and achievesthe required voltage and speed (frequency) within the specified tine (15 seconds) fr~om the designbasis actuation signal (Safety Injection Actuation Signal) and operates for >5 minutes. The 5minute period provides sufficient time to demonstrate stability. Since the specified actuationsignal (ESF signal without loss of offsite power) will not cause the emergency bus loads to beshed, and will not cause the diesel generator" to load, the surveillance ensures that permanentlyconnected loads and autoconnected loads remain energized from the offsite electrical powersystem (Unit 2 RSST or NSST, or Unit 3 RSST or NSST). In certain circumstances, many of theseloads cannot actually be connected without undue hardship or potential for undesired operation. Itis not necessary to verify all autoconnected loads remain connected. A representative sample isacceptable.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.MILLSTONE -UNIT 2B3/8-4AedntN.2,B 3/4 8-14Amendment No. 7-7-, LBD CR 14-MP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESFor the purpose of this testing, the diesel generators must be started from a standbycondition. Standby condition for a diesel generator means the diesel engine coolant and oil arebeing circulated and temperature is being maintained consistent with manufacturerrecommendations.SR 4.8.1.1.2.c.9This surveillance demonstrates that the diesel engine can restart from a hot condition, suchas subsequent to shutdown from a normal surveillance, and achieve the required voltage andspeed within 15 seconds. The 15 second time is derived from the requirements of the accidentanalysis to respond to a design basis large break LOCA.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.This surveillance is modified by a Note. The Note ensures that the test is performed withthe diesel sufficiently hot. The load band is provided to avoid routine overloading of the dieselgenerator. Routine overloads may result in more frequent teardown inspections in accordancewith vendor recommendations in order to maintain diesel generator OPERABILITY. Therequirement that the diesel has operated for at least 1 hour at rated load conditions prior toperformance of this surveillance is based on manufacturer recotmmendations for achieving hotconditions. Momentary transients due to changing bus loads do not invalidate this test.SRs 4.8.1.l.2.d.1 and 4.8.l.1.2.d.2SR 4.8.1.1 .2.d. 1 verifies that, at the frequency specified in the-Surveillan~ce FrequencyControl Program, the diesel generator starts from standby conditions and achieves requiredvoltage and speed (frequency) within 15 seconds. The 15 second start requirement supports theassumptions of the design basis LOCA analysis in the FSAR. Diesel generator voltage and speedwill continue to increase to rated values, and thern should stabilize. SR 4.8.l.1.2.d.2 verifies theability of the diesel generator to achieve steady state voltage and frequency conditions. The timefor voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated toidentify degradation of governor or voltage regulator performance when besting in accordancewith the requirements of this surveillance.These surveillance frequencies are controlled under the Surveillance Frequency ControlProgram. In addition, SR 4.8.1.1.2.d may be performed in lieu of 4.8.1.1.2.a.MILLSTONE -UNIT 2B3/815AedntN.27B 3/4 8-15Amendment No. LBDCR 14-MP2-016September 4, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESFor the purpose of this testing, the diesel generators must be started from a standbycondition. Standby condition for a diesel generator means the diesel engine coolant and oil arebeing circulated and temperature is being maintained consistent with manufacturerrecommendations.During performance of SR 4.8.1.1,2.d. 1, the diesel generators shall be started by using oneof the following signals:1. Manual;2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;3. Simulated safety injection actuation sign~al alone; or4. Simulated loss of power alone.SR 4.8.1.1.2.d.3This surveillance verifies that the diesel generators are capable of synchronizing with theoffsite electrical system and accepting loads greater than or equal to the equivalent of maximum expected accident loads. A minimum run time of 60 minutes is required to stabilizeengine temperatures, while minimizing the time that the diesel generator is connected to theoffsite source. Although no power factor requirements are established by this surveillance, thediesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 valueis the design rating of the machine, while 1.0 is an operational limitation.The surveillance frequency is controlled under the Surveillance Frequency Control [ProgramIThis SR is modified by four Notes. Note 1 indicates that diesel engine runs for thissurveillance may include gradual loading, as recommended by the manufacturer, so thatmechanical stress and wear on the diesel engine are minimized. Note 2 states that momentarytransients because of changing bus loads do not invalidate this test. Similarly, momentary powerfactor transients above the limit will not invalidate the test. Note 3 indicates that this surveillanceshould be conducted on only one diesel generator at a time in order to avoid common causefailures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisiterequirement for performance of this surveillance. A successful diesel generator start must precedethis test to credit satisfactory performance.MILLSTONE -UNIT 2 B 3/4 8-16 Amendment No. 4g, 92, 2-3-1-, 248,2641-, 2-T, , February 19, 2009LBDCR 09-MP2-0023/4.8 ELECTRICAL POWER SYSTEMSBASESThe OPERABILITY of the minimum specified A.C. and D.C. power sources andassociated distribution systems during shutdown and refueling ensures that 1) the facility can bemaintained in the shutdown or REFUELING condition for extended time periods and 2) sufficientinstrumentation and control capability is available for monitoring and maintaining the facilitystatus. If the required power sources or distribution systems are not OPERABLE in MODES 5and 6, operations involving CORE ALTERATIONS, positive reactivity additions, or movement ofrecently irradiated fuel assemblies are required to be suspended. Suspending positive reactivityadditions that could result in failure to meet the minimum SDM or boron concentration limit isrequired to assure continued safe operation. Introduction of coolant inventory must be fromsources that have a boron concentration greater than that what would be required in the RCS forminimum SDM or refueling boron concentration. This may result in an overall reduction in RCSboron concentration, but provides acceptable margin to maintaining subcritical operation.Introduction of temperature changes including temperature increases when operating with apositive MTC must also be evaluated to ensure they do not result in a loss of required SDM. The.movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a criticalreactor core within the previous 300 hours), is also required to be suspended.Suspension of these activities does not preclude completion of actions to establish a safeconservative condition. These actions minimize the probability of the occurrence of postulatedevents. It is further required to immediately initiate action to restore the required AC and DCelectrical power source or distribution subsystems and to continue this action until restoration isaccomplished in order to provide the necessary power to the unit safety systems.Each 125-volt D.C. bus train consists of its associated 125-volt D.C. bus, a 125-volt D.C.battery bank, and a battery charger with at least 400 ampere charging capacity. To demonstrateOPERABILITY of a 125-volt D.C. bus train, these components must be energized and capable ofperforming their required safety functions. Additionally;in~MODES 1 through 4 at least one tiebreaker between the 125-volt D.C. bus trains must be open for a 125-volt D.C. bus train to beconsidered OPERABLE.For MODES 5 and 6, each battery is sized to supply the total connected vital loads (onebattery connected to both buses) for one hour without charger support. Therefore, in MODES 5and 6 with at least one. 125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied, the 125-volt D.C: support system operability requirements for both buses-are satisfied.Footnote (a) to Technical Specification Tables 4.8-i and 4.8-2 permits the electrolyte levelto be above the specified maximum level for the Category A limits during equalizing charge,provided it is not overflowing. Because of the internal gas generation during the performance ofan equalizing charge, specific gravity gradients and artificially elevated electrolyte levels areproduced which may exist for several days following completion of the equalizing charge. Theselimits ensure that the plates suffer no physical damage, and that adequate electron transfercapability is maintained in the event of transient conditions. In accordance with therecommendations of IEEE 450-1980, electrolyte level readings should be taken only after thebattery has been at float charge for at least 72 hours.MILLSTONE -UNIT 2 B 3/4 8-17 Amendment No. 4-88, 4-9-2, 2-34-, 248~,-264-, mg, 27-9, 3, March 29, 2007LBDCR 07-MP2-0093/4.8 ELECTRICAL POWER SYSTEMSBASES1Based on vendor recommendations and past operating experience, seven (7) days has beendetermined a reasonable time frame for the 1 25-volt D.C. batteries electrolyte level to stabilizeand to provide sufficient time to verify battery electrolyte levels are with in the Category A limits.Footnote (b) to Technical Specification Tables 4.8-1 and 4.8-2 requires that levelcorrection is not required when battery charging current is < 5 amps on float charge. This currentprovides, in general, an indication of overall battery condition.Footnote (c) to Technical Specification Tables 4.8-1 and 4.8-2 states that level correctionis not required when battery charging current is < 5 amps on float charge. This currentprovides,in general, an indication of overall battery condition. Because of specific gravity gradients thatare produced during the recharging process, delays of several days may occur while waiting forthe specific gravity measurement for determining the state of charge. This footnote allows thefloat charge current to be used as an alternative to specific gravity to show OPERABILITY of abattery for up to seven (7) days following the completion of a battery equalizing charge. Eachconnected cells specific gravity must be measured prior to expiration of the 7 day allowance.Surveillance Requirements 4.8.2.3.2.c. 1 and 4.8.2.5.2.c.1 provide for visual inspection ofthe battery cells, cell plates, and battery racks to detect any indication of physical damage orabnormal deterioration that could potentially degrade battery performance.The non-safety grade 125V D.C. Turbine Battery is required for accident mitigation for a main steam line break within containment with a coincident loss of a vital D.C. bus. The TurbineBattery provides the alternate source of power for Inverters 1 & 2 respectively via non-safetygrade Inverters 5 & 6. For the loss of a D.C. eveit[ wiiltaicbincident steam line break withincontainment, the feedwater regulating valves are required to close to ensure containment designpressure is not exceeded.The Turbine Battery D.C. electrical power subsystem consists of 125-volt D.C. bus 201Dand 125-volt D.C. battery bank 201D. To demonstrate OPERABILITY of this subsystem, thesecomponents must be energized and capable of performing their required safety functions.*The feedwater regulating valves require power to close. On loss of a vital D.C. bus, thealternate source of power to the vital A.C. bus via the Turbine Battery ensures power is availableto the affected feedwater regulating valve such that the valve will isolate feed flow into the faultedgenerator. The Turbine Battery is considered inoperable when bus voltage is less than 125 voltsD.C., thereby ensuring adequate capacity for isolation functions via the feedwater regulating.valves during the onset of a steam line break.The Turbine Battery Charger is not required to be included in Technical Specificationseven though the Turbine Battery is needed to power backup Inverters 5 & 6 for a main steam linebreak inside containment coincident with a loss of a Class 1 E D.C. bus. This is due to the fact thatfeedwater isolation occurs within seconds from the onset of the event.MILLSTONE -UNIT 2 B 3/4 8-18 Amendment No. 4-18, 4-9, -24%, j 9 June 28, 2006.3/4.9 REFUELING OPERATIONSBASES3/4.9 REFUELING OPERATIONSThe ACTION requirements to immediately suspend various activities (COREALTERATIONS, fuel movement, CEA movement, etc.) do not preclude completion of themovement of a component to a safe position.3/4.9.1 BORON CONCENTRATIONThe limitations on reactivity conditions during REFUELING ensure that: 1) the reactorwill remain subcritical during CORE ALTERATIONS, and 2) sufficient boron concentration ismaintained forlreactivity control in the water volume having direct access to the reactor vessel.These limitations are consistent with the initial conditions assumed for the boron dilution incidentin the accident-analyses. Reactivity control in the water volume having direct access to thereactor vessel is achieved by determining boron concentration in the refueling canal. Therefueling canal is defined as the entire length of pool stretching from refuel pool through transfercanal to spent fuel pool.The applicability is modified by a Note. The Note states that the limits on boronconcentration are only applicable to the refueling canal when this volume is connected to theReactor Coolant System (RCS). When the refueling canal is isolated from the RCS, no potential.~ *path for boron dilution exists. Prior to reconnecting portions of the refueling canal to the RCS,S Surveillance 4.9.1 .2 must be met. If aydilution activity has occurred while the refueling canal: was disconnected from the RCS, this ansurveillance ensures the correct boron concentration prior tocommunication with the RCS.Concerning the ACTION statement, operations that individually add limited positive reactivity(e.g., temperature fluctuations from inventory addition or temperature control fluctuations), butwhen combined with all other operations affecting core reactivity (e.g., intentional boration)result in overall net negative reactiv'ity addition, are not precluded by this ACTION.314.9.2 INSTRUMENTATIONThe OPERABILITY of the source range neutron flux monitors ensures that redundantmonitoring capability is available to detect changes in the reactivity condition of the core.Concerning ACTION a., with only one SRM OPERABLE, redundancy has been lost. Since theseinstruments are the only direct means of monitoring core reactivity conditions, COREALTERATIONS and introduction of coolant into the RCS with boron concentration less thanrequired to meet the minimum boron concentration of LCO 3.9.1 must be suspended immediately.Suspending positive reactivity additions that could result in failure to meet the minimum boronconcentration limit is required to assure continued safe operation. Introduction of coolantinventory must be from sources that have a boron concentration greater than that which would berequired in the RCS for minimum refueling boron concentration. This may result in an overallreduction in RCS boron concentration, but provides acceptable margin to maintaining subcriticaloperation. Performance of ACTION a. shall not preclude completion of movement of acomponent to a safe position..MILLSTONE -UNIT 2 B 3/4 9-1 Amendment No. 72, 14, 4-50, 1-,24-5, 26-3, 293 LBDCR 1 0-MP2-007June 22,.2010REFUELING OPERATIONSBASES (continued)3/4.9.3 DECAY TIMEThe minimum requirement for reactor subcriticality prior to movement of irradiated fuelensures that sufficient time has elapsed to allow the radioactive decay of the-short-lived fissionproducts so that the calculated radiological dose consequences of the fu~el handling accident arebounding.3/4.9.4 CONTAINMENT PENETRATIONSThe requirements on containment penetration closure and OPERABILITY ensure that arelease of radioactive material within containment to the environment will be minimized. TheOPERABILITY, closure restrictions, and administrative controls are sufficient to minimize therelease of radioactive material from a fuel element rupture based upon the lack of containmentpressurization potential durirng the movement of in'adiated fu~el assemblies within containment.The containment purge valves are containment penetrations and must satisfy all requirementsspecified for a containment penetration.Containment penetrations, including the personnel airlock doors and equipment door, canbe open during the movement of irradiated fuel provided that sufficient administrative controlsare in place such that any of these containment penetrations can be closed within 30 minutes.Following a Fuel Handling Accident, each penetration, including the equipment door, is closedsuch that a containment atmosphere boundary can be established. However, if it is thatclosure of all containment penetrations would represent a significant radiological hazard to thepersonnel involved, the decision may be made to forgo the closure of the affected penetration(s).The containment atmosphere boundary is established when any penetration which provides directaccess to the outside atmosphere is closed such that at least one barrier between the containmentatmosphere and the outside atmosphere is established. Additional actions beyond establishing thecontainment atmosphere boundary, such as installing flange bolts for the equipment door or acontainment penetration, are not necessary.Administrative controls for opening a containment penetration require that one or moredesignated persons, as needed, be available for isolation of containment from the outsideatmosphere. Procedural controls are also in place to ensure cables or hoses which pass through acontainment opening can be quickly removed. The location of each cable and hoses isolationdevice for those cables and hoses which pass through a containment opening is recorded to ensuretimely closure of the containment boundary. Additionally, a closure plan is developed for eachcontainment opening which includes an estimated time to close the containment opening. A log ofpersonnel designated for containment closure is maintained, including identification of whichcontainment openings each person has responsibility for closing. As necessary,equipment will bepre-staged to support timely closure of a containment penetration.MILLSTONE -UNIT 2 B 3/4 9-l a Amendment No. 7-2-, -144, 1-N0, 20-1,,240, 24#5, 24, September 20, 2004REFUELING OPERATIONSBASES (continued)3/4.9.4 CONTAINMENT PENETRATIONS (Continued')Prior to opening a containment penetration, a review of containment penetrationscurrently open is performed to verify that sufficient personnel are designated such that allcontainment penetrations can be closed within 30 minutes. Designated personnel may have otherduties, however, they must be available such that their assigned containment openings can beclosed within 30 minutes. Additionally, each new work activity inside containment is reviewed toconsider its effect on the closuire of the equipment dooi, personnel air lock, and/or other opencontainmaent penetrations. The required number of designated personnel are continuouslyavailable to perform closure of their assigned containment openings whenever irradiated fuel isbeing moved within the containmaent.Administrative controls are also in place to ensure that the containment atmosphereboundary is established if adverse weather conditions which could present a potential missilehazard threaten the plant. Weather conditions are monitored during irradiated fuel movementwhenever a containment penetration, including the equipment door and personnel air lock, is openand a storm center is within the plant monitoring radius of 150 miles.The administrative controls ensure that the containment atmosphere boundary can bequickly established (i.e., within 30 minutes) upon determining that adverse weather conditionsexist which pose a significant threat to the Millstone Site. A significant threat exists when ahurricane warning or tornado warning is issued which applies to the Millstone Site, or if anaverage wind speed of 60 miles an hour or greater is recorded by plant meteorological edluipmentat the meteorological tower. If the meteorological equipment is inoperable, information from theNational Weather Service can be used as a backup in determining plan~t wind speeds. Closure ofcontaimnent penetrations, including the equipment door and personnel air lock door, beginimmediately upon determination that a significant threat exists.When severe weather conditions which could generate a missile are within the plantmonitoring radius, containment and spent fuel pool penetrations are closed to establish thecontainment atmosphere boundary.314.9.5 DELETEDMILLSTONE -UNIT 2 B349l mnmn o 8B 3/4 9-1bAmendment No. 284 LIBDCR 15-MP2-003March 26, 2015REFUELING OPERATIONS EBASES3/4.9.6 DELETED3/4.9.7 DELETED3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATIONIn MODE 6 the shutdown cooling trains are the primary means of heat removal. One SDCtrain provides sufficient heat removal capability. However, to provide redundant paths for heatremoval either two SDC trains are required to be OPERABLE and one SDC train must be inoperation, or" one SDC train is required to be OPERABLE and in operation with the refuelingcavity water level 23 feet above the reactor vessel flange. This volume of water in the refuelingcavity will provide a large heat sink in the event of a failure of the operating SDC train. Anyexception to these requirements are contained in the LCO Notes.An OPERABLE SDC train, for plant operation in MODE 6, includes a pump, heatexchangei; valves, piping, instruments, and controls to ensure an OPERABLE flow path and todetermine RCS temperature. In addition, sufficient portions of the Reactor Building ClosedCooling Water (RBCCW) and Service Water (SW) Systems are available to provide cooling to theSDC heat exchanger. The flow path starts at the RCS hot leg and is retum-ed to the RCS cold legs.An OPERABLE SDC train consists of the following equipment: ::1. An OPERABLE SDC pump (low pressure safety injection pump);2. The associated SDC heat exchanger from the same facility as the SDC pump;3. An RBCCW pump, powered from the same facility as the SDC pump, and RBCCW heatexchanger capable of cooling the associated SDC heat exchanger;4. A SW pump, powered from the same facility as the SDC pump, capable of supplyingcooling water to the associated RBCCW heat exchanger; and5. All valves required to support SDC System operation are in the required position or arecapable of being placed in the required position.In MODE 6, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchanger-s,2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headersare required to provide cooling to the SDC heat exchangers, but only 1 SW header is required tosupport the SDC trains. The equipment specified is sufficient to address a single active failure ofthe SDC System and associated support systems.MILLSTONE -UNIT 2 B 3/4 9-2 Amendment No. 6-9, p-l-, 4-7, 4-8g, 24G,244, -240., September 14, 2006LBDCR 06-MP2-030REFUELING OPERATIONSBASES3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued)In addition, two SDC trains can be considered OPERABLE, with only one 125-volt D.C.bus train OPERABLE, in accordance with Limiting Condition for Operation (LCO) 3.8.2.4.2-SI-306 and 2-SI-657 are both powered from the same 125-volt D.C. bus, on Facility 1. Shouldthese valves reposition due to a loss of power, SDC would no longer be aligned to cool the RCS.However, a designated operator is assigned to reposition these valves as necessary in the event125-volt D.C. power is lost. Consistent with the bases for LCO 3.8.2.4, the 125-volt D.C. supportsystem operability requirements for both trains of SDC are satisfied in MODE 6 with at least one125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied.Either SDC pump may be aligned to the refueling water storage tank (RWST) to supportfilling the fueling cavity or for performance of required testing. A SDC pump may also be used totransfer water from the refueling cavity to the RWST. In addition, either SDC pump may bealigned to draw a suction on the spent fuel pool (SFP) through 2-RW- 11 and 2-SI-442 instead ofthe normal SDC suction flow path, provided the SFP transfer canal gate valve 2-RW-280 is openunder administrative control (e.g., caution tagged). When using this alternate SDC flow path, itwill be necessary to secure the SFP cooling pumps, and limit SDC flow as specified in theappropriate procedure, to prevent vortexing in the suction piping. The evaluation of this alternateSDC flow path assumed that this flow path will not be used during a refueling outage until afterthe completion of the fuel shuffle such that approximately one third of the reactor core willcontain new fuel. By waiting until the completion of the fuel shuffle, sufficient time (at least 14days from reactor shutdown) will have elapsed to-.ensure-the limited SDC flow rate specified forthis alternate lineup will be adequate for decay heat removal from the reactor core and the spentfuel pool. In addition, CORE ALTERATIONS shall be suspended when using this alternate flowpath, and this flow path should only be used for short time periods, approximately 12 hours. If thealternate flow path is expected to be used for greater than 24 hours, or the decay heat load will notbe bounded as previously discussed, further evaluation is required to ensure that this alternateflow path is acceptable.These alternate lineups do not affect the OPERABILITY of the SDC train. In addition,these alternate lineups will satisfy the requirement for a SDC train to be in operation if theminimum required SDC flow through the reactor core is maintained.In MODE 6, with the refueling cavity filled to >_ 23 feet above the reactor vessel flange,both SDC trains may not be in operation for up to 1 hour in each 8 hour period, provided nooperations are permitted that would dilute the RCS boron concentration by introduction of coolantinto the RCS with boron concentration less than required to meet the minimum boronconcentration of LCO 3.9.1. Boron concentration reduction with coolant at boron concentrationsless than required to assure the RCS boron concentration is maintained is prohibited becauseMILLSTONE -UJNIT 2 B 3/4 9-2a Amendment No. 69, 7-l-, 4-1-7-, -l-8-5, 24O,24-5, 2.49,-2-g4,-29)3,Acknowledged By NRC July 5, 2007 January 27, 2009LBDCR 08-MP2-030.REFUELING OPERATIONSBASES314.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued)uni~form concentration distribution cannot be ensured without forced circulation. This permitsoperations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles,and RCS to SDC isolation valve testing. During this 1 hour period, decay heat is removed bynatural convection to the large mass o fwater in the refueling pool.In MODE 6, with the refueling cavity filled to >_ 23 feet above the reactor vessel flange,both SDC trains may also not be in operation for local leak rate testing of the SDC cooling suctionline (containment penetration number 10) or to permit maintenance on valves located in thecommon SDC suction line. This will allow the performance of required maintenance and testingthat otherwise may require a full core offload. an adition to the requirement prohibitingoperations that would dilute the RCS boron concentration by introduction of coolant into the RCSwith boron concentration less than required to meet the minimum boron concentration of LCO3.9.1, CORE ALTERATIONS are suspended and all containment penetrations providing directaccess from the containment atmosphere to outside atmos phere must be closed. The containmentpurge valves are containment penetrations and must satisf all requirements specified for acontainment penetration. No time limit is specified to operate in this configuration. However,factors such as scope of the work, decay heat load/heatup rate, and RCS temperature should beconsidered to determine if it is feasible to perform the work. Prior to using thisprovision, a reviewand approval of the evolution by the Facility Safety Review Committee (FSRC is required. Thisreview will evaluate currentplant conditions and the proposed work to determine if this provisionshould be used, and to establi~sh the termination criteria and appropriate contingency plans. ~During this period, decay heat is removed by natural convection to the large mass of water in the0In Mode 6, with the refueling cavity filled to > 23 feet above the reactor vessel flange andthe required shutdown cooling train inoperable or not-in operation (with the exceptions providedin the note. following LCO 3.9.8.1I), there will be no forced circulation to provide mixing to ensureuniform boron concentration distribution. Suspending posi~tive reactivity additions that couldresult in failure to meet the boron concentration-i-riihit in aiccordance with LCO 3.9.1 is required toassure continued safe .operation. Also, actions shall be taken immediately to suspend loadingirradiated fuel assemblies in the core. With no forced circulation cooling, decay neat removalfrom the core occurs by natural convection to the heat sink provided by the water above the core.A minimum refueling water level of 23 feet above the reactor vessel fange provides an adequateavailable heat sink. Suspending any operation that would increase the decay heat load, such asloading an irradiated fuel assembly, is a prudent action under this condition. However, suspensionof loading irradiated fuel assemblies shall not preclude completion of movement of an irradiatedfuel assembly to a safe position outsidte the core."The requirement that at least one shutdown cooling loop be in operation at >_ 1000 g pmensures that (1) sufficient cooling capacity is available to remove decay heat and maintain thewater in the reactor pressure vessel below 1 400F as required during the REFUELING MODE, (2)sufficient coolant circulation is maintained through the reactor core to minimize the effects of aboron dilution incident and prevent boron stratification, and (3) is consistent with boron dilutionanalysis assumptions. The 1000 gpm shutdown cooling flow limit is the minimum analyticallimit. Plant operating procedures maintain the minimum shutdown cooling flow at a higher valueto accommodate flow measurement uncertainties.Average Coolant Temperature (Tavg) values are derived under shutdown coolingconditions, using the designated formula for use in Unit 2 operating procedures.* SDC flow greater than 1000 gpm: (SDCoutiet + SDCiniet) / 2 = Tav 0MILLSTONE -UNIT 2 B 3/4 9-2b Amendment No. 69, 7-l-, 44-7-, 4-84, 240,-24-5, 249, 29-LBDCR 06-MP2-030September 14, 2006REFUELING OPERATIONSBASES3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued)During SDC only operation, there is no significant flow past the loop RTDs. Core inletand outlet temperatures are accurately measured during those conditions by using T3 51 Y, SDCreturn to RCS temperature indication, and T351IX, RCS to SDC temperature indication. The.average of these two indicators provides a temperature that is equivalent to the average RCStemperature in the core.T35 IX will not be available when using the alternate SDC suction flow path from the SFP.Substitute temperature monitoring capability shall be established to provide indication of reactorcore o~utlet temp~erature. ..A portable temp~erature device can be used.to -indicate reactor, core outlet.to ,thle cottrl .rod'tu petr'oi~tel.: A~r~nmfte {teevisioti cdti-neia dr- an a~sgigifi~dindividual are acceptable alternative methods to provide this indication to control room personnel.3/4.9.9 AND_3/4.9.10 DELETED3/4.9.11 AND 3/4.9.12 WATER LEVEL-REACTOR VESSEL AND STORAGE POOL WATERLEVELThe restrictions on minimum water level ensure that sufficient water depth is available toremove 99% of the assumed 10% iodine gap activity released from the rupture of an irradiatedfuel assembly. The minimum water depth is consistent with the assumptions of the accident.analysis.MILLSTONE -UNIT 2B 3/4 9-2cAmendment No.Acknowledged By NRC July 5, 2007 .REVERSiE OF PAGE B 3/4 INTENTIONALLY LEFT BLANK... September 20, 2004F"REFUELING OPERATIONSBASES3/4.9.13 DELETED3/4,9.14 DELETED3/4.9.15 DELETEDMILLSTONE -UNIT 2B 3/4 9-3Amendment No. gO, 4-09, 44-7, 4-5n,4-1-5, 4~-7, g08, 24g, 284 September 20, 2004THIS PAGE TNTENTIONALLY LEFT BLANKOMILLSTONE -UNIT 2B 3/4 9-3aAmendment No. 3%, 4-09, 4-4-, 4-5-4,4-5-7, 4-7-2, Q, 245-, 284 LBDCR 14-MP2-016September 4, 2014REFUELING OPERATIONSBASES (Continued)314.9.16 SHIELDED CASKThe limitations of this specification ensure that in the event of a shielded cask dropaccident the doses from ruptured fuel assemblies will be within the assumptions of the safetyanalyses.3/4.9.17 SPENT FUEL PO OL B ORON CONCENTRATIONThe limitations of this specification ensures that sufficient boron is present to maintainspent fuel pool Keff_< 0.95 under accident conditions.Postulated accident conditions which could cause an increase in spent fuel pool reactivityare: a single dropped or mis-loaded fuel assembly, a single dropped or mis-loaded ConsolidatedFuel Storage Box, or a shielded cask drop onto the storage racks. A spent fuel pool soluble boronconcentration of 1400 ppm is sufficient to ensure Keff _ 0.95 under these postulated accidentconditions. The required spent fuel pool soluble boron concentration of___ 1720 ppmconservatively bounds the required 1400 ppm. The ACTION statement ensure that if the solubleboron concentration falls below the required amount, that fuel movement or shielded caskmovement is stopped, until the boron concentration is restored to within limits.An additional basis of this LCO is to establish 1720 ppm as the minimum spent fuel pooisoluble boron concentration which is sufficient to ensure that the design basis value of 600 ppmsoluble boron is not reached due to a postulated spent fuel pool boron dilution event. As part ofthe spent fuel pool criticality design, a spent fuel soluble boron concentration of 600 ppm issufficient to ensure Keff < 0.95, provided all fuel is stored consistent with LCO requirements. Bymaintaining the spent fuel pool soluble boron concentration > 1720 ppm, sufficient time isprovided to allow the operators to detect a b~oron dilution event, and terminate the event, prior tothe spent fuel pool being diluted below 600 ppm. In the unlikely event that the spent fuel poolsoluble boron concentration is decreased to 0 ppm,. Keff will be maintained <1.00, provided allfuel is stored consistent with LCO requirements. The ACTION statement ensures that if thesoluble boron concentration falls below the required amount, that immediate action is taken torestore the soluble boron concentration to within limits, and that fuel movement or shielded caskmovement is stopped. Fuel movement and shielded cask movement is stopped to prevent thepossibility of creating an accident condition at the same time that the minimum soluble boron isbelow limits for a potential boron dilution event.The surveillance of the spent fuel pool boron concentration within 24 hours of fuelmovement, consolidated fuel movement, or cask movement over the cask layout area, verifies thatthe boron concentration is within limits just prior to the movement. The periodic surveillanceinterval is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 2 B 3/4 9-3b Amnendment No. g-Q, 1409,1447, 4--57, 1-7-2, 208, 2Ag, 2-74,2,84,...n.....g.. N,. C .. uly. 5, 2007 April 1, 2003R.EFUELING OPERATIONSBASES3/4.9.18 SPENT FUEL POOL -STORAGEThe limitations described by Figures 3.9-la, 3.9-Ib, and 3.9-3 ensure that the reactivity offuel assemblies and consolidated fuel storage boxes, introduced into the Region C spent fuelracks, are conservatively within the assumptions of the safety analysis.The limitations described by Figure 3.9-4 ensure that the reactivity of the fuel assemblies,introduced into the Region A spent fuel racks, are conservatively within the assumptions of thesafety analysis.3/4.9.19 SPENT FUEL POOL -STORAGE PATTERNThe limitations of this specification ensure that the reactivity condition of the Region Bstorage racks and spent fuel pool Keffwill remain less than or equal to 0.95.The Cell Blocking Devices in the 4th location of the Region B storage racks are designedto prevent inadvertent placement andlor storage in the blocked locations. The blocked locationremains empty, or a Batch B fuel assembly may be stored in the blocked location, to maintainreactivity control for fuel assembly storage in any adjacent locations. Region B (non-cell blockerlocations) is designed for the storage of new assemblies in the spent fuel pool, and for fuelassemblies which have not sustained sufficient burnup to be stored in Region A or Region C.This LCO is not applicable during the initial installation of Batch B fuel assemblies in thecell blocker locations of Region B. This is acceptable because only Batch B fuel assemblies willbe moved during the initial installation of Batch B fuel assemblies, under the Region B cellblockers. Batch B fuel assemblies are qualified for storage in any spent fuel pool storage racklocation, hence a fuel misloading event which causes a reactivity consequence is not credible.This exception is valid only during the initial installation of Batch B fuel assemblies in the cellblocker locations.3/4.9.20 SPENT FUEL POOL -CONSOLIDATIONThe limitations of these specifications ensure that the decay heat rates and radioactiveinventory of the candidate fuel assemblies for consolidation are conservatively within theassumptions of the safety analysis.MILLSTONE -UNIT 2 B 3/4 9-4 Amendment No. -447, 4-1-5, 4-58, 4-7-2,274 September 25, 2003P 3.4.10 SpECIAL TEST EXCEPTIONSBASES3/4.10.1 SHUTDOWN MARGINThis special test exception provides that a minimum amount of CEA worth is immediatelyavailable for reactivity control or that the reactor is sufficiently subcritical so as to provide safeoperating conditions when tests are performed for CEA worth measurement. This special testexception is required to permit the periodic verification of the actual versus predicted corereactivity condition oecuring as a result of fuel bumup or fuel cycling operations.3/4.10.2 GROUP HEIGHT ANTD INSERTION LIMITSThis special test exception permits individual CEAs to be positioned ouside of theirnormal group heights and insertion limits during the performance of such PHYSICS TESTS asthose required .to 1) measure CEA worth and 2) determine the reactor stability index and dampingfactor under xenon oscillation conditions.SMiLLSTONE -UNIT 2 3401AedetN.,28B 3/4 10-1Amendment No. 280 October 27, 1977DELETED I27MILLSTONE -UNIT 2 B341-B 3/4 10-2 November 28, 20003/4.11 DELETEDBASES3/4.11.1 -DELETED3/4.11.2 -DELETED3/4.11.3 -DELETEDMILLSTONE -UNIT 2B 3/4 11-1MILLTONE- UNT 2 3/411-1Amendmient No. 250 November 28, 2000This page intentionally left blankNillstone Unit 2B 3/4 11-2MilltoneUnit2 B /4 1-2 /Aendment No. J79, 250 November 28, 2000This page intentionally left blankMILLSTONE -UNIT 2B 3/4 11-3MILLTON -NIT B /4 1-3Amendment No. 250 November 28, 2000This page intentionally left blankMILLSTONE -UNIT 2B 3/4 11-4MILLTONE- UNT 2 3/411-4Amendment No. JX9, 250 Serial No. 16-078Docket No. 50-423ATTACHMENT 2BASES PAGES FOR MILLSTONE POWER STATION UNIT 3DOMINION NUCLEAR CONNECTICUT, INC.MILLSTONE POWER STATION UNIT 3 BASESFORSECTION 2.0SAFETY LIMITSANDLIMITING SAFETY SYSTEM SETTINGS NOTEThe BASES contained in succeeding pages summarizethe reasons for the Specifications in Section 2.0,but in accordance with 10 CFR 50.36 are not partof these Technical Specifications. LBDCR No. 06-MP3-014June 22, 2006D.' BASES*:, 2.1.1 REACTOR COREBACKGROUND10 CER 50, Appendix A, General Design Criterion 10, requires that specified acceptable fueldesign limits are not exceeded during steady state operation, normal operational transients, andanticipated operational occurrences (AOOs). This is accomplished by having a departure fromnucleate boiling (DNB) design basis, which corresponds to a 95% probability at a 95%confidence level (the 95/95 DNB criterion) that DNB will not occur and by requiring that fuelcenterline temperature stays below the melting temperature.The restrictions of this Safety Limit (SL) prevent overheating of the fuel and cladding, as well aspossible cladding perforation, that would result in the release of fission products to the reactorcoolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate(LHR) below the level at which fuel centerline melting occurs. Overheating of the fuel claddingis prevented by restricting fuel operation to within the nucleate boiling regime, where the heattransfer coefficient is large and the cladding surface temperature is slightly above the coolantsaturation temperature.Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel ishigh enough to cause the fuel centerline temperature to reach the melting point of the fuel.Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the>: point of failure, allowing an uncontrolled release of activity to the reactor coolant.Operation above the boundary of the nucleate boiling regime could result in excessive claddingtemperature because of the onset of DNB and the resultant sharp reduction in heat transfercoefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water(zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuelcladding to a structurally weaker form. Thisweaker form may lose its integrity, resulting in anuncontrolled release of activity to the reactor coolant.The proper functioning of the Reactor Protection System (RPS) and steam generator safety valvesprevents violation of the reactor core SLs.APPLICABLE SAFETY ANALYSESThe fuel cladding must not sustain damage as a result of nonnal operation and AOOs. The reactorcore SLs are established to preclude violation of the following fuel design criteria:a. There must be at least 95% probability at a 95% confidence level (the 95/95 DNBcriterion) that the hot fuel rod in the core does not experience DNB, andb. The hot fuel pellet in the core must not experience centerline fuel melting.MILLSTONE -UNIT 3 B-B2-1Amendment No. 60, 2--t4, LBDCR No. 06-MP3-014June 22, 20062.1 SAFETY LIMITSBASES (Continued)The Reactor Trip System setpoints, in combination with all the LCOs, are designed to prevent anyanticipated combination of transient conditions for Reactor Coolant System (RCS) temperature,pressure, RCS Flow, ALI, and THERMAL POWER level that would result in a departure fromnucleate boiling ratio (DNBR) of less than the DNBR limit and preclude the existence of flowinstabilities.Automatic enforcement of these reactor core SLs is provided by the appropriate operation of theRPS and the steam generator safety valves.SAFETY LIMITSThe figure provided in the CORE OPERATING LIMITS REPORT (COLR) shows the loci ofpoints of THERMAL POWER, RCS pressure, and average temperature for which the minimumDNBR is not less than the safety analyses limit, that fuel centerline temperature remains belowmelting, that the average enthalpy in the hot leg is less than or equal to the enthalpy of saturatedliquid, or that the exit quality is within the limits defined by the DNBR correlation.The reactor core SLs are established to preclude violation of the following fuel design criteria:a. There must be at least a 95% probability at a 95% confidence level (the 95/95DNB criterion) that the hot fuel rod in the core does not experience DNB, andb. There must be at least a 95% probability at a 95% confidence level that the hot fuelpellet in the core does not experience centerline fuel melting.The reactor core SLs are used to define the various RPS .functions such that the above criteria aresatisfied during steady state operation, normal operational transients, and AOOs. To ensure thatthe RPS precludes the violation of the above criteria, additional criteria are applied to theOvertemperature and Overpower AT reactor trip functions. That is, it must be demonstrated thatthe average enthalpy in the hot leg is less than or equal to the saturation enthalpy and that the coreexit quality is within the limits defined by the DNBR correlation. Appropriate functioning of theRPS ensures that for variations in the THERMAL POWER, RCS Pressure, RCS averagetemperature, RCS flow rate, and AI that the reactor core SLs will be satisfied during steady stateoperation, normal operational transients, and AOOs.APPLICABILITYSL 2.1.1 only applies in MODES 1 and 2 because these are the only MODES in which the reactoris critical. Automatic protection functions are required to be OPERABLE during MODES 1 and2 to ensure operation within the reactor core SLs. The steam generator safety valves or automaticprotection actions serve to prevent RCS heatup to the reactor core SL conditions or to initiate areactor trip function, which forces the unit into MODE 3. In MODES 3, 4, 5, and 6, applicabilityis not required since the reactor is not generating significant THERMAL POWER.MILLSTONE -UNIT 3 B2l mnmn oB2-1aAmendment No. LBDCR No. 06-MP3-014June 22, 20062.1 SAFETY LIMITSBASES (Continued)SAFETY LIMIT VIOLATIONSIf SL 2.1.1 is violated, the requireme~nt to go to HOT STANDBY places the unit in a MODE inwhich this SL is not applicable. The allowed completion time of 1 hour recognizes theimportance of bringing the unit to a MODE of operation where this SL is not a~ppicable, andreduces the probability of fuel damage.Amendment No.MILLSTONE -UNIT 3 B2lB2-1b January 31, 1986SAFETY LIMITSBASES2.1.2 REACTOR COOLANT SYSTEM PRESSUREThe restriction of this Safety Limit protects the integrity of the Reactor Coolant Systemn(RCS) fromn overpressurization and thereby prevents the release of radionuclides contained in the-reactor coolant from reaching the containment atmosphere.The reactor vessel, pressurizer, and the RCS piping, valves and fittings are designed toSection III of the ASME Code for Nuclear Power Plants which permits a. maximum transientpressure of 110% (2750 psia) of design pressure.. The Safety Limit of 2750 psia is thereforeconsistent with the design criteria and associated Code requirements.The entire RCS is hydrotested at 125% (3125 psia) of design pressure, to demonstrateintegrity prior to initial operation.MILLSTONE -UNIT 3B22B 2-2 LBDCR Noj)4-MP3-01 5February 24, 20052.2 LIMITING SAFETY SYSTEM SETTINGSBASES2.2.1 REACTOR TRIP SYSTEM INSTRUMENTATION SETPOINTSThe Nominal Trip Setpoints specified in Table 2.2-1 are the nominal values at which thereactor trips are set for each functional unit. The Allowable Values (Nominal Trip Setpoints +/-k thecalibration tolerance) are considered the Limiting Safety System Settings as identified in10OCFR50.36 and have been selected to ensure that the core and Reactor Coolant System are .prevented from exceeding their safety limits during normal operation and design basis anticipatedoperational occurrences and to assist the Engineered SafetyFeatures Actuation System inmitigating the consequences of accidents. The Setpoint for a Reactor Trip System or interlockfunction is considered to be consistent with the nominal value when the measured "as left"Setpoint is within the administratively controlled (+) calibration tolerance identified in plantprocedures (which specifies the difference between the Allowable Value and Nominal TripSetpoint). Additionally, the Nominal Trip Setpoints may be adjusted in the conservative directionprovided the calibration tolerance remains unchanged.Measurement and Test Equipment accuracy is administratively controlled by plantprocedures and is included in the plant uncertainty calculations as defined in WCAP-10991.OPERABILITY determinations are based on the use of Measurement and Test Equipment thatconforms with the accuracy used in the plant uncertainty calculation.The Allowable Value specified in Table 2.2-1 defines the limit beyond which a channel isinoperable. If the process rack bistable setting is measured within the "as left" calibrationtolerance, which specifies the difference between-the A-iiowable Value and Nominal TripSetpoint, then the channel is considered to be OPERABLE.The methodology, as defined in WCAP- 10991 to derive the Nominal Trip Setpoints, isbased upon combining all of the uncertainties .in the channels. Inherent in the determination of theNominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and otherinstrumentation utilized in these channels should be capable of operating within the allowances ofthese uncertainty magnitudes. Occasional drift in excess of the allowance may be determined tobe acceptable based on the other device performance characteristics. Device drift in excess of theallowance that is more than occasional, may be indicative of more serious problems and wouldwarrant further investigation.The various reactor trip circuits automatically open the reactor trip breakers whenever acondition monitored by the Reactor Trip System reaches a preset or calculated level. In additionto the redundant channels and trains, the design approach provides Reactor Trip Systemfunctional diversity. TheMILLSTONE -UNIT 3 B 2-3 Amendment No. 59,Acknowledged by NRC letter dated08/25/05 LBDCR 07-MP3-037-July 12, 20072.2 LIMITING SAFETY SYSTEM SETTINGSBASESREACTOR TRIP SYSTEM INSTRUMENTATION SETPOINTS (Continued)functional capability at the specified trip setting is required for those anticipatory or diversereactor trips for which no direct credit was assumed in the safety analysis to enhance the overallreliability of the Reactor Trip System. The Reactor Trip System initiates a turbine trip signalwhenever reactor trip is initiated. This prevents the reactivity insertion that would otherwiseresult from excessive Reactor Coolant System cooldown and thus avoids unnecessary actuation of:the Engineered Safety Features Actuation System.Manual Reactor TripThe Reactor Trip System includes manual Reactor trip capability.Power Range. Neutron FluxIn each of the Power Range Neutron Flux channels there are two independent bistables,each with its own trip setting used for a High and Low Range trip setting. The Low Setpoint tripprovides protection during subcritical and low power operations to mitigate the consequences of apower excursion beginning from low power, and the High Setpoint trip provides protection duringpower operations to mitigate the consequences of a reactivity excursion from all power levels. lThe Low Setpoint trip may be manually blocked above P-i 10 (a power level ofapproximately 10% of RATED THERMAL PO.WER)._and is automatically reinstated below theP-10 Setpoint.Power Range. Neutron Flux. High Positive RateThe Power Range Positive Rate trip provides protection against rapid flux increases whichare characteristic of positive reactivity insertion events. Specifically, this trip complements thePower Range Neutron Flux High and Low trips to ensure that the criteria are met for all rodejection accidents. This trip also complements the Pressurizer Pressure-High trip, along with theOvertemperature AT and the Power Range Neutron Flux High Positive Rate trips, to ensure thatthe criteria are met for the rod withdrawal at power accidents.MILLSTONE -UNIT 3 B 2-4 Amendment No. 4-46, 4-59, 24-l-, LBDCR No. 07-MP3-017April 12, 2007LIMITING SAFETY SYSTEM SETTINGSBASESIntermediate and Source Range. Neutron FluxThe Intermediate and Source Range, Neutron Flux trips provide core protection duringreactor startupto mitigate the consequences of an uncontrolled rod cluster control assembly bankwithdrawal from a. subcritical condition. These trips provide redundant protection to the LowSetpoint trip of the Power Range, Neutron Flux channels. The Source Range channels willinitiate a Reactor trip at about 105 counts per second unless manually blocked when P-6 becomesactive. The Intermediate Range channels will initiate a Reactor trip at a current level equivalentto approximately 25% of RATED THERMAL POWER unless manually blocked when P-10becomes active. No credit was taken for operation of the trips associated with either theIntermediate .or Source Range Channels in the accident analyses; however, their functionalcapability at the specified trip settings is required by this specification to enhance the overallreliability of the Reactor Trip System.Overtemperature ATThe Overtemperature AT trip provides core protection to prevent DNB for allcombinations of pressure, power, coolant temperature, and axial power distribution, provided thatthe transient is slow with respect to piping transit delays from the core to the temperaturedetectors, and pressure is within the range between the Pressurizer High and Low Pressure trips.The Setpoint is automatically varied with: (1) coolant temperature to correct for temperatureinduced changes in density and heat capacity of water and ~includes dynamic compensation for .piping delays from the core to the loop temperature detectors, (2) pressurizer pressure, and(3) axial power distribution. With normal axial power distribution, this Reactor trip limit isalways below the core Safety Limit as shown by the Reactor Core Safety Limit curves in theCOLR. If axial peaks are greater than design, as indicated by the difference between top andbottom power range nuclear detectors, the Reactor trip is automatically reduced according to thenotations in Table 2.2-1. Although a direction of conservatism is identified for theOvertemperature AT reactor trip function K2 and K3 gains, the gains should be set as close aspossible to the values contained in Note 1 to ensure that the Overtemperature AT setpoint isconsistent with the assumptions of the safety analyses.Overpower ATThe Overpower AT trip provides assurance of fuel integrity (e.g., no fuel pellet meltingand less than 1% cladding strain) under all possible overpower conditions, limits the requiredrange for Overtemperature ATMILLSTONE -UNIT 3B 2-5MILLTON -NIT3 B2-5Amendment No. 2, 60, 4-52, 2-l--7-, LBDCR No.;08-MP3-014October 21, 2008LIMITING SAFETY SYSTEM SETTINGSBASEStrip, and provides a backup to the High Neutron Flux trip. The Setpoint is automatically variedwith: (1) coolant temperature to correct for temperature induced changes in density and heatcapacity of water, and (2) rate of change of temperature for dynamic compensation for pipingdelays from the core to the loop temperature detectors, to ensure that the allowable heatgeneration rate (kW/ft) is not exceeded. The Overpower AT trip provides protection to mitigatethe consequences of various size steam breaks as reported in WCAP-9226, "Reactor CoreResponseto Excessive Secondary Steam Releases."Pressurizer PressureIn each of the pressurizer pressure channels, there are two independent bistables, each with itsown trip setting to provide for a High and Low Pressure trip thus limiting the pressure range inwhich reactor operation is permitted. The Low Setpoint trip protects against low pressure whichcould lead to DNB by tripping the reactor in the event of a loss of reactor coolant pressure.On decreasing power the Low Setpoint trip is automatically blocked by P-7 (a power level ofapproximately 10% of RATED THERMAL POWER with turbine impulse chamber pressure atapproximately 10% of full power equivalent); and on increasing power, automatically reinstatedby P-7.The High Setpoint trip functions in conjunction with the pressurizer relief and safety valves toprotect the Reactor Coolant System against system overpressure.Pressurizer Water LevelThe Pressurizer Water Level High trip is provided~-.to pre-vent water relief through the pressurizersafety valves. On decreasing power the Pressurizer High Water Level trip is automaticallyblocked by P-7 (a power level of approximately 10% of RATED THERMAL POWER with aturbine impulse chamber pressure at approximately 10% of full power equivalent); and onincreasing power, automatically reinstated by P-7.Reactor Coolant FlowThe Reactor Coolant Flow Low trip provides core protection to prevent DNB by mitigating theconsequences of a loss of flow resulting from the loss of one or more reactor coolant pumps.The nominal RCS flow is the actual measured RCS flow during POWER OPERATION. The lowRCS flow RPS trip is set to be greater than or equal to 90% of the actual measured flow.Technical Specification 3.2.3, RCS Flow Rate and Nuclear Enthalpy Rise Hot Channel Factor,assures that the nominal (actual measured) RCS flow will exceed the RCS design Hlow rate usedfor design basis accidents and the Minimum Measured Flow used in the DNBR analysis asspecified in the COLR and consequently the trip setpoint based upon the nominal (actualmeasured) RCS will be conservative with respect to the safety analysis. A trip setpoint basedupon 90% of nominal (actual measured) RCS flow assures that the design basis analyses and theDNBR analyses are conservative and bounding.MILLSTONE -UNIT 3 B- mnmn oB 2-6Amendment No. LBDCR No. 08-MP3-036October 30, 2008LIMITING SAFETY SYSTEM SETTINGSBASESOn increasing power above P-7 (a power level of approximately 10%. of RATED THERMALPOWER or a turbine impulse chamber pressure at approximately 10% of full power equivalent),an automatic Reactor trip will occur if the flow in more than one loop drops below 90% ofnominal full loop flow. Above P-8 (a power level of approximately 50% of RATED THERMALPOWER) an automatic Reactor trip will occur if the flow in any single loop drops below 90% ofnominal full loop flow. Conversely, on decreasing power between P-8 and the P-7 an automaticReactor trip will occur on low reactor coolant flow in more than one loop and below P-7 the tripfunction is automatically blocked.'Steam Generator Water LevelThe Steam Generator Water Level Low-Low trip protects the reactor from loss of heat sink in theevent of a sustained steamn/feedwater flow mismatch resulting from loss of normal feedwater. Thespecified Setp~oint provides allowances for starting delays of the Auxiliary Feedwater System.Low Shaft Speed -Reactor Coolant PumpsThe Low Shaft Speed -Reactor Coolant Pumps trip provides core protection to prevent DNB inthe event of a sudden significant decrease in reactor coolant pump speed (with resulting decreasein flow) on two reactor coolant pumps in any two operating reactor coolant loops. The tripsetpoint ensures that a reactor trip will be generated, considering instrument errors andresponse times, in sufficient time to allow the DNBR to be maintained greater than the designabove limit following a four-pump loss of flow event.Turbine TripA Turbine trip initiates a Reactor trip. On decreasing power the Reactor trip from the Turbine tripis automatically blocked by P-9 (a power level of approximately 50% of RATED THERMALPOWER); and on increasing power, reinstated automatically by P-9. The P-9 setpoint isacceptable with up to two steam dump valves out of service.Safe.ty Injection Input from ESFIf a Reactor trip has not already been generated by the Reactor Trip System instrumentation, theESF automatic actuation logic channels will initiate Reactor trip upon any signal which initiates aSafety Injection. The ESF instrumentation channels which initiate a Safety Injection signal areshown in Table 3.3-3.Reactor Trip System InterlocksThe Reactor Trip System interlocks perform the following functions:P-6 On increasing power, P-6 becomes active above the Interlock Allowable Valuespecified on Table 2.2-1 to allow the manual block of the Source Range trip (i.e.,prevents premature block of the Source Range trip during reactor startup) anddeenergizes the high voltage to the detectors. On decreasing power during aMILLSTONE -UNIT 3B27AmnetNoB 2-7Amendment No. LBDCR No,-08-MP3-014*October 21, 2008LIMITING SAFETY SYSTEM SETTINGSBASESReactor Trip System Interlocks (Continued)reactor shutdown, Source Range Level trips are automatically reactivated and highvoltage restored when P-6 deactivates. The P-6 deactivation will occur at a valuebelow its activation value and may be calibrated to occur below the P-6 InterlockAllowable Value specified on Table 2.2-1 to prevent overlap and chatter based upon.:the expected bistable drift.P-7 On increasing power P-7 automatically enables Reactor trips on low flow in morethan one reactor coolant loop, reactor coolant pump low shaft speed, pressurizer lowpressure and pressurizer high level. On decreasing power, the above listed trips areautomatically blocked.P-8 On increasing power, P-8 automatically enables Reactor trips on low flow in one ormore reactor coolant loops. On decreasing power, the P-8 automatically blocks theabove listed trips.P-9 On increasing power, P-9 automatically enables Reactor trip on Turbine trip. Ondecreasing power, P-9 automatically blocks Reactor trip on Turbine trip.P-i10 On increasing power, P- 10 provides input to P-7 to ensure that Reactor Trips on lowflow in more than one reactor coolant loop, reactor coolant pump low shaft speed,pressurizer low pressure and pressurizer high level are active when powver reaches11%. It also allows the manual block of the Intermediate Range trip and the LowSetpoint Power Range trip; and automatically blocks the Source Range trip anddeenergizes the Source Range high voltage power.On decreasing power, P-10 resets to automatically reactivate the Intermediate Rangetrip and the Low Setpoinit Power Range trip before power drops below 9%. It alsoprovides input to reset P-7.P-13 On increasing power, P-13 provides input to P-7 to ensure that Reactor trips onlow flow in more than one reactor coolant loop, reactor coolant pump low shaftspeed, pressurizer low pressure and pressurizer high level are active when powerreaches 10%.On decreasing power, P-13 resets when power drops below 10% and provides input,along with P-10, to reset P-7.MILLSTONE -UNIT 3B 2-8MILSTOE UNT B -8Amendment No. -5 2--l-g, :2---, BASES FORSECTIONS 3.0 AND 4.0LIMITING CONDITIONS FOR OPERATIONANDSURVEILLANCE REQUIREMENTS NOTEThe BASES contained in succeeding pages summarizethe reasons for the Specifications in Sections 3.0and 4.0, but in accordance with 10 CFR 50.36 arenot part of these Technical Specifications. october 25, 1990.3/4.0 APPLICABILITY'! BASES3/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS3/4.0 APPLICABILITYSpecification 3.0.1 throuah 3.0.4 establish the general requirementsapplicable to Limiting Conditions for Operation. These requirements are basedon the requirements for Limiting Conditions for Operation stated in the Codeof Federal Regulations, 10 CFR 50.36(c)(2):"Limiting conditions for operation are the lowest functional capability orperformance levels of equipment required for safe operation of the facility.When a limiting condition for operation of a nuclear reactor is not met, thelicensee shall shut down the reactor or follow any remedial action permittedby the technical specification until the condition can be met."Specification 3.0.1 establishes the Applicability statement within eachindividual specification as the requirement for when (i.e., in whichOPERATIONAL MODES or other specif'ied conditions) conformance to the LimitingConditions for Operation is required for safe operation of the facility. TheSACTION requirements establish those remedial measures that must be takenwithin specified time limits when the requirements of a Limiting Condition for*Operation are not met.S There are two basic types of ACTION requirements. The first specifies theS remedial measures that permit continued operation of the facility which is notfurther restricted by the time limits of the ACTION requirements. In thiscase, conformance to the ACTION requirements provides an acceptable level ofsafety for unlimited continued operation as long as the ACTION requirementscontinue to be met. The second type of ACTION requirement specifies a timelimit in which conformance to the conditions of the Limiting Condition forOperation must be met. This time limit is the allowable outage time torestore an inoperable sYstem or component to OPERABLE status of for restoringparameters within specified limits. If these actions are not completed withinthe allowable outage time limits, a shutdown is required to place the facilityin a MODE or condition in which the specification no longer applies. It isnot intended that the shutdown ACTION requirements be used as an operationalconvenience which permits (routine) voluntary removal of a system(s) orcomponent(s) from service in lieu of other alternatives that would not resultin redundant systems or components being inoperable.The specified time limits of the ACTION requirements are applicable from thepoint in time it is identified that a Limiting Condition for Operation is notmet. The time limits of the ACTION requirements are also applicable when asystem or component is removed from service for surveillance testing orinvestigation of operational problems. Individual specifications may includea specified time limit for the completion of a Surveillance Requirement whenequipment is removed from service. In this case, the allowable outage timern limits of the ACTION requirements are applicable when this limit expires if~the surveillance has not been completed. When a shutdown is required toMILLSTONE -UNIT 3 B3401 AEDETN.5B 3/4 0-IAMENDMENT NO. 57 October 25, 3/4.0 APPLICABILITY WBASEScomply with ACTION requirements, the plant may have entered a MODE in which anew specification becomes applicable. In this case, the time limits of theACTION requirements would apply from the point in time that the newspecification becomes applicable if the requirements of the Limiting Conditionfor Operationfare not met.Specification 3.0.2 establishes that noncompliance with a specificationexistswhen the requirements of the Limiting Condition for Operation are not met andthe associated ACTION requirements have not been implemented within thespecified time interval. The purpose of this specification is to clarify that(I) implementation of the ACTION requirements within the specified timeinterval constitutes compliance with a specification and (2) completion of theremedial measures of the ACTION requirements is not required when compliancewith a Limiting Condition of Operation is restored within the time intervalspecified in the associated ACTION requirements.Specification 3.0.3 establishes the shutdown ACTION requirements that must beimplemented when a Limiting Condition for Operation is not met and thecondition is not specifically addresFzA by the associated ACTION requirements.The purpose of this specification is 'o delineate the time limits for placingthe unit in a safe shutdown MODE when plant operation cannot be maintainedwithin the limits for safe operation defined by the Limiting Conditions for i.Operation and its ACTION requirements. It is not intended to be used as anoperational convenience which permits (routine) voluntary .removal of redundantsystems or components from service in lieu of other alternatives that wouldnot result in redundant systems or components being inoperable. This timepermits the operator to coordinate the reduction in electrical generation withthe load dispatcher to ensure the stability and availability of the electricalgrid. The time limits specified to reach lower MODES of operation permit theshutdown to proceed in a controlled and orderly manner that is well within thespecified maximum cooldown rate and Within the cooldown capabilities of thefacility assuming only the minimum required equipment is OPERABLE. Thisreduces thermal stresses on components of the primary coolant system and thepotential for a plant upset that could challenge safety systems underconditions for which this specification applies.If remedial measures permitting limited continued operation of the facilityunder the provisions of the ACTION requirements are completed, the shutdownmay be terminated. The time limits of the ACTION requirements are applicablefrom the point in time it is identified that a Limiting Condition forOperation is not met. Therefore, the shutdown may be terminated if the ACTIONrequirements have been met or the time limits of the ACTION requirements havenot expired, thus providing an allowance for the completion of the requiredactions. The time limits of Specification 3.0.3 allow 37 hours for the plantto be in COLD SHUTDOWN MODE when a shutdown is required during the POWER MODEof operation. If the plant is in a lower MODE of operation when a shutdown isrequired, the time limit for reaching the next lower MODE of operationapplies. However, if a lower MODE of operation is reached in less time thanallowed, the total allowable time to reach COLD SHUTDOWN, or other applicable MILLSTONE -UNIT 3MILTN NT3B 3/4 0-2 AMENDMENT NO. 57 3/4.0 APPLICABILITY Apr11 17, 2000BASESMODE, is not reduced. For example, if HOT STANDBY is reached in 2 hours, thetime allowed to reach HOT SHUTDOWN is the next 11 hours because the total timeto reach HOT SHUTDOWN is not reduced from the allowable limit of 13 hours.Therefore, if remedial measures are completed that would permit a return toPOWER operation, a penalty is not incurred by having to reach a lower MODE ofoperation in less than the total time allowed.The same principle applies with regard to the allowable outage time limits ofthe ACTION requirements, if compliance with the ACTION requirements for one*specification results in entry. into a MODE or condition of operation foranother specification in which the requirements of the Limiting Condition forOperation are not met. If the new specification becomes applicable in lesstime than specified, the difference may be added to the allowable outage timelimits of the second specification. However, the allowable outage.time limitsof ACTION requirements for a higher MODE of operation may not be used toextend the allowable outage time that is applicable when a Limiting Conditionfor Operation is not met in a lower MODE of operation.The Shutdown requirements of Specification 3.0.3 do not apply in MODES 5 and6, because the ACTION requirements of individual specifications define theremedial measures to be taken.Specification 3.0.4 establishes limitations on MODEchanges when a LimitingCondition for Operation is not met. It precludes placing the facility in ahigh MODE of operation when the requirements for a Limiting Condition forOperation are not met and continued noncompliance to these conditions wouldresult in a shutdown to comply with the ACTION requirements if a change inMODES were permitted. The purpose of this specification is to ensure thatfacility operation is not initiated or that higher MODES of operation are notentered when corrective action is being taken to obtain compliance with aspecification by restoring equipment to OPERABLE status or parameters tospecified limits. Compliance with ACTION requirements that permit continuedoperation of the facility for an unlimited period of time provides *anacceptable level of safety for continued operation without regard to thestatus of the plant before or after a MODE change. Therefore, in this case,entry into an OPERATIONAL MODE or other specified condition may be made inaccordance with the provisions of the ACTION requirements. The provisions ofthis specification should not, however, *be interpreted as endorsing thefailure to exercise good practice in restoring systems or components toOPERABLE status before plant startup.When a shutdown is required to comply with ACTION requirements, the provisionof Specification 3.0.4 do not apply because they would delay placing thefacility in a lower MODE of operation.Specification 3.0.5 establishes the allowance for restoring equipment toservice under administrative controls when it has been removed from serviceor declared inoperable to comply with ACTIONS. The sole purpose of thisSpecification is to provide an exception to Specifications 3.0.1 and 3.0.2(e.g., to not comply with the applicable Required Action(s)) to allow theperformance of required testing to demonstrate either:a. The OPERABILITY of the equipment being returned to. service; orb. The OPERABILITY of other equipment.MILLSTONE -UNIT 3B 3/4 0-3MILLTONE- UNT 3 3 40-3Amendment No. F7, 179 3/4.0 APPLICABILITY Arl1,20April 17, 2000BASESThe administrative controls ensure the time the equipment is returned to ,service in conflict with the requirements of the ACTIONS is limited to thetime absolutely neCessary to perform the required testing to demonstrate,OPERABILITY. This Specification does not provide time to perform any otherpreventive or corrective maintenance.An example of demonstrating the OPERABILITY of the equipment being returnedto service is reopening a containment isolation valve that has been closed tocomply with Required Actions and must be reopened to perform the requiredtesting.An example of demonstrating the OPERABILITY of other equipment is taking aninoperable channel or trip system out of the tripped condition to prevent thetrip function from occurring during the performance of required testing onanother channel in the other trip system. A similar example of demonstratingthe OPERABILITY of other equipment is taking an inoperable channel or tripsystem out of the tripped condition to permit the logic to function andindicate the appropriate response during the performance of required testingon another channel in the same trip system.Specifications 4.0.1 through 4.0.5 establish the general requirementsapplicable to Surveillance Requirements. These requirements are based on theSurveillance Requirements stated in the Code of Federal Regulations, 10 CFR50.36(c) (3) :0iMILLSTONE UNIT 3B 3/40-3aMILLTONEUNI 3 B3/4 -3aAmendment No. 179 November 15, 20023/4.0 APPLICABILITYBASES"Surveillance requirements are requirements relating to test, calibration, or inspection toensure that the necessary quality of systems and components is maintained, that facility operationwill be within safety limits, and that the limiting conditions of operation will be met."Specification 4.0.1 establishes the requirement that surveillances must be met during theOPERATIONAL MODES or other conditions for which the requirements of the LimitingConditions for Operation apply unless otherwise stated in an individual SurveillanceRequirement. The purpose of this specification is to ensure that surveillances are performed toverify the OPERABILITY of systems and components and that parameters are within specifiedlimits to ensure safe operation of the facility when the plant is in a MODE or other specifiedcondition for which the associated Limiting Conditions for Operation are applicable. Failure tomeet a Surveillance within the specified surveillance interval, in accordance with Specification4.0.2, constitutes a failure to meet a Limiting Condition for Operation.Systems and components are assumed to be OPERABLE when the associated SurveillanceRequirements have been met. Nothing in this Specification, however, is to be construed asimplying that systems or components are when either:a. The systems or components are known to be inoperable, although still meeting theSurveillance Requirements orb. The requirements of the Surveillance(s) are known to be not met between requiredSurveillance performances.Surveillance requirements do not have to be performed when the facility is in an OPERATIONALMODE or other specified conditions for which the requirements of the associated LimitingCondition for Operation do not apply unless otherwise specified. The Surveillance Requirementsassociated with a Special Test Exception are only applicable when the Special Test Exception isused as an allowable exception to the requirements of a specification.Unplanned events may satisfy the requirements (including applicable acceptance criteria) for agiven Surveillance Requirement. In this case; the unplanned event may be credited as fulfillingthe performance. of the Surveillance Requirement. This allowance includes those SurveillanceRequirement(s) whose performance is normally precluded in a given MODE or other specifiedcondition.Surveillance Requirements, including Surveillances invoked by ACTION requirements, do nothave to be performed on inoperable equipment because the ACTIONS define the remedialmeasures that apply. Surveillances have to be met and performed in accordance withSpecification 4.0.2, prior to returning equipment to OPERABLE status.Upon completion of maintenance, appropriate post maintenance testing is required to declareequipment OPERABLE. This includes ensuring applicable Surveillances are not failed and theirmost recent performance is in accordance with Specification 4.0.2. Post maintenance testing maynot be possible in the current MODE or other specified conditions in the Applicability due to thenecessary unit parameters not having been established. In these situations, the equipment may beconsidered OPERABLE provided testing has been satisfactorily completed to the extent possibleand the equipment is not otherwise believed to be incapable of performing its function. This willallow operation to proceed to a MODE or other specified condition where other necessary postmaintenance tests can be completed.MILLSTONE -UNIT 3B 3/4 0-4MILL TON -NIT3 B3/40-4Amendment No. =5-7, -l-2-, 213 LBDCR No. 074-MP3-015February 24, 20053/4.0 APPLICABILITY 'BASESSome examples of this process are:a. Auxiliary feedwater (AFW) pump turbine maintenance during refueling thatrequires testing at steam pressure > 800 psi. However, if other appropriate testingis satisfactorily completed, the AFW System can be considered OPERABLE. Thisallows startup and other necessary testing to proceed until the plant reaches thesteam pressure required to perform the testing.b. High pressure safety in~jection (I-PSI) maintenance during shutdown that requires*system functional tests at a specified pressure. Provided other appropriate testingis satisfactorily completed, startup can proceed with HPSI consideredOPERABLE. This allows operation to reach the specified pressure to complete thenecessary post maintenance testing.Specification 4.0.2 This specification establishes the limit for which the specified time intervalfor surveillance requirements may be extended. It permi~ts an allowable extension of the normalsurveillance interval to facilitate surveillance scheduling and consideration of plant operatingconditions that may not be suitable for conducting the surveillance; e.g., transient conditions orother ongoing surveillance or maintenance activities. It also provides flexibility to accommodatethe length of a fuel cycle for surveillances that are performed at each refueling outage and arespecified typically with an 18-month surveillance interval. It is not intended that this provision be used repeatedly as a convenience to extend surveillance intervals beyond that specified forsurveillances that are not performed during refueling outage. The limitation of 4.0.2 is based on"engineering judgment and the recognition that the most probable result of any particularsurveillance being performed is the verification of conformance with the surveillancerequirements. This provision is sufficient to ensure that the reliability ensured throughsurveillance activities is not significantly degraded beyond that obtained from the specifiedsurveillance interval.*Specification 4.0.3. establishes the flexibility to defer declaring affected equipment inoperable oran affected variable outside the specified limits when a Surveillance has not been completedwithin the specified surveillance interval. A delay period of up to 24 hours or up to the limit ofthe specified surveillance interval, whichever is greater, applies from the point in time that it isdiscovered that the Surveillance has not been performed in accordance with Specification 4.0.2,and not at the time that the specified surveillance interval was not met.This delay period provides adequate time to complete Surveillances that have been missed. Thisdelay period permits the completion of a Surveillance before complying with ACTIONrequirements or other remedial measures that might preclude completion of the Surveillance.The basis for this delay period includes consideration of unit conditions, adequate planning,availability of personnel, the time required to perform the Surveillance, the safety significance of'the delay in completing the required Surveillance, and the recognition that the most probableresult of any particular Surveillance being performed is the verification of conformance with therequirements.MILLSTONE -UNIT 3 B 3/4 0-5 Amendment No. , 22, 06, t-3,0Acknowledged by NRC letter dated08/25/05 LBDCR No. 04-MP3-015February 24, 20053/4.0 APPLICABILITYBASESWhen a Surveillance with a surveillance interval based not on time intervals, but upon specifiedunit conditions, operating situations, or requirements of regulations, (e.g., prior to enteringMODE I after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified byapproved exemptions, etc.) is discovered to not havje been performed when specified,Specification 4.0.3 allows for the full delay period of up to the specified surveillance interval toperform the Surveillance. However, since there is not a time interval specified, the missedSurveillance should be performed at the first reasonable opportunity.Specification 4.0.3 provides a time limit for, and allowances for the performance of, Surveillancesthat become applicable as a consequence of MODE changes imposed by ACTION requirements.[Failure to comply with specified surveillance intervals for the Surveillance Requirements isexpected to be an infrequent occurrence. Use of the delay period established by Specification4.0.3 is a flexibility which is not intended to be used as an operational convenience to extendSurveillance intervals. While up to 24 hours or the limit of the specified surveillance interval isprovided to perform the missed Surveillance, it is expected that the missed Surveillance will beperformed at the first reasonable opportunity. The determination of the first reasonableopportunity should include consideration of the impact on plant risk (from delaying theSurveillance as well as any plant configuration changes required or shutting the plant down to.perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions,planning, availability of personnel, and the time required to perform the Surveillance. This riskimpact should~be managed, through the program in place to implement 10 CFR 50.65(a)(4) and itsimplementation guidance, NRC Regulatory Guide 1.182, "Assessing and Managing Risk BeforeMaintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses considerationof temporary and aggregate risk impacts, determination of risk management action thresholds,and risk management action up to and including plant shutdown. The missed Surveillance shouldbe treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluationmay use quantitative, qualitative, or blended methods. The degree of depth and rigor of theevaluation should be commensurate with the importance of the component. Missed Surveillancesfor important components should be analyzed quantitatively. If the results of the risk evaluationdetermine the risk increase is significant, this evaluation should be used to determinethe safestcourse of action. All missed Surveillances will be placed in the licensee's Corrective ActionProgram.If a Surveillance is not completed within the allowed delay period, then the equipment isconsidered inoperable or the variable* is considered outside the specified limits and the entry intothe ACTION requirements for the applicable Limiting Condition for Operation beginsimmediately upon, expiration of the delay period. If a Surveillance is failed within the delayperiod, then the equipment is inoperable, or the variable is outside the specified limits and entryinto the ACTION requirements for the applicable Limiting Conditions for Operation beginsimmediately upon the failure of the Surveillance.Completion of the Surveillance within the delay period allowed by this Specification, or withinthe Allowed Outage Time of the applicable ACTIONS, restores compliance with Specification4.0.1.MILLSTONE -UNIT 3 B 3/4 0-5a Amendment No. 2-4-3,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 07-MP3-009June 19, 20073/4.0 APPLICABILITYBASESSpecification 4.0.4 establishes the requirement that all applicable surveillances must be metbefore entry into an OPERATIONAL MODE or other condition of operation specified in theApplicability statement. The purpose of this specification is to ensure that system and componentOPERABILITY requirements or parameter limits are met before entry into a MODE or conditionfor which these systems and components ensure safe operation of the facility. This provisionapplies to changes in OPERATIONAL MODES or other specified conditions associated withplant shutdown as well as startup.Under the provisions of this specification, the applicable Surveillance Requirements must beperformed within the specified surveillance interval to ensure that the Limiting Conditions forOperation are met during initial plant startup or following a plant outage.When a shutdown is required to comply with ACTION requirements, the provisions ofSpecification 4.0.4 do not apply because this would delay placing the facility in a lower MODE ofoperation.Specification 4.0.5 establishes the requirement that inservice testing of ASME Code Class 1, 2,and 3 pumps and valves shall be performed in accordance with a periodically updated version ofthe ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OMN Code) andapplicable Addenda as required by l0CFR5O.55a(f). These requirements apply except whenrelief has been provided in writing by the Commission.This specification includes a clarification of the frequencies for performing the inservice testingactivities required by the ASME. OM Code and applicable Addenda. This clarification isprovided to ensure consistency in surveillance intervals throughout the Technical Specificationsand to remove any ambiguities relative to the frequencies for performing the required inservicetesting activities..Under the terms of this specification, the more restrictive requirements of the TechnicalSpecifications take precedence over the ASME OM Code and applicable Addenda. Therequirements of Specification 4.0.4 to perform surveillance activities before entry into anOPERATIONAL MODE or other specified condition takes-precedence over the ASME OM Code"provision which allows pumps and valves to be tested up to one week after return to normaloperation.MILLSTONE -UNIT 3B 3/4 0-6MILLTONE- UNT 3 3/40-6Amendment No. 2--3, LBDCR 06-MP3-013April 5, 20063/4.1 REACTIVITY CONTROL SYSTEMSBASES3/4.1.1 BORATION CONTROL3/4.1.1.1i and 3/4.1.1.2 SHUTDOWN MARGINA sufficient SHUTDOWN MARGIN ensures that: (1) the reactor can be made subcriticalfrom all operating. conditions, (2) the reactivity transients associated with postulated accidentconditions are controllable within acceptable limnits, and (3) the reactor will be maintainedsufficiently subcritical to preclude inadvertent criticality in the shutdown condition.sHUTDOWN MARGIN requirements vary throughout core life as a function of fueldepletion, RCS boron concentration, and RCS Tavg. In MODES I and 2, the mnost restrictivecondition occurs at EOL with Tav at n1o load operating temperature, and is associated with apostulated steam line break accident and resulting uncontrolled RCS cooldown. In the analysis ofthis accident, a minimum SHUTDOWN MARGIN as defined in Specification 3/4.1.1.1.1 isrequired to: control the reactivity transient. Accordingly, the SHUTDOWN MARGINrequirement is based upon this limiting condition and is consistent with FSAR safety analysisassumptions. In MODES 3, 4 and 5, the mnost restrictive condition occurs at BOL, associated witha boron dilution accident. In the analysis of this accident, a minimum SHUTDOWN MARGIN asdefined in Specification 3/4.1.1 .1 .2 is required to allow the operator 15 minutes from the initiationof the Shutdown Margin Monitor alarm to total loss of SHUTDOWN MARGIN. Accordingly,the SHUTDOWN MARGIN requirement is based upon this limiting requirement and isconsistent with the accident analysis assumption.The locking closed of the required valves in MODE 5 (with the loops not filled) willpreclude the possibility of uncontrolled boron dilution of the Reactor Coolant System bypreventing flow of unborated water to the RCS.3/4.1.1.3 MODERATOR TEMPERATURE COEFFICIENTThe limitations on moderator temperature coefficient (MTC) are provided to ensure thatthe value of this coefficient remains within the limniting condition assumned in the FSAR accidentand transient analyses.The MTC values of this specification are applicable to a specific set of plant conditions;accordingly, verification of MTC values at conditions other than those explicitly stated willrequire extrapolation to those conditions in order to permit an accurate comparison.The most negative MTC, value equivalent to the nmost positive moderator densitycoefficient (MDC), was obtained by incrementally correcting the MDC used in the ESARanalyses to nominal operating conditions.MILLSTONE -UNIT 3 B 3/4 1-1 Amendment No. 9,-6O, 9~9, 4-1-,Acknowledged by NRC Letter dated 12/19/06 August 27, 2001REACTIVITY CONTROL SYSTEMSBASESMODERATOR TEMPERATURE COEFFICIENT (Continued)These corrections involved: (1) a conversion of the MDC used in the FSAR safetyanalyses to its equivalent MTC, based on the rate of change of moderator density withtemperature at RATED THERMAL POWER conditions, and (2) subtracting from this value thelargest differences in MTC observed between EOL, all rods withdrawn, RATED TIHERMALPOWER conditions, and those most adverse conditions of moderator temperature and pressure,rod insertion, axial power skewing, and xenon concentration that can occur in normal operationand lead to a significantly more negative EOL MTC at RATED THERMAL POWER. Thesecorrections transformed the MDC value used in the FSAR safety analyses into the limiting End ofCycle Life (EOL) MTC value. The 300 ppm surveillance limit MTC value represents aconservative MTC value at a core condition of 300 ppm equilibr/ium boron concentration, and isobtained by making corrections for burnup and soluble boron to the limiting EOL MTC value.The Surveillance Requirements for measurement of the MTC at the beginning and nearthe end of the fuel cycle are adequate to confirm that the MTC remains within its limits since thiscoefficient changes slowly due principally to the reduction in RCS boron concentration associatedwith fuel burnup.3/4.1.1.4 MINIMUM TEMPERATURE FOR CRITICALITYThis specification ensures that the reactor will not be made critical with the ReactorCoolant System average temperature less than 551. This limitation is required to ensure: (1) themoderator temperature coefficient is within it analyzed temperature range, (2) the tripinstrumentation is within its normal operating range, (3) the P-12 interlock is above its setpoint,(4) the pressurizer is capable of being in an OPERABLE status with a steam bubble, and (5) thereactor vessel is above its minimum RTNDT temperature.3/4.1.2 DELETEDMILLSTONE -UNIT 3B 3/4 1-2MILLTON -NIT3 B3/41-2Amendment No. 2-9, 5-0, 4457-, 197 LBDCR 07-MP3-037Jtily 12, 2007REACTIVITY CONTROL SYSTEMSBASES3/4.1.3 MOVABLE CONTROL ASSEMBLIESThe specifications of this section ensure that: (1) acceptable power distribution limits aremaintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effectsof rod misalignment on associated accident analyses are limited. OPERABILITY of the controlrod position indicators is required to detennine control rod positions and thereby ensurecompliance with the control rod aligmnent and insertion limits. Verification that the Digital RodPosition Indicator agrees with the demanded position within +/--12 steps at 24, 48, 120, and fullywithdrawn position for the Control Banks and 18, 210, and fully withdrawn position for theShutdown Banks provides assurances that the Digital Rod Position Indicator is operatingcorrectly over the full range of indication. Since the Digital Rod Position Indication System doesnot indicate the actual shutdown rod position between 18 steps and 210 steps, only points in theindicated ranges are picked for verification of agreement with demanded position.The ACTION statements which permit limited variations from the basic requirements areaccompanied by additional restrictions which ensure that the original design criteria are met.Misalignment of a rod requires measurement of peaking factors and a restriction in TI-ERMALPOWER. These restrictions provide assurance of fuel rod integrity during continued operation. Inaddition, those safety analyses affected by a misaligned rod are reevaluated to confirm that theresults remain valid during future operation.The maximaum rod drop time restriction is consistent with the assumed rod drop time used in thesafety analyses. Measurement with Tavg greater than or equal to 500°F and with all reactor coolantpumps operating ensures that the measured drop times will be representative of insertion timesexperienced during a Reactor trip at operating conditions.The required rod drop time of< 2.7 seconds specified in Technical Specification 3.1.3A4 is used inthe FSAR accident analysis. A rod drop time was calculated to validate the TechnicalSpecification limit. This calculation accounted for all uncertainties, including a plant specificseismic allowance of 0.50 seconds. Since the seismic allowance should be removed whenverifying the actual rod drop time, the acceptance criteria for surveillance testing is 2.20 seconds(Reference 4).Measuring rod drop times prior to reactor criticality, after reactor vessel head removal andinstallation, ensures that the reactor internals and rod drive mechanism will not interfere with rod.motion or rod drop time, and that no degradation in these systems has occurred that wouldadversely affect rod motion or drop time. Any time the OPERABILITY of the control rods hasbeen affected by a repair, maintenance, modification, or replacement activity, post maintenancetesting in accordance with SR 4.0.1 is required to demonstrate OPERABILITY.MILLSTONE -UNIT 3 B 3/4 1-3 Amendment No..-!-2., 60, .83, 4-4-, 4-5-7,164, 4-9-7, LBDCR l2-MP3-010September 20, 2012REACTVTSCNRLSYTMBASESMOVABLE CONTROL ASSEMIBLIIES (Continued')Control rod positions and OPERABILITY of the rod position indicators are required to beverified at the frequency specified in the Surveillance Frequency Control Program with morefrequent verifications required if an automatic monitoring channel is inoperable. Theseverification frequencies are adequate for assuring that the applicable LCOs are satisfied.The Digital Rod Position Indication (DRPI) System is defined as follows:* Rod position indication as displayed on DRPI display panel (MB4), or* Rod position indication as displayed by the Plant Process Computer System.With the above definition, LCO 3.1.3.2, "ACTION a." is no applicable with either DRPI displaypanel or the plant process computer points OPERABLE.The plant process computer may be utilized to satisfy DRIPI System requirements which meetsLCO 3.1.3.2, in requiring diversity for determining digital rod position indication.Technical Specification SR 4.1.3.2.1 determines each digital rod position indicator to beOPERABLE by verifying the Demand Positioni Indication System and the DRPI System agreewithin 12 steps at the frequency specified in the Surveillance Frequency Control Program, exceptduring the time when the rod position deviation monitor is inoperable, then compare the DemandPosition Indication System and the DRIPI System at least once each 4 hours.The Rod Deviation Monitor is generated only from the DRIPI panel at M4I34. Therefore, when rodposition indication as displayed by the plant process computer is the only available indication,then perform SURVEILLANCE REQUIREMENTS every 4 hours.MILLSTONE -UNIT 3 B 3/4 1-4 Amendment No. 6Q0 : LBDCR 12-MP3-010September 20, 2012REACTIVTY CONTROL SYSTEMSD BASESMOVABLE CONTROL ASSEMBLIES (Continued)Additional surveillance is required to ensure the plant process computer indications are inagreement with those displayed on the DRPI. This additional SURVEILLANCEREQUIREMENT is as follows:Each rod position indication as displayed by the plant process computer shall bedetermined to be OPERABLE by verifying the rod position indication as displayed on theDRPI display panel agrees with the rod position indication as displayed by the plantprocess computer at the frequency specified in the Surveillance Frequency ControlProgram.The rod position indication, as displayed by DRPI display panel (@AB4), is a non-QA system,calibrated on a refueling interval, and used to implement T/S 3.1.3.2. Because the plant processcomputer receives field data from the same source as the DRPI System (MB4), and is alsocalibrated on a refueling interval, it fully meets all requirements specified in T/S 3.1.3.2 for rodposition. Additionally, the plant process computer provides the same type and level of accuracy asthe DRPI System (MB4). The plant process computer does not provide any alarm or rod positioni deviation monitoring as does DRPI display panel (MB4).For Specification 3.1.3.1 ACTIONS b. and c., it is incumbent upon the plant to verify thetrippability of the inoperable control rod(s). Tripp ability is defined in Attachment C to a letterdated December 21, 1984, from E. P. Rahe (Westinghouse) to C. 0. Thomas (NRC). This may beby verification of a control system failure, usually electrical in nature, or that the failure is....as.sociated with the control rod stepping mechanism. In the event the plant is unable to verify therod(s) trippability, it must be assumed to be untrippable andi-thus f~alls undr therequirements of-ACTION a. Assuming a controlled shutdoWn from 100% RATED THERMAL POWER, thisallows approximately 4 hours for this verification.For LCO 3.1.3.6 the control bank insertion limits are specified in the CORE OPERATINGLIMITS REPORT (COLR). These insertion limits are the initial assumptions in safety analysesthat assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuelburnup distributions, assumptions of available SHUTDOWN MARGIN, and initial reactivityinsertion rate.The applicable I&C calibration procedure (Reference 1.) being current indicates the associatedcircuitry is OPERABLE.There are conditions when the Lo-Lo and Lo alarms of the RIu Monitor are limited below the RILspecified in the COLR. The RIL Monitor remains OPERABLE because the lead control rod bankstill has the Lo and Lo-Lo alarms greater than or equal to the RIL.MILLSTONE -UNIT 3 B3415AedetN.6B 3/4 1-5Amendment No. 60 LBDCR 14-MP3-005May 8, 2014REACTIVITY CONTROL SYSTEMSBASESMOVABLE CONTROL ASSEMBLIES (Continued)When rods are at the top of the core, the Lo-Lo alarm is limited below the RIL to prevent spuriousalarms. The RIL is equal to the Lo-Lo alarm until the adjustable upper limit setpoint on the RILMonitor is reached, then the alarm remains at the adjustable upper limit setpoint. When the RIL isin the region above the adjustable upper limit setpoint, the Lo-Lo alarm is below the RIL.

References:

1. SP 3451N23, Rod Insertion Limits Calibration.2. Letter NS-OPLS-OPL-1-91-226, (Westinghouse Letter NEU-91-563), dated April 24, 1991.3. Millstone Unit 3 Technical Requirements Manual, Appendix 8.1, "CORE OPERATINGLIMITS REPORT".4. Westinghouse Letter NEU-07-62, "MPS3 -SPUP RCCA Drop Time," dated June 4, 2007.5. Westinghouse Letter 98NEU-G-0060, "Millstone Unit 3. -Robust Fuel Assembly (DesignReport) and Generic SECL," dated October 2, 1998.MILLSTONE -UNIT 3 B3416Amnmn oB 3/4 1-6Amendment No.

LBDCR No. 04~-MP3-0l5February 24, 20053/4.2 POWER DISTRIBUTION LIMITSBASESThe specifications of this section provide assurance of fuel integrity during Condition I(Normal Operation) and II (Incidents of Moderate Frequency) events by: (1) maintaining theminimum DNBR in the core greater than or equal to the design limit during normal operation and*in short-tenn transients, and (2) limiting the fission gas release, fuel pellet temperature, andcladding mechanical properties to within assumed design criteria. In addition, limiting the peaklinear power density during Condition I events provides assurance that the initial conditionsassumed for the LOCA analyses are met and the ECCS acceptance criteria limit of 2200°F is notexceeded.The definitions of certain hot channel and peaking factors as used in these specifications-are as follows:FQ(Z) Heat Flux Hot Channel Factor, is defined as the maximum local heat flux on thlesurface of a fuel rod at core elevation Z divided by the average fuel rod heat flux,allowing for manufacturing tolerances on fuel pellets and rods;, andF NNuclear Enthalpy Rise. Hot Channel Factor, is defined as the ratio of the integral ofAH linear power along the rod with the highest integrated power to the average rodpower.3/4.2.1 AXIAL FLUX DIFFERENCEThe limits on AXIAL FLUX DIFFERENCE (AFD) assure that the FQ(Z) up~per boundenvelope of the FQ limit specified in. the CORE OPERATING LIMITS REPORT (COLR) times.the normalized axial peaking factor is not exceeded during either normal operation or in the eventof xenon redistribution following power changes.Target flUX difference is determined at equilibrium xenon conditions. The full-length rodsmay be positioned within the core in accordance with their respective insertion limits and shouldbe inserted near their normal position for steady-state operation at high power levels.' The val~ueof the target flux difference Obtained under these conditions divided by the fraction of RATEDTHERMAL POWER is the target flux difference at RATED THERMAL POWER for the.associated core burnup conditions. Target flux differences for other THERMAL POWER levelsare obtained by multiplying the RATED THERMAL POWER value by the appropriate fractionalTHERMAL POWER level. The periodic updating of the target flux difference value is necessaryto reflect core burnup considerations.MILLSTONE -UNIT 3 B 3/4 2-1 Amendment No. g0, 60,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015Februaiy 24, 2005POWER DISTRIBUTION LIMITSBASESAXIAL FLUX DIFFERENCE (Continued)At power lev'els below APLND, the limits on AFD are defined in the COLR consistent with thaeRelaxed Axial Offset Control (RAOC) operating procedure and limits. These limits werecalculated in a manner such that expected operational transients, e.g., load follow operations,would not result in the AFD deviating outside of those limits. However, in the event such adeviation occurs, the short period of time allowed outside of the limits at reduced power levelswill not result in significant xenon redistribution such that the envelope of peaking factors wouldchange sufficiently to prevent operation in the vicinity of the APLND power level.At power levels greater than APLNO, two modes of operation are permissible: (1) RAOC,the AFD limit of which are defined in the COLR, and (2) base load operation, which is defined asthe maintenance of the AFD within COLR specifications band about a target value. The RAOCoperating procedure above APLNO is the same as that defined for operation, below APLND.However, it is possible when following extended load following maneuvers that the AFD limitsmay result in restrictions in the maximum allowed power or AFD in order to guarantee operationwith FQ(Z) less than its limiting value. To allow operation at. the maximum permissible powerlevel, the base load operating procedure restricts the indicated AFD to relatively small target band(as specified in the COLR) and power swings (APLND < power < APLBL or 100% RATEDTHERMAL POWER, whichever is lower). For base load operation, it is expected that the plantwill .operate within the target band. Operation outside of the target band for the short time periodallowed will not result in significant xenon redistribution such that the envelope of peakingfactors wotuld change sufficiently to prohibit cohatint~e&d operation iti the power tegiori definedabove.. To assure there is no residual xenon redistribution impact from .past operation on the baseload operation, a 24-hour waiting period at a power level above APLND and allowed by RAOC isnecessary. During this time period load changes and rod motion are restricted to that allowed bythe base load procedure. After the waiting period, extended base load operation is permissible.The computer determines the 1-minute average of each of the oPERABLE excore detectoroutputs and provides an alarm message immediately if the AFD for at least 2 of 4 or 2 of 3OPERABLE excore channels are: (1) outside the allowed delta-I power operating space (forRAOC operation), or (2) outside the allowed delta-I target band (for base load operation). These.alarms are active when power is greater than (1) 50% of RATED THERMAL POWER (forRAOC operation), orMILLSTONE -UNIT 3 B 3/4 2-2 Amendment No. NO, 60,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 06-MP3-014June 22, 2006POWER DISTRIBUTION LIMITSBASESAXIAL FLUX DIFFERENCE (Continued)(2) APN (for base load operation). Penalty deviation minutes for base load operation are notaccumulated based on the short period of time during which operation outside of the target band isallowed.3/4.2.2 AND 3/4.2.3 HEAT FLUX HOT CHANNrEL FACTOR AND RCS FLOW RATE ANDNUCLEAR ENTHALPY RISE HOT CHANNEL FACTORThe limits on heat flux hot channel factor, RCS flow rate, and nuclear enthalpy rise hotchannel factor ensure that: (1) the design limits on peak local power density and minimum.DNBR are not exceeded and (2) in the event of a LOCA the peak fuel clad temperature will notexceed the 2200°F ECCS acceptance criteria limit.Each of these is mieasurable but will normally only be determined periodically as specifiedin Specifications 4.2.2 and 4.2.3. This periodic sutrveillance is sufficienat to ensure that the limitsare maintained provided:a. Control rods in a single group move together with no individual rod insertiondiffering by more than +/-12 steps, indicated, from the group demand position;b. Control rod groups are sequenced with overlapping groups as described inSpecification 3.1.3.6;c. The control rod insertion limits of Specifications 3.1.3.5 and 3.1.3.6 aremaintained; andd. The axial power distribution, expressed in terms of AXIAL FLUX DIFFERENCE,is maintained within the lhinits.FNAH will be maintained within its limits provided Conditions a. through d. above aremaintained. The relaxation of FNAH as a function of THERMAL POWER allows changes in theradial power shape for all permissible rod insertion limits.The FNaH as calculated in Specification 3.2.3.1 is used in the various accident analyseswhere FNN_ influences parameters other than DNBR, e.g., peak clad temperature, and thus is themaximum "as measured" value allowed.The RCS total flow rate and FNAHt are specified in the CORE OPERATING LIMITSREPORT (COLR) to provide operating and analysis flexibility from cycle to cycle. However, theminimum RCS flow rate, that is based on 10% steam generator tube plugging, is retained in theTechnical Specifications.MILLSTONE -UNIT 3B 3/4 2-3MILSTOE -UNI 3 3/2-3Amendment No. .5-, 60, _9-1--7-, LBDCR 12-MP3-010September 20, 2012POWER DISTRIBUTION LIMITSBASES3/4.2.2 and 3/4.2.3 HEAT FLUX HOT CHANNEL FACTOR and RCS FLOW RATE ANDNUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR (Continued)Margin is maintained between the safety analysis limit DNBR and the design limit DNBR. Thismargin is more than sufficient to offset the effect of rod bow and any other DNB penalties thatmay occur. The remaining margin is available for plant design flexibility.When an FQ measurement is taken, an allowance for both experimental error and manufacturingtolerance mnust be made. An allowance of 5% is appropriate for a full core map taken with theincore detector flux mapping system and a 3% allowance is appropriate for manufacturingtolerance.The heat flux hot channel factor, FQ(Z), is measured periodically in accordance with theSurveillance Frequency Control Program using the incore detector system. These measurementsare generally taken with the core at or near steady state conditions. Using the measured threedimensional power distributions, it is possible to derive F.QM~z),.a computed value Of FQ..(Z).However, because this value represents a steady state condition, it does not include the variationsin the value Of FQ(Z) that are present during nonequilibrium situations.To account for these possible variations, the steady state limit of FQ(Z) is adjusted by an elevationdependent factor appropriate to either RAOC or base load operatio~n, W(~Z) or W(Z)BL, thataccounts for the calculated worst case transient conditions. The W(Z) and W(Z)BL, factorsdescribed above for normal operation are specified in the COLR per Specification 6.9.1.6. Coremonitoring and control under nonsteady state conditions are accomplished by operating the corewithin the limits of the appropriate LCOs, including the limits on AFD, QPTR, and control rodinsertion. Evaluation of the steady state FQ(Z) limit is performed in Specification 4.2.2.1 .2.b and4.2.2.1.4.b while evaluation nonequilibriumn limits are performed in Specification 4.2.2.1.2.c and4.2.2.1 .4.c.When RCS flow rate and FNAH_ are measured, no additional allowances are necessary prior tocomparison with the limits of the Limiting Condition for Operation. Measurement errors for RCStotal flow rate and for have been taken into account in determination of the design DNBRvalue.The measurement error for RCS total flow rate is based upon performing a precision heat balanceand using the result to calibrate the RCS flow rate indicators. To perform the precision heatbalance, the instrumentation used for determination of steam pressure, feedwater pressure,feedwater temperature, and feedwater venturi AP in the calorimetric calculations shall becalibrated in accordance with the Surveillance Frequency Control Program. Potential fouling of.the feedwater venturi which might not be detected could bias the result fl'om the precision heatbalance in a non-conservative manner. Any fouling which might bias the RCS flow ratemeasurement can be detected by monitoring and trending various plant perfonmance parameters.If detected, action shall be taken before performing subsequent precision heat balancemeasurements, i.e., either the effect of the fouling shall be quantified and compensated for in theRCS flow rate measurement or the venturi shall be cleaned to eliminate the fouling.MILLSTONE -UNIT 3B 3/4 2-4MILLTONE- UNT 3 3/42-4Amendment No. 2, 61), -!-7@,2-7 LBD CR 12-MP3-010September 20, 2012POWER DISTRIBUTION LIMITSBASESHEAT FLUX HOT CHANNhEL FACTOR and RCS FLOW RATE AND1T NUCLEARENTHAIPY RISE HOT CHAINNEL FACTOR (Continued)The periodic surveillance of indicated RCS flow in accordance with the SurveillanceFrequency Control Program is sufficient to detect only flow degradation which could lead tooperation outside the acceptable region of operation defined in Specifications 3.2.3.1.3/4.2.4 QUADRANT POWER TILT RATIOThe QUADRANT POWER TILT RATIO limit assures that the radial power distributionsatisfies the design values used in the power capability analysis. Radial power distributionmeasurements are made during STARTUP testing and periodically during POWEROPERATION.The limit of 1.02, at which corrective action is required, provides DNB and linear heatgeneration rate protection with x-y plane power tilts. A limiting tilt of 1.025 can be toleratedbefore the margin for uncertainty in FQ is depleted. A limit of 1.02 was selected to provide anallowance for the uncertainty associated with the indicated power tilt.The 2-hour" time allowance for operation with a tilt condition greater than 1.02 but lessthan 1.09 is provided to allow identification and correction of a dropped or misaligned controlrod. In the event such action does riot conrect the tilt, the margin for uncertainty on FQ is reinstatedby reducing the maximum allowed power by 3% for each percent of tilt in excess of 1.For purposes of monitoring QUADRANT POWER TILT RATIO when one excoredetector is inoperable, the moveable incore detectors are used to confirm that the normalizedsymmetric power distribution is consistent with the QUADRANT POWER TILT RATIO. Theincore detector monitoring is done with a full incore flux map or two sets of four symmetricthimbles. The two sets of four symmetric thimbles is a unique set of eight detector locations.These locations are C-8, E-5, E-11, H-3, H-13, L-5, L-11, N-8.3/4.2.5 DNB The limits on the DNB-related parameters assure that each of the parameters aremnaintained within the normal steady-state envelope of operatioii assumed in the transient andaccident analyses. The limits are consistent with the initial FSAR assumptions and have beenanalytically demonstrated adequate to maintain a minimum DNBR greater than the design limitthroughout each analyzed transient. The indicated Tavg valuesMILLS TON~E -UNIT 3 B 3/4 2-5 Amnendment No. 7-, .50, 60,1),!7-LBDCR 12-MP3-010September 20, 2012POWER DISTRIBUTION LIMITS BASESDNB PARAMETERS (Continued)and the indicated pressurizer pressure values are specified in the CORE OPERATING LIMITSREPORT. The calculated values of the DN-B related parameters will be an average of theindicated values for the OPERABLE channels.The periodic surveillance of these parameters through instrument readout inaccordance with the Surveillance Frequency Control Program is sufficient to ensure that theparameters are restored within their limits following load changes and other expected transientoperation. Measurement uncertainties have been accounted for in detennining the parameterlinuits.MILLSTONE -UNIT 3B 3/4 2-6MILLSONE -UNIT3 B 342-6Amendment No. 4-!, 60, -- LBDCR 12-MIP3-010September 20, 20123/4.3 INSTRUMENTATIONBASES3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION AND ENGINEEREDSAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATIONThe OPERABILITY of the Reactor Trip System and the Engineered Safety FeaturesActuation System instrumentation and interlocks ensures that: (1) the associated action and/orReactor trip will be initiated when the parameter monitored by each channel or combinationthereof reaches its setpoint, (2) the specified coincidence logic is maintained, (3) sufficientredundancy is maintained to permit a channel to be out of service for testing or maintenance, and(4) sufficient system functional capability is available from diverse parameters.The OPERABILITY of these systems is required to provide the overall reliability,redundancy, and diversity assumed available in the facility design1 for the protection andmitigation of accident and transient conditions. The integrated operation of each of these systemsis consistent with the assumptions used in the safety analyses. The Surveillance Requirementsspecified for these systems ensure that the overall system fimlctional capability is maintainedcomparable to the original design standards. The periodic surveillance tests performed aresufficient to demonstrate this capability. The surveillance frequency is controlled under theSurveillance Frequency Contr'ol Program.The Engineered Safety Features Actuation System Nominal Trip Setpoints specified inTable 3.3-4 are the nominal values of which the bistables are set for each functional unit. TheAllowable Values (Nominal Trip Setpoints +/-- the calibration tolerance) are considered theLimiting Safety System Settings as identified in lOCFR5O.36 and have been selected to mitigatethe consequences of accidents. A Setpoint is considered to be consistent with the nominal valuewhen the measured "as left" Setpoint is within the administratively controlled (#) calibrationtolerance identified in plant procedures (which specifies the difference between the AllowableValue and Nominal Trip Setpoint). Additionally, the Nominal Trip Setpoints may be adjusted inthe conservative direction provided the calibration tolerance remains unchanged.Measurement and Test Equipment accuracy is administratively controlled by plantprocedures and is included in the plant uncertainty calculations as defined in WCAP- 10991.OPERABILITY determinations are based on the use of Measurement and Test Equipment thatconfonns with the accuracy used in the plant uncertainty calculation.The Allowable Value specified in Table 3.3-4 defines the limit beyond which a channel is.inoperable. If the process rack bistable setting is measured within the "as left" calibrationtolerance, which specifies the difference between the Allowable Value and Nominal TripSetpoint, then the channel is considered to be OPERABLE.MILLSTONE -UNMT 3B3/31AmnetNo -9B 3/43-1Amendment No. 4-5-9 LBDCR 12-MP3-010September 20, 2012INSTRUMENTATIONBASES3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINJEEREDSAFETY FEATUIRES ACTUATION SYSTEM 1NSTRUMIENTATION (Continued).The methodology, as defined in WCAP-10991 ito derive the Nomhinal Trip Setpoints, is basedupon combining all of the uncertainties in the channels. Inherent in the detennination of theNominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and otherinstrumentation utilized in these channes should be capable of operating within the allowances ofthese uncertainty magnitudes. Occasional drift in excess of the allowance may be determined tobe acceptable based on the other device perfonnance characteristics. Device drift in excess of theallowance that is more than occasional, may be indicative of more serious problems and wouldwarrant further investigation.The above Bases does not apply to the Control Building Inlet Ventilation radiation monitors ESFTable (Item 7E). For these radiation monitors the allowable values are essentially nominal values.Due to the uncertainties involved in radiological parameters, the methodologies of WCAP- 10991were not applied. Actual trip setpoints will be reestablished below the allowable value based oncalibration accuracies and good practices.The OPERABILITY requirements for Table 3.3-3, Functional Units 7.a, "Control BuildingIsolation, Manual Actuation," and 7.e, "Control Building Isolation, Control Building InletVentilation Radiation," are defined by table notation "*". These functional units are required to beOPERABLE at all times during plant operation in MODES 1, 2, 3, and 4. These functional units are also required to be OPERABLE during movement of recently irradiated fuel assemblies, as -specified by table notation "*i". The Control Building Isolation Manual Actuation and ControlBuilding.Inlet Ventilation Radiation are required to be OPERABLE during movement of recentlyirradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within theprevious 350 hours*). Table notation "*" of Table 4.3-2 has the same applicability.The verification of response time provides assurance that the reactor iri and the engineeredsafety features actuation associated with each channel is completed within the tim~e limit assumedin the safety analysis. No credit is taken in the analysis for those channels with response timesindicated as not applicable (i.e., N.A.). The surveillance frequency is controlled under theSurveillance Frequency Control Program.Required ACTION 4. of Table 3.3-1 is modified by a Note to indicate that nonnal plant controloperations that individually add limited positive reactivity (e.g., temperature or b~oron fluctuationsassociated with RCS inventory management or temperature control) are not precluded by thisACTION provided they are accounted for in the calculated SDM. The proposed change pennitsoperations introducing positive reactivity additions but prohibits the temperature change oroverall boron concentration from decreasing below that required to maintain the specified SDMor required boron concentration.* During fuel assembly cleaning evolutions that involve the handling or cleaning of twofuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part ofa critical reactor core within the previous 525 hours.MILLSTONE -UNIT 3 B 3/4 3:2 Amendment No. 3,-9-1, 4-!-9,14-7-, 4-7, 2-!9, -230 O March 17, 2004INSTRUMENTATIONBASESI': 3/4.3-1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION andl ENGINEEREDSAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)Response time may be verified. by actual response time tests in any series of sequential,overlapping or total channel measurements, or by the summation of allocated sensor, signalprocessing and actuation logic responsetimes with actual response time tests on the remainder ofthe channel. Allocations for sensor response times may be obtained from: (1) historical recordsbased on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace,onsite, or offsite (e.g. vendor) test measurements, or (3) utilizing vendor engineeringspecifications. WCAP-13 632-P-A, Revision 2, "Elimination of Pressure Sensor Response TimeTesting Requirements" provides the basis and methodology for using allocated sensor~responsetimes in the overall verification of the channel response time for specific sensors identified in theWCAP. Response time verification for other sensor types must be demonstrated by test. Detectorresponse times may be measured by the in-situ online noise analysis-response time degradationmethod described in the Westinghouse Topical Report, "The Use of Process Noise Measurementsto Determine Response Characteristics of Protection Sensors in U.S. Plants," dated August 1983.WCAP- 14036, Revision 1, "Elimination of Periodic Protection Channel Response TimeTests" provides the basis and methodology for using allocated signal processing and actuationlogic response times in the overall verification .of the protection system channel response time.O I The allocations for sensor, signal conditioning and actuation logic response times must be verifiedi! prior to placing the component in operational service and re-verified following maintenance thatmay adversely affect response time. In general, electrical repair work does not impact response._time provided the parts used for repair are of the same. type and value. Specific componentsidentified in the WCAP may be replaced without verification testing. One example whereresponse time could be affected is replacing the sensing assembly of a transmitter.The Engineered Safety Features Actuation System senses selected plant parameters anddetermines whether or not predetermined limits are being exceeded. If they are, the signals arecombined into logic matrices sensitive to. combinations indicative of various accidents, events,and transients. Once the required logic combination is completed, the system sends actuationsignals to those Engineered Safety Features components whose aggregate function best serves the.requirements of the condition. As an example, the following actions may be initiated by theEngineered Safety Features Actuation System to mitigate the consequences of a steam line breakor loss-of-coolant accident: (1) Safety Injection pumps start and automatic valves position, (2)Reactor trip, (3) feed-water isolation, (4) startup of the-emergency diesel generators, (5) quenchspray pumps start and automatic valves .position, (6) containment isolation, (7) steam lineisolation, (8) Turbine trip, (9) auxiliary feedwater pumps start, (10) Service water pumps start andautomatic valves position, and (1 1) Control Room isolates.O MILLSTONE -UNIT 3 B 3/4 3-2a Amendment No. 3, 9-3-, 4-98, 219 LBDCR No. 0J4-MP3-015February 24, 2005INSTRUMENTATIONBASES3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEEREDSAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)For slave relays, or any auxiliary relays in: ESFAS circuits that are of the type Potter & BrumfieldMVDR series relays, the SLAVE RELAY TEST is performed at an "R" frequency (at least onceevery 18 months) provided the relays meet the reliability assessment criteria presented inWCAP- 13 878, of Potter and Brumfield MDR series relays," andWCAP-13 900, "Extensiin of Slave Relay Surveillance Test Intervals." The reliabilityassessments performed as part of the aforementioned WCAPs are relay specific and apply only toPotter and B~rumfield MDR series relays. Note that for normally energized applications, the relaysmay have to be replaced periodically in accordance with the guidance given in WCAP-13 878 forMDR relays.REACTOR TRIP BREAKERThis trip function applies to the reactor trip breakers (RTBs) exclusive of individual tripmechanisms. The LCO requires two OPERABLE trains of trip breakers. A trip breaker trainconsists of all trip breakers associated with a single RTS logic train that are racked in, closed, andcapable of supplying power to the control rod drive (CRD) system. Thus, the train may consist ofthe main breaker, bypass breaker, or main breaker and bypass breaker, depending upon the systemconfiguration. Two OPERABLE trains ensure no single random failure can disable the RTS tripcapability.These trip f-unctions must be.OPE.R.AB3LE in MODE 1 .or 2 when the reactor is critical.. InMODE 3, 4, or 5, these RTS trip functions must be OPERABLE when the RTBs or associatedbypass breakers are closed, and the CRD system is capable of rod withdrawal.BYPASSED CHANNEL* -. Technical Specifications 3.3.1 and 3.3.2 often allow thebypassing of instrument channels in the case of an inoperable instrument or for surveillancetesting.A BYPASSED CHARNEL shall be a channel which is:* Required to be .in its accident or tripped condition, but is not presently in its accident ortripped condition using a method described below; or* Prevented from tripping.MILLSTONE -UNIT 3 B 3/4 3-2b Amendment No. 24-9,Acknowledged by NRC letter dated 08/25/05 March 17, 2004INSTRUMENTATIONBASES3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEEREDSAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)A channel may be bypassed by:* Insertion of a simulated signal to the bistable; or* Failing the transmitter or input device to the bypassed condition; or* Returning a channel to service in a untripped condition; or* An equivalent method, as determined by Engineering and I&C*Bypass switches exist only for NIS source range, NIS intermediate range, and containmentpressure Hi-3.TRIPPED CHANN'EL -Technical Specifications 3.3.1 and 3.3.2 often require the tripping.of instrument channels in the case of an inoperable instrument or for surveillance testing.A TRIPPED CHANNEL shall be a channel which is in its required accident or trippedcondition.A channel may be placed in trip by:-The Bistable Trip Switches; or.. ....o Insertion of a simulated signal to the bistable; or* Failing the transmitter or input device to the tripped condition; or* An equivalent method, as determined by Engineering and I&CThe Engineered Safety Features Actuation System interlocks perform the followingfunctions:P-4 Reactor tripped -Actuates Turbine trip, closes main feedwater valves on Tavbelow Setpoint, prevents the opening of the main feedwater valves which wereclosed by a Safety Injection or High Steam Generator Water Level signal, allowsSafety Injection block so that components can be reset or tripped.Reactor not tripped .- prevents manual block of Safety Injection.MILLSTONE -UNIT 3B 3/4 3-3MILLTONE- UNT 3 3/43-3Amendment No. 4-, 4-64, 219 LBDCR ¶ 0-MP3-003February 23, 2010INSTRUMENTATIONBASES3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEEREDSAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)P-Il On increasing pressurizer pressure, P-1l automatically reinstates Safety Injectionactuation on low pressurizer pressure and low steam line pressure. On decreasingpressure, P-l1 allows the manual block of Safety Injection actuation on lowpressurizer pressure and low steam line pressure.P-12 On increasing reactor coolant ioop temperature, P-12 automatically provides anarming signal to the Steam Dump System. On decreasing reactor coolant looptemperature, P-12 automatically removes the arming signal from the Steam DumpSystem.P-14 On increasing steam generator water level, P-14 automatically trips all feedwaterisolation valves, main feed pumps and main turbine, and inhibits feedwater controlvalve modulation.P-19 Upon decreasing Reactor Coolant System pressure, permits the cold leg injectionvalves to automatically open upon receipt of a Safety Injection signal.314.3.3 MONITORING INSTRUMENTATION3/4.3.3.1 RADIATION MONITORING FOR PLANT OPERATIONSThe OPERABILITY of the radiation monitoring instrumentation for plant operations ensures.that: (1) the associated action will be initiated when the radiation level monitored by eachchannel or combination thereof reaches its Setpoint, (2) the specified coincidence logic ismaintained, and (3) sufficient redundancy is maintained to permit a channel to be out-of-servicefor testing or maintenance. The radiation monitors for plant operations .senses radiation levels inselected plant systems and locations and determines whether or not predetermined limits arebeing exceeded. If they are, the signals are combined into logic matrices sensitive to combinationsindicative of various accidents and abnormal conditions. Once the required logic combination iscompleted, the system sends actuation signals to initiate alarms.The Fuel Storage Pool Area Monitor is required to be OPERABLE during movement of recentlyirradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within theprevious 350 hours*).*During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuelassemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a criticalreactor core within the previous 525 hours.MILLSTONE -UNIT 3B 3/4 3-4MILLTONE- UIT 3B 3/3-4Amendment No. 49-3, 2-1-9 LBDCR October 21, 2008INSTRUMENTATIONBASES3/4.3.3.2 DELETED3/4.3.3.3 DELETED3/4.3.3.4 DELETED3/4.3.3.5 REMOTE SHUTDOWN INSTRUMENTATIONThe OPERABILITY of the Remote Shutdown Instrumentation ensures that sufficient capability isavailable to permit safe shutdown of the facility from locations outside of the control room. Thiscapability is required in the event control room habitability is lost and is consistent with GeneralDesign Criterion 19 of 10 CFR Part 50.Calibration of the Intermediate Range Neutron Amps channel from Table 4.3-6 applies to thesignal that originates from the output of the isolation amplifier within the intermediate rangeneutron flux processor drawers in the control room and terminates at the displays within theAuxiliary Shutdown Panel.The OPERABILITY of the Remote Shutdown Instrumentation ensures that a fire will not.preclude achieving safe shutdown. The remote shutdown monitoring instrumentation, control,and power circuits and transfer switches necess.a~ryto eliminate effects of the fire and allowoperation of instrumentation, control and power circuits required to achieve and maintain a safe-shutdown condition are independent of areas where a fire could damage systems normally used toshut down the reactor. This capability is consistent with General Design Criterion 3 andAppendix R to 10 CFR Part 50.3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATIONThe OPERABILITY of the accident monitoring instrumentation ensures that sufficientinformation is available on selected plant parameters to monitor and assess these variablesfollowing an accident. The instrumentation included in this specification are those instrumentsprovided to monitor key variables, designated as Category 1 instruments following the guidancefor classification contained in Regulatory Guide 1.97, Revision 2, "Instrumentation forLight-Water-Cooled Nuclear Power Plants To Assess Plant and Environs Conditions During andFollowing an Accident."MILLSTONE -UNIT 3B 3/4 3-5MILLTON -JNIT3 B3/43-5Amendment No. 3, :76, g4, 2, 2-1-9, LBDCR No;.04.-MP3-015February 24, 2005INSTRUMENTATIONBASES3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continued)ACTION Statement "a":The use of one main control board indicator and one computer point, total of twoindicators per steam generator, meets the requirements for the total number of channels forAuxiliary Feedwater flow rate. The two channels used to satisfy this Technical Specification foreach steam generator are as follows:Steam Instrument (M5 Instrument .(Computer),eneratorS/G 1 FWA*FI51A1 (Orange) FWA -F33A3 (Purple)S/G 2 FWA*FI33B 1 (Purple) FWA -F51 B3 (Orange)I/G 3 FWA*FI33C1 (Purple) FWA -F51 C3 (Orange)S/0 4 FWA*FI51D1 (Orange) FWA -F33D3 (Purple)The SPDS computer point for auxiliary feedwater flow will be lost 30 minutes followingan LOP when the power supply for the plant computer is lost. However, this design configuration-one continuous main control board indicator and one indication via the SPDS/plant computer,total of two per steam generator -was submitted[-o~ the-N!C via "Response to question 420.6"dated January 13, 1984, B 11002. NRC review and approval was obtained with the acceptance ofMP3, SSER 4 Appendix L, "Conformance to Regulatory Guide 1.97," Revision 2. (datedNovember 1985).LCO 3.3.3.6, Table 3.3-10, Item (17), requires 2 OPERABLE reactor vessel water level(heated junction thermocouples -IHJTC) channels. An OPERABLE reactor vessel water levelchannel shall be defined as:1. Four or more total sensors operating.2. At least one of two operating sensors in the upper head.3. At least three of six operating sensors in the upper plenum.MILLSTONE -UNIT 3B 3/4 3-5aAmendment No. :3, :-6, 84, 4-42, 2-1-9,Acknowledged by NRC letter dated 08/25/05 LBDCR 05-MP3-028November 30, 2005INSTRUMENTATIONBASES3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continued)A channel is OPERABLE if four or more sensors, half or more in the upper head regionand half or more in the upper plenum region, are OPERABLE.In the event more than four sensors in a Reactor Vessel Level channel are inoperable,repairs may only be possible during the next refueling outage. This is because the sensors areaccessible only after the missile shield and reactor vessel head are removed. It is not feasible torepair a channel except during a refueling outage when the missile shield and reactor vessel headare removed to refuel the core. If only one channel is inoperable, it should be restored toOPERABLE status in a refueling outage as soon as reasonably possible. If both channels areinoperable, at least one channel shall be restored to OPERABLE status in the nearest refuelingoutage..... The Reactor Coolant System Subcooling Margin Monitor, Core Exit The.rmocouples, andReactor Vessel Water Level instruments are processed by two separate trains of ICC (InadequateCore Cooling) and HJTC (Heated Junction ThennoCouple) processors. The preferred indicationfor these parameters is the Safety Parameter Display System (SPDS) via the non-qualified PPC(Plant Process Computer) but qualified indication is provided in the instrument rack room. When.the PPC data links cease to transmit data, the processors must be reset in order to restore the flowof data to the PPC. During reset, the qualified indication in the instrument rack room is lost.These instruments are OPERABLE during this reset since the indication is only brieflyinterrupted while the processors reset and the indication is promptly restored. The sensors are notremoved from service during this reset. The train should be considered inoperable only if thequalified indication fails to be restored following reset. Except for the non-qualified PPC display,the instruments operate as required.3/4.3.3.7 DELETED3/4.3.3.8 DELETED3/4.3.3.9 DELETED3/4.3.3.10 DELETED3/4.3.4 DELETEDMILLSTONE -UN4IT 3 B 3/4 3-6 Amendment No. 4-8%, 9-3,-24-9,Acknowledged by NRC Letter dated 04/12/06 REVERSE OF PAGE B 3/4 3-6INTENTIONALLY LEFT BLANK 0 LBDCR No. 04-MP3-015February 24, 2005INSTRUMENTATION.. BASES3/4.3.5 SHUJTDOWN MARGIN MONITORThe Shutdown Margin Monitors provide an alarm that a Boron Dilution Event may be inprogress. The minimum count rate of Specification 3/4.3.5 and the SHUTDOWN MARGINrequirements specified in the CORE OPERATING LIMITS REPORT for MODE 3, MODE 4 andMODE 5 ensure that at least 15 minutes are available for operator action from the time of the "Shutdown Margin Monitor alarm to total loss of SHUTDOWN MARGIN. By borating anadditional 1:50 ppm above the SHUTDOWN MARGIN specified in the CORE OPERATINGLIMITS REPORT for MODE 3 or 350 ppm above the SHUTDOWN MARGIN specified in theCORE OPERATING LIMITS REPORT for MODE 4, MODE 5 With RCS loops filled, or MODE5 with RCS loops not filled, lower values of minimum count rate are accepted.Shutdown Margin Monitors

Background:

The purpose of the Shutdown Margin Monitors (SMM) is-to annunciate an increase in coresubcritical multiplication allowing the operator at least 15 minutes response time to mitigate theconsequences of the inadvertent addition of unborated primary grade water (boron dilution event)into the Reactor Coolant System (RCS) when the reactor is shut down (MODES 3, 4, and 5).* The SMMs utilizes two channels of source range instrumentation (GM detectors). Each channel.provides a signal to its applicable train of SMM. The SMM channel uses the last 600 or morecounts to calculate the count rate and updates the measurement after 30 new counts or 1* Second,whichever is longer. Each channel has 20 registers that hold the counts (20 registers X 30 count=600 counts) for averaging the rate. As the .cduiit rate decreasges, the ldiigei- it takes t6 fIl theregisters (fill the 30 count minimum). As the instrume~n.t's measured count rate decreases, thedelay time in thie instrument's response increases. This delay time leads to the requirement of aminimum count rate for OPERABILITY.During the dilution event, count rate will increase to. a level above the normal steady state countrate. When this new count rate level increases above, the. instrument's setpoint, .the channel willalarm alerting the operator of the event.Applicable Safety AnalysisThe SMM senses abnormal increases in the source range count per second and alarms theoperator of an inadvertent dilution event. This alarm will occur at least 15 minutes prior to thereactor achieving criticality. This 15 minute window allows adequate operator response time toterminate the dilution, FSAR Section 15.4.6.LCOLCO 3.3.5 providesthe requirements for OPERABILITY -of the instrumentation of the SMMsthat are used to mitigate the boron dilution event. Two trains are required to be OPERABLE toprovide protection against single failure.* MILLSTONE -UN4IT 3 B 3/4 3-7 Amendment No. 64, 217T-,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015February 24, 2005BASES (continued)Applicability 9The SMM must be OPERABLE in MODES 3, 4, and 5 because the safety analysis identifies thissystem as the primary means to alert the operator and mitigate the event. The SMMs are allowed*to be blocked during start up activities in MODE 3 in accordance with approved plant procedures.The alarm is blocked to allow the SMM channels to be used to monitor the 1/M approach tocriticality.The SMM are not required to be OPERABLE in MODES 1 and 2 as other RPS is credited withaccident mitigation, over temperature delta temperature and power range neutron flux high (lowsetpoint of 25 percent RTP) respectively. The SMMs are not required to be OPERABLE inMODE 6 as the dilution event is precluded by administrative controls over all dilution flow paths(Technical Specification 4.1.1.2.2).ACTIONS*Channel inoperability of the SMMs can be caused by failure of the channel's electronics, failureof the channel to pass its calibration procedure, or by the channel's count rate falling below theminimum count rate for OPERABILITY. This can occur when the count rate is so low that the ]channel's delay time is in excess of that assumed in the safety analysis. In any of the aboveconditions, the channel must be declared inoperable and the appropriate ACTION statemententered. If the SMMs are declared inoperable due to low count rates, an RCS heatup will causethe SMM channel count rate to increase to above the minimum count rate for OPERCABILITY. I Allowing the plant to increase modes will actually return the SMMs to OPERABLE status. Oncethe SMM channels are above the minimum count rate for OPERABILITY, the channels can~bedeclared OPERABLE and the LCO ACTION statements can be exited-.LCO 3.3.5, ACTION a. -With one train of SMM inoperable, ACTION a. requires the inoperabletrain to be returned to OPERABLE status within 48 hours. In this condition, the remaining SMMtrain is adequate to provide protection. If the above required ACTION cannot be met, alternatecompensatory actions must be performed to provide adequate protection from the boron dilution.event. All operations involving positive reactivity changes associated with RCS dilutions and rod~withdrawal must be suspended, and all dilution flowpaths must be closed and secured in position(locked closed per Technical Specification 4.1.1.2.2) within the following 4 hours.LCO 3.3.5, ACTION b. -With both trains of SMM inoperable, alternate protection must beprovided:1. Positive reactivity operations via dilutions and rod withdrawal are suspended. The intentof this ACTION is to stop any planned dilutions of the RCS. The SMMs are not intendedto monitor core reactivity during RCS temperature changes. The alarm setpoint isroutinely reset during the plant heatup due to the increasing count rate. During cooldownsas the count rate, decreases, baseline count rates are continually lowered automatically bythe SMMs. The Millstone Unit No. 3 boron dilution. analysis assumes.steady state RCStemperature conditions.MILLSTONE -UNIT 3 B 3/4 3-8 Amendment No. 4-164,Acknowledged by NRC letter dated 08/25/05 LBDCR 12-MP3-010September 20, 2012INSTRUMENTATION3/4.3.5 SHUTDOWN MARGIN MONITORBASES (continued)Required ACTION b. is modified by a Note which permits plant temperature changesprovided the temperature change is accounted for in the calculated SDM. Introduction oftemperature changes, including temperature increases when a positive MTC exists, mustbe evaluated to ensure they do not result in a loss of required SDM.2. All dilution flowpaths are isolated and placed under admninistrativye control (lockedclosed). This action provides redundant protection and defense in depth (safety overlap) tothe SMMs. In1 this configuration, a boron dilution event (BDE) cannot occur. This is thebasis for not having to analyze for BDE in MODE 6. Since the BDE cannot occur with thedilution flow paths isolated, the SMMs are not required to be OPERABLE as the eventcannot occur and OPERABLE SMMs provide no benefit.3. Increase the SIIUTDOWN MARGIN surveillance frequency fi-om the frequencyspecified in the Surveillance Frequency Control Program to every 12 hours. This action incombination with the above, provide defense in depth and overlap to the loss of theSMMs.Surveillance RequirementsThe SMMs are subject to an ANALOG CHANNEL OPERATIONAL TEST to ensure each trainof SMM is fully operational. This test shall include verification that the SMvfls are set per theCORE OPERATING LIMITS REPORT. The surveillance fr'equency is controlled under theSurveillance Frequency Control Program.MILLSTONE-UNIT3B 3/4 3-9MILLSONE -UMT B 31 3-9Amendmnent No. 4-64, 2. REVERSE OF PAGE B 314 3-9INTENTIONALLY LEFT BLANK LBDCR No. 06-MP3-005May 25, 20063/4.4 REACTOR COOLANT SYSTEMBASES3/4.4.1 REACTOR COOLANT LOOPS AND COOLANT CIRCULATIONThe purpose of Specification 3.4.1.1 is to require adequate forced flow rate for core heatremoval in MODES 1 and 2 during all normal operations and anticipated transients. Flow isrepresented by the number of reactor coolant pumps in operation for removal of heat by the steamgenerators. To meet safety analysis acceptance criteria for DNB, four reactor coolant pumps arerequired at rated power. An OPERABLE reactor coolant ioop consists of an OPERABLE reactorcoolant pump in operation providing forced flow for heat transport and an OPERABLE steamgenerator. With less than the required reactor coolant loops in operation this specificationrequires that the plant be in at least HOT STANDBY within 6 hours.In MODE 3, three reactor coolant loops, and in MODE 4, two reactor coolant loopsprovide sufficient heat removal capability for removing core decay heat even in the event of abank withdrawal accident; however, in MODE 3 a single reactor coolant loop provides sufficientheat removal capacity~if a bank withdrawal accident can be prevented, i.e., the Control Rod DriveSystem is not capable of rod withdrawal.In MODE 4, if a bank withdrawal accident can be prevented, a single reactor coolant loopor RHR loop provides sufficient heat removal capability for removing decay heat; but singlefailure considerations require that at least two loops (any combination of RI-R or RCS) beOPERABLE.In MODE 5, with reactor coolant loops filled, a single RUR loop provides sufficient heatremoval capability for removing decay heat; but single failure considerations require that at leasttwo RIIR loops or at least one RIHR loop and two steam generators be OPERABLE.In MODE 5 with reactor coolant loops not filled, a single RHR loop provides sufficientheat removal capability for removing decay heat; but single failure considerations, and theunavailability of the steam generators as a heat removing component, require that at least twoRHR loops be OPERABLE.In MODE 5, during a planned heatup to MODE 4 with all RAIR loops removed fromoperation, an RCS loop, OPERABLE and in operation, meets the requirements of an OPERABLEand operating RI-R loop to circulate reactor coolant. During the heatup there is no requirementfor heat removal capability so the OPERABLE and operating RCS loop meets all of the requiredfunctions for the heatup condition. Since failure of the RCS loop, which is OPERABLE andoperating, could also cause the associated steam generator to be inoperable, the associated steamgenerator cannot be used as one of the steam generators used to meet the requirement of LCO3.4.1l.4.1.b.MILLSTONE -UNIT 3B 3/4 4-1MILLTONE- UNT 3 3/44-1 Amendment No. 60, gO, 99, 4-5--5, -7, 2-t--7, LBDCR No. 04-MP3-015February 24, 20053/4.4 REACTOR COOLANT SYSTEMBASES (Continued)The operation of one reactor coolant pump (RCP) or one RH-R pump provides adequateflow to ensure mixing, prevent stratification and produce gradual reactivity changes during boronconcentration reductions in the Reactor Coolant System. The reactivity change rate associatedwith boron reduction will, therefore, be within the capability of operator recognition and control.The restrictions on starting the first RCP in MODE 4 below the cold overpressureprotection enable temperature (226°F), and in MODE 5 are provided to prevent RCS pressuretransients. These transients, energy additions due to the differential temperature between thesteam generator secondary side and the RCS, can result in pressure excursions which couldchallenge the PIT limits. The RCS will be protected against overpressure transients and will notexceed the reactor vessel isothermal beitline PIT limit by restricting RCP starts based on thedifferential water temperature between the secondary side of each steam generator and the RCScold legs. The restrictions on starting the first RCP only apply to RCPs in RCS loops that are notisolated. The restoration of isolated RCS loops is normally accomplished with all RCPs secured.If an isolated RCS loop is to be restored when an RCP is operating,. the appropriate temperaturedifferential limit between the secondary side of the isolated loop steam generator and the inservice RCS cold legs is applicable, and shall be met prior to opening the loop isolation valves.The temperature differential limit between the secondary side of the steam generators andthe RCS cold legs is based on the equipment providing cold overpressure protection as requiredby Technical Specification 3.4.9.3. If the pressurizer PORVs are providing cold overpressureprotection, the steam generator secondary to RCS cold leg water temperature differential islimited to a maximum of 50°F. If any P1-R relief valve is providing cold overpressure protectionand RCS cold leg temperature is above 150OT, the steam generator secondary water temperaturemust be at or below RCS cold leg water temperature. If any RHJR relief valve is providing coldoverpressure protection and RCS cold leg temperature is at or below 1500'F, the steam generatorsecondary to RCS cold leg water temperature differential is limited to a maximum of 50°F.Specification 3.4.1.5The reactor coolant loops are equipped with loop stop valves that permit any loop to beisolated from the reactor vessel. One valve is installed on each hot leg and one on each cold leg.The loop stop valves are used to perform maintenance on an isolated loop. Operation in MODES1-4 with a RCS loop stop valve closed is not permitted except for the mitigation of emergency orabnormal events. If a loop stop valve is closed for any reason, the required ACTIONS of thisspecification must be completed. To ensure that inadvertent closure of a loop stop valve does notoccur, the valves must be open with power to the valve operators removed in MODES 1, 2, 3 and4.MILLSTONE -UNIT 3 B 3/4 4-la Amendment No. 60, :7O, 9-9, .447, 4-9-7, 20-2,,2--7, j Acknowledged by NRC letter dated 08/25/05 W LBDCR 12-MP3-0i0September 20, 20123/4.4 REACTOR COOLANT SYSTEMBASESThe safety analyses performed for the reactor at power assume that all reactor coolantloops are initially in operation and the loop stop valves are open. This LCO places controls on theloop stop valves to ensure that the valves are not inadvertently closed in MODES 1, 2, 3 and 4.The inadvertent closure of a loop stop valve when the Reactor Coolant Pumps (RCPs) areoperating will result in a partial loss of forced reactor coolant flow. If the reactor is at rated powerat the time of the event, the effect of the partial loss of forced coolant flow is a rapid increase inthe coolant temperature which could result in DNB with subsequent fuel damage if the reactor isnot tripped by the Low Flow reactor trip. If the reactor is shutdown and a RCS loop is in operationremoving decay heat, closure of the loop stop valve associated with the operating ioop could alsoresult in increasing coolant temperature and the possibility of fuel damage.The loop stop valves have motor operators. If power is inadvertently restored to one ormore loop stop valve operators, the potential exists for accidental closure of the affected loop stopvalve(s) and the partial loss of forced reactor coolant flow. With power applied to a valveoperator, only the interlocks prevent the valve from being operated. Although operatingprocedures and interlocks make the occurrence of this event unlikely, the prudent action is toremove power from the loop stop valve operators. The time period of 30 mninutes to removepower from the loop stop valve operators is sufficient considering the complexity of the task.Should a loop stop valve be closed in MODES 1 through 4, the affected valve must bemaintained closed and the plant placed in MODE 5. Once in MODE 5, the isolated loop may bestarted in a controlled manner in accordance with LCO 3.4.1.6, "Reactor Coolant System IsolatedLoop Star'tup." Opening the closed loop stop valve in MODES 1 tin'ough 4 could result in colderwater or water at a loweriboron concentration being mixed with the operating RCS loops resultingin positive reactivity insertion. The time period provided in ACTION 3.4.1.5 .b allows time forborating the operating loops to a shutdown boration level such that the plant can be brought toMODE 3 within 6 hours and MODE 5 within 30 hours. The allowed ACTION times arereasonable, based on operating experience, to reach the required plant conditions from full powerconditions in an orderly manner and without challenging plant systems.Surveillance Requirement 4.4.1.5 is perforned to ensure that the RCS loop stop valves areopen, with power removed from the loop stop valve operators. The primamyr function of thisSurveillance is to ensure that power is removed from the valve operators, since SurveillanceRequirement 4.4.1.1 requires verification that all loops are operating and circulating reactorcoolant, thereby ensuring that the loop stop valves are open. The frequency specified in theSurveillance Frequency Control Program ensures that the required flow is available. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3MILSTOE -UNI 3B 3/4 4-lb Amnendlnent No. 60, 7-0, 9-, 1-7,4-9-7-,-202,2-1 LBDCR No. 05-MVP3-026October 19, 20053/4.4 REACTOR COOLANT SYSTEMBASES (Continued)Specification 3.4.1.6The requirement to maintain the isolated loop stop valves shut with power removedensures that no reactivity addition to the core could occur due to the startup of an isolated loop.Verification of the boron concentration in an isolated loop prior to opening the first stop valveprovides a reassurance of the adequacy of the boron concentration in the isolated loop.RCS Loops FilledINot Filled:In MODE 5, any RHR train with only one cold leg injection path is sufficient to provideadequate core cooling and prevent stratification of boron in the Reactor Coolant System.The definition of OPERABILITY states that the system or subsystem must be capable ofperforming its specified function(s). The reason for the operation of one reactor coolant pump(RCP) or .one RHR pump is to:* Provide sufficient decay heat removal capability* Provide adequate flow to ensure mnixing to:* Prevent stratification* Produce gradual reactivity changes due to boron concentration changes in theRCSThe definition of "Reactor coolant loops filled" includes a ioop that is filled, swept, andvented, and capable of supporting natural circulation heat transfer. This allows the non-operatingRHR loop to be removed from service while filling and unisolating loops as long as steamgenerators on the OPERABLE reactor coolant loops are available to support decay heat removal.Any loop being unisolated is not OPERABLE until the ioop has been swept and vented. Theprocess of sweep and vent will make the previously OPERABLE loops finoperable and therequirements of LCO 3.4.1.4.2, "Reactor Coolant System,.COLD SI{UTDOWN -Loops NotFilled," are applicable. When the RCS has been filled, swept and vented using an approvedprocedure, all unisolated loops may be declared OPERABLE.The definition of "Reactor coolant loops filled" also includes a ioop that has been vacuum [filled and capable of supporting natural circulation heat transfer. Any isolated loop that has been Ivacuum filled is OPERABLE as soon as the loop is unisolated.One cold leg injection isolation valve on an RI-R train may be closed without consideringthe train to be inoperable, as long as the following conditions exist:* CCP temperature is at or below 950F* Initial RUR temperature is below 1 84°FMILLSTONE -UNIT 3 B 3/4 4-ic Amendmnent No. ;2-4-7,Acknowledged by NRC Letter dated 04/12/06 LBDCR No._08-MP3-014October 21, 20083/4.4 REACTOR COOLANT SYSTEMBASES (Continued)* The single RI-R cold leg injection flow path is no_! utilized until a minimum of 48hours after reactor shutdown* CCP flow is at least 6,600 gpm* RHR flow is at least 2,000 gpmIn the above system lineup, total flow to the core is decreased compared to the flow whentwo cold legs are in service. This is acceptable due to the substantial margin between the flowrequired for cooling and the flow available, even through a slightly restricted R.HR train.The review concerning boron stratification with the utilization of the single injection pointline, indicates there will not be a significant change in the flow rate or distribution through thecore, so there is not an increased concern due to stratification.Flow velocity, which is high, is not a concern from a flow erosion or pipe loadingstandpoint. There are no loads imposed on the piping system which would exceed thoseexperienced in a seismic event. The temperature of the fluid is low and is not significant from aflow erosion standpoint.The boron dilution accident analysis, for Millstone Unit 3 in MODE 5, assumes a fullRHR System flow of approximately 4,000 gpm. Westinghouse analysis, Reference (1), for RHRflows down to 1,000 gpm, determined adequate mixing results. As the configuration will result ina R}IR flow rate only slightly less then 4,000 gpm:-here-is no concern in regards to a borondilution accident.The basis for the requirement of two RCS loops OPERABLE is~to provide naturalcirculation heat sink in the event the operating RHR loop is lost. If the RI-R loop were lost, withtwo loops filled and two loops air bound, natural circulation would be established in the two filledloops.Natural circulation would not be established in the air bound loops. Since there would beno circulation in the air bound loops, there would be no mechanism for the air in those loops to becarried to the vessel, and subsequently into the filled loops rendering them inoperable for heatsink requirements.The LCO is met as long as at least two reactor coolant loops are OPERABLE and thefollowing conditions are satisfied:* One RI-R loop is OPERABLE and in operation, with exceptions as allowed inTechnical Specifications; andMILLSTONE -UNIT 3B3/4-dAemntN.2,B 3/4 4-1dAmendment No. g-t-7-, LBDCR. 04-MP3-001December 10, 20033/4.4 REACTOR COOLANT SYSTEMBASES (Continued)Either of the following:o An additional RHR loop OPERABLE, with exceptions as allowed in TechnicalSpecifications; or* The secondary side water level of at least two steam generators shall be greater than .17% (These are assumed to be on OPERABLE reactor coolant loops)When the reactor coolant loops are swept, the mechanism exists for air to be carried intopreviously OPERABLE loops. All previously OPERABLE loops are declared inoperable and anadditional RIIR loop is required OPERABLE as specified by LCO 3.4.1.4.2 for loops not filled.When the RCS has been filled, swept, and vented using an approved procedure, all unisolatedloops may be declared OPERABLE.ISOLATED LOOP STARTUPThe below requirements are for unisolating a loop with all four loops isolated while decayheat is being removed by RIIR and to clarify, prerequisites to meet T/S requirements forunisolating a loop at any time.With no RCS loops operating, the two RHR loops referenced in Specification 3.4.1.4.2 arethe operating loops. Starting in MODE 4 as referenced in Specification 3.4.1.3, the RHR loopsare allowed to be used in place of an operating R CS loop:. Specification 3.4.1.4.2 requires twoRH{R loops OPERABLE and at least one in operation. Ensuring the isolated cold leg temperatureis within 20°F of the highest RHR outlet temperature for the operating RHR loops within 30minutes prior to opening the cold leg stop valve is a conservative approach since the majorconcern is a positive reactivity addition.SR 4.4.1.6.1 : When in MODE 5 with all RCS loops isolated, the two RH-R loopsreferenced in LCO 3.4.1.4.2 shall be considered the OPERABLE RCS loops. The isolated loopcold leg temperature shall be determined to be within 20°F of the highest RHR outlet temperaturefor the operating RHR loops within 30 minutes prior to opening the cold leg stop valve.Surveillance requirement 4.4.1.6.2 is met when the following actions occur within 2 hoursprior to opening the cold leg or hot leg stop valve:* An RCS boron sample has been taken and analyzed to determine current boronconcentration* The SHUTDOWN MARGIN has been determined using OP 3209B, "ShutdownMargin" using the current boron concentration determined aboveMILLSTONE -UNIT 3 B 3/4 4-1le Amendment No. 2-1-7,Acknowledged by NRC Letter dated 04/12/06 LBDCR 12-MiP3-010September 20, 20123/4.4 REACTOR COOLANT SYSTEMBASES (continued)*For the isolated loop being restored, the power to both loop stop valves has beenrestoredSurveillance 4.4.1.6.2 indicates that the reactor shall be determined subcritical by at leastthe amount required by Specifications 3.1.1.1.2 or 3.1.1.2 for MODE 5 or Specification 3.9.1.1for MODE 6 within 2 hours of opening the cold leg or hot leg stop valve.The SHUTDOWN MvARGIN requirement in Specification 3.1.1.1.2 is specified in theCORE OPERATING LIMITS REPORT for MODE 5 with RCS loops filled. Specification3.1.1.1.2 cannot be used to determine the required SHUTDOWN MARGIN for MODE 5 loopsisolated condition.Specification 3.1.1.2 requires the SHUTDOWN MARGIN to be greater than or equal tothe limits specified in the CORE OPERATING LIMITS REPORT for MODE 5 with RCS loopsnot filled provided CVCS is aligned to preclude boron dilution. This specification is for loops notfilled and therefore is applicable to an all loops isolated condition.Specification 3.9.1.1 requires Keff of 0.95 or less, or a boron concentration of greater thanor equal to the limit specified in the COLR in MODE 6.Specification 3.1.1.1.2 or 3.1.1.2 for MODE 5, both require boron concentration to bedetennined at the frequency specified in the Surveillance Frequency Control Program.SR 4.1.1.1.2.1 .b.2 and 4.1.1 .2.1.b.1 satisfy the requirements of Specifications 3.1.1.1.2 and 3.1.1.2respectfully. Specification 3.9.1.1 for MODE 6 requires boron concentration to be determined atthe frequency specified in the Surveillance Frequency Control Program. S.R. 4.9..1.1.2 satisfy therequirements of Specification 3.9.1.1.Per Specifications 3.4.1.2, ACTION c.; 3.4.1.3, ACTION c.; 3.4.1.4.1, ACTION b.; and3.4.1.4.2, ACTION b., suspending the introductiorn of coolant into the RCS of coolant with boronconcentr~iion less than required to meet the minimum SDM of LCO 3.1.1.1.2 is required to assurecontinued safe operation. With coolant added without forced circulation, unmrixed coolant couldbe introduced to the core, however, coolant added with boron concentration meeting theminimum SDM maintains acceptable margin to subcritical operations.

References:

1. Letter NEU-94-623, dated July 13, 1994; Mixing Evaluation for Boron DilutionAccident in Modes 4 and 5, Westinghouse HR-5 9782.2. Memo No. MP3-E-93-821, dated October 7, 1993.MILLSTONE -UNIT 3B 3/4 4-1fMILSTOE -UNT 3B 34 4ifAmendment No. 2-3g.

REVERSE OF PAGE B 3/4 4-ifINTENTIONALLY LEFT BLANK LBDCR No. 07-MP3-009June 19, 2007REACTOR COOLANT SYSTEMBASES314.4.2 SAFETY VALVESThe pressurizer Code safety valves operate to prevent the RCS from being pressurizedabove its Safety Limit of 2750 psia. Each safety valve is designed to relieve 420,000 lbs per hourof saturated steam at the valve Setpoint. The relief capacity of a single safety valve is adequate torelieve any overpressure condition which could occur during shutdown. If any pressurizer Codesafety valve is inoperable, and cannot be restored to OPERABLE status, the ACTION statementrequires the plant to be shut down and cooled down such that Technical Specification 3.4.9.3 willbecome applicable and require cold overpressure protection to be placed in service.During operation, all pressurizer Code safety valves must be OPERABLE to prevent theRCS firom being pressurized above its Safety Limit of 2750 psia. The combined relief capacity ofall of these valves is greater than the maximaum surge rate resulting from a complete loss-of-loadassuming no Reactor trip until the first Reactor Trip System Trip Setpoint is reached (i.e., nocredit is taken for a direct Reactor trip on the loss-of-load) and also assuming no operation of thepower-operated relief valves or steam dump valves.Demonstration of the safety valves' lift settings will occur only during shutdown and willbe performed in accordance with the provisions of the ASME Code for Operation andMaintenance of Nuclear Power Plants.3/4.4.3 PRESSURIZERTh~e pressurizer provides a point in the RCS when liquid and vapor are maintained inequilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in theremainder of the RCS. Key functions include maintaining required primatyr system pressureduring steady state operation and limiting the pressure changes caused by reactor. coolant thermalexpansion and contraction during load transients.MODES 1 AND 2The requirement for the pressurizer to be OPERABLE, with pressurizer level maintainedat pro granmmed level within 4- 6% of full scale is consistent with the accident analysis in Chapter15 of the FSAR. The accident analysis assumes that pressurizer level is being maintained at theprogrammed level by the automatic control system, and when in manual control, similar limits areestablished. The progralmmed level ensures the capability to establish and maintain pressurecontrol for steady state operation and to minimize the consequences of potential overpres sure andpressurizer overfill transients. A pressurizer level control error based upon automatic level controlhas been taken into account for those transients where pressurizer overfill is a concern (e.g., lossof feedwater, feedwater line break, and inadvertent ECCS actuation at power). When in manualcontrol, the goal is to maintain pressurizer level at the program level value. The +/-- 6% of full scaleacceptance criterion in the Technical Specification establishes a band for operation toaccommnodate variations between level measurements. This value is bounded by the marginapplied to the pressurizer overfill events.MILLSTONE -UNIT 3B 3/4 4-2MILLTON -NIT3 B3/44-2Amendment No. -!-60, 4-9-7-, LBDCR 12-MP3-010September 20, 2012REACTOR COOLANT SYSTEMBASES3/4.4.3 PRESSURIZER ('continued)The periodic surveillances require that pressurizer level be maintained at programmedlevel within =k 6% of full scale. The surveillance is performed by observing the indicated level.The surveillance frequency is controlled under the Surveillance Frequency Control Program.During transitory conditions, i.e., power changes, the operators will maintain progralmmed level,and deviations greater than 6% will be corrected within 2 hours. Two hours has been selected forpressurizer level restoration after a transient to avoid an unnecessary downpower with pressurizerlevel outside the operating brand. Nonnally, alarms are also available for early detection ofabnormal level indications.Electrical itmmersion heaters, located in the lower section of the pressurizer vessel, keepthe water in the pressurizer at saturation temperature and maintain a constant operating pressure.A minimumn required available capacity of pressurizer heaters ensures that the RCS pressure canbe maintained. The capability to maintain and control system pressure is important formaintaining subcooled conditions in the RCS and ensuring the capability to remove core decayheat by either forced or natural circulation of the reactor coolant. Unless adequate heater capacityis available, the hot high-pressure condition cannot be maintained indefinitely and still providethe required subcooling margin in the primary system. Inability to control the system pressure andmaintain subcooling under conditions of natural circulation flow in the primary system could leadto a loss of single-phase natural circulation and decreased capability to remove core decay heat.The LCO requires 'two groups of OPERABLE pressurizer heaters, each with a capacity ofat least 175 kW. The heaters are capable of being powered from either the offsite power source orthe emergency power supply. The minimum heater capacity required is sufficient to maintain theRCS near normal operating pressure when accounting for heat losses thraough the pressurizerinsulation. By maintaining the pressure near" the operating conditions, a wide margin tosubcooling can be obtained in the loops. The requirement for two groups of pressurizer heaters,each having a capacity of 175 kW, is met by verifying the capacity of the pressurizer heatergroups A and B. Since the pressurizer heater groups A and B are supplied from the emergency480V electrical buses, there is reasonable assurance that these heaters can be energized during aloss of offsite power to maintain natural circulation at HOT STANhDBY. Providing an emergency(Class 1EB) power source for the required pressurizer heaters meets the requirement of NUREG-0737, "A Clarification of TMI Action Plan Requirements," II.E.3.1, "Emergency PowerRequirements for Pressurizer Heaters."If one required group of pressurizer heaters is inoperable, restoration is required within72 hours. The Completion Time of 72 hours is reasonable considering that a demand caused byloss of offsite power would be unlikely in this time period. Pressure control may be maintainedduring this time using normal station powered heaters.MODE 3The requirement for the pressurizer to be OPERABLE, with a level less than or equal to89%, ensures that a steam bubble exists. The 89% level preserves the steam space for pressurecontrol. The 89% level has been established to ensure the capability to establish and maintainpressure control for MODE 3 and to ensure a bubble is present in the pressurizer. Initialpressurizer level is not significant for those events analyzed for MODE 3 in Chapter 15 of theFSAR.MILLSTONE -UNIT 3B 3/4 4-2aMILLTON -NIT B /4 -2aAmendment No. 60, !-0 LBDCR 12-MP3-010September 20, 2012.REACTOR COOLANT SYSTEMO BASES3/4.4.3 PRESSURIZER (cont'd.)The periodic surveillance requires that during MODE 3 operation, pressurizer level ismaintained below the nominal upper limit to provide a minimum space for a steam bubble. Thesurveillance is performed by observing the indicated level. The surveillance frequency iscontrolled under the Surveillance Frequency Control Program. Alarms are also available for earlydetection of abnormal level indications.The basis for the pressurizer heater requirements is identical to MODES 1 and 2.3/4.4.4 RELIEF VALVESThe power-operated relief valves (PORVs) and steam bubble function to relieve RCSpressure during all design transients up to and including the design step load decrease with steamdump. Operation of the PORVs minimizes the undesirable opening of the spring-loadedpressurizer Code safety valves. Each PORV has a remotely operated block valve to provide apositive shutoff capability should a relief valve become inoperable. Requiring the PORVs to beOPERABLE ensures that the capability for depressurization during safety grade cold shutdown ismet.ACTION statements a, b, and c distinguishes the inoperability of the power operated relief valves! (ORV). Specifically, a PORV mybe designated inoperable but it mybe able to automatically*and manually open and close and therefore, able to perform its function. PORV inoperability maybe due to seat leakage which does not prevent automatic or manual use and does not create thepossibility for a small-break LOCA. For these reasons, the block valve may be closed but theaction requires power to be maintained to the valve. This allows quick access to the PORV forpressure control. On the other hand if a PORV is inoperable and not capable of beingautomatically and manually cycled, it must be either restored or isolated by closing the associatedblock valve and removing power.Note: PORV position indication does not affect the ability of the PORV to perform any of itssafety functions. Therefore, the failure of PORV position indication does not cause the PORV tobe inoperable. However, failed position indication of these valves must be restored "as soon aspracticable" as required by Technical Specification 6.8.4.e.3.Automatic operation of the PORVs is created to allow more time for operators to terminate anInadvertent ECCS Actuation at Power. The PORVs and associated piping have been demonstratedto be qualified for water relief. Operation of the PORVs will prevent water relief fr'om thepressurizer safety valves for which qualification for water relief has not been demonstrated. If thePORVs are capable of automatic operation but have been declared inoperable, closure of thePORV block valve is acceptable since the Emergency Operating Procedures provide guidance toassure that the PORVs would be available to mitigate the event. OPERABILITY and setpointcontrols for the safety grade PORV opening logic are maintained in the Technical RequirementsManual..MILLSTONE -UNIT 3 B 3/4 4-2b Amendment No. 4-10, 4-4-1 LBDCR No. 14-MP3-014September 18, 2014REACTRCOLNESSE0BASESRELIEF VALVES (Continued)The prime importan~ce for the capability to close the block valve is to isolate a stuck-open FORM.Therefore, if the block valve(s) cannot be restored to OPERABLE status within 1 hour, theremedial action is to place the PORV in manual control (i.e., the control switch in the "CLOSE"position) to preclude its automatic opening for an overpressure event and to avoid the potential ofa stuck-open PORV at a time that the block valve is inoperable. The time allowed to restore theblock valve(s) to OPERABLE status is based upon. the remedial action time limits for inoperablePORV per ACTION requirements b. and c. ACTION statement d. does not specify closure of theblock valves because such action would not likely be possible when the block valve is inoperable.For the same reasons, reference is not made to ACTION statements b. and c. for the requiredremedial actions.SURVEILLANCE REQUIREMENT 4.4.4.2 verifies that a block valve(s) can be opened orclosed if necessary. This SURVEILLANCE REQUIREMENT is not required to be perform~edwith the block valve(s) closed in accordance with the ACTIONS of TS 3.4.4. Opening the blockvalve(s) in this condition increases the risk of an unisolable leak from the RCS since the PORV(s)is already inoperable.MILLSTONE -UNIT 3B 3/4 4-2cAmendment No. gg, 4-10, 61-,Acknowledged by NRC letter dated 08/28/15 LBDCR No. 12-MP3-007June 26, 2012REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITYLCOThe LCO requires that steam generator (SG) tube integrity be maintained. The LCO also requiresthat all SG tubes that satisfy the plugging criteria be plugged in accordance with the SteamGenerator Program.During a SG inspection, any inspected tube that satisfies the Steam Generator Program pluggingcriteria is removed from service by plugging. If a tube was determined to satisfy the pluggingcriteria but was not plugged, the tube may still have tube integrity.In the context of this Specification, a SG tube is defined as the entire length of the tube, includingthe tube wall between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weldat the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performancecriteria are defined in Specification 6.8.4.g, "Steam Generator Program," and describe acceptableSG tube performance. The Steam Generator Program also provides the evaluation process fordetermining conformance with the SG performance criteria. There are three SG performancecriteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure tomeet any one of these criteria is considered failure to meet the LCO.The structural integrity performance criterion provides a margin of safety against tube burst orcollapse under normal and accident conditions, and ensures structural integrity of the SG tubesunder all anticipated transients included in the design specification. Ttibe burst is defined as, "Thegross structural failure of the tube wall. The condition typically corresponds to an unstableopening displacement (e.g., opening area increased in response to constant pressure) accompaniedby ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse isdefined as, "For the load displacement curve for a given structure, collapse occurs at the top of theload versus displacement curve where the slope of the curve becomes zero." The structuralintegrity performance criterion provides guidance on assessing loads that have a significant effecton burst or collapse. In that context, the term "significant" is defined as "An accident loadingcondition other than differential pressure is considered significant when the addition of such loadsin the assessment of the structural integrity performance criterion could cause a lower structurallimit or limiting burst/collapse condition to be established." For tube integrity evaluations, exceptfor circumferential degradation, axial thermal loads are classified as secondary loads. Forcircumferential degradation, the classification of axial thermal loads as primary or secondaryloads will be evaluated on a case-by-case basis. The division between primary and secondaryclassifications will be based on detailed analysis and/or testing.MILLSTONE -UNIT 3B3/4-AmnetNoB 3/4 4-3Amendment No. LBDCR No. 06-MP3-005May 25, 2006REACTOR COOLANT SYSTEMBASES.° 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)* Structural integrity requires that the primary membrane stress intensity in a tube not exceed the* yield strength for all ASME Code, Section III, Service Level A (normal operating conditions) andService Level B (upset or abnormal conditions) transients included in the design specification.This includes safety factors and applicable design basis loads based on ASMIE Code, Section III,* Subsection NB (Ref. 4).and Draft Regulatory Guide 1.121 (Reference 5).The accident induced leakage performance criterion ensures that the primary to secondary.....LE-AKAGE caused by a design basis accident, other than a SGTR, is within the accident analysisassumptions. The accident analysis assumes that accident induced leakage does not exceed 1* gallon per minute or is assumed to increase to 1 gallon per minute for all steam generators. The: accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the,.-. accident in addition to primary to secondary LEAKAGE induced during the accident..The operational LEAKAGE performance criterion provides an observable indication of SG tubeconditions during plant operation. The limit on operational LEAKAGE is contained in RCS LCO3.4.6.2, "Operational Leakage," and limits primary to secondary LEAKAGE through any one SG* .to 150 gallons per day. This limit is based on the assumption that a single crack leaking this* amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steamline break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small,r .. and the above assumption is conservative.* APPLICABILITYSteam generator tube integrity is challenged when the pressure differential across the tubes is* large. Large differential pressures across SG tubes can only be experienced during MODES 1, 2,3, and 4.* .. RCS conditions are far less challenging during MODES 5 and 6 than during MODES 1, 2, 3, and" 4. During MODES 5 and 6, primary to secondary differential pressure is low, resulting in lowerstresses and reduced potential for LEAKAGE.ACTIONSThe ACTIONS are modified by a NOTE clarifying that the Conditions may be entered* ...independently for each SG tube. This is acceptable because the Required Actions provideappropriate compensatory actions for each affected SG tube. Complying with the RequiredActions may allow for continued operation, and subsequent affected SG tubes are governed bysubsequent Condition entry and application of associated Required Actions.MILLSTONE -UNIT 3 B3443 mnmnoB 3/4 4-3aAmendment No. LBDCR No. 12-MiP3-007June 26, 2012REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued')a.1 and a.2ACTION a. applies if it is discovered that one or more SG tubes examined in an inserviceinspection satisfy the tube plugging criteria but were not plugged in accordance with the SteamGenerator Program as required by SR 4.4.5.2. An evaluation of SG tube integrity of the affectedtube(s) must be made. Steam generator tube integrity is based on meeting the SG performancecriteria described in the Steam Generator Program. The SG plugging criteria define limits on SGtube degradation that allow for flaw growth between inspections while still providing assurancethat the SG performance criteria will continue to be met. In order to determine if a SG tube thatshould have been plugged has tube integrity, an evaluation must be completed that demonstratesthat the SG performance criteria will continue to be met until the next refueling outage or SG tubeinspection. The tube integrity determination is based on the estimated condition of the tube at thetime the situation is discovered and the estimated growth of the degradation prior to the next SGtube inspection. If it is determined that tube integrity is not being maintained, ACTION b. applies.A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk ofplant operation with a SG tube that may not have tube integrity.If the evaluation determines that the affected tube(s) have tube integrity, Required ACTION a.2allows plant operation to continue until the next refueling outage or SG inspection provided theinspection interval continues to be supported by an operational assessment that reflects theaffected tube(s). However, the affected tube(s) must be plugged prior to entering MODE 4following the next refueling outage or SG inspection. This Completion Time is acceptable sinceoperation until the next inspection is supported by the operational assessment.b. I and b.2If the ACTIONS and associated Completion Times of ACTION a. are not met or if SG tubeintegrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours andMODE 5 within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reach thedesired plant conditions from full power conditions in an orderly manner and without challengingplant systems.MILLSTONE -UNIT 3 B3443 mnmn oB 3/4 4-3bAmendment No. LBDCR No. 12-MiP3-007Iune 26, 2012REACTOR COOLANT SYSTEM 'BASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued~)SURVEILLANCE REQUIREMENTSTS 4.4.5.1During shutdown periods the SGs are inspected as required by this SR and the Steam Generator" Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRIGuidelines, establish the content of the Steam Generator Program. Use of the Steam GeneratorProgram ensures that the inspection is appropriate and consistent with accepted industry practices.During SG inspections a condition monitoring assessment of the SG tubes is performed. Thecondition monitoring assessment determines the "as found" condition of the SG tubes. Thepurpose of the condition monitoring assessment is to ensure that the SG performance criteria havebeen met for the previous operating period.The Steam Generator Program determines the scope of the inspection and the methods used todetermine whether the tubes contain flaws satisfying the tube plugging criteria. Inspection scope(i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing andpotential degradation locations. The Steam Generator Program also specifies the inspectionmethods to be used to find potential degradation. Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, andinspection locations.The Steam Generator Program defines the Frequency of TS 4.4.5.1. The Frequency is determinedby the operational assessment and other limits in the SG examination guidelines (Reference 6).The Steam Generator Program uses information on existing degradations and gr'owth rates todetermine an inspection Frequency that provides reasonable assurance that the tubing will meetthe SG performance criteria at the next scheduled inspection. In addition, Specification 6.8.4.gcontains prescriptive requirements concerning inspection intervals to provide added assurancethat the SG performance criteria will be met between scheduled inspections. If crack indicationsare found in any SG tube, the maximum inspection interval for all affected and potentiallyaffected SGs is restricted by Specification 6.8.4.g until subsequent inspections support extendingthe inspection interval.TS 4.4.5.2During a SG inspection, any inspected tube that satisfies the Steam Generator Program pluggingcriteria is removed from service by plugging. The tube plugging criteria delineated inSpecification 6.8.4.g are intended to ensure that tubes accepted for continued service satisfy theS G performance criteria with allowance for error~ in the flaw size measurement and for future flawgrowth. In addition, the tube plugging criteria, in conjunction with other elements of the SteamGenerator Program, ensure that the SG performance criteria will continue to be met until the nextinspection of the subject tube(s). Reference 1 provides guidance for performing operationalMILLSTONE -UNIT 3 B/43 mnmn oB 3/4 4-3cAmendment No. LBDCR No. 12-MIP3-007June 26, 2012REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued~)assessments to verify, that the tubes remaining in service will continue to meet the SGperformance criteria.The Frequency of prior to entering MODE 4 following a SG inspection ensures that theSurveillance has been completed and all tubes meeting the plugging criteria are plugged prior tosubjecting the SG tubes to significant primary to secondary pressure differential.BACKGROUNDSG tubes are small diameter, thin walled tubes that carry primary coolant through the primary tosecondary heat exchangers. The SG tubes have a number of important safety functions. Steamgenerator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such,are relied on to maintain the primary system s pressure and inventory. The SG tubes isolate theradioactive fission products in the primary coolant from the secondary system. In addition, as partof the RCPB, the SG tubes are unique in that they act as the heat transfer surface between theprimary and secondary systems to remove heat from the primary system. This Specificationaddresses only the RCPB integrity function of the SG. The SG heat removal function is addressedby LCO 3.4.1.1, "STARTUP and POWER OPERATION," LCO 3.4.1.2, "HOT STANDBY,"LCO 3.4.1.3, "HOT SI{UTDOWN," and LCO 3.4.1.4.1, "COLD SI{UTDOWN -Loops Filled."SG tube integrity means that the tubes are capable of performing their intended RCPB safetyfunction consistent with the licensing basis, including applicable regulatory requirements.SG tubing is subject to a variety of degradation mechanisms. Steam generator tubes mayexperience tube degradation related to corrosion phenomena, such as wastage, pitting,intergranular attack, and stress corrosion cracking, along with other mechanically inducedphenomena such as denting and wear. These degradation mechanisms can impair tube integrity ifthey are not managed effectively. The SG performance criteria are used to manage SG tubedegradation.Specification 6.8.4.g., "Steam Generator (SG) Program," requires that a program be establishedand implemented to ensure that SG tube integrity is maintained. Pursuant to Specification6.8.4.g., tube integrity is maintained when the SG performance criteria are met. There are threeSG performance criteria: structural integrity, accident induced leakage, and operationalLEAKAGE. The SG performance criteria are described in Specification 6.8.4.g. Meeting the SOperformance criteria provides reasonable assurance of maintaining tube integrity at normal andaccident conditions.The processes used to meet the SG performance criteria are defined by the Steam GeneratorProgram Guidelines (Reference 1).MILLSTONE -UNIT 3 B3443 mnmnoB 3/4 4-3dAmendment No. LBDCR No. 06-MP3-005May 25, 2006REACTOR COOLANT SYSTEMBASES3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)APPLICABLE SAFETY ANALYSESThe steam generator tube rupture (SGTR) accident is the limiting design basis event for SG tubesand avoiding an SGTR is the basis for this Specification. The analysis of a SGTR event assumes abounding primary to secondary LEAKAGE rate greater than the operational LEAKAGE ratelimits in RCS LCO 3.4.6.2, "Operational LEAKAGE," plus the leakage rate associated with adouble-ended rupture of a single tube. The accident analysis for a SGTR assumes thecontaminated secondary fluid is released to the atmosphere via safety valves or atmospheric dumpvalves.The analysis for design basis accidents and transients other than a SGTR assume the SG tubesretain their structural integrity (i.e., they are assumed not to rupture.) In these analyses, the steamdischarge to the atmosphere is based on the total primary to secondary LEAKAGE from all S~sof 1 gallon per minute or is assumed to increase to 1 gallon per minute as a result of accidentinduced conditions. For accidents that do not involve fuel damage, the primary coolant activitylevel of DOSE EQUIVALENT 1-131 is assumed to be equal to the RCS LCO 3.4.8, "SpecificActivity" limits. For accidents that assume fuel damage, the primary coolant activity is a functionof the amount of activity released from the damaged fuel. The dose consequences of these eventsare within the limits of GDC 19 (Reference 2), 10 CER 50.67 (Reference 3) or the N-RC approvedlicensing basis (e.g., a small fraction of these limits).Steam Generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).REFERENCES1. NEJ 97-06, "Steam Generator Program Guidelines."2. 10 CFR 50 Appendix A, GDC 19.3. 10OCFR 50.67.4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.*5. Draft Regulatory Guide 1.12 1, "Basis for Plugging Degraded Steam GeneratorTubes," August 1976.6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines."MILLSTONE -UNIT 3B3/43eAenmtNoB 3/4 4-3eAmendment No. LBDCR No. 07-MP3-032August 8, 2007REACTOR COOLANT SYSTEMBAsEs3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE3/4.4.6.1 LEAKAGE DETECTION SYSTEMSThe RCS Leakage Detection Systems required by this specification are provided to monitor anddetect leakage from the reactor coolant pressure boundary. These Detection Systems areconsistent with the recommendations of Regulatory Guide 1.45, "Reactor Coolant PressureBoundary Leakage Detection Systems," May 1973.ACTION c-provides a 72 hour allowed outage time (AOT) when both the containmentatmosphere particulate radioactivity monitor and the containment drain sump monitoring system,are inoperable. The 72 hour AOT is appropriate since additional actions will be taken during thislimited time period to ensure RCS leakage, in excess of the UNIDENTIFIED LEAKAGE TSlimit of 1 gpm (TS 3.4.6.2), will be readily detectable. This will provide reasonable assurancethat any significant reactor coolant pressure boundary degradation is detected soon afteroccurrence to minimize the potential for propagation to a gross failure. This is consistent with therequirements of General Design Criteria (GDC) 30 and also Criterion 1 of 10 CFR 50.3 6(d)(2)(ii)which requires installed instrumentation to detect, and indicate in the control roo~m, a significantabnormal degradation of the. reactor coolant pressure boundary. The RCS water inventorybalance calculation determines the magnitude of RCS UNIDENTIFIED LEAKAGE by use ofinstrumentation readily available to the control room operators. However, the proposedadditional actions will not restore the continuous monitoring capability normally provided by theinoperable equipment.The RCS water inventory balance is capable of identifying a one gpm RCS leak rate. Thecontainment grab samples will also indicate an increase in RCS leak rate which would then bequantified by the RCS water inventory balance. Since these additional actions are sufficient toensure RCS LEAKAGE is withi~n TS limits, it is appropriate to provide a limited time period to.restore at least one of the TS-required LEAKAGE monitoring systems.LCO 3.4.6.1 .b. Containment Sump Drain Monitoring SystemThe intent of LCO 3.4.6.1.b is to have a system able to monitor and detect leakage from thereactor coolant pressure boundary (RCPB). Any of the following three methods may be used tomeet LCO 3.4.6.l.b:A. 3DAS-P1O, Unidentified Leakage Sump Pump, and associated local and mainboard annunciation.B. 3DAS-P 10, Unidentified Leakage Sump Pump, and computer point 3DAS-L39and CVLKR2.C. 3DAS-P2A or 3DAS-P2B, Containment Drains Sump Pump, and computer points.3DAS-L22 and CVLKR2 or CVLKjR3I.To meet Regulatory Guide 1.45 recommendations, the Containment Drain Sump MonitoringSystem must meet the following five criteria:1. Must monitor changes in sump water level, changes in flow rate or changes in theoperating frequency of pumps.2. Be able to detect an UNIDENTIFIED LEAKAGE rate of 1 gpm in less than one hour.MILLSTONE -UNIT 3B3/44AmnetNoB 3/4 4-4Amendment No. LBDCR No. 07-MP3-032August 8, 2007REACTOR COOLANT SYSTEMBASES3/4.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued)3. Remain OPERABLE following an Operating Basis Earthquake (OBE).4. Provide indication and alarm in the Control Room.5. Procedures for converting various indications to a common leakage equivalentmust be available to the Operators.The three Containment Drain Sump Monitoring Systems identified above meet these fiverequirements as follows:A. 3DAS-PiO. Unidentified Leakage Sump Pump. and associated main boardannunciation.1. Sump level is monitored at two locations by the starting-and stopping of3DAS-P 10, Unidentified Leakage Sump Pump. Flow is measured as afunction of time between pump starts/stops and the known sunap levels atwhich these Occur.2. Two timer relays in the control circuitry of 3DAS-P 1O are set to identify a 1 .gpmleak rate within 1 hour.3. This monitoring, system is not seismic Category I, but is expected to remainOPERABLE during an OBE. If the monitoring system is not OPERABLEfollowing a seismic event, the appropriate ACTION according to TechnicalSpecifications will. be taken. This position has been reviewed by the NRC anddocumented as acceptable in the Safety Evaluation Report.4. If the control circuitry of 3DAS-P10 identifies a 1 gpm leak rate within 1 hour,Liquid Radwaste Panel Annunciator LWS :4-5, CTMT UJNIDENT LEAKAGETROUBLE, and Main Board Annunciator MB1 B 4-3, RAD LIQUID WASTESYS TROUBLE, will alarm. These control circuits and alarms operateindependently from the plant process computer.If the computer is inoperable, these control circuits and alarms meet the TechnicalSpecification requirements for the Containment Drain Sump Monitoring System.5. To convert the unidentified leakage sump pump run times to a leakage rate, use thefollowing formula:(3DAS-P1O run times in minutes -[number of 3DAS-P10 starts x.5 minutes]) x 20 gpm' Elapsed monitored Time in minutesB. 3DAS-P 10. Unidentified Leakage Sump Pump. and computer points 3DAS-L39 andCVLKR2.1. Sump level is monitored by 3DAS-LI39, the Unidentified Leakage Sump Levelindicator. This level indicator provides an input to computer point 3DAS-L39.MILLSTONE -UNIT 3 B/44 mnmn oB 3/4 4-4aAmendment No. LBDCR No. 1 1-MP3-004March 22, 2011REACTOR COOLANT SYSTEMBASES3/4.4.6.1I LEAKAGE DETECTION SYSTEMS (Continued)2. The plant process computer calculates a leakage rate every 30 seconds when3DASP1O indicates stop. This leakage rate is displayed via computer pointCVLKR2. When pump Pl10 does run, the leakage rate calculation is stopped andresumes 10 minutes after pump PlO stops. If it cannot provide a value of theleakage rate within any 54 minute interval, CVDASPIONC (UNDNT LKG RTNOT CALC) alarms which alerts the Operator that UNIDENTIFIED LEAKAGEcannot be determined.3. This monitoring system is not seismic Category I, but is expected to remainOPERABLE during an OBE. If the monitoring system is not OPERABLEfollowing a seismic event, the appropriate ACTION according to TechnicalSpecifications will be taken.4. A priority computer alarm (CVLKR2) is generated if the calculated leakage rate isgreater than a value specified on the Priority Alarm Point Log. This alarm valueshould be set to alert the Operators to a possible RCS leak rate in excess of theTechnical Specification maximum allowed UNIDENTIFIED LEAKAGE. Thealarm value may be set at one gallon per minute or less above the rate ofIDENTIFIED LEAKAGE, from the reactor coolant or auxiliary systems, into theunidentified leakage sump. The rate of IDENTIFIED LEAKAGE may bedetermined by either measurement or analysis. If the Priority Alarm Point Log isadjusted,.the high leakage rate alarm will be bounded by the IDENTIFIEDLEAKAGE rate and the low leakage rate alarm will be set to notify the operatorthat a decrease in leakage may require the high leakage rate alarm to be reset. Thepriority alarm setpoint shall be no greater than 2 gallons per minute. This ensuresthat the IDENTIFIED LEAKAGE will not mask a small increase inUNIDENTIFIED LEAKAGE that is of concern. The 2 gallons per minute limit isalso within the identified leakage sump level monitoring system alarm operatingrange which has a maximumn setpoint of 2.3 gallons per minute.To convert unidentified leakage sump level changes to leakage rate, use thefollowing formula:Note: Wait 10 minutes after 3DAS-Pl10 stops before taking level readings.1.083 15 gallons X % change in level from 3DAS-L391% time between level readings in minutesC. 3DAS-P2A or 3DAS-P2B. Containment Drains Sump Pump, and computer points3DAS-L22 and CVLKR2 or CVLKR3I.1. Sump level is monitored by 3DAS-L122, the Containment Drains Sump LevelIndicator. This level indicator provides an input to computer point 3DAS-L22.This method can be used to monitor UNIDENTIFIED LEAKAGE when Pump Pl10and its associated equipment is inoperable provided Pump Pl10 is out of service and3DAS-L1 39 indicates that the unidentified leakage sump is overflowing to thecontainment drains sump (approximately 40% level on 3DAS-LI39).MILLSTONE -UNIT 3B 3/4 4-4bAmendment No. LBDCR No. 07-MP3-032August 8, 2007REACTOR COOLANT SYSTEMBASES3/4.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued)In this case, CVLKR2 and CVLKR3I monitor flow rate by comparing levelindications on the containment drains sump when Pumps Pl10, P2A, P2B and P 1are not running.2. The plant process computer calculates a leakage rate every 30 seconds when3DAS-P 10, 3DAS-Pl1, 3DAS-P2A and 3DAS-P2B indicate stop. This leakage rateis displayed via computer points CVLKR3I and CVLKR2 when 3DAS-PI10 is offand when the unidentified leakage sump is overflowing to the containment drainssump. When one of these pumps does run, the leakage rate calculation is stoppedand resumes 10 minutes after all pumps stop. If it cannot provide value of theleakage rate within any 54 minute interval, two computer point alarms(CVDASP2NC, UNDNT LKG RT NOT CALC and CVDASP2NC, SMP 3 LKGRT NT CALC) are generated which alerts the Operator that UNIDENTIFIEDLEAKAGE cannot be determined.3. This monitoring system is not seismic Category I, but is expected to remainOPERABLE during an OBE. If the monitoring system is not OPERABLEfollowing a seismic event, the appropriate ACTION according to TechnicalSpecifications will be taken.4. Two priority computer alarms (CVLKR2 and CVLKR3I) are generated if thecalculated leakage rate is greater than a value specified on the Priority Alarm PointLog. This alarm value should be set to alert the Operators to a possible RCS leakrate in excess of the Technical Specification maximum allowed UNIDENTIFIEDLEAKAGE. The alarm value may be set at one gallon per minute or less above the Wi :Prate of IDENTIFIED LEAKAGE, from the reactor coolant or auxiliary systems,into the containment drains sump. The rate of IDENTIFLED LEAKAGE may bedetermined by either, measurement or by analysis. If the Priority Alarm Point Logis adjusted, the high leakage rate alarm will be bounded by the IDENTIFIEDLEAKAGE rate and the low leakage rate alarm will be set to notify the operatorthat a decrease in leakage may require the high leakage, rate alarm to be reset. Thepriority alarm set-point shall be no greater than 2 gallons per minute. This ensuresthat the IDENTIFIED LEAKAGE will not mask a small increase inUNIDENTIFIED LEAKAGE that is of concern. The 2 gallons per minute limit isalso within the contaimnent drains sump level monitoring system alann operatingrange which has a maximum setpoint of 2.5 gallons per minute.5. To convert containment drains sump run times to a leakage rate, refer to procedureSP3 670.1 for guidance on the conversion method.3/4.4.6.2 OPERATIONAL LEAKAGELCORCS operational LEAKAGE shall be limited to:a. PRESSURE BOUNDARY LEAKAGENo PRESSURE BOUNDARY LEAKAGE is allowed, being indicative of materialdeterioration. LEAKAGE of this type is unacceptable as the leak itself could cause furtherMILLSTONE -UNIT 3 B3444 mnmn oB 3/4 4-4cAmendment No. LBDCR No. 07-MP3-032August 8, 2007REACTOR COOLANT SYSTEMBASES3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)deterioration, resulting in higher LEAKAGE. Violation of this LCO could result incontinued degradation of the RCPB. LEAKAGE past seals and gaskets is not PRESSUREBOUNDARY LEAKAGE.b. UNIDENTIFIED LEAKAGEOne gallon per minute (gpm) of UNIDENTIFIED LEAKAGE is allowed as a reasonableminimum detectable amount that the containment air monitoring and containment sumplevel monitoring equipment can detect within a reasonable time period. Violation of thisLCO could result in continued degradation of the RCPB, if the LEAKAGE is from thepressure boundary.*c. Primary_ to Secondary. LEAKAGE through Any One Steam Generator (SG)The limit of 150 gallons per day per SG is based on the operational LEAKAGEperformance criterion in NEl 97-06, Steam Generator Program Guidelines (Reference 4).The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states, "The RCS operational primaryr to secondary LEAKAGE through any one SGshall be limited to 150 gallons per day." The limit is based on operating experience withSG tube degradation mechanisms that result in tube leakage. The operational LEAKAGErate criterion in conjunction with the implementation of the Steam Generator Program isan effective measure for minimizing the frequency of steam generator tube ruptures.d. IDENTIFIED LEAKAGEUp to 10 gpm of IDENTIFIED LEAKAGE is considered allowable because LEAKAGEis from known sources that do not interfere with detection of UNIDENTIFIEDLEAKAGE and is well within the capability of the RCS makeup system. IDENTIFIEDLEAKAGE includes LEAKAGE to the containment from specifically known and locatedsources, but does not include PRESSURE BOUNDARY LEAKAGE or controlled reactorcoolant pump (RCP) seal leakoff (CONTROLLED LEAKAGE). Violation of this LCOcould result in continued degradation of a component or system.e. CONTROLLED LEAKAGEThe CONTROLLED LEAKAGE limitation restricts operation when the total flowsupplied to the reactor coolant pump seals exceeds 40 gpm with the modulating valve inthe supply line fully open at a nominal RCS pressure of 2250 psia. This limitation ensuresthat in the event ofa LOCA, the safety injection flow will not be less than assumed in thesafety analyses.A limit of 40 gpm is placed on CONTROLLED LEAKAGE.f. RCS Pressure Isolation Valve LEAKAGEThe specified allowable leakage from any RCS pressure isolation valve is sufficiently lowto ensure early detection of possible in-series valve failure. It is apparent that whenpressure isolation is provided by two in-series valves and when failure of one valve in thep~air can go undetected for a substantial length of time, verification of valve integrity isrequired. Since these valves are important in preventing overpressurization and rupture ofthe ECCS low pressure piping which could result in a LOCA, these valves should betested periodically to ensure low probability of gross failure.MILLSTONE -UNIT 3B3/44dAemntN.2,B 3/4 4-4dAmendment No. g09, LBDCR No. 06-MP3-005May 25, 2006REACTOR COOLANT SYSTEMBASES3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)APPLICABILITYIn MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS ispressurized.In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is farlower, resulting in lower stresses and reduced potentials for LEAKAGE.LCO 3.4.6.2.f~, RCS Pressure Isolation Valve (PIV) Leakage, measures leakage through eachindividual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakagemeasured through one PIV does not result in RCS LEAKAGE when the. other is leak tight. Ifboth valves leak and result in a loss of mass from the RCS, the loss must be included in theallowable identified LEAKAGE.ACTIONSb.,c.UNIDENTIFIED LEAKAGE, IDENTIFIED LEAKAGE or RCS pressure isolation valveLEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours. ThisCompletion Time allows time to verify leakage rates and either identify' UNIDENTIFIEDLEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. Thisaction is necessary to prevent further deterioration of the RCPB.a. b. c.If any PRESSURE BOUNDARY LEAKAGE exists, or primary to secondary LEAKCAGE is notwithin limits, or if UNIDENTIFIED LEAKAGE, IDENTIFIED LEAKAGE, or RCS pressureisolation valve LEAKAGE cannot be reduced to within limits within 4 hours, the reactor must bebrought to lower pressure conditions to reduce the severity of the LEAKAGE and its potentialconsequences. It should be noted that LEAKAGE past seals and gaskets is not PRESSUREBOUNDARY LEAKAGE. The reactor must be brought to HOT STANDBY within 6 hours andCOLD SHUTDOWN within the following 30 hours. This action reduces the LEAKAGE and alsoreduces the factors that tend to degrade the pressure boundary.The allowed Completion Times are reasonable, based on operating experience, to reach therequired plant conditions from full power conditions in an orderly manner and withoutchallenging plant systems. In COLD SHUTDOWN, the pressure stresses acting on the reactorcoolant pressure boundary are much lower, and further deterioration is much less likely.MILLSTONE -UNIT 3B3444eA ndntN.O,B 3/4 4-4eAmendment No. -2419, LBDCR No. 06-MP3-005May 25, 2006REACTOR COOLANT SYSTEMBASES3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)SURVEILLANCE REOUIREMENTS4.4.6.2.1 .cCONTROLLED LEAKAGE is determined under; a set of reference conditions, listed below:a. One Charging Pump in operation.b. RCS pressure at 2250 +/- 20 psia.By limiting CONTROLLED LEAKAGE to 40 gpm during normal operation, it can be assuredthat during an SI with only one charging pump injecting, RCP seal injection flow will continue toremain less than 80 gpin as assumed in the accident analysis. When the seal injection throttlevalves are set with a normal charging lineup, the throttle valve position bounds conditions wherehigher charging header pressures could exist. Therefore, conditions which create higher chargingheader pressures such as an isolated charging line, or two pumps in service are bounded by thesingle puinp-nonnal system lineup surveillance configuration. Basic accident analysisassumptions are that 80 gpin flow is provided to the seals by a single pump in a runout condition.4.4.6.2.1 .dVerifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the reactor coolantpressure is maintained. PRESSURE BOUNDARY LEAKAGE would at first appear asUNIDENTIFIED LEAKAGE and can only be positively identified by inspection. It should benoted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE.UNIDENTIFIED LEAKAGE and IDENTIFIED LEAKAGE are determined by performance ofan RCS water inventory balance.The RCS water inventory balance must be performed with the reactor at steady state operatingconditions (stable temperature, power level, pressurizer and makeup tank levels, makeup andletdown, and RCP seal injection and return flows). The Surveillance is modified by two Notes.Note 1 states that this SR is not required to be performed until 12 hours after establishing steadystate operation. The 12 hour allowance provides sufficient thne to collect and process allnecessary data after stable plant conditions are established.Steady state operation is required to perform a proper water inventory balance since calculationsduring maneuvering are not useful. For RCS operational LEAKAGE detennination by waterinventory balance, steady state is defined as stable RCS pressure, temperature, power level,pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and returnflOWS.MILLSTONE -UNIT 3B /4fAenetNoB 3/4 4-4fAmen&nent No. [ LBDCR 12-MP3-010September 20, 2012REACTOR. COOLANT SYSTEM lBASES3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)An early warning of PRES SURE BOUNDARY LEAKAGE or UNIDENTIFIED LEAKAGE isprovided by the automatic systems that monitor the containment atmosphere radioactivity and thecontainment sump level. It should be noted that LEAKAGE past seals and gaskets is notPRESSURE BOUNDARY LEAKAGE. These leakage detection systems are specified in RCSLCO 3.4.6.1, "Leakage Detection Systems."Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGEof 150 gallons per day caimot be measured accurately by an RCS water inventory balance.The surveillance frequency is controlled under the Surveillance Frequency Control Program.4.4.6.2.1 .eThis SR verifies that primary to secondary¢ LEAKAGE is less than or equal to 150 gallons per daythrough any one SG. Satisfying the primary to secondary LEAKAGE limait ensures that theoperational LEAKAGE performance criterion in the Steam Generator Progr'am is met. If this SR isnot met, compliance with LCO 3.4.5, "Steam Generator Tube Integrity," should be evaluated. The150 gallons per day limit is measured at room temperature as described in Reference 5. The ,operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should beconservatively assumed to be from one SG.The Surveillance is modified by a Note which states that the surveillance is not required to beperformed until 12 hours after establishment of steady state operation. For RCS primary tosecondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature,power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection andreturn flows.The surveillance frequency is controlled under the Surveillance Frequency Control Program. Theprimary to secondary LEAKAGE is determined using continuous process radiation monitors orradiochemical grab sampling in accordance with the EPRI guidelines (Reference 5).4.4.6.2.2The Surveillance Requirements for RCS pressure isolation valves provide assurance of valveintegrity thereby reducing the probability of gross valve failure and consequent intersystem LOCA.Leakage from the RCS pressure isolation valve is IDENTIFIED LEAKAGE and will be consideredas a portion of the allowed limit.MILLSTONE -UNIT 3B3/4gAenetNoB 3/4 4-4gAmendment No. LBDCR No. 06-MP3--005May 25, 2006REACTOR COOLANT SYSTEMBASES3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)Entry into MODES 3 and 4 is allowed to establish the necessary differential pressures and stableconditions for performance of Surveillance Requirement 4 .4 .6.2 .2 (including SurveillanceRequirement 4.4.6.2.2.d) for RCS pressure isolation valves which can only be leak-tested atelevated RCS pressures. The requirements of Surveillance Requirement 4.4.6.2.2.d to verify thata pressure isolation valve is OPERABLE shall be performed within 24 hours after the requiredRCS pressures has been met.In MODES 1 and 2, the plant is at normal operating pressure and Surveillance Requirement4.4.6.2.2.d shall be performed within 24 hours of valve actuation due to automatic or manualaction or flow through the valve. In MODES 3 and 4, Surveillance Requirement 4.4.6.2.2.d shall*be performed within 24 hours of valve actuation due to automatic or manual actuation of flowthrough the valve if and when RCS pressure is sufficiently high for performance of thissurveillance.BACKGROUNDComponents that contain or transport the coolant to or from the reactor core make up the reactorcoolant system (RCS). Component joints are made by welding, bolting, rolling, or pressureloading, and valves isolate connecting systems from the RCS.During plant life, the joint and valve interfaces can produce varying amounts of reactor coolantLEAKAGE, through either normal operational wear or mechanical deterioration. The purpose ofthe RCS "Operational LEAKAGE" LCO is to limit system operation in the presence ofLEAKAGE from these sources to amounts that do not compromise safety. This LCO specifiesthe types and amounts of LEAKAGE.10 CFR 50, Appendix A, GDC 30 (Reference 1), requires means for detecting and, to the extent.practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45(Reference 2) describes acceptable methods for selecting leakage detection systems.The safety significance of RCS LEAKAGE varies widely depending on its source, rate, andduration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containmentarea is necessary. Quickly separating the IDENTIFIED LEAKAGE from the UNIDENTIFIEDLEAKAGE is necessary to provide quantitative information to the operators, allowing them totake corrective action should a leak occur detrimental to the safety of the facility and the public.A limited amount of leakage inside containment is expected from auxiliary systems that cannot bemade 100% leaktight. Leakage from these systems should be detected, located, and isolated fromthe containment atmosphere, if possible, to not interfere with RCS LEAKAGE detection.This LCO deals with protection of the reactor coolant pressure boundary (RCPB) fromdegradation and the core from inadequate cooling, in addition to preventing the accident analysisradiation release assumptions from being exceeded. The consequences of violating this LCOinclude the possibility of a loss of coolant accident (LOCA).MILLSTONE -UNIT 3 B3444 mnmn oB 3/4 4-4hAmendment No. [ LBDCR No. 06-MP3-005May 25, 2006REACTOR COOLANT SYSTEMBASES3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)APPLICABLE SAFETY ANALYSES -OPERATIONAL LEAKAGEExcept for primary to secondary LEAKAGE, the safety analyses do not address operationalLEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA;the amount of leakage can affect the probability of such an event. The safety analysis for an eventresulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGEfrom all steam generators (SGs) is 1 gallon per minute or increases to 1 gallon per minute as aresult of accident induced conditions. The LCO requirement to limit primary to secondaryLEAKAGE through any one SG to less than or equal to 150 gallons per day is significantly lessthan the conditions assumed in the safety analysis.Primary to secondary LEAKAGE is a factor in the dose releases outside containment resultingfrom a main steam line break (MSLB). To a lesser extent, other accidents or transients involvesecondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR)accident. The leakage contaminates the secondary fluid.The ESAR (Reference 3) analysis for SGTR assumes the contaminated secondary fluid is releasedvia atmospheric dump valves. The 1 gpm primary to secondary LEAKAGE safety analysisassumption is relatively inconsequential.The safety analysis for the MSLB accident assumes 500 gpd primary to secondary LEAKAGE isthrough the affected steam generator and the remainder of the 1 gpm is through the intact SGs asan initial condition. The dose consequences resulting from the MSLB accident are within theguidelines based on 10 CFR 50.67 or other staff approved licensing basis.The RCS operational LEAKAGE satisfies Criterion 2 of 10 CER 50.36(c)(2)(ii).REFERENCES1. 10 CFR 50, Appendix A, GDC 30.2. Regulatory Guide 1.45, May 1973.3. FSAR, Section 15.4. NEI 97-06, "Steam Generator Program Guidelines."5. EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."* 6. Letter FSD/SS-NEU-37 13, dated March 25, 1985.7. Letter NEU-89-639, dated December 4, 1989.MILLSTONE -UNIT 3 B3444 mnmn oB3/4 4-4iAmendment No. LBDCR No. 08-MP3-013March 18, 2008REACTOR COOLANT SYSTEMBASES3/4.4.7 DELETED3/4.4.8 SPECIFIC ACTIVITYBACKGROUNDThe maximum dose that an individual at the exclusion area boundary can receive for 2 hoursfollowing an accident, or at the low population zone outer boundary for the radiological releaseduration, is specified in 10 CFR 50.67 (Reference 1). Doses to control room occupants must belimited per GDC 19. The limits on specific activity ensure that the offsite and Control RoomEnvelope (CRE) doses are appropriately limited during analyzed transients and accidents.The RCS specific activity LCO limits the allowable concentration of radionuclides in the reactorcoolant. The LCO limits are established to minimize the dose consequences in the event of asteam line break (SLB) or steam generator tube rupture (SGTR) accident.The LCO contains specific activity limits for both DOSE EQUIVALENT I-i131 and DOSEEQUIVALENT XE-133. The allowable levels are intended to ensure that offsite and CRE dosesmeet the appropriate acceptance criteria in the Standard Review Plan (Reference 2).APPLICABLE SAFETY ANALYSESThe LCO limits on the specific activity of the reactor coolant ensure the resulting offsite and CREdoses meet the appropriate SRP acceptance criteria following a SLB or SGTR accident. Thesafety analyses (References 3 and 4) assume the specific activity of the reactor coolant is at theLCO limits, and an existing reactor coolant (SG) tube leakage rate of"l gpmexists. The safety analyses assume the specific activity of the secondary coolant is at its limit of0.1 jgCi/gm DOSE EQUIVALENT 1-131 from LCO 3.7.1.4, "Specific Activity."The analyses for the SLB and SGTR accidents establish the acceptance limits for RCS specificactivity. Reference to these analyses is used to assess changes to the unit that could affect RCSspecific activity, as they relate to the acceptance limits.The safety analyses consider two cases of reactor coolant iodine specific activity. One caseassumes specific activity at 1.0 .ixCi/gm DOSE EQUIVALENT 1-131 with a concurrent largeiodine spike that increases the rate of release of iodine from the fuel rods containing claddingdefects to the primary coolant immediately after a SLB (by a factor of 500), or SGTR (by a factorof 335) respectively. The second case assumes the initial reactor coolant iodine activity at 60.0gICi/gm DOSE EQUIVALENT 1-131 due to an iodine spike caused by a reactor or an RCStransient prior to the accident. In both cases, the noble gas specific activity is assumed to be 81 .2gaCi/gm DOSE EQUIVALENT XE- 133.The SGTR analysis also assumes a loss of offsite power at the same time as the reactor trip. TheSGTR causes a reduction in reactor coolant inventory. The reduction initiates a reactor trip from alow pressurizer pressure signal or an RCS overtemperature AT signal.MILLSTONE -UNIT 3B3/45AmnetNo24B 3/4 4-5Amendment No. 2-04 LBDCR No:08-MP3-013March 18, 2008REACTOR COOLANT SYSTEMBASESSPECIFIC ACTIVITY (Continued)The loss of offsite power causes the steam dump valves to close to protect the condenser. The risein pressure in the ruptured SG discharges radioactively contaminated steam to the atmospherethrough the SG power operated relief valves and/or the main steam safety valves. The unaffectedSGs remove core decay heat by venting steam to the atmosphere until the cooldown ends and theResidual Heat Removal (RHIR) system is put in service."The SLB radiological analysis assumes offsite power is lost at the same time as the pipe breakoccurs outside containment. Reactor trip occurs after the generation of an SI signal on low steamline pressure. The affected SG blows down completely and steam is vented directly to theatmosphere. The unaffected SGs remove core decay heat by venting steam to the atmosphereuntil the cooldown ends and the RUR system is placed in service.Operation with iodine specific activity levels greater than I /tCi/gm but less than or equal to60.0 jixCi/gm is permissible for up to 48 hours while efforts are made to restore DOSEEQUIVALENT 1-131 to within the 1 pCi/gm LCO limit. Operation with iodine specific activitylevels greater than 60 jgCi/gm is not permissible.The RCS specific activity limits are also used for establishing standardization in radiationshielding and plant personnel radiation protection practices.RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).LCOThe iodine specific activity in the reactor coolant is limited to 1.0 paCi/gm DOSE EQUIVALENTI-131, and the noble gas specific activity in the reactor coolant is limited to 81.2 pCi/gm DOSEEQUIVALENT XE-133. The limits on specific activity ensure that offsite and CRE doses willmeet the appropriate SRP acceptance criteria (Reference 2).The SLB and SGTR accident analyses (References 3 and 4) show that the calculated doses arewithin acceptable limits. Operation with activities in excess of the LCO may result in reactorcoolant radioactivity levels that could, in the event of an SLB or SGTR, lead to doses that exceedthe SRP acceptance criteria (Reference 2).APPLICABILITYIn MODES 1, 2, 3, and 4, operation within the LCO limits for DOSE EQUIVALENT 1-131 andDOSE EQUIVALENT XE-133 is necessary to limit the potential consequences of a SLB orSGTR to within the SRP acceptance criteria (Reference 2).In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS andsteam generators are depressurized, and primary to secondary LEAKAGE is minimal. Therefore,the monitoring of RCS specific activity is not required.MILLSTONE -UNIT 3B3/46AmnetNoB 3/4 4-6Amendment No. LBDCR No. 08-MP3-013March 18, 2008REACTOR COOLANT SYSTEMBASESSPECIFIC ACTIVITY (Continued)ACTIONSa. and b.With the DOSE EQUIVALENT 1-131 greater than the LCO limit, samples at intervals of fourhours must be taken to demonstrate that the specific activity is < 60 pCi/gim. Four hours isrequired to obtain and analyze a sample. Sampling is continued every four hours to provide atrend.The DOSE EQUIVALENT 1-131 must be restored to within limit within 48 hours. Thecompletion time of 48 hours is acceptable since it is expected that, if there were an iodine spike,the nonnal coolant iodine concentration would be restored within this time period. Also, there is alow probability of a SLB or SGTR occurring during this time period.A statement in ACTION b. indicates the provisions of LCO 3.0.4 are not applicable. Thisexception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTIONS a. andb. while the DOSE EQUIVALENT 1-13 1 LCO is not met. This exception is acceptable due to thesignificant conservatism incor~porated into the RCS specific activity limit, the low probability ofan event which is limiting due to exceeding this limit, and the ability to restore transient-specificactivity excursions while the plant remains at, or proceeds to, POWER OPERATION.c.If the required action and completion time of ACTION b. is not met, or if the DOSEEQUIVALENT 1-131 is > 60 jFCi/gm, the reactor must be brought to HOT STANDBY (MODE 3)within 6 hours and COLD SHUTDOWN (MODE 5) within 36 hours. The allowed completiontimes are reasonable, based on operating experience, to reach the reqfiired plant conditions fromfull power conditions in an orderly maimer and without challenging plant systems.d_.With the RCS DOSE EQUIVALENT XE-133 greater than the LCO limit, DOSE EQUIVALENTXE-133 must be restored to within limit within 48 hourns. The allowed completion time of 48hours is acceptable since it is expected that, if there were a noble gas spike, the normaal coolantnoble gas concentration would be restored within this time period. Also, there is a low probabilityof a SLB or SGTR occurring during this time period.A statement in ACTION d. indicates the provisions of LCO 3.0.4 are not applicable. Thisexception to LCO 3.0.4 permnits entry into the applicable MODE(S), relying on ACTION d. whilethe DOSE EQUIVALENT XE-133 LCO is not met. This exception is acceptable due to thesignificant conservatism incorporated into the RCS specific activity limit, the low probability ofan event which is limiting due to exceeding this limit, and the ability to restore transient-specificactivity excursions while the plant remnains at, or proceeds to, POWER OPERATION.MILLSTONE -UNIT 3 B3446 mnmn o* B 3/4 4-6aAmendment No. LBDCR 12-MPll3-010September 20, 2012REACTOR. COOLANT SYSTEMBASESSPECIFIC ACTIVITY (Continued)ACTIONS (Continued)e.If the required action and completion time of ACTION d. is not met, the reactor must be broughtto HOT STANDBY (MODE 3) within 6 hours and COLD SIIUTDOWN (MODE 5) within3 6 hours. The allowed completion times are reasonable, based on operating experience, to reachthe required plant conditions from full power conditions in an orderly manner mad withoutchallenging plant systems.SURVEILLANCE REQUIREMENTS4.4.8.1Surveillance Requirement 4.4.8.1 requires performing a gamma isotopic analysis as a measure ofthe noble gas specific activity of the reactor coolant at the frequency specified in the SurveillanceFrequency Control Program. This measurement is the sum of the degassed gamma activities andthe gaseous gamma activities in the sample taken. This Surveillance Requirement provides anindication of any increase in the noble gas specific activity.Trending the results of this Surveillance Requirement allows proper remedial action to be takenbefore reaching the LCO limit under normal operating conditions. The surveillance frequency iscontrolled under the Survweillance Frequency Control Progr-am.Due to the inaherent difficulty in detecting Kr'-85 in a reactor coolant sample due to masking fromradioisotopes with similar decay energies, such as F-18 and 1-134, it is acceptable to include theminimum detectable activity for Kr-85 in the Surveillance Requirement 4.4.8.1 calculation. If aspecific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE-133 is notdetected, it should be assumed to be present at the minimum detectable activity.A Note modifies the Su'veillance Requirement to allow entry into and operation in MODE 4,MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows theSurveillance Requirement to be performned in those MODES, prior to entering MODE 1.4.4.8.2This Surveillance Requirement is performed to ensure iodine specific activity remains within the.LCO limit during normal operation and following fast power changes when iodine spiking ismore apt to occur The surveillance fr'equency is controlled under the Surveillance FrequencyControl Program. The frequency of between 2 and 6 hours after a power change _> 15% RTPwithin a 1 hour period is established because the iodine levels peak during this time followingiodine spike initiation; samples at other times would provide inaccurate results.MILLSTONE -UNIT 3 B3446 mnmn oB 3/4 4-6bAmendment No. LBDCR No. 08-MP3-013March 18, 2008REACTOR COOLANT SYSTEMBASESSPECIFIC ACTIVITY (Continued)SURVEILLANCE REQUIREMENTS (Continued)The Note modifies this Surveillance Requirement to allow entry into and operation in MODE 4,MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows theSurveillance Requirement to be performed in those MODES, prior to entering MODE 1.REFERENCES1. 10CFR5O.67.2. Standard Review Plan (SRP) Section 15.0.1, "Radiological Consequence Analyses UsingAlternate Source Terms."3. FSAR, Section 15.1.5.4. FSAR, Section 15.6.3.3/4.4.9 PRESSURE/TEMPERATURE LIMITSREACTOR COOLANT SYSTEM (EXCEPT THE PRESSURIZER)BACKGROUNDAll components of the RCS are designed to withstand effects of cyclic loads due to systempressure and temperature changes. These loads are introduced by startup (heatup) and shutdown(cooldown) operations, power transients, and reactor trips. This LCO limits the pressure andtemperature changes during RCS heatup and cooldown, within the design assumptions and thestress limits for cyclic operation.Figures 3.4-2 and 3.4-3 contain P/T limit curves for heatup, cooldown, inservice leak andhydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolanttemperature.Each PIT limit curve defines an acceptable region for normal operation. The usual use of thecurves is operational requirements during heatup or cooldown maneuvering, when pressure andtemperature indications are monitored and compared to the applicable curve to determine thatoperation is within the allowable region. A heatup or cooldown is defined as a temperatureincrease or decrease of greater than or equal to 1 0°F in any one hour period. This definition ofheatup and cooldown is based upon the ASME definition of isothermal conditions described inASME, Section XI, Appendix E.MILLSTONE -UNIT 3B 3/4 4-7MILLTONE- UNT 3 3/44-7Amendment No. 5, 4-9-7, LBDCR 3-4-03May 20, 2004REACTOR COOLANT SYSTEMBASESPRESSURE/TEMPERATURE LIMITS (continued)Steady state thermal conditions exist when temperature increases or decreases are <1 0°Fin any one hour period and when the plant is not performing a planned heatup or cooldown inaccordance with a procedure.The LCO establishes operating limits that provide a margin to brittle failure, applicable tothe fenritic material of the reactor coolant pressure boundary (RCPB). The vessel is thecomponent most subject to brittle failure, and the LCO limits apply mainly to the vessel. Thelimits do not apply to the Pressurizer.The P/T limits have been established for the ferritic materials of the RCS consideringASME Boiler and Pressure Vessel Code Section XI, Appendix G (Reference 1) as modified byASME Code Case N-640 (Reference 2), and the additional requirements of 10 CFR 50Appendix G (Reference 3). Implementation of the specific requirements provide adequate marginto brittle fracture of ferritic materials during normal operation, anticipated operationaloccurrences, and system leak and hydrostatic tests.The neutron embrittlement effect on the material toughness is reflected by increasing thenil ductility reference temperature (RTNDT) as exposure to neutron fluence increases.The actual shift in the RTNDT of the vessel material will be established periodically byremoving and evaluating the irradiated reactor ve~ssel material specimens, in accordance withASTM E 185 (Ref. 4) and Appendix H of 10 CFR 50 (Ref. 5). The operating P/T limit curveswill be adjusted, as necessary, based on the evaluation findings and. the recommendations ofRegulatory Guide 1.99 (Ref. 6).The P/T limit curves are composite curves established by superimposing limits derivedfrom stress analyses of those portions of the reactor vessel and head that are the most restrictive.At any specific pressure, temperature, and temperature rate of change, one location within thereactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves,different locations may be more restrictive, and thus, the curves are composites of the mostrestrictive regions.The heatup curve represents a different set of restrictions than the cooldown curve becausethe directions of the thermal gradients through the vessel wall are reversed. The thermal gradient-reversal alters the location of the tensile stress between the outer and inner walls.The P/T limits include uncertainty margins to ensure that the calculated limits are notinadvertently exceeded. These margins include gauge and system loop uncertainties, elevationdifferences, containment pressure conditions and system pressure drops between the beltlineregion of the vessel and the pressure gauge or relief valve location.MILLSTONE -UNIT 3 B 3/4 4-8 Amendment No. 48, -l-5-, 19-7,Acknowledged by NRC letter dated 08/25/05 August 27, 2001REACTOR COOLANT SYSTEMBASES.PRESSURE/TEMPERATURE LIMITS (continued)The criticality limit curve includes the Reference 1lrequirement that it be >_ 40°F above theheatup curve or the cooldown curve, and not less than 1 60°F above the minimum permissible:temperature for ISLH testing. This limit provides the required margin relative to brittle fracture.However, the criticality curve is not operationally limiting; a more restrictive limit exists in LCO3.1.1.4, "Minimurn Temperature for Criticality."The consequence of violating the LCO limits is that the RCS has been operated underconditions that can result in brittle failure of the ferritic RCPB materials, possibly leading to anonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluationmust be performed to determine, the effect on the structural integrity of the RCPB components.The ASME Code, Section XI, Appendix F (Ref. 7) provides a recommended methodology for-evaluating an operating event that causes an excursion outside the limits.APPLICABLE SAFETY ANALYSISThe P/T limits are not derived from Design Basis Accident (DBA) analyses. They areprescribed during normal operation to avoid encountering pressure, temperature, and temperaturerate of change conditions that might cause undetected flaws to prop agate and cause nonductile* failure of the RCPB, an unanalyZed condition. Reference 1, as modified by Reference 2,il!: combined with the additional requirements of Reference 3 provide the methodology fordetermining the P/T limits. Although the PiT limits are not derived from any DBA, the P/T limitsare acceptance limits since they preclude operation in an 'unanalyzed condition.RCS P/T limits satisfy Criterion 2 of.l0CFR,50.36(e)(2)(ii-).LCOThe LCO limits apply to ferritic components of the RCS, except the Pressurizer. These limitsdefine allowable operating regions while providing margin against nonductile failure for the"controlling ferritic components.The limitations imposed on the rate of change of temperature have been established to ensureconsistency with the resultant heatup, cooldown, and ISLH testing P/T'limit curves. These limitscontrol the thermal gradients (stresses) within .the reactor vessel belt line (the limitingcomponent). Note that while these limits are to provide protection to ferritic components withinthe reactor coolant pressure boundary, a limit of 1 000F/hr applies to the reactor, coolant pressuireboundary (except the pressurizer) to ensure that operation is maintained within the ASME SectionIII design loadings, stresses, and fatigue analyses for heatup and cooldown.MILLSTONE -UNIT 3B 3/4 4-9MILLTON -NIT3 B3/44-9Amendment No. 4--57-, 197 LBDCR 04-MP3-001REACTOR COOLANT SYSTEMBASESPRESSURE/TEMPERATURE LIMITS (continued)Violating the LCO limits places the reactor vessel outside of the bounds of the analyses and canincrease stresses in other RCPB components. The consequences depend on several factors, asfollows:a. The severity of the departure from the allowable operating P/T regime or theseverity of the rate of change of temperature;b. The length of time the limits were violated (longer violations allow thetemperature gradient in the thick vessel walls to become more pronounced); andc. The existences, sizes, and orientations of flaws in the vessel material.APPLICABILITYThe RCS P/T limits LCO provides a definition of acceptable operation for prevention ofnonductile failure of ferritic RCS components using ASME Section XI Appendix G, as modifiedby Code Case N-640 and the additional requirements of l0CFR50, Appendix G (Ref. 1). The P/Tlimits were developed to provide requirements for operation during heatup or cooldown (MODES3, 4, and 5) or ISLH testing, in keeping with the concern for nonductile failure. The limits do notapply to the Pressurizer.During MODES 1 and 2, other Technical Specifications priovide limits for operation that can bemore restrictive than or can supplement these P/T limits. LCO 3.2.5, "DNB Parameters"; LCO3.2.3. 1, "RCS Flow Rate and Nuclear En~thaltpy H'ot Channel Facto',;.LCO 3,1.1.4,"Minimum Temperature for Criticality"; and Safety Limit 2.1, "Safety Limits," also provideoperational restrictions for pressure and temperature and maximum pressure. Furthermore,MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stressanalyses have been performed. for normal maneuvering profiles, such as power ascension ordescent.ACTIONSOperation outside the P/T limits must be corrected so that the RCPB is returned to a. condition thathas been verified by stress analyses. The Allowed Outage Times (AOTs) reflects the urgency ofrestoring the parameters to within the analyzed range. Most violations will not be severe, and the*activity can be accomplished in this time in a controlled manner.Besides restoring operation within limits, an evaluation is required to. determine if RCS operationcan continue. The evaluation must verify the RCPB integrity remains acceptable and must becompleted before continuing operation. Several methods may be used, including comparisonwith pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.MILLSTONE -UNIT 3 B 3/4 4-10 Amendment No. 5-7, 1-9-, 2--l--,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP'3-015* February 24, 2005REACTOR COOLANT SYSTEMBASESPRESSURE/TEMPERATURE LIMITS (continued)ASME Code, Section XI, Appendix E (Ref. 7), may be used to support the evaluation. However,its use is restricted to evaluation of the vessel beltline.The 72 hour AOT when operating in MODES 1 through 4 is reasonable to accomplish theevaluation. The evaluation for a mild violation ispossible within this time, but more severeviolations may require special; event specific* stress analyses or inspections. A favorableevaluation must be completed before continuing to operate.This evaluation must be completed whenever a limit is exceeded. Restoration within the AOTalone is insufficient because higher than analyzed stresses may have occurred and may haveaffected the RCPB integrity.If the required remedial actions are not *completed within the allowed times, the plant must beplaced in a lower MODE or not allowed to enter MODE 4 because either the RCS remained in anunacceptable P/T region for an extended period of increased stress or a sufficiently severe eventcaused entry into an unacceptable region. Either possibility indicates a need for more carefulexamination of the event, best accomplished with the RCS at reduced pressure and temperature.In reduced pressure and temperature conditions, the possibility of propagation with undetectedflaws is decreased.If the required evaluation for continued operation in MODES 1 through 4 cannot be accomplishedwithin 72 hours or the results are indeterminate or unfavorable, action must proceed to reducepreSur~e and te~fnperathire as sp~cifr~d~ii the ACT]ION stiatement. A evaluation must becompleted and documented before r-etrnirng to operating pressure and temperature conditions.Pressure and temperature are reduced by bringing the plan~t to MODE 3 within 6 hours and toMODE 5 with RCS pressure < 500 psia within the next 30 hours.Completion of the required evaluation following limit violation in other than MODES 1 through 4is required before plant startup to MODE 4 can* proceed..The AOTs are reasonable, based on operating experience to reach the required plant conditionsfrom full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE REQUIREMENTSVerification that operation is within the LCO limits as well as the :limits of Figures 3.4-2 and -3.4-3 is required every 30 minutes when RCS pressure and temperature conditions areundergoing planned changes. This frequency is considered reasonable in view of the controlroom indication available to monitor RCS status.MILLSTONE -UNIT 3 B 3/4 4-11 Amendment No. 4&, 89, 4-5#, 4)-97,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015February 24, 2005REACTOR COOLANT SYSTEMBASES :PRES SURE/TEMPERATURE LIMITS (continued)Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definitiongiven in the relevant plant procedure for ending the activity is satisfied.This Surveillance Requirement is only required to be performed during system heatup, cooldown,and ISLJ- testing. No Surveillance Requirement is given for criticality operations because LCO3.1.1.4 contains a more restrictive requirement.It is rnot necessary to perform Surveillance Requirement 4.4.9.1.1 to verify' compliance withFigures 3.4-2 and 3.4-3 when the reactor vessel is fully detension'ed. During REFUELING; withthe head fully detensioned or off the reactor vessel, the RCS is not capable of being pressuriz~ed toany significant value. The limiting thermal stresses which could be encountered during this timewould be limited to flood-up using RWST water as low as 40°F. It is not possible to cause crackgrowth of postulated flaws in the reactor vessel at normal REFUELING temperatures eveninjecting 40°F Water.REFERENCES1. ASME Boiler and Pressure Vessel Code, Section XI, Appendix GQ "Fracture :IToughness for Protection Against Failure," 1995 Edition.2. ASME Section XI, Code Case N-640, "Alternative R~eference Fracture Toughnessfor Development of P-T Limit Curves," dated F~ebruary 26, 1999.3. 10 CFR 50 Appendix G, "Fracture Toughness Requirements."4. ASTM E 185-82, "Standard Practice for Conducting Surveillance Tests for Light-Water Cooled Nuclear Power Reactor. Vessels, E 706."5. 10 CFR 50 Appendix IH, "Reactor Vessel Material Surveillance ProgramRequirements."6. Regulatory Guide 1.99 Revision 2, "Radiation Embrittlement of Reactor VesselMaterials," dated May 1988.7. ASME Boiler and Pressure Vessel Code, Section XI, Appendix E, "Evaluation ofUnanticipated Operating Events," 1995 Edition.MILLSTONE -UNIT 3 B 3/4 4-12 Amendment No. 48,14-7, 9-,-2-04,-2-t-4,Acknowledged by NRC letter dated 08/25/05 May 8, 2002This page intentionally left blankMILLSTONE -UNIT 3B 3/4 4-13MILLTON -NIT B /4 -13Amendment No. #$, Z7'7 204 May 8, 2002This page intentionally left blankMILLSTONE -UNIT 3B 3/4 4-14MILLTON -NIT B /4 -14 Amendment No. JF7, 204 REACTRCOLNESSEMay 8, 2002BASESIOVERPRESSURE PROTECTION SYSTEMSBACKGROUNDThe Cold Overpressure Protection System limits RCS pressure at low temperaturesso the integrity of the reactor coolant pressure boundary (RCPB) is notcompromised by violating the isothermal beltline. pressure and temperature (P/I)limits developed using the guidance of ASME Section XI, Appendix G (Reference 1)as modified by ASME Code Case N-640 (Reference 2). The reactor vessel is thelimiting RCPB component for demonstrating such protection.Cold Overpressure Protection consists of two PORVs with nominal lift setting asspecified in Figures 3.4-4a and 3.4-4b, or two residual heat removal (RHR)suction relief valves, or one PORV and one RHR suction relief valve, or adepressurized RCS and an RCS vent of sufficient size. Two relief valves arerequired for redundancy. One relief valve has adequate relieving capability toprevent overpressurization of the RCS for the required mass input capability.MILLSTONE -UNIT 3B 3/4 4-15 Amendment No. J7, J 7, 204 REVERSE OF PAGE B 3/4 4-15INTENTIONALLY LEFT BLANK-LBDCR Nb. 04-MP3-015February 24, 2005REACTOR COOLANT SYSTEMBASESOVERPRESSURE PROTECTION SYSTEMS (continued)The use of a PORV for Cold Overpressure Protection is limited to those conditions when no morethan one RCS loop is isolated from the reactor vessel. When two or more ioops are isolated, ColdOverpressure Protection must be provided by either the two RHR suction relief valves or adepressurized and vented RCS,The reactor vessel material is less tough at low temperatures than at normal operatingtemperature. As the vessel neutron exposure accumulates, the material toughness decreases andbecomes less resistant to stress at low temperatures (Ref. 3). RCS pressure, therefore, ismaintained low at low temperatures and is increased only as temperature is increased.The potential for vessel overpressurization is most acute when the RCS is water solid, occurringwhile shutdown; a pressure fluctuation can occur more quickly than an operator can react torelieve the condition. Exceeding the RCS P/T limits by a significant amount could causenonductile cracking of the reactor vessel. LCO 3.4.9.1, "Pressure/Temperature Limits -ReactorCoolant System,'"requires administrative control of RCS pressure and temperature during heatupand cooldown to prevent exceeding the limits providedin Figures 3.4-2 and 3.4-3.This LCO provides RCS overpressure protection by limiting mass input capability and requiringadequate pressure relief: capacity. Limiting mass input capability requires all Safety InjectionO ~ (illI) pumps and all but one centrifugal charging pump to be incapable of injection into the RCS.W The pressure relief capacity requires either two redundant relief valves or .a depressurized RCSand an RCS vent of sufficient size. One relief valve or the open RCS vent is the overpressureprotection device that acts to terminate an increas~ing presswr~e event..With minimum mass input capability, the ability to p rovi'de core coolant addition is restricted.The LCO does not require the makeup control system deactivated or the safety injection (SI)actuation circuits blocked. Due to the lower pressures in the Cold Overpressure Protection modesand the expected core decay heat levels, the makeup system can provide adequate flow via themakeup control valve.If a loss of RCS inventory or reduction in SHUTDOWN MARGIN event occurs, the appropriateresponse will be to correctthe situation by starting RCS makeup pumps. If the loss of inventory or-SHUTDOWN MARGIN is significant, this may necessitate the use of additional RCS makeuppumps that are being maintained not capable of injecting into the RCS in accordance withTechnical Specification 3.4.9.3. The use of these additional pumps to restore RCS inventory orSHUTDOWN MARGIN will require entry into the associated ACTION statement. The ACTION* Istatement requires immediate action to comply with the specification. The restoration of RCSinventory or SHUTDOWN MARGIN canbe considered to be part of the immediate action to-restore the additional RCS makeup pumps to a not capable of injecting status. While recoveringRCS inventory or SHUTDOWN MARGIN, RCS pressure will be maintained below the P/Tlimits. After RCS inventory or SHUTDOWN MARGIN has been restored, the additional pumpsshould be immediately made not capable of injecting and the ACTION statement exited.O MILLSTONE -UNIT 3 B 3/4 4-16 Amendment No. 4-&, 88 3-8, 4-5-7, Acknowledged by NRC letter dated 08/25/05 August 27, 2001REACTOR COOLANT SYSTEMBASESOVERPRES SURE PROTECTION SYSTEMS (continued)PORV RequirementsAs designed, the PORV Cold Overpressure Protection (COPPS) is *signaled to open if the RCSpressure approaches a limit determined by the COPPS actuation logic..The COPPS actuationlogic monitors both RCS temperature and RCS pressure and determines when the nominalsetpoint of Figure 3.4-4a or Figure 3.4-4b is approached. The wide range RCS temperatureindications are auctioneered to select the lowest temperature signal.The lowest temperature signal is processed through a function generator that calculates a pressuresetpoint for that temperature. The calculated pressure setpoint is then compared with RCSpressure measured by a wide range pressure channel. If the measured pressure meets or exceedsthe calculated value, a PORV is Signaled to open.The use of the PORVs is restricted to three and four RCS loops unisolated: for a loop to beconsidered isolated, both RCS loop stop valves must be closed. If more than one loop is isolated,then the PORVs must have their block valves closed or COPPS must be blocked. For these cases,Cold Overpressure Protection must be provided by either the two RHR suction relief valves or adepressurized RCS and an RCS vent. This is necessary because the PORV mass and heat injectiontransients have only been analyzed for a maximum of one loop isolated, the use of the PORVs is irestricted to three and four RCS loops unisolated. WThe RHR suction relief valves have been qualified for all mass. injection transients for. anycombination of isolated loops. In addition, the heat injection transients not..prohibited by theTechnical"Sp~ecificationis have also b~een' the alilifi~ationi of the RHR s~Ictibr reliefvalves.Figure 3.4-4a and Figure 3.4-4b present the PORY setpoints for COPPS. The setpoints are.staggered so only one valve opens during a low temperature overpressure transient. Setting bothvalves to the values of Figure 3.4-4a and Figure 3.4-4b within the tolerance allowed for thecalibration accuracy, ensures that the isothermal P/T limits will not be exceeded for the analyzed [isothermal events.When a PORV is opened, the release of coolant will cause the pressure increase to slow andreverse; As the PORV releases coolant, the RCS press~ure decreases until a reset pressure isreached and the valve is signaled to close. Thie pressure continues to decrease below the resetpressure as the valve closes.MILLSTONE -UNIT 3B 3/4 4-16aMILLTON -UIT B 34 416aAmendment No. 48, 88, 4-57, 197 August 27, 2001REACTOR COOLANT SYSTEMBASESOVERPRES SURE PROTECTION SYSTEMSRIIR Suction Relief Valve RequirementsThe isolation valves between the RCS and the RIIR suction relief valves must be open to make*the RIIR.suction relief valves OPERABLE for RCS overpressure mitigation. The RHRsuctionvalves are spring loaded, bellows type water relief valves with setpoint tolerances andaccumulation limits established by Section III of the American Society of Mechanical Engineers(AS ME) Code (Ref. 4) for Class 2 relief valves.When the RHR system is operated for decay heat removal or low pressure letdown control, the.isolation valves between the RCS and the RHR suction relief valves are open, and the RHR_suct~ion relief valves are exposed to the RCS and are able to relieve pressure transients in the RCS.RCS Vent RequirementsOnce the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the'RCS at acceptable pressure levels in an RCS overpressure transient, if the relieving requirementsof the transient do not exceed the capabilities of the vent. *Thus, the vent path must be capable Qfrelieving the flow resulting from the limiting mass or heat input transient, and maintaining .pressure below the P/T limits for the analyzed isothermal events.For an RCS vent to meet the flow capacity requirement, it requires removing a Pressurizer safetyvalve, removing a Pressurizer manway, or similarly establishing a vent by opening* an RCS ventvalve provided that the opening meets the relieving capacity requirements. The vent path must beabove the level of reactor coolant, so as not to drain t/he RCS wheri open.MILLSTONE -UNIT 3B 3/4 4-17MILLTONE- UNT 3 3/4-17Amendment No. 1-5-7, 197 LBDCR No. 04-MP3-015February 24, 2005REACTOR COOLANT SYSTEMBASES iOVERPRES SURE PROTECTION SYSTEMS (continued)APPLICABLE SAFETY ANALYSISSafety analyses (Ref. 5) demonstrate that the reactor yessel is adequately protected againstexceeding the PIT limits for the analyzed isothermal events. In MODES 1, 2, AND3, and inMODE 4, with RCS cold leg temperature exceeding 2260F, the pressurizer safety valves willprovide RCS overpressure protection in the ductile region. At.2260F and below, overpressureprevention is provided by two means: (1) two OPERABLE relief valves, or (2) a depressurizedRCS with a sufficiently sized RCS vent, consistent with ASMIE Section XI, Appendix G fortemperatures less than RTNDT +/- 50OF. Each oftlhese means has a limuited overpressure reliefcapability.The required RCS temperature for a given pressure increases as the reactor vessel materialtoughness decreases due to neutron embrittlement. Each time the Technical. Specification curvesare revised, the cold overpressure protection must be re-evaluated to ensure its functionalrequirements continue to be met using the RCS relief valve method or the depressurized andvented RCS condition.Transients capable of overpressurizing the RCS are categorized as either mass or heat inputtransients, examples of which follow:Mass Input Transientsa. Inadvertent safety injection; orb. Charging/letdown flow mismatchHeat Input Transientsa. Inadvertent actuation of Pressurizer heaters;b. Loss of RHIR cooling; orc. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCSor between the RCS and steam generators.The Technical Specifications ensure that mass input transients beyond the OPERABILITY of thecold overpressure protection means do not occur by rendering all Safety Injection Pumps and all*but one centrifugal charging pump incapable of injecting into the RCS whenever an RCS cold legis _2260F.The Technical Specifications ensure that energy addition transients beyond the OPERABILITYof the cold overpressure protection means do not occur by limiting reactor coolant pump starts.LCO 3.4.1.4.1, "Reactor Coolant Loops and Coolant Circulation -COLD SHUTDOWN -LoopsFilled," LCO 3.4.1.4.2, "Reactor CoolantMILLSTONE -UNIT 3 B 3/4 4-18 Amendment No. 1-5-7, I-9-7,Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015February 24, 2005REACTOR COOLANT SYSTEMBA.SESOVERPRESSURE PROTECTION SYSTEMS (continued)Loops and Coolant Circulatio~n -COLD SHUTDOWN -Loops Not Filled," and LCO 3.4.1.3,""'Reactor Coolant Loops and Coolant Circulation -HOT SHUTDOWN" limit starting the firstreactor coolant pump such that it shall not be started when any RCS loop wide range cold legtemperature is 226°F unless the secondary side water temperature of each steam generator is< 50°F above each RCS cold leg temperature. The restrictions ensure the potential energyaddition to the RCS from the secondary side of the steam generators will not result in an RCSoverpressurization event beyond the capability of the COPPS to mitigate. The COPPS utilizes thepressurizer PORVs and the RHR relief valves to. mitigate th~e limiting mass .and en~ergy additionevents, thereby protecting the isothermal reactor vessel b.eltline P/T limits. The restrictions w~illensure the reactor vessel. wili~be protected from a. cold .oyerpress~ure event whenlstartinag the firstRCP. If at least, one RCP is operating, no restrictions are necessary to start additional RCPs for'reactor vessel protection. In addition, this restriction only applies to RCS loops and associatedcomponents that are. not isolated from the reactor vessel.The RCP starting criteria are based on the equipment used to provide cold overpressureprotection. A maximum temperature differential of 50°F between the steam generator secondarysides and RCS cold legs will limit the potential energy addition to within the capability of the*pressurizer PORVs to mitigate the transient. The RHR relief valve are also adequate to mitigateenergy addition transients constrained by this temperature differential limit, provided all RCScold leg temperature are at or below 150°F. The ability of the RUR relief valves to mitigate.energ~y cold leg ,temperature is .above,.,500F has not analyzed.As a result, the temperature of the steam-generator secondary sides must 'be at or below the RCScold leg temperature if the RHR relief valves are providing cold overpressure protection and theRCS cold leg temperature is above 150OT.! MILLSTONE -UNIT 3 B 3/4 4-19 Amendment No. t4-7, -l-9-?,Acknowledged by NRC letter dated 08/25/05 August 27, 2001REACTOR COOLANT SYSTEMBASESOVERPRESSURE PROTECTION SYSTEMS (continued)The cold overpres sure transient analyses demonstrate that either one relief valve or thedepressurized RCS and RCS vent can maintain RCS pressure below limits when RCS letdown isisolated and only one centrifugal charging pump is operating. Thus, the LCO allows only onecentrifugal charging pump capable of injecting when cold overpressure protection is required:The cold overpressure protection enabling temperature is conservatively established at a value.< 226°F based on the *criteria provided by ASME Section XI, Appendix G.PORV PerformanceThe analyses show that the vessel is protected against non-ductile failure When the PORVs are setto open at the values shown in Figures 3.4-4a and 3.4-4b within the tolerance allowed for thecalibration accuracy. The curves are derived by analyses for both three and four RCS loopsunisolated that model the performance of the PORV cold overpressure protection system(COPPS), assuming the limiting mass and heat transients of one centrifugal charging pumpinjecting into the RCS, or the energy addition as a result of starting an RCP with temperatureasymmetry between the RCS and the steam generators. These analyses consider pressureovershoot beyond the PORV opening setpoint resulting from signal processing and valve stroke*times.The PORV setpoints in Figures 3.4-4a and 3.4-4b will be updated when the P/T limits conflict*with the cold overpressure analysis limits. The P/T limits are periodically modified as the reactorvessel material toughness decreases due to neutron embrittlement. Revised limits are determinedusing neutron fluence projections and the results of testing of the reactor vessel materialirradiation-survei~ltancee-speeimens. The .Baseso~for ,LCO -3.49-l,. "P..ressure/Temperature Limits -Reactor Coolant System (Except the Pressurizer)," dismiss these, e-valuations.The PORVs are considered active components. Thus, the failure of one PORV is assumed torepresent the worst case, single active failure.RHR Suction Relief Valve PerformanceThe RIIR suction relief valves do not have variable pressure and temperature lift s etpoints as dothe PORVs. Analyses show that one RHIR suction relief valve with a setpoint at or between426.8 psig and 453.2 psig will pass flow greater than that required for the limiting coldoverpressure transient while maintaining RCS pressure less than the isothermal P/T limit curve.Assuming maximum relief flow requirements during the limiting cold overpressure. event, anRHR suction relief valve will maintain RCS pressure to _< 110% of the nominal lift setpoint.Although each RHR suction relief valve is a passive spring loaded device, which meets singlefailure criteria, its location within the RHR System precludes meeting single failure criteria whenspurious RHR suction isolation valve or RIIR suction valve closure is postulated. Thus the los~s ofan RHR suction reliefMILLSTONE -UNIT 3B 3/4 4-20MILLTON -NIT3 B3/4-20Amendment No. I1-5g, 197 REACTOR COOLANT SYSTEM AUgust 27, 2001BASESOVFRPRESSURE PROTECTION SYSTEMS (conti~nued)valve is the worst case single failure. Also, as the RCS P/T limits are revisedto reflect change in toughness in the reactor vessel materials, the RHR suction.rel~ief valve's analyses must be re-evaluated to ensure continued accommodationof-:the design bases cold overpressure transients.RCS vent PerformanceWith the RCS depressurized, analyses show a vent size of > 2.0 square inches iscapable of mitigating the limiting cold overpressure transient. The capacitfofthis vent size is greater .than the flow of the limiting transient, whilemaintaining RCS pressure less than the maximum pressure on the isothermal P/Tlimit curve.The RCS vent size will be re-evaluated for compliance each time the isothermalP/I limit curves are revised.The RCS vent is a passive device and is not subject to active failure.The RCS vent satisfies Criterion 2 of 1OCFR50.36(c)(2)(ii).MILLSTONE- UNIT 3:B 3/4 4-21MILL TON -UIT .B /4 -21Amendment No. 197 REACTOR COOLANT SYSTEM August 27, 2001BASESOVERPRESSURE PROTECTION SYSTEMS (continued)LCOThis LCO requires that cold overpressure protection be OPERABLE and the maximummass input be limited to one charging pump. Failure to meet this LCO could leadto the loss of low temperature overpressure mitigation and violation of thereactor vessel isothermal P/T limits as a result of an operational transient.To limit the mass input capability, the LCO requires a maximum of one centrifugalcharging pump capable of injecting into the RCS.The elements of the LCO that provides low temperature overpressure mitigationthrough pressure relief are:I. Two OPERABLE PORVs; orA PORV is OPERABLE for cold overpressure protection when its block valve is*open, its lift setpoint is set to the nominal- setpoints provided for boththree and four loops unisolated by Figure 3.4-4a or 3.4-4b and when thesurveillance requirements are met.2. Two OPERABLE RHR suction relief valves; orAn RH-R suction relief valve is OPERABLE for cold overpressure protectionwhen its isolation valves from the RCS are open and when its setpoint is ator between 426.8 psig and 453.2 psig, as verified by required testing.3. One OPERABLE PORV and one OPERABLE RHR suction relief valve; or4. A depressurized RCS and an RCS vent.An RCS vent is OPERABLE when open with an area of > 2.0 square inches.Each of these methods of ovepressure prevention is Capable of mitigating thelimiting cold overpressure transient.MILLSTONE -UNIT 3B 3/4 4-Z2MILLTON -NIT B /4 -22Amendment No. 197 LBD CR No. 04-MP3-015February 24, 2005REACTOR COOLANT SYSTEMBASESOVERPRESSURE PROTECTION SYSTEMS (continued)APPLICABILITYThis LCO is applicable in MODE 4 when any RCS cold leg temperature is < 226°F, in MODE 5,and in MODE 6 when the head is on the reactor vessel. The Pressurizer safety valves provideRCS ovelrpressure protection in the ductile region (i.e. > 226°F). When the reactor head is off,overpressurization cannot occur.LCO 3.4.9.1 "Pressure/Temperature Limits" provides the operational P/T limits for all MODES.LCO 3.4.2, "Safety Valves," requires the OPERABILITY of the Pressurizer safety valves thatprovide overpressure protection during MODES 1, 2, and 3, and 4 when all RCS cold legtemperatures are > 226°F.Low temperature overpressure prevention is most critical during shutdown when the RCS is watersolid, and a mass or heat input transient can cause a rapid increase in RCS pressure when little orno time exists for operator action to mitigate the event.ACTIONSa. and b.With two or more centrifugal charging pumps capable of injecting into the RCS, or with any SIHpump capable of injecting into the RCS, RCS over~pressurization is possible.To immediately initiate action to restore restricted massinput capability to the Rcs reflects theurgency of removing the RCS from this condition.Required ACTION a. is modified by a Note that permits two centrifugal charging pumps capableof RCS injection for < 1 hour to allow for pump swaps. This is a controlled evolution of shortduration and the procedure prevents having two charging pumps simultaneously out of pull-to-lock while both charging pumps are capable of injecting into the RCS.c.In MODE 4 when any RCS cold leg temperature is < 226°F, with one required relief valveinoperable, the RCS relief valve must be restored to OPERABLE status within an allowed outagetime (AOT) of 7 days. Two relief valves in any combination of the PORVs and the RHR suctionrelief valves are requi'ed to provide low temperature overpressure mitigation while withstandinga single failure of an active component.MILLSTONE -UNIT 3 B 3/4 4-23 Amendmen~t No. 9-7,Acknowledged by NRC letter dated 0 8/25/05 LBDCR 12-MP3-010September 20, 2012REACTOR COOLANT SYSTEMBASESOVERPRES SURE PROTECTION SYSTEMS (continued')The AOT in MODE 4 considers the facts that only one of the relief valves is required to mitigatean overpressure transient and that the likelihood of an active failure of the remaining valve pathduring this time period is very low. The RCS must be depressurized and a vent must beestablished within the following 12 hours if the required relief valve is not restored toOPERABLE within the required AOT of 7 days.d.The consequences of operational events that will overpressure the RCS are more severe at lowertemperatures (Ref. 8). Thus, with one of the two required relief valves inoperable in MODE 5 orin MODE 6 with the head on, the AOT to restore two valves to OPERABLE status is 24 hours.The AOT represents a reasonable time to investigate and repair several types of relief valvefailures without exposure to a lengthy period with only one OPERABLE relief valve to protectagainst events. The RCS must be depressurized and a vent must be establishedwithin the following 12 hours if the required relief valve is not restored to OPERABLE within therequired AOT of 24 hours.e.The RCS must be depressurized and a vent must be established within 12 hours when bothrequired Cold Overpressure Protection relief valves are inoperable.The vent must be sized >_ 2.0 square inches to ensure that the flow capacity is greater than thatrequired for the worst case cold overpressure transient reasonable during the applicable MODES.This action is needed to protect the RCPB from a low temperature overpressureevent and apossible non-ductile failure of the reactor vessel.The time required to place the plant in this Condition is based on the relatively low probability ofan overpressure event during this time period due to increased operator awareness ofadministrative control requirements.SURVEILLANCE REQUIREMENTS4.4.9.3.1Performance of an ANALOG CHANNEL OPERATIONAL TEST is required within 31 daysprior to entering a condition in which the P0KV is required to be OPERABLE and at the[frequency specified in the Surveillance Frequency Control Program thereafter on each requiredPORV to verify and, as necessary, adjust its lift setpoint. The ANALOG CHANNELOPERATIONAL TEST will verify the setpoint in accordance with the nominal values given inFigures 3.4-4a and 3.4-4b. P0RV actuation could depressurize the RCS; therefore, valveoperation is not required.MILLSTONE -UNIT 3B 3/4 4-24MILLTONE- UNT 3 3/44-24Amendment No. 4-l-57-,4-97 LBDCR 12-MiP3-010September 20, 2012REACTOR COOLANT SYSTEMBASESOVERPRES SURE PROTECTION SYSTEMS (continued)Performance of a CHANNEL CALIBRATION on each required PORV actuation channel isrequired periodically to adjust the channel so that it responds and the valve opens within therequired range and accuracy to a known input. The surveillance frequency is controlled under theSurveillance Frequency Control Program.The PORV block valve must be verified open and COPPS must be verified anned periodically toprovide a flow path and a cold overpressure protection actuation circuit for each required PORVto perform its function when required. The valve is remotely verified open in the main controlroom. This Surveillance is perfonned if credit is being taken for the PORV to satisfy the LCO.The block valve is a remotely controlled, motor operated valve. The power to the valve operator isnot required to be removed, and the manual operator is not required to be locked in the openposition. Thus, the block valve can be closed in the event the PORV develops excessive leakageor does not close (sticks open) after relieving an overpressure transient.The surveillance frequency is controlled under the Surveillance Frequency Control Program.4.4.9.3.2Each required RH-R suction relief valve shall be demonstrated OPERABLE by verifying the .RHRsuction valves, 3R1IS*MV8701A and 3 RHS*M8701 C, are open when suction r.elief valve3PJHS*RV8708A is being used to meet the LCO and by verify"ing theRiHR suction valves,3RHS*MVT8702B and 3RHIS*MV\8702C, are open when suction relief valve 3RHS*RV8708B isbeing used to meet the LCO. Each required RHIR suction relief valve shall also be demonstratedOPERABLE by testing it in accordance with 4.0.5. This Surveillance is only required to beperformed if the RUR suction relief valve is being used to meet this LCO.The RHR suction valves are periodically verified to be open. The surveillance frequency iscontrolled under the Surveillance Frequency Control Program.The ASME Code for Operation and Maintenance of Nuclear Power Plants, (Reference 9), test per4.0.5 verifies OPERABILITY by proving proper relief valve mechanical motion and bymeasuring and, if re~quired, adjusting the lift setpoint.MILLSTONE -UNIT 3B 3/4 4-25MILLSONE -UNIT B 3/4-25Amendment No. 5, -I-97-, 2. LBDCR 12-MP3-010September 20, 2012REACTOR COOLANT SYSTEMdBASESOVERPRESSUJRE PROTECTION SYSTEMS (continued)4.4.9.3.3The RCS vent of> 2.0 square inches is proven OPERABLE periodically by verifying its opencondition. A removed Pressurizer safety valve fits this category.This passive vent arrangement must only be open to be OPERABLE. This Surveillance isrequired to be performed if the. vent is being used to satisfy the pressure relief requirements of theLCO. The surveillance frequency is controlled under the Suareillance Frequency ControlProgram.4.4.9.3.4 and 4.4.9.3.5To minimize the potential for a low temperature overpressure event by limiting the mass inputcapability, all SIHl pumps and all but one centrifugal charging pump are verified incapable ofinjecting into the RCS.The SIll pumps and charging pumps are rendered incapable of injecting into the RCS throughremoving the power from the pumps by racking the breakers out under administrative control.Alternate methods of control may be employed using at least two independent means to preventan injection into the RCS. This may be accomplished thr'ough any of the following methods:1) placing the pump in pull to lock (PTL) and pulling its UJC fuses, 2) placing the pump in pull tolock (PTL) and closing the pump discharge valve(s) to the injection line, 3) closing the discharge valve(s) to the injection line and either removing power from the valve operator(s) orlocking manual valves closed, and 4) closing the valve(s) from th~e injection source and eitherremoving power fr'om the valve operator(s) or locking manual valves closed.An SIN- pump may be energized for testing or for filling* teAcmulators provided it is incapableof injecting inato the RCS.The surveillance frequency is controlled under the Surveillance Frequency Control Program.REFERENCES1. ASME Boiler and Pressure Vessel Code, Section XI, Appendix G-, "FractureToughness for Protection Against Failure," 1995 Edition.2. ASME Section XI, Code Case N-640, "Alternative Reference Fracture Toughnessfor Development of P-T Lim~it Curves," dated February 26, 1999.3. Generic Letter 88-114. ASMiE, Boiler and Pressure Vessel Code, Section III5. FSAR, Chapter 156. lOCFR50, Section 50.467. 10CFR50, Appendix K8. Generic Letter 90-069. ASME Code for Operation and Maintenance of Nuclear Power PlantsMILLSTONE -UNIT 3 B 3/4 4-26 Amendmnent No. 1-5-7-, 4- 0 , May 8, 2002This page intentionally left blankMILLSTONE -UNIT 3B 3/4 4-27 Amendment No. X7204 REVERSE OF PAGE B 3/4-4-27INTENTIONALLY LEFT BLANK LBDCR 05-MP3-025March 7, 20063/4.5 EMERGENCY CORE COOLING SYSTEMSBASES3/4.5.1 ACCUMULATORSThe OPERABILITY of each Reactor Coolant System (RCS) accumulator ensures that a sufficientvolume of borated water will be immnediately forced into the reactor core through each of the coldlegs in the event the RCS pressure falls below the pressure of the accumulators. This initial surgeof water into the core provides the initial cooling mechanism during large RCS pipe ruptures.The limits on accumulator volume, boron concentration and pressure ensure that the assumptionsused for accumulator injection in the safety analysis are met.The accumulator power operated isolation valves are required to meet the guidance of "operatingbypasses" in the context of IEEE Std. 279-1971, which requires that bypasses of a protectivefunction be removed automatically whenever permissive conditions are not met. The "operatingbypass" designed for the isolation valves is applicable to MODES 1, 2, and 3 with Pressurizerpressure above P-Il1 setpoint. In addition, as these accumulator isolation valves fail to meetsingle failure criteria, removal of power to the valves is required.The limits for operation with an accumulator inoperable for any reason except an isolation valveclosed minimizes the time exposure of the plant to a LOCA event occurring concurrent withfailure of an additional accumulator which may result in unacceptable peak claddingtemperatures. If a closed isolation valve cannot be immediately opened, the full capability of oneaccumulator is not available and prompt action is required to place the reactor in a mode wherethis capability is not required.3/4.5.2 AND 3/4.5.3 ECCS SUBSYSTEMSThe OPERABILITY of two independent ECCS subsystems ensures that sufficient emergencycore cooling capability will be available in the event of a LOCA assuming the loss of onesubsystem through any single failure consideration. Either subsystem operating in conjunctionwith the accumulators is capable of supplying sufficient core cooling to limit the peak claddingtemperatures within acceptable limits for all postulated break sizes ranging from the double endedbreak of the largest RCS cold leg pipe downward. In addition, each ECCS subsystem provideslong-term core cooling capability in the re-circulation mode during the accident recovery period.With the RCS temperature below 350°F, one OPERABLE ECCS subsystem is acceptable withoutsingle failure consideration and with some valves out of normal injection lineup, on the basis ofthe stable reactivity condition of the reactor and the limited core cooling requirements.The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System isrequired to be available to support charging pump operation. The Charging Pump/Reactor PlantComponent Cooling Water Pump Ventilation System consists of two redundant trains, eachcapable of providing 100% of the required flow. Each train has a two position, "Off" and "Auto,"remote control switch. With the remote control switches for each train in the "Auto" position, thesystem is capable of automatically transferring operation to the redundant train in the event of alow flow condition in the operating train. The associated fans do not receive any safety relatedautomatic start signals (e.g., Safety Injection Signal).MILLSTONE -UNIT 3B3/5-AmnetNo -,B 3/4 5-1Amendment No. :t-5-7, LBDCR No. 05-MP3-025March 7, 2006EMERGENCY CORE COOLING SYSTEMSBASES "OECCS SUBSYSTEMS (Continued)Placing the remote control switch for a Charging Pump/Reactor Plant Component Cooling WaterPump Ventilation Train in the "Off' position to start the redundant train or" to per~form postmaintenance testing to verify availability of the redundant train will not affect the availability ofthat train, provided appropriate administrative controls have been established to ensure the remotecontrol switch is immediately returned to the "Auto" position after the completion of the specifiedactivities or in response to plant conditions. These administrative controls include the use of anapproved procedure and a designated individual at the control switch for the respective ChargingPump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respondto instructions from procedures, or control room personnel, based on plant conditions.The Surveillance Requirements provided to ensure OPERABILITY of each component ensuresthat at a minimum, the assumptions used in the safety analyses are met and that subsystemOPERABILITY is maintained. Surveillance Requirements for throttle valve position stopsprovide assurance that proper ECCS flows will be maintained in the event of a LOCA.Maintenance of proper flow resistance and pressure drop in the piping system to each injectionpoint is necessary to: (1) prevent total pump flow from exceeding runout conditions when thesystem is in its minimum resistance configuration, (2) provide the proper flow split betweeninjection points in accordance with the assumptions used in the ECCS-LOCA analyses, and :B.(3) provide an acceptable level of total ECCS flow to all injection points equal to or above that.assumed in the ECCS-LOCA analyses.Any time the OPERABILITY of an ECCS throttle valve or an ECCS Subsystem has been affectedby repair, maintenance, modification, or replacement activity that alter flow characteristics, postmaintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY.Surveillance Requirement 4.5.2.b.l1 requires verifying that the ECCS piping is full of water. TheECCS pumps are normally in a standby, nonoperating mode, with the exception of the operatingcentrifugal charging pump(s). As such, the ECCS flow path piping has the potential to developvoids and pockets of entrained gases. Maintaining the piping from the ECCS pumps to the RCSfull of water ensures that the system will perform properly when required to inject into the RCS.This will also prevent water hammer, degraded performance, cavitation, and gas binding of ECCSpumps, and reduce to the greatest extent practical the pumping of non-condensible gases (e.g., air,nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling.This Surveillance Requirement is met by:*VENTING the ECCS pump casings and VENTING or Ultrasonic Test (UT) of theaccessible suction and discharge piping high points including the ECCS pump suctioncrossover piping (i.e., downstream of valves 3RSS*MV8837A/B and3RSS*MV8838A/B to safety injection and charging pump suction). VENTING of the ,MILLSTONE -UNIT 3B 3/4 5-2MILSTOE -UNI 3 3/5-2Amendment No. 4-00, 4-4-7, -l--5-7, LBDCR No. 05-MP3-004April 21, 2005EMERGENCY COPE COOLING SYSTEMS.BASESECCS SUBSYSTEMS (Continued)accessible suction and discharge piping high points including the ECCS pump suctioncrossover piping is required when gas accumulations exceed the gas accumulationlimits. NOTE: Certain maintenance (e.g. ECCS pump overhaul) or other evolutions*can cause gas or air to enter the EGGS. VENTING of the affected portion of theECCS is necessary for these evolutions.*VENTING of the nonoperating centrifugal charging pumps at the suction line testconnection. The nonoperating centrifugal charging pumps do not have casing ventconnections and VENTING the suction pipe will assure that the pump casing does notvoids and pockets of entrained gases.*using ant external water level detection method for the water filled portions of the RSSpiping upstream of valves 3RSS*MV8837AJB and 3RSS*MV8838AJB. Whendeemed necessary by an external water level detection method, filling and venting toreestablish the acceptable water levels may be performed after entering LCO.ACTION statement 3.6.2.2 since VENTING without isolation of the affected trainwould result in a breach of the containment pressure boundary.The following ECCS subsections are exempt from this Surveillance:* the operating centrifugal charging pump(s) and associated piping -as an operatingpump is self VENTING and cannot develop voids and pockets of entrained gases.* the RSS pumps, since this equipment is partially dewatered during plant operation.Each RS S pump is equipped with a pump casing vent line that allows automaticVENTING of the pump casing prior to pump operation following an accident.I* the RSS heat exchangers, since this equipment is laid-up dry during plant operation.Gas is flushed out of the heat exchangers during the initial operation of the RS Spumps following an accident.* the RSS piping that is not maintained filled with water during plant operation. Theconfiguration of this piping is such that it is self VENTING upon initial operation ofthe RSS pumps.*the ECCS discharge piping within containment. These piping sections areinaccessible during reactor operations due to accessibility (containment entry), safety,and radiological concerns. They are static sections of piping relatively insensitive to* gas accumulations since these lines are stagnant during normal power operation. TheECCS discharge piping inside containment is filled and vented upon system return toservice.* the Residual Heat Removal (RI-R) heat exchangers. These are dual pass, verticalu-tube heat exchangers that do not allow direct measurement of gas voids. SystemMILLSTONE -UNIT 3 B 3/4 5-2a Amendment No. 4-1-@, 5-7,Acknowledged by NRC Letter dated 04/12/06 LBDCR 12-MIP3-O00September 20, 2012EMERGENCY CORE COOLING SYSTEMS ,l0BASESECCS SUB SYSTEMS (Continued)flush upon heat exchanger return to service and procedural compliance is relied upon toensure that gas is not present within the heat exchanger u-tubes.Surveillance Requirement 4.5 .2.C.2 requires that the visual inspection of the containment heperformed at least once daily iffthe contaimnent has been entered that day and when the finalcontainment entry is made. This will reduce the number of unnecessary inspections and also reducepersonnel exposure.Surveillance Requirement 4.5.2.d.2 addresses periodic inspection of the containment sump toensure that it is unrestricted and stays in proper operating condition. The surveillance fr'equency iscontrolled under the Surveillance Frequency Control Program.The Emergency Core Cooling System (ECCS) has several piping cross connection points foruse during the post-LOCA recirculation phase of operation. These cross-connection points allow theRecirculation Spray System (RSS) to supply water from the containment sump to the safety injectionand charging pumps. The RSS has the capability to supply both Train A and B safety injectionpumps and both Train A and B charging pumps. Operator action is required to position valves toestablish flow fr'om the containment sump through the RSS subsystems to the safety injection andcharging pumps since the valves are not automatically repositioned. The quarterly stroke testing(Technical Specification 4.0.5) of the ECC/RSS recirculation flowpath valves discussed below willnot result in subsystem inoperability (except due to other equipment manipulations to support valvetesting) since these valves are manually aligned in accordance with the Emnergency OperatingProcedures (EOPs) to establish the recirculation flowpaths. It is expected the valves will be returnedto the normal pre-test position following termination of the surveillance testing in response to the 9accident. Failure to restore any valve to the normal pre-test position will be indicated to the ControlRoom Operators when the ESF status panels are checked, as directed by the EOPs. The EOPs directthe Control Room Operators to check the ESF status panels early in the event to ensure properequipment alignment. Sufficient time before the recirculation flowpath is required is expected to beavailable for operator action to position any valves that have not been restored to the pretest position,including local manual valve operation. Even if the valves are not restored to the pre-test position,sufficient capability will remain to meet ECCS post-LOCA recirculationi requirements. As a result,stroke testing of the ECCS recirculation valves discussed below will not result in a loss of systemindependence or redundancy, and both ECCS subsystems will remain OPERABLE.When performing the quarterly stroke test of 3 SIH*MV8923A, the control switch for safetyinjection pump 3SIH*PIA is placed in the pull-to-lock position to prevent an automatic pump staitwith the suction valve closed. With the control switch for 3 SIH*PIA in pull-to-lock, the Train AECCS subsystem is inoperable and Technical Specification 3.5.2, ACTION a., applies. ThisACTION statement is sufficient to administratively contr'ol the plant configuration with theautomatic start of 3S1H*P1A defeated to allow stroke testing of 3SIH*MV8923A. In addition, theEOPs and the ESF status panels will identify this abnormal plant configuration, if not correctedfollowing the termination of the surveillance testing, to the plant operators to allow restoration of thenormal post-LOCA recirculation flowpath. Even if system restoration is not accomplished, sufficientequipment will be available to perfonn all ECCS and RSS injection and recirculation functions,provided no additional ECCS or RSS equipment is inoperable, and an additional single failure doesnot occur (an acceptable assumption since the Technical Specification ACTION statement limits theplant configuration time such that no additional equipment failure need be postulated). During theinjection phase the redundant subsystem (Train B) is fully functional, as is a significant portion ofthe Train A subsystem. During the recirculation phase, the Train A RSS subsystem can supply waterfrom the containment sumnp to the Train AMILLSTONE -UNIT 3B 3/4 5-2bMILLTON -NIT B 14 -2bAmendment No. -!00, 4-!4-, 4-5 LBDCR No. 05-MP3-004April 21, 2005EMERGENCY CORE COOLING SYSTEMvSBASESand B charging pumps, and the Train B RSS subsystem can supply water from the containmaentsump to the B safety injection pump.When performing the quarterly stroke test of 3 SIH*MV8923B, the control switch forsafety injection pump 3SIH*'PlB is placed in the pull-to-lock position to prevent an automaticpump start with the suction valve closed. With the control switch for 3SIW*P1B in pull-to-lock,the Train B ECCS subsystem is inoperable and Technical Specification 3.5.2, ACTION a.,applies. This ACTION statement is sufficient to administratively control the plant configurationwith the automatic start of 3SIH*PlB defeated to allow stroke testing of 3 SIH*VMV8923B. Inaddition, the EOPs and the ESE status panels will identify this abnormal plant configuration, ifnot corrected following the termination of the surveillance testing, to the plant operators to allowrestoration of the normal po st-LOCA recirculation flowpath. Even if system restoration is notaccomplished, sufficient equipment will be available to perform all ECCS and RSS injection andrecirculation functions, provided no additional ECCS or RSS equipment is inoperable, and anadditional single failure does not occur (an acceptable assumption since the TechnicalSpecification ACTION statement limits the plant configuration time such that no additionalequipment failure need be postulated). During the injection phase the redundant subsystem(Train-A) is fully functional, as is a significant portion of the Train B subsystem. During therecirculation phase, the Train A RSS subsystem can supply water from the containment sump tothe Train A and B charging pumps and the Train A safety injection pump. The Train B RSSsubsystem cannot supply water from the containment sump to any of the remaining pumps.When performing the quarterly stroke test of 3SIH*MV8807A or 3SIH*MV8807B,3 SIH*IMV8924 is closed first to prevent the potential injection of RWST water into the RCSthrough the operating charging pump. When 3S1H*MV8924 is closed, it is not necessary todeclare either ECCS subsystem inoperable..Although expected to be open for post-LOCArecirculation, sufficient time is expected to be available post-LOCA to identify and open31H*IV1-V8924 either from thle Control Room or locally at valve. The EOPs and the ESF statuspanels will identify this abnormal planlt configuration, if not corrected following the terminationof thle surveillance testing, to the plant operators to allow restoration of the normal po st-LOCArecirculation flowpath. Even if system restoration is not accoimplished, sufficient equipment willbe available to perform all ECCS and RSS binjection and recirculation functions, provided noadditional ECCS or RSS equipment is inoperable, eyen if a single failure is postulated. The failureto open 3SIH*'MV8924 due to mechanical binding or the loss of power to ECCS Train A could bethe single failure. If a different single failure is postulated, restoration of 3SIH'*MV8924 can beaccomplished. The closure of 3SIH*MV8924 has no affect on the injection phase. During therecirculation phase, assuming 3SIH*MI\V8924 remains closed (i.e., the single failure), the Train ARSS subsystem can supply water from the containmaent sump to the Train A and B chargingpumps, and the Train B RSS subsystem can supply water from the containment sump to the TrainA and B safety injection pumps. If power is lost to ECCS Train A and 3SIH*MV8924 is notopened locally (i.e., the single failure), cold leg recirculation can be accomplished by using RSSTrain B to supply containment sump water via 3SIW*PIB to the RCS cold legs and3S1L*MV8809B can be opened to supply containment sump water via RSS Train B to the RCScold legs. Hot leg recirculation can be accomplished by using RSS Train B to supply containmentsump water via 3SIH*PlB to the RCS hot legs and maintaining 3SIL*~MV8809B open to supplycontaimnent sump water via RSS Train B to the RCS cold legs.MILLSTONE -UNIT 3 B 3/4 5-2c Amendment No. 4-08, 7,, Ackn~owledged by NRC Letter dated 04/12/06 LBDCR No. 13-MP3-011October 30, 2013CORE COOLING SYSTEMSBASESECCS Subsystems: Auxiliary Building RPCCW Ventilation Area Temperature Maintenance:In MODES 1, 2, 3 and 4, two trains of 4 heaters each, powered from class 1E powersupplies, are required to support charging pump OPERABILITY during cold weather conditions.These heaters are required whenever outside temperature is less than or equal to 17°F.When outside air temperature is below 17°F, if both trains of heaters in the RPCCWVentilation Area are available to maintain at least 65°F in the Charging Pump and ReactorComporhent Cooling Water Pump areas of the Auxiliary Building, both charging pumps areOPERABLE for MODES 1, 2 and 3.When outside air temperature is below 17°F, if one train of heaters in the RPCCWVentilation Area is available to maintain at least 32°F in the Charging Pump and ReactorComponent Cooling Water Pump areas of the Auxiliary Building, the operating charging pump isOPERABLE, for MODE 4.With less than 4 OPERABLE heaters in either train, the corresponding train of charging isinoperable. This condition will require entry into the applicable ACTION statement for LCOs3.5.2 and 3.5.3.LCO 3.5.2 ACTION statement "b", and LCO 3.5.3 ACTION statemnent "c" addressspecial reporting requirements in response to ECCS actuation with water injection to the RCS.The special report completion is not a requirement for logging out of the ACTION statements thatrequire the reports.3/4.5.4 REFUELING WATER STORAGE TANKThe OPERABILITY of the refueling water storage tank (RWST) as part of the ECCSensures that a sufficient supply of borated water is available for injection by theECCS in theevzent of a LOCA. The limits on RWST minimum volume and boron concentration ensure that: (1)sufficient water is available within containmient to permit recirculation cooling flow to the core,and (2) the reactor will remain subcritical in the cold condition following a large break (LB)LOOA, assuming mixing of the RWST, RCS, EGGS water, and other sources of water that mayeventually reside in the sump, with all control rods assumed to be out. These assumptions areconsistent with the LOCA analyses.The contained water volume limit includes an allowance for water not usable because oftank discharge line location or other physical characteristics.The limits on contained water vo lumne and boron concentration of the RWST also ensure a pHvalue of between 7.0 and 7.5 for the solution recirculated within containment after a LOCA. ThispH band minimizes the effect of chloride and caustic stress corrosion on mechanical systems andcomponents.MILLSTONE -UNIT 3 B 3/4 5-2d Amendment No. 4-I0, ,-i4, ,-4-57, LBDCR No. 13-MP3-011October 30, 2013EMERGENCY CORE COOLING SYSTEMSBASESThe minimum and maxinmum solution temperatures for the RV\ST in MODES 1, 2, 3 and 4 arebased on the following:The 42°F minimum and 73 °F maximum solution temperature values identified within theTechnical Specifications include an operational margin of 2°F (e.g., measurement uncertainties,analytical uncertainties, and design uncertainties) from values used in accident analysis/pipingstress analysis. Accident analysis/piping stress analysis used 40°F and 75°F for the minimum andmaximum RWST solution temperature.MILLSTONE -UNIT 3 B3452B 3/4 5-2e 0REVERSE OP PAGE B 3/4 5-2eINTENTIONALLY LEFT BLANK 0 May 26, 1995EMERGENCY CORE COOLING SYSTEMS3/4.5.5 TRISODIUM pHOSpHATE STORAGEBASKETSBASESBACKGROUNDTrisodlum phosphate (TSP) dodecahydrate is stored in porous wire meshbaskets on the floor or in the sump of the containment building to ensure thatiodine, which may be dissolved in the recirculated reactor cooling waterfollowing a loss of coolant accident (LOCA), remains In solution, TSP alsohelps inhibit stress corrosion cracking (SCC) of austenitic stainless steelcomponents in containment during the recirculatlon phase following anaccident.Fuel that is damaged during a LOCA will release iodine in severalchemical forms to the reactor coolant and to the containment, atmosphere. Aportion of the iodine in the containment atmosphere is washed to the sump bycontainment sprays (i.e.., Quench Spray and/or Containment RecirculationSpray). The emergency core cooling water is borated for reactivity control.This borated water causes the sump solution to be acidic. In a low pH(acidic) solution, dissolved iodine will be converted to a volatile form. Thevolatile iodine will evolve out of solution Into the containment atmosphere,significantly increasing the levels of airborne iodine. The increased levelsof airborne iodine in containment contribute to the radiological releases andincrease the consequences from the accident due to containment atmosphereleakage.After a LOCA, the components of the core cooling and containment spraysystems will be exposed to high temperature borated water. Prolonged exposureto the core cooling water combined with stresses imposed on the components cancause SCC. The SCC is a function of stress, oxygen and chlorideconcentrations, pH, temperature, and alloy composition Of the components.High temperatures and low pH,.which would be present after a LOCA, tend topromote SCC. This can lead to the failure of necessary safety systems orcomponents.Adjusting the pH of the recirculation solution to levels above 7.0prevents a significant fraction of the dissolved iodine from converting to avolatile form. The higher pH thus decreases the level of airborne Iodine incontainment and reduces the radiological consequences from containmentatmosphere leakage following a LOCA. Maintaining the solution pH Z 7.0 alsoreduces the occurrence of SCC of austenltic stainless steel components incontainment. Reducing SCC reduces the probability of failure of components.Granular TSP dodecahydrate Is employed as a passive form of pH controlfor post LOCA containment spray and core cooling water. Baskets of TSP areplaced on the floor or In the sump of the containment building to dissolveMILLSTONE UNIT NO. 3 B 3/4 5-3 Amendment No.115 May 26, 1995CORE COOLING SYSTEMSBASES (continued)BACKGROUND (continued)from released reactor coolant water and containment sprays after a LOCA.Recirculation of the water for core cooling and containment sprays thenprovides mixing to achieve a uniform solution pH. The dodecahydrate form ofTSP is used because of the high humidity in the containment building duringnormal operation. Since the TSP is hydrated, it is less likely to abso~rblarge amounts of water from the humid atmosphere and will undergo lessphysical and chemical change than the anhydrous form of TSP.APPLICABLE SAFETY ANALYSESThe LOCA radiological consequences analysis takes credit for "iodineretention in the sump solution based on the recirculation water pH beingS7.0. The radionuclide releases from the containment atmosphere and theconsequences of a LOCA would be increased if the pH of the recirculation waterwere not adjusted to 7.0 or above.LIMITING CONDITION FOR OPERATIONThe TSP is required to adjust the pH of the recirculation water to Z 7.0after a LOCA. A pH 7.0 after a LOCA is necessary to prevent significantamounts of iodine released from fuel failures and dissolved in therecirculation water from converting to a volatile form and evolving into thecontainment atmosphere. Higher levels of airborne iodine in containment mayincrease the release of radionuclides and the consequences of the accident. ApH 7.0 is also necessary to prevent SCC of austenitic stainless steelcomponents in containment. SCC increases the probability of failure ofcomponents.The required amount of TSP is based upon the extreme cases of watervolume and pH possible in the containment sump after a large break LOCA. Theminimum required volume is the volume of TSP that will achieve a sump solutionpH of 7.0 when taking into consideration the maximum possible sump watervolume and the minimum possible pH. The amount of TSP needed in thecontainment building is based on the mass of TSP required to achieve thedesired pH. However, a required volume Is specified, rather than mass, sinceit Is not feasible to weigh the entire amount of TSP In containment. Theminimum required volume is based on the manufactured density of TSPdodecahydrate. Since TSP can have a tendency to agglomerate from highhumidity In the containment building, the density may increase and the volumedecrease during normal plant operation. Due to possible agglomeration andincrease in density, estimating the minimum volume of TSP in containment isconservative with respect to achieving a minimum required pH.MILLSTONE UNIT NO. 3 B 3/4 5-4 Amendment No. 1150303 LBDCR 12-MP3-010September 20, 2012EMERGENCY CORE COOLING SYSTEMSBASES (Continued)APPLICABILITYIn MODES 1, 2, 3, and 4, a design basis accident (DBA) could lead to a fission productrelease to containment, that leaks to the secondary containment boundary. The large break LOCA,on which this system's design is based, is a full-power event. Less severe LOCAs and leakage stillrequire the system to be OPERABLE thraoughout these MODES. The probability and severity of aLOCA decrease as core power and reactor coolant system pressure decrease. With the reactor shutdown, the probability of release of radioactivity resulting from such an accident is low.In MODES 5 and 6, the probability and consequence of a DBA are low due to the pressureand temperature limitations in these MODES. Under these conditions, the SLCRS is not requiredto be OPERABLE.ACTIONSIf it is discovered that the TSP in the containment building sump is not within limits,action must be taken to restore the TSP to within limits. During plant operation, the containmentsuinp is not accessible and corrections may not be possible.The 7-day Completion Time is based on the low probability of a DBA occurring duringthis period. The Completion Time is adequate to restore the volume of TSP to within the technicalspecification limits.If the TSP cannot be restored within limits within the 7-day Completion Time, the plantmust be brought to a MODE in which the LCO does not apply. The specified Completion Timesfor reaching MODES 3 and 4 are those used throughout the technical specifications; they werechosen to allow reaching the specified conditions from full power in an orderly manner andwithout challenging plant systems.SURVEILLANCE REQUIREMENTSSurveillance Requirement 4.5.5Periodic determination of the volume of TSP in containment must be perfonned due to thepossibility of leaking valves and components in the containment building that could causedissolution of the TSP during nonmal operation. This requirement ensures that there is anadequate volume of TSP to adjust the pH of the post LOCA sump solution to a value > 7.0. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3B 3/4 5-5MILLTON -NIT3 B3/45-5Amendment No. 14-5-, 204

• 0REVERSE OF PAGE B 3/4 5-5 iTNTENTIONALLY LEFT BLANK 0 LBDCR No. 06-MP3-026October* 15,. 20063/4.6 CONTAINMENT sYSTEMSBASES3/4.6.1 PRIMARY CONTAINMENT3/4.6.1.1 'CONTAINMENT INTEGRITYPrimary CONTAINMENT INTEGRITY ensures that the release of radioactive materialsfrom the containment atmosphere will be restricted to those leakage paths and associated leakrates assumed in the safety analyses. This restriction, in conjunction with the leakage ratelimitation, will. limit the SITE BOUNDARY radiation doses to within the dose guidelines of10 CFR 50.67 during accident conditions and the control room operators dose to withintheguidelines of GDC 19.* Prim~ary .CONTAINM. ENT INTEGR.TY is-req~ui.red i:.n .MODE...!.h_.ugl;;:, 4 i .......press~ure, low pressufizer pressure and low steam~line pressure. In MODE 4 the automaticcontainment isolation* signals generated by high containment pressure, low pressurizer pressureand 10ow steamline pressure .ar~e not required to be OPERABLE. Automatic actuation of thecontainment i solation system in-MODE 4 is not required because adequate time is available forplant operators to evaluate plant Conditions and respond by manually operating engineered safetyfeatures components. Automatic actuation logic and actuation relays must be OPERABLE inMODE 4 to support system level manual initiation. Since the manual actuation pushbuttonsporti~on.;of the containment isolation system is required to be OPERABLE in MODE 4, the plantoperators can. use the manual pushbuttons to rapidly position all automatic containment isolationvalves to the required accident positioni. Therefore, the containment isolation actuationpushbuttons satisfy the requirementfor an OPERABLE containment automatic isolation valvesystem in MODE 4."3/4.6.1.2 CONTAINMENT LEAKAGEThe limitations on containment leakage rates, as specified in the Containment LeakageRate Testing Program,. ensure that the total containment~leakage volume will not exceed the valueassumed in the safety analyses at the peak accident pressure, P a- As an added conservatism, themeasured overall integra~ted leakage rate is flurther limited to less than 0.75 La during performnanceof the periodic test to account for possible degradation of the containment leakage barriersbetween leakage tests..*The Limiting Conditioh for Operation defines the limitations on containment leakage.The leakage rates are verified by surveillance testing as specified in the Containment LeakageRate Testing Program, in accordance with therequirements of Appendix J. Although the LCOspecifies the leakage rates at accident pressure, Pa, it is not feasible to perform a test at such anexact vahue for~pressiire. Consequently, the surveillance testing is performed at a pressure greaterthan or equal to Pa to. account for test instrument uncertainties and stabilization changes. Thisconservative test pressure en'sures that the measured leakage ratesMILLSTONE -UNIT 3 B 3/4 *6-1 Amendment No. 5gg, 89, 1-, 54, 4-1-6, 2-1-6NRC Verbal Acknowledgement: 07/05/07 May 15, 20023/4.6 CONTAINMENT SYSTEMSBASES3/4.6.1.2 CONTAINMENT LEAKAGE (continued)are representative of those which would occur at accident pressure while meeting the intent of theLCO. This test methodology is in accordance with the Containment Leakage Rate TestingProgram.The surveillance testing. for~measuring leakage rates' are in accordance with theContainment Leakage Rate Testing Program.The enclosure building bypass leakage paths are listed in the "Technical RequirementsManual." The addition or deletion of the enclosure buiilding bypass leakage paths shall be madein accordance with Section 50.59 of 10CFR50.and approved by the Plant Operations ReviewCommittee.Th& requireiiii: :t~ ar6 "ri:di~fi~d !by a -1f46tg That allow6 'nfy it:id exift (6efon.repairs on the affected air lock components. .This means there, m~ay be a short time during whichthe containment boundary .is not intact (e.g., duri~ng access through the OPERABLE door). The -ability to open the OPERABLE door, even if it means the containment boundary is temporarilynot intact, is acceptable due to the low probability of an evenit that could pressurize thecontainment during the short time in which the OPERABLE door is expected to be open. After.each entry and exit, the OPERABLE door must be immediately closed.ACTION a.. is only applicable when one air lock door is inoperable.. With only one airlock door inoperable, the remaining OPERABLE air lock door murst be verified closed within 1hour. This ensures a leak tight containment barrier is maintained by use of the remaining*OPERABLE air lock door. The 1lhour requirement is consistent with the requirements of.Technical Specification 3.6.i. 1 to restore CONTAINMENT INTEGRITY. In addition, theremaining OPERABLE air lock door must be locked closed within 24 hours and then verifiedperiodically to ensure an acceptable containment leakage bounda~ry is maintained. Otherwise, aplant shutdown is required.ACTION b. is only applicable when the air lock door intdrlock mechanism is inoperable.With only the air lock interlock mechanism inoperable, an. OPERABLE air lock door must beverified closed within 1 hour. This ensures a leak tight containment barrier is maintained by useof an OPERABLE air lock door. The 1 hour requirement is consistent with the requirements ofTechnical Specification 3.6.1.1 to restore.CONTAJNMENT INTEGRITY. In addition, anOPERABLE air" lock door must be locked closed within 24 hours and then verified periodically toensure an acceptable containment leakage boundary is maintained. Otherwise, a. plant shutdownis required. In addition, entry into and exit from containment under the control of a dedicatedindividual stationed at the air lock to ensure that only one door is opened at a time (i. e., theindividual perfoimas the function of the in~terlock) is permitted.ACTION c. is applicable when both air lock doors, are inoperable, or the air lock isinoperable for any other reason excluding the door interlock mechanism. With both air lock doorsinoperable or the air lock otherwise inoperable, an evaluation of the overall containmaent leakagerate per Specification 3.6.1.2"MILLSTONE -UNIT 3 B 3/4 6-1la Amendment No. 59189, 4-4,4--7-7,4-1-6,205 3/4.6 .CONTAINMENT SYSTEMS.-May 15, 2002BASES3/4.6.1.3. CONTAINMENT.AIR.LOCKS (continued).shall be initiated immediately, and an air lock door must be verified closedwithin 1.hour. .An evaluation..is acceptable since it is overly .conservative to.i y decl.are .the. cont ai nment .i noper.ab~le eif both doors in the. air .lock. have.failed, a seal-test or if overall a~ir.lockileakage *is not within limi~ts. In many.instances (e.g.,i .only..one. seal iper doQor has fai~led), containment: remainsOPERABLE, yet only 1 hour (.per'..S'pecificati~on"3.6.1.1). woul'd'.be provided to.restore the air .lock to OPERABLE status pri~or to requiri~ng ap1lant s~hutdown.. Inaddition,, even with both.'dOors .fail inlg the seal test., .the. ove~rall, leakage rate can still be within limits. The 1 hour requirement is consistentwith the requirements of Technical Specification 3.6.1.1 to restore CONTAINMENTINTEGRITY. In'addit~ion, the air.lock, and/or at least one air lock door' must be.restored to .OPERABLE. status within .24 hours or a-plant *shutdown is..required...SurveilIlance Requi rement 4 .*6.1..3. a .veri fi es leakage through the .cont ainmentair l ock..i~s within' the requirements specified in' the. Containment .Leakage, Rate.Testing Program. T!he containment air *lock leakage results are account'ed for inthe combined: Type Band C containment, leakage, rate. Failure of an a'ir lock doordoes not invalidate the previous satisfactory overall air lock leakage testbecause either air lock door is capable of providing a fission product barrierin the event of a design basis accident.The .limitations on. closure rate for .the containment air locksare required to meet the restrictions on CONTAINMENT INTEGRITY and containmentleak rate. Surveillance.testing of the air lock seals is performed in accordancewith the Containment Leakage Rate Testing Program, which ensures that the overallair lock leakage will not become excessive due .to seal damage during theintervals between air lock leakage tests. While the leakage rate limitation isspecified at accident pressure, Pa the actual surveillance testing is performedby applying a pressure greater than or equal to Pa. This higher pressureaccounts for test instrument uncertainties and test volume stabilization changeswhich occurs under actual test conditions.3/4.6.1.4 and 3/4.6.1.5 AIR PRESSURE and AIR TEMPERATUREThe limitations on containment pressure and average air 'temperatureensure that: (1) the containment structure is prevented from exceeding itsdesign negative pressure 'of 8 psia, and (2) the containment peak pressure doesnot exceed the design pressure of 60 psia during LOCA conditions. Measure-ments .shall be made at all listed locations, whether by fixed or portableinstruments, prior to determining the average air temperature. The limits onthe pressure and average air temperat~ure are consistent with the assumptionsof the safety analysis. The minimum total containment pressure of 10.6 psiais determined by summing the minimum 'permissible. air partial pressure of.8.9 psia and the maximum expected vapor pressure of .l.7 psia (occurring at themaximum permissible containment initial temperature of 1200F).MILLSTONE -UNIT 3 B3 3/4 6-lb Amendment No. ;I#082 77, 7 zo25 REVERSE OF PAGE B 3/4 6-lbINTENTIONALLY LEFT BLANK June 3, 2002CONTAINMENT SYSTEMSBASES3/4.6.1.6 CONTAINMENT STRUCTURAL INTEGRITYThis limitation ensures that the structural integrity of the containment will be manahtainedcomparable to the original design standards for the life of the facility. Structural integrity isrequired to ensure that the containment will withstand the maximum pressure of 60 psia in theevent of a LOCA. A visual inspection, in accordance with the Containment Leakage Rate TestingProgram, is sufficient to demonstrate this capability.3/4.6.1.7 CONTAINMENT VENTILATION SYSTEMThe 42-inch containment purge supply and exhaust isolation valves are required to be lockedclosed during plant operation since these valves have not been demonstrated capable of closingduring a LOCA or steam. line break accident. Maintaining these valves closed during plantoperations ensures that excessive quantities of radioactive materials will not be released via theContainment Purge System. To provide assurance that these containment valves cannot beinadvertently opened, the valves are locked closed in accordance with Standard Review Plan 6.2.4which incudes mechanical devices to seal or lock the valve closed, or prevents power from beingsupplied to the valve operator.The Type C testing frequency required by 4.6.1.2 is acceptable, provided that the resilient seats ofthese valves are replaced every other refueling outage.3/4.6.2 DEPRESSURIZATION AND COOLING SYSTEMS3/4.6.2.1 and 3/4.6.2.2 CONTAINMENT OUENCH SPRAY SYSTEM and RECIRCULATIONSPRAY SYSTEMThe OPERABILITY of the Containment Spray Systems ensures that containmefltdepressurization and iodine removal will occur in the event of a LOCA. The pressure reduction,iodine removal capabilities and resultant containment leakage are consistent with the assumptionsused in the safety analyses.LCO 3.6.2.2One Recirculation Spray System consists of:* Two OPERABLE contaimnent recirculation heat exchangers* Two OPERABLE contaiznment recirculation pumpsThe Contaimnent Recirculation Spray System. (RSS) consists of two paralle redundantsubsystems which feed two parallel 360 degree spray headers. Each subsystem consists of twopumps and two heat exchangers. Train A consists of 3RSS*P1A and 3R5S*P1C. Tamn B consistsof 3RSS*PIB and 3RSS*PID.MILLSTONE -UNIT 3 B 3/4 6-2 Amendment No. 145,4-4,"Revised by NRC Letter A15710" LIBDCR 12-MP3-010September 20. 2012CONTAINMENT SYSTEMSBASESThe design of the Containment RSS is sufficiently independent so that an active failure in therecirculation spray mode, cold leg recirculation mode, or hot leg recirculation mode of the ECCShas no effect on its ability to perform its engineered safety function. In other words, the failure inone subsystem does not affect the capability of the other subsystem to perfonn its designatedsafety function of assuring adequate core cooling in the event of a design basis LOCA. As long asone subsystem is OPERABLE, with one pump capable of assuring core cooling and the other*pump capable of removing heat from containment, the RSS system meets its design requirements.The LCO 3.6.2.2. ACTION applies when any of the RSS pumps, heat exchangers, or associatedcomponents are declared inoperable. All four RSS pumps are required to be OPERABLE to meetthe requirements of this LCO 3.6.2.2. During the injection phase of a Loss Of Coolant Accidentall four RSS pumps would inject into containment to perform their contaimnent heat removalfunction. The minimum requirement for the RSS to adequately perform this function is to have atleast one subsystem available. Meeting the requirements of LCO 3.6.2.2. ensures the minimumRSS requirements are satisfied.Surveillance Requirement 4.6.2.2.c requires that verification is made that on a CDA test signal,each RSS pump starts automatically after receipt of an RWST Low-Low level signal. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.6.2.1.d and 4.6.2.2.e require verification that each spray nozzle isunobstructed following maintenance that could cause nozzle blockage. Nonnal plant operationand maintenance activities are not expected to trigger performance of these surveillancerequirements. However, activities, such as an inadvertent spray actuation that causes fluid flowthrough the nozzles, a major configuration change, or a loss of for~eign material control whenworking within the respective system boundary may require surveillance performance. Anevaluation, based on the specific situation, Will detennine the appropriate test method (e.g., visualinspection, air or smoke flow test) to verify no nozzle obstruction.MILLSTONE -UNIT 3 B3462 mnmn oB 3/4 6-2aAmendment No.

LBDCR 12-MIP3-010September 20, 2012CONTAINMENT SYSTEMSBASES3/4.6.3 CONTAINMEvffNT ISOLATION VALVESThe OPERABILITY of the contairnment isolation valves ensures that the containmentatmosphere will be isolated from the outside environment in the event of a release of radioactivematerial to the containment atmosphere or pressurization of the containment and is consistentwith the requirements of General Design Criteria 54 through 57 of Appendix A to10 CFR Part 50. Containment isolation within, the time limits specified for these isolation valvesdesigned to close automatically ensures that the release of radioactive material to the environmentwill be consistent with the assumptions used in the analyses for a LOCA. FSAR Table 6.2-65 listsall containment isolation valves. The addition or deletion of any contaimnent isolation valve shallbe made in accordance with Section 50.59 of 10OCFR50 and approved by the committee(s) asdescribed in the QALP Topical Report.For the purposes of meeting this LCO, the safety function of the containment isolationvalves is to shut within the time limits assumed in the accident analyses. As long as the valves canshut within the time limits assurned in the accidefit analyses, the valves are OPERABLE. Wherethe valve position indication does not affect the operation of the valve, the indication is notrequired for valve OPERABILITY under this LCO. Position indication for contaimnent isolationvalves is covered by Technical Specification 6.8.4.e., Accident Monitoring Inastrumentation.Failed position ...indication on these valves must be restored "as soon as practicable" .as re quired byTechnical Specification 6.8.4.e.3. Maintaining the valves OPERABLE, when position indicationfails, facilitates troubleshooting and correction of the failure, allowing the indication to berestored "as soon as practicable.".. With one or more penetration flow paths with one containanent isolation valve inoperable,the inoperable valve must be restored to OPERABLE status or the affected penetration flow pathmust be isolated. The method of isolation must include the use of at least one isolation barrier thatcannot be adversely affected by a single active failure. Isolation barriers that meet this criterionare a closed and deactivated automatic valve, a closed manual valve, and a blind flange. A checkvalve may not be used to isolate the affected penetration.If the containment isolation valve on a closed system becomes inoper'able, the remainingbarrier is a closed system since a closed system is an acceptable alternative to an automatic valve.However, actions must still be taken to meet Technical Specification ACTION 3.6.3 .d and thevalve, not nonnally considered as a containment isolation valve, and closest to the containmentwall should be put into the closed position. No leak testing of the alternate valve is necessary tosatisfy the ACTION statement. Placing the manual valve in the closed position sufficientlydeactivates the penetration for Technical Specification compliance." Closed system isolation valves applicable to Technical Specification ACTION 3.6.3.d areincluded in FSAR Table 6.2-65, and are the isolation valves for those penetrations credited asGeneral Design Criteria 57. The specified time (i.e., 72 hours) of Technical SpecificationACTION 3.6.3.d is reasonable, considering the relative stability of the closed system (hence,reliability) to act as a penetration isolation boundary and the relative importance of supportingcontainment OPERABILITY during MODES 1, 2, 3 and 4. In the event the affected penetration isisolated in accordance with 3.6.3.d, the affected penetration flow path must be verified to beisolated on a periodic basis, (Surveillance Requirement 4.6.1.1 .a). This is necessary to assure leaktightness of contaimnent and that containment penetrations requiring isolation following anaccident are isolated. The surveillance frequency is controlled under the Surveillance FrequencyControl Program.MILLSTONE -UNIT 3B 3/4 6-3MILLTONE- UNT 3 3/46-3Ameihdment No. 2-8, 62:-, 4-4-2_,2-- LBDCR 05-MiP3-028November 30, 2005CONTAINMENT SYSTEMS OBASESFor the purposes of meeting this LCO, neither the containmaent isolation valve, nor anyalternate valve on a closed system have a leakage limit associated with valve OPERABILITY.The opening of contafinment isolation valves on an fintermittent basis under administrativecontrols includes the following considerations: (1) stationing an operator, who is in constantcommunication with the control room, at the valve controls, (2) instructing this operator to closethese valves in an accident situation, and (3) assuring that environmnental conditions will notpreclude access to close the valves and that this action will prevent the release of radioactivityoutside the containment.The appropriate administrative controls, based on the above considerations, to allowcontainment isolation valves to be opened are contained in the procedures that will be used tooperate the valves. Entries should be placed in the Shift Manager Log when these valves areopened or closed. However, it is not necessary to log into any Technical Specification ACTIONStatement for these valves, provided the appropriate administrative controls have beenestablished.Opening a closed containmaent isolation valve bypasses a plant design feature thatprevents the release of radioactivity outside the contafi~nment. Therefore, this should not be donefrequently, and the time the valve is opened should be minimized. The determination of the appropriate administrative controls for containment isolation valves requires an evaluation of the 'expected environmnental conditions. This evaluation must conclude environmental conditions willnot preclude access to close the valve, and this action will prevent the release of radioactivityoutside of contafinment through the respective penetration.When the Residual Heat Removal (RHR) System is placed in. service finthe plantcooldown mode of operation, the RIIR suction isolation remotely operated valves3RHS*MV8701A and 3RHS*MV8701B, and/or 3RTIS*MV8702A and 3RP-IS*MV8702B areopened. These valves are nonnally operated fr~om the control room. They do not receive anautomatic containment isolation closure signal, but are interlocked to prevent their opening ifReactor Coolant System (RCS) pressure is greater than approximately 412.5 psia. When any ofthese valves are opened, either one of the two required licensed (Reactor Operator) control roomoperators can be credited as the operator required for administrative control. It is not necessary touse a separate dedicated operator.3/4.6.4 DELETEDMILLSTONE -UNIT 3 B 3/4 6-3a Amendment No. 2--, 6-3, -42_ ---,0Acknowledged by NRC Letter dated 04/12/06 LBDCR 05-MP3-028November 30, 2005THIS PAGE INTENTIONALLY LEFT BLANK9YILLSTONE -UNIT. 3B 3/4 6-3bAmendment No. , 6-3,. 4-4, 24l-6,.Acknowledged by NRC Letter dated 04/12/06 LBDCR 05-MP3-028November 30, 2005THIS PAGE INTENTIONALLY LEFT BLANKMILLSTONE -uNIT3B 3/46-3cAmendment No. 6-3-, 442, 6Acknowledged by NRC Letter dated 04/12/06 LBDCR 05-MP3-028November 30, 2005CONTAINMENT SYSTEMSBASES3/4.6.5 SUJBATMOSPHERIC PRESSURE CONTROL SYSTEM3/4.6.5.1 STEAM JET AIR EJECTORThe closure of the isolation valves in the suction of the steam jet air ejector ensures that:(1) the containment internal pressure may be maintained within its operation limits by themechanical vacuum pumps, and (2) the containment atmosphere is isolated from the outsideenvironment in the event of a LOCA. These valves are required to be closed for containmentisolation.MILLSTONE -UNIT 3B 3/4 6-3d... Amendment No. 3-3, 4-42, 216,Acknowledged by NRC Letter dated 04/12/06 REVERSE OF PAGE B 314 6-3dINTENTIONALLY LEFT BLANK June 3, 2002CONTAINMENT SYSTEMSBASES3/4.6.6 SECONDARY CONTAINMENT3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEMB ack ground.The OPERABILITY of the Supplementary Leak Collection and Release System (SLCRS)ensures thatradioactive materials that leak from the primary containment into the SecondaryContainment following a Design Basis Accident (DBA) are filtered out and adsorbed prior to any.release to the environment.SLCRS Ductwork Integrity:The Supplementary Leak Collection and Release System (SLCRS) remains OPERABLEwith the following bolting*configuration:a. For 311VR*DMPF44:* Eight bolts properly installed on the ductwork access panels.* At least one bolt must be installed in each corner area.*The remaining bolts should be installed in the center area of each side.b. For 3HVR*DMPF29:* 12 bolts properly installed on the ductwork access panel.* At least one bolt must be installed in each corner area.* The remaining bolts should be approximately equally spaced along each sidewith two bolts per side.With the above bolting specified for- 3HVR*DMPF44 and 3HVR*DMPF29, reference* (l)concluded the foillowing:..* Any leakage around the plates is minimal and causes negligible effect on theperformance of the SLCRS system.* Assures the gasket will not be extruded from between the plate and duct flangewhen the. SLCRS fans are started.* The remaining bolts may be installed with the fans running.* Provides adequate structural integrity in the seismic event based onengineering analysis.Applicable Safety AnalysesThe SLCRS design basis is established by the consequences of the limiting DBA, which isa LOCA. The accident analysis assumes that only one train of the SLCRS and one train of the.auxiliary building filter system is functional due to a single failure that disables the other train.The accident analysis accounts for the reduction of the airborne radioactive material provided bythe remaining one train of this filtration system. The amount of fission products available forrelease from the containment is determined for a LOCA.The SLCRS is not normally in operation. The SLCRS starts on a SIS signal. Themodeled SLCRS actuation in the safety analysis (the Millstone 3MILLSTONE -UNIT 3 B 3/4 6-4 Amendment No. 87 4-2-6,"Revised by NRC Letter A15710". LBDCR No. 04-MP3-015February 24, 2005CONTATNMENT SYSTEMSBASES O3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued)FSAR Chapter 15, Section 15.6) is based upon a worst-case response time following an SIinitiated at the limiting setpoint. One train of the SLCRS in conjunction with the AuxiliaryBuilding Filter (ABF) system is capable of drawing a negative pressure (0.4 inches water gauge at.the auxiliary building 24'6" elevation) within 120 seconds after a LOCA. This time includesdiesel generator startup and sequencing time, system startup time, and time for the system toattain the required negative pressure after starting.LCOIn the event of a DBA, one SLCRS is required to provide the minimum postulated iodineremoval assumed in the safety analysis. Two trains of the SLCRS must be OPERABLE to ensurethat at least one train will operate, assuming that the other train is disabled by a single-activefailure. The SLCRS works in conjunction with the ABF system. Inoperability of one train of theABF system also results in inoperability of the corresponding train of the SLCRS. Therefore,whenever LCO 3.7.9 is entered due to the ABF train A (B) being inoperable, LCO 3.6.6.1 must beentered due to the SLCRS train A (B3) being inoperable.When a SLCRS LCO is not met, it is not necessary to declare the secondary containmentinoperable. However, in this event, it is necessary to determine that a loss of safety function doesnot exist. A loss of safety function exists when, assuming no concurrent single failure, a safetyfunction assumed in the accident analysis cannot be performed.ApplicabilityIn MODES 1, 2, 3, and 4, a DBA could lead to a fission product release to containmentthat leaks to the seco~idar contaipnment. Th~e !rge b~reak LOCA, o~n whic. sys!ter's d~e sign isbased, is a full- power event. Less severe LOCAs and leakage still require the syst.em to beOPERABLE throughout these MODES. The probability and severity of a LOCA decrease as*core power and reactor coolant system pressure decrease. With the reactor shut down, theprobability of release of radioactivity resulting from such, an accident is low.In MODES 5 and 6, the probability and consequences of a DBA are low due to thepressure and temperature limitations in these MODES. Under these conditions, the SLCRS is notrequired to be OPERABLE.ACTIONSWith one SLCRS train inoperable, the inoperable train must be restored to OPERABLEstatus within 7 days. The OPERABLE train is capable of providing 100 percent of the iodineremoval needs for a DBA. The 7-day Completion Time is based on consideration of such factors* as the reliability of the OPERABLE redundant SLCRS train and the low probability of a DBAoccurring during this period. The Completion Time is adequate to make most repairs. If theSLCRS cannot be restored to OPERABLE status :within the required Completion Time, the plantmust be brought to a MODE in which the LCO does not apply. To achieve this status, the plantmust be brought to at least MODE 3 within 6 hours and MODE 5 within the following 30 hours.The allowed Completion Times are reasonable, based on operating experience, to reach therequired plant conditions from full-power conditions in an orderly manner and withoutchallenging plant systems.MILLSTONE -UNIT 3 B 3/4 6-5 Amendment No. g-7, -I-2-6,Acknowledged by NRC letter dated 08/25/05 LBDCR 12-MTP3-010September 20, 2012CONTAINMENT SYSTEMSBASES3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued)Surveillance RequirementsCumulative operation of the SLCRS with heaters operating for at least 10 continuous hours issufficient to reduce the buildup of moisture on the adsorbers and HEPA filters. The surveillancefrequency is controlled under the Surveillance Frequency Control Program.b, c, e, and fThese surveillances verify that the required SLCRS filter testing is performed in accordance withRegulatory Guide 1.52, Revision 2. ANSI N510-1980 shall be used in place of ANSI N510-1975referenced in Regulatory Guide 1.52, Revision 2. Laboratory testing of methyl iodide penetrationshall be performed in accordance with ASTM D3803-89 and Millstone Unit 3 specificparameters. The surveillances include testing HEPA filter perfonnance,. charcoal adsorberefficiency, system flow rate, and the physical properties of the activated charcoal (general use andfollowing specific operations). The heater kW measured must be corrected to its nameplate rating.Variations in system voltage can lead to measurements of kW which cannot be compared to thenameplate rating because the output kW is proportional to the square of the voltage.Any time the OPERABILITY of a HEPA filter or charcoal adsorber housing has been affected byrepair, maintenance, modification, or replacement activity, post maintenance testing inaccordance with SR 4.0.1 is required to demonstrate OPERABILITY.The 720 hours of operation requirement originates from Regulatory Guide 1.52, Revision 2,March 1978, Table 2, Note "c", which states that "Testing should be performed (1) initially, (2) atleast once per 18 months thereafter for systems maintained in a standby status or after 720 hoursof system operations, and (3) following painting, fire, or chemical release in any ventilation zonecolmmunicating with the system." This testing ensures that the charcoal adsorbency capacity hasnot degraded below acceptable limits, as well as providing trend data. The 720 hour figure is anarbitrary number which is equivalent to a 30 day period.. This criteria is directed to filter systemsthat are normally in operation and also provide emergency air cleaning functions in the event of aDesign Basis Accident. The applicable filter units are not normally in operation and the samplecanisters are typically removed due to the 18 month criteria.dThe periodic automatic startup ensures that each SLCRS train responds properly. The surveillancefrequency is controlled under the Surveillance Frequency Contr'ol Program. The surveillanceverifies that the SLCRS starts on a SIS test signal. It also includes the automatic functions toisolate the other ventilation systems that are not part of the safety-related postaccident operatingconfiguration and to start up and to align the ventilation systems that flow thr'ough the secondarycontaimunent to the accident condition.MILLSTONE -UNIT 3B 3/4 6-6MILSTOE UNT 3B /4 -6Amendment No. 8-- 23-, 84-,--2-06 LBDCR 05-MIP3-025March 7, 2006CONTAINMENT SYSTEMSBASES3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued)* The main steam valve building ventilation system isolates.* Auxiliary building ventilation (normaal) system isolates.* Charging pump/reactor plant component cooling water pump area cooling subsystemaligns and discharges to the auxiliary building filters and a filter fan starts.* Hydlrogen recombiner ventilation system aligns to the postaccident configuration.* The engineered safety features building ventilation system aligns to the postaccidentconfiguration.

References:

1. Engineering analysis, Memo MP3-DE-94-539, "Bolting Requirements for Access Panelson Dampers 3HVR*DMPF29 & 44," dated June 16, 1994.MILLTON -NIT B /4 -6aAmendment No. 8-7-, 23-, 84,MILLSTONE -UNIT 3B 3/4 6-6a LBDCR No. 06-MIP3-026October 15, 2006CONTAINMENT SYSTEMSBASES3/4.6.6.2 SECONDARY CONTAINMENTThe Secondary Containment is comprised of the containment enclosure building and allcontiguous buildings (main steam valve building [partially]; engineering safety features building[partially], hydrogen recombiner building [partially], and auxiliary building). The SecondaryContainment shall exist when:a. Each door in each access opening is closed except when the access opening isbeing used for normal transit entry and exit,b. The sealing mechanism associated with each penetration (e.g., Welds, bellows, or0-rings) is OPERABLE.Secondary Containment ensures that the release of radioactive materials from the primarycontainment atmosphere will be restricted to those leakage paths and associated leak ratesassumed in the safety analyses. This restriction, in conjunction with operation of theSupplemnentary Leak Collection and Release System, and Auxiliary Building Filter System willlimit the SITE BOUNDARY radiation doses to within the dose guideline values of 10 CFR 50.67during accident conditions.The SLCRS and the ABF fans and filtration units are located in the auxiliary building. TheSLCRS is described in the Millstone Unit No. 3 FSAR, Section 6.2.3.order to ensure a negative pressure in all areas within the Secondary Containment under mostmeteorological conditions, the negative pressure acceptance criterion at the measured location(i.e., 24' 6" elevation in the auxiliary building) is 0.4 inches water gauge.LCOThe Secondary Containment OPERABILITY must be maintained to ensure proper operation ofthe SLCRS and the auxiliary building filter system and to limit radioactive leakage fr'om thecontainment to those paths and leakage rates assumed in the accident analyses.ApplicabilityMaintaining Secondary Contaimnent OPERABILITY prevents leakage of radioactive materialfr'om the Secondary Containment. Radioactive material may enter the Secondary Containmentfrom the containment following a LOCA. Therefore, Secondary Containment is required inMODES 1, 2, 3, and 4 when a design basis accident such as a LOCA could release radioactivematerial to the containment atmnosphere.MILLSTONE -UNIT 3 B 3/4 6-7 Amendment No. 8-7-, 4--26NRC Verbal Acknowledgement: 97/05/07 LBDCR 12-MP3-010September 20, 2012CONTAINMENT SYSTEMS 1BASES3/4.6.6.2 SECONDARY CONTAINMENT (continued)In MODES 5 and 6, the probability and consequences of a DBA are low due to the RCStemperature and pressure limitation in these MODES. Therefore, Secondary Containmrent is notrequired in MODES 5 and 6.ACTIONSIn th~e event Secondary Containment OPERABILITY is not maintained, SecondaryContainment OPERABILITY must be restored within 24 hours. Twenty-four hours is areasonable Completion Time considering the limited leakage. design of contaimnent and the !owprobability of a DBA occurring during this time period.Inoperability of the Secondary Contahunent does not make the SLCRS fans and filtersinoperable. Therefore, while in this ACTION Statement solely due to inoperability of theSecondary Containment, the conditions and required ACTIONS associated with Specification3.6.6.1 (i.e., Supplementary Leak Collection and Release System) are not required to be entered.If the Secondary Containment OPERABILITY cannot be restored to OPERABLE status withinthe required completion time, the plant must be brought to a MODE in which the LCO does apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and toWMODE 5 within the following 30 hours. The allowed Completion Times are reasonable, based onoperating experience, to reach the required plant conditions from full-power conditions in anorderly manner and without challenging plant Systems.Surveillance Requirements4.6.6.2.1Maintaining Secondary Containment oPERABILITY requires maintaining each door ineach access opening in a closed position except when the access opening is being used for normalentry! and exit. The normal time allowed for passage of equipment and personnel through eachaccess opening at a time is defined as no more than 5 minutes. The access opening shall not beblocked open. During this time, it is not considered necessary to enter the ACTION statement. A5-minute time is considered acceptable since the access opening can be quickly closed withoutspecial provisions and the probability of occurrence of a DBA concurrent with equipment andlorpersonnel transit time of 5 minutes is low.The surveillance frequency is controlled under the Surveillance Frequency ControlProgram.MILLSTONE -UNIT 3 B3468AedetN.~-2B 3/4 6-8Amendment No. 8-7-,

February 5, 1998CONTAINMENT SYSTEMSBASES3/4.6.6.2 SECONDARY CONTAINMENT (continued)4.6.6.2.2The ability of a SLCRS to produce the required negative pressure duringthe test operation within the required time provides assurance that theSecondary Containment is adequately sealed.With the SLCRS in postaccident configuration, the required negativepressure in the Secondary Containment is achieved, in 110 seconds from the timeof simulated emergency diesel generator breaker closure. Time delays ofdampers and, logic delays must be accounted for in this surveillance. The timeto achieve the required negative pressure is 120 seconds, with a loss-of-offsite power coincident with a SIS. The surveillance verifies that one trainof-'SLCRS in conjunction with the ABF system will produce a negative pressureof-O.4 inches water gauge at the auxiliary building 24'6" elevation relativeto the outside atmosphere in the Secondary Containment. For the purpose ofthis surveillance, pressure measurements will be made at the 24'6" elevationin the auxiliary building. This single location is considered to be adequateand representative of the entire Secondary Containment due to the large cross-section of the air passages which interconnect the various buildings withinthe Secondary Containment. In order to ensure a negative pressure in allareas inside the Secondary Containment under most meteorological conditions,the negative pressure acceptance criterion at the measured location is_0.4 inch water gauge. It is recognized that there will be an occasionalmeteorological condition under which slightly positive pressure may exist atsome localized portions of the boundary (e.g., the upper elevations on thedown-wind side of a building). For example, a very low outside temperaturecombined with a moderate wind speed could cause a slightly positive pressureat the upper elevations of the containment enclosure building on the leewardface. The probability of occurrence of meteorological conditions which couldresult in such a positive differential pressure condition in the upper levelsof the enclosure building has been estimated to be less than 2% of the time.The probability of wind speed within the necessary moderate band,combined with the probability of extreme low temperature, combined with thesmall portion of the boundary affected, combined with the low probability ofairborne radioactive material migrating to the upper levels ensures that theoverall effect on the design basis dose calculations is insignificant.The SLCRS system and fan sizing was based on an estimated infiltrationrate. The fan flow rates are verified within a minimum and maximum on amonthly basis. Initial testing verified that the drawdown criterion was metat the lowest acceptable flow rate. The new standard Technical Specification(NUREG-1431) 3.6.6.2 surveillance requirement requires that the drawdownHILLSTONE -UNIT 3B 3/4 6-9MILLTONE- UNT 3 3/46-9Amendment No. F7, 126 February 5, 1996CONTAINMENT SYSTEMSBASES3/4.6.6,2 SECONDARY CONTAINMENT (continued)criterion be met while not exceeding a maximum flow rate. It is assumed thatthe purpose of this flow limit is to ensure that adequate attention is givento maintain the SLCRS boundary integrity and not using excess system capacityto cover .for boundary degradation.The SLCRS system was designed with minimal marginand, therefore, doesnot have excess capacity that can be substituted for boundary integrity.Additionally, since SLCRS fan flow rates are verified to be acceptable on amore frequent basis than the drawdown test surveillance, and by means ofprevious testing the minimum flow rate is acceptable, verifying a flow rateduring the drawdown test would not provide an added benefit. Historical SLCRSflow measurements show a lack of repeatability associated with the inaccura-cies of air flow measurement. As a result, the more reliable verification ofsystem performance is the actual negative pressure generated by the drawdowntest and a measured flow rate would add little.3/4.6.6.3 SECONDARY CONTAINMENT STRUCTURAL INTEGRITYThis limitation ensures that the structural integrity of the SecondaryContainment will be maintained comparable to the original design standards forthe life of the facility. Structural integrity is required to provide asecondary boundary surrounding the primary containment that can be maintainedat a negative pressure during accident conditions. A visual inspection issufficient to demonstrate this capability.MILLSTONE -UNIT 3B s/4 6-zoMILLTON -NIT B /4 -10Amendment No. F7, 126 LBDCR-.07-MP3 -037July 12, 20073/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVESBACKGROUNDThe primary purpose of the main steam line Code safety valves (MSSVs) is to provideoverpressure protection for the secondary system. The MSSVs also provide protection againstoverpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for theremoval of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided bythe Condenser and Circulating Water System, is not available.Five MSSVs are located on each main steam header, outside containment, upstream of the mainsteam isolation valves, as described in the FSAR, Section 10.3.1 (Reference 1). The MSSVs musthave sufficient capacity to limit the secondary system pressure to less than or equal to 110% of thesteam generator design pressure in order to meet the requirements of the ASME Code, Section III(Reference 2). The design minimum total relieving capacity for all valves on all of the steam linesis 1.579 x 107 lbs/hr which is 105% of total secondary steam flow of 1.504 x 10 lbs/h at 100%RATED THERMAL POWER. The MSSV design includes staggered setpoints, according to Table3.7-3 in the accompanying LCO, so that only the needed valves will actuate. Staggered setpointsreduce the potential for valve chattering that is due to steam pressure insufficient to fully open allvalves following a turbine reactor trip. Table 3.7-3 allows a +/- 3% setpoint tolerance (allowablevalue) on the lift setting for OPERABILITY to account for drift over an operating cycle.APPLICABLE SAFETY ANALYSESThe design basis for the MSSVs comes from Reference 2 and its purpose is to limit the secondarysystem pressure to less than or equal to 110% of design pressure for any anticipated operationaloccurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transientanalysis.The events that challenge the relieving capacity of the MSSVs, and thus RCS pressure, are thosecharacterized as decreased heat removal events, which are presented in the FSAR, Section 15.2(Reference 3). Of these, the full power turbine trip without steam dump is typically the limitingAOO. This event also terminates normal feedwater flow to the steam generators.The safety analysis demonstrates that the transient response for turbine trip occurring from fullpower without a direct reactor trip presents no hazard to the integrity of the RCS or the MainSteam System. One turbine trip analysis is performed assuming primary system pressure controlvia operation of the pressurizer relief valves and spray. This analysis demonstrates that the DNBdesign basis is met. Another analysis is performed assuming no primary system pressure control,but crediting reactor trip on high pressurizer pressure and operation of the pressurizer safetyMILLSTONE -UNIT 3B 3/4 7-1MILLTON -NIT3 B3/47-1Amendment No. 4-t02,, 7-, LBDCR_.7-MP3-037July 12, 20073/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVES (Continued)valves. This analysis demonstrates that RCS integrity is maintained by showing that themaximum RCS pressure does not exceed 110% of the design pressure. All cases analyzeddemonstrate that the MSSVs maintain Main Steam System integrity by limiting the maximumsteam pressure to less than 110% of the steam generator design pressure.In addition to the decreased heat removal events, reactivity insertion events may also challenge therelieving capacity of the MSSVs. The uncontrolled rod cluster control assembly (RCCA) bankwithdrawal at power event is characterized by an increase in core power and steam generation rateuntil reactor trip occurs when either the Overtemperature AT or Power Range Neutron Flux-Highsetpoint is reached. Steam flow to the turbine will not increase from its initial value for this event.The increased heat transfer to the secondary side causes an increase in steam pressure and mayresult in opening of the MSSVs prior to reactor trip, assuming no credit for operation of theatmospheric or condenser steam dump valves. The FSAR Section 15.4 safety analysis of theRCCA bank withdrawal at power event for a range of initial core power levels demonstrates thatthe MSSVs are capable of preventing secondary side overpressurization for this AOO.The FSAR safety analyses discussed above assume that all of the MSSVs for each steamgenerator are OPERABLE. If there are inoperable Ms sv(s), it is necessary to limit the primarysystem power during steady-state operation and AOOs to a value that does not result in exceedingthe combined steam flow capacity of the turbine (if available) and the remaining OPERABLEMSSVs. The required limitation on primary system power necessary to. prevent secondary systemoverpressurization may be determined by system transient analyses or conservatively arrived atby a simple heat balance calculation. In some circumstances it is necessary to limit the primaryside heat generation that can be achieved during an AOO by reducing the setpoint of the PowerRange Neutron Flux-High reactor trip function. For example, if more than one MSSV on a singlesteam generator is inoperable, an uncontrolled RCCA bank withdrawal at power event occurringfrom a~partial power level may result in an increase in reactor power that exceeds the combinedsteam flow capacity of the turbine and the remaining OPERABLE MSSVs. Thus, for multipleinoperable MSSVs on the same steam generator it is necessary to prevent this power increase bylowering the Power Range Neutron Flux-High setpoint to an appropriate value. If the ModeratorTemperature Coefficient (MTC) is positive, the reactor power may increase above the initial valueduring an RCS heatup event (e.g., turbine trip). Thus, for any number of inoperable MSSVs, it isnecessary to reduce the trip setpoint if a positive MTC may exist at partial power conditions,unless it is demonstrated by analysis that a specified reactor power reduction alone is sufficient toprevent overpressurization of the steam system.MILLSTONE -UNIT 3 B347l mnmn o -2B 3/4 7-1aAmendment No. LBDCR 07-MP3-037July 12, 20073/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVES (Continued)The MSSVs are assumed to have two active and one passive failure modes. The active failuremodes are spurious opening, and failure to reclose once openfed. The passive failure mode is .failure to open upon demand.The MSSVs satisfy Criterion 3 of 10 CFR 50.3 6(c)(2)(ii).LCOThe accident analysis requires that five MSSVs per steam generator be OPERABLE to provideoverpressure protection for design basis transients occurring at 102% RTP. The LCO requires thatfive MSSVs per steam generator be OPERABLE in compliance with Reference 2, and the DBAanalysis.The OPERABILITY of the MSSVs is defined as the ability to open upon demand within thesetpoint tolerances, to relieve steam generator overpressure, and reseat when pressure has beenreduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing inaccordance with the Inservice Testing Program.This LCO provides assurance that the MSSVs will perform their designed safety functions tomitigate the consequences of accidents that challenge to the RCPB, or MainSteam System integrity.APPLICABILITYIn MODES 1, 2, and 3, five MSSVs per steam generator are required to be OPERABLE toprevent Main Steam System overpressurization.In MODES 4 and 5, there are no credible transients requiring the MSSVs. The steam generatorsare not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized;there is no requirement for the MSSVs to be OPERABLE in these MODES.ACTIONSACTIONS are modified by a Note indicating that separate Condition entry is allowed for eachMSSV.With one or more MSSVs inoperable, action must be taken so that the available MSSV relievingcapacity meets Reference 2 requirements for the applicable THERMAL POWER.MILLSTONE -UNIT 3 B347l mnmn oB 3/4 7-1bAmendment No. LBDCR 07-MP3-037-July 12, 20073/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1 .1 SAFETY VALVES (Continued)Operation with less than all five MSSVs OPERABLE for each steam generator is permissible, ifTHERIMAL POWER is limited to the relief capacity of the remaining MSSVs. This isaccomplished by restricting THERMAL POWER so that the energy transfer to the most limitingsteam generator is not greater than the available relief capacity in that steam .generator.In the case of only a single inoperable MSSV on one or more steam generators when theModerator Temperature Coefficient is not positive, a reactor power reduction alone is sufficient tolimit primary side heat generation such that overpressurization of the secondary side is precludedfor any RCS heatup event. Furthermore, for this case there is sufficient total steam flow capacityprovided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in theevent of an increased reactor power due to reactivity insertion, such as in the event of anuncontrolled RCCA bank withdrawal at power. Therefore, ACTION a. requires an appropriatereduction in reactor power within 4 hours. If the power reduction is not completed within therequired time, the unit must be placed in at least HOT STANDBY within the next 6 hours, and inHOT SHUTDOWN within the following 6 hours.The maximum THERMAL POWER correspondin~g to._he.heat removal capacity of the remainingOPERABLE MSSVs is determined via a conservative heat balance calculation as described in theattachment to Reference 4 with an appropriate allowance for calorimetric power uncertainty.The maximum THERMAL POWER corresponding to the heat removal capacity of the remainingOPERABLE MSSVs is determined by the governing heat transfer relationship is the equationq = mnAh, where q is the heat input from the primary side, mn is the mass flow rate of the steam,and Ah is the increase in enthalpy that occurs in converting the secondary side water to steam. Ifit is conservatively assumed that the secondary side water is all saturated liquid (assuming nosubcooled feedwater), then the Ah is the heat of vaporization (hfg) at the steam'relief pressure.For each steam generator, at a specified pressure, the maximum allowable power level isdetermined as follows:100 wQ- x shfgNMaximum Allowable Power Level < KMILLSTONE -UNIT 3 B347l mnmn oB 3/4 7-1cAmendment No. LBDCR- 07-MP3-037July 12, 20073/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVES (Continued)Where:Q =Nominal NSSS power rating of the plant (including reactor coolant pump heat), MWtK =Conversion factor, 947.82(Btu/sec)MWtWs= Minimum total steam flow rate capability of the OPERABLE MSSVs on any one steamgenerator at the highest OPERABLE MSSV opening pressure including tolerance andaccumulation, as appropriate, lb/sec.hfg =Heat of vaporization at the highest MSSV opening pressure including tolerance andaccumulation as appropriate, Btu/lbm.N =Number of loops in the plant.For use in determining the % RTP in ACTION a., the Maximum NSSS Power calculated above isreduced by 2% RTP to account for calorimetric power uncertainty.b and cIn the case of multiple inoperable MSSVs on one or more steam generators, with a reactor powerreduction alone there may be insufficient total steam flow capacity provided by the turbine andremaining OPERABLE MSSVs to preclude overpressurization in the event of an increasedreactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bankwithdrawal at power. Furthermore, for a single inoperable MSSV on one or more steamgenerators when the Moderator Temperature Coefficient is positive the reactor power mayincrease as a result of an RCS heatup event such that flow capacity of the remaining OPERABLEMSSVs is insufficient. The 4 hour completion time to reduce reactor power is consistent withACTION a. An additional 32 hours is allowed to reduce the Power Range Neutron Flux Highreactor setpoint. The total completion time of 36 hours is based on a reasonable time to correctthe MSSV inoperability, the time to perform the power reduction, operating experience to reset allchannels of a protection function, and on the low probability of the occurrence of a transient thatcould result in steam generator overpressure during this period. If the required action is notcompleted within the associated time, the unit must be placed in at least HOT STANDBY withinthe next 6 hours, and in HOT SHUTDOWN within the following 6 hours.MILLSTONE -UNIT 3 B347i mnmn oB 3/4 7-1dAmendment No. LBDCR 07-MP3-037July 12, 20073/4.7 PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE3/4.7.1.1 SAFETY VALVES (.Continued)The maximum THERMAL POWER corresponding to the heat removal capacity of the remainingOPERABLE MSSVs is determined via a conservative heat balance calculation as described in the.:attachment to Reference 4, with an appropriate allowance for nuclear instrumentation system tripchannel uncertainties. ..To determine the Table 3.7-1 Maximum Allowable Power for Required ACTIONS b and c(%RTP), the calculated Maximum NSSS Power is reduced by 9% RTP to account for NuclearInstrumentation System trip channel uncertainties.ACTIONS b and c are modified by a Note. The Note states that the Power Range Neutron FluxHigh reactor trip setpoint reduction is only required in MODE 1. in MODES 2 and 3 the reactorprotection system trips specified in LCO 2.2.1, "Reactor Trip System Instrumentation Setpoints,"provide sufficient protection.The allowed completion times are reasonable based on operating experience to accomplish theACTIONS in an orderly manner without challenging unit systems.dIf one or more steam generators have four or more inoperable MSSVs, the unit must be placed ina MODE in which the LCO does not apply. To achieve this status, .the unit must be placed in atleast HOT STANDBY within the next 6 hours, and in HOT SHUTDOWN within the following6 hours. The allowed completion times are reasonable, based on operating experience, to reachthe required unit conditions from full power conditions in an orderly manner and withoutchallenging unit systems.SURVEILLANCE REQUIREMENTS (SR) 4.7.1.1This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint(Table 3.7-3) in accordance with the Inservice Testing Program. During this testing, the MSSVsare OPERABLE provided the actual lift settings are within +/- 3% of the required lift setting. TheASME Code specifies the activities and frequencies necessary to satisfy the requirements. Table3.7-3 allows a +/- 3% setpoint tolerance for OPERABILITY; however, the valves are reset to +/- 1%during the Surveillance to allow for drift during the next operating cycle. However, if the testingis done at the end of the operating cycle when the plant is being shut down for refueling,MILLSTONE -UNIT 3 B347l mnmn oB 3/4 7-1eAmendment No. LBDCR 07-MIP3-037July 12, 2007PLANT SYSTEMSBASES3/4.7.1 TURBINE CYCLE314.7.1.1 SAFETY VALVES (Continued')restoration to +/- 1% of the specified lift setting is not required for valves that will not be used (e.g.,replaced) for the next operating cycle. While the lift settings are being restored to within the +/- 1%of the required setting, the MS SVs remain OPERABLE provided the actual lift setting is within+/-t 3% of the required setting. The lift settings, according to Table 3.7-3, correspond to ambientconditions of the valve at nominal operating temperature and pressure.This SR is modified by a Note that allows entry into and operation in MODE 3 prior toperforming the SR. The MSSVs may be either bench tested or tested in situ at hot conditionsusing an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, thelift setting pressure shall be corrected to ambient conditions of the valve at operating temperatureand pressure.REFERENCES1. FSAR, Section 10.3.1.2. ASMdE, Boiler and Pressure Vessel Code, Section~ III, 1971 edition.3. FSAR, Section 15.2.4. NRC Information Notice 94-60, "Potential Overpressurization of the Main SteamSystem," August 22, 1994.3/4.7.1.2 AUXILIARY FEED WATER SYSTEMThe OPERABILITY of the Auxiliary Feedwater (AFW) System ensures a makeup water supplyto the steam generators (SGs) to support decay heat removal from the Reactor Coolant System(RCS) upon the loss of normal feedwater supply, assuming the worst case single failure. TheAFW System consists of two motor driven AFW pumps and one steam turbine driven AFWpump. Each motor driven AFW pump provides at least 50% of the AEW flow capacity assumedin the accident analysis. After reactor shutdown, decay heat eventually decreases so that onemotor driven AFW pump can provide sufficient SG makeup flow. The steam driven AFW pumphas a rated capacity approximately double that of a motor driven AFW pump and is thus defined*as a 100% capacity pump.Given the worst case single failure, the AFW System is designed to mitigate the consequences ofnumerous design basis accidents, including Feedwater Line Break, Loss of Normal Feedwater,Steam Generator Tube Rupture, Main Steam Line Break, and Small Break Loss of CoolantAccident.MILLSTONE -UNIT 3B 3/4 7-2MILLTON -NIT3 B3/47-2Amendment No. 0-2, 3-, 0, LBDCR 14-MIP3-006July 8, 2014PLANT SYSTEMSBASESAUXILIARY FEED WATER SYSTEM (Continued)In addition, given the worst case failure, the AFW is designed to supply sufficient makeupwater to replace SG inventory loss as the RCS is cooled to less than 350°F at which point theResidual Heat Removal System may be placed into operation.Motor driven auxiliary feedwater pumps and associated flow paths are OPERABLE in thefollowing alig-nment during normal operation below 10% RATED THIERMVAL POWER.*Motor operated isolation valves (3FWA*MOV35A/B/CiD) are open in MODE 1, 2 and 3,*Control valves (3FWA*HV3 1A/B/C/D) may be throffled or closed during alignment,operation and restoration of the associated motor driven AFW pump for steam generatorinventoly control.The motor operated isolation valves must remain fully open due to single failure criteria(the valves and associated pump are powered from the opposite electrical trains).The Turbine Driven Auxiliary Feedwater (TDAFW) pump and associated flow paths areOPERABLE with all control and isolation valves fully open in MODE 1, 2 and 3. Due to HighEnergy Line Break analysis, the TDAFW pump cannot be used for steam generator inventorycontrol during normal operation below 10% RATED THERMAL POWER.At M/IPS 3, only two of the three available steam supplies are required to establish anOPERABLE steam supply sys~tem. With one of the two required steam supplies inoperable,normally the third steam supply will be used to satisfy the requirement for two OPERABLEsteam supplies. If the third steam supply is also inoperable (i.e., only one steam supply to theturbine-driven auxiliary feedwater pump is OPERABLE), then ACTION a. is entered.If the turbine-driven auxiliary feedwater pump is inoperable due to one required steamsupply being inoperable in MODES 1, 2, and 3, or ifra turbine-driven auxiliary feedwater pump isinoperable while in MODE 3 immnrediately following REFUELING, action must be taken torestore the inoperable equipment to an OPERABLE status within 7 days. The 7 day allowedoutage time is reasonable, based on the following reasons:MILLSTONE -UNIT 3B 3/4 7-2aMILLTONE- UNT 3 3/47-2aAmendment No. 03, 4-39, 4-5-0 LBDCR No. 04-MP3-011November 10, 2005PLANT SYSTEMSBASESAUXILIARY FEED WATER SYSTEM (Continued)a. For the inoperability of the turbine-driven auxiliary feedwater pumrp due to onerequired steam supply to the turbine-driven auxiliary feedwater pump beinginoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwaterpump is operable), the 7 day allowed outage time is reasonable since the auxiliary* feedwater system design affords adequate redundancy for the steam supply line forthe turbine-driven pump.b. For the inoperability of a turbine-driven auxiliary feedwater pump while in MODE3 ilmmediately subsequent to a refueling, the 7 day allowed outage time is* reasonable due to the minimal decay heat levels in this situation.c. For both the inoperability of the turbine-driven auxiliary feedwater pump due toone required steam supply to the turbine-driven auxiliary feedwater pump beinginoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwaterpump is operable), and an inoperable turbine-driven auxiliary feedwater pumpwhile in MODE 3 imxmediately following a refueling outage, the 7 day allowedoutage time is reasonable due to the availability of redundant OPERABLE motordriven auxiliary feedwater pumps, and due to the low probability of an eventrequiring the use of the turbine-driven auxiliary feedwater pump.The required ACTION dictates that if either the 7 day allowed outage time is reached theunit must be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWNwithin the following 12 hours.The allowed time is reasonable, based on operating experience, to reachithe requiredconditions from full power conditions in an. orderly manner and without challenging plantsystems.A Note limits the applicability of the inoperable equipment condition b. to when the unithas not entered MODE 2 following a REFUELING. Required ACTION b. allows one auxilia-yfee~dwater pump to be inoperable for 7 days vice the 72 hour allowed outage time in requiredACTION c. This longer allowed outage thne is based on the reduced decay heat followingREFUELING and prior to the reactor being critical.With one of the auxiliary feedwater pumps inoperable in MODE 1, 2, or 3 for reasonsother than ACTION a. or b., ACTION must be taken to restore OPERABLE status within 72hours. This includes the loss of three steam supply lines to the turbine-driven auxiliary feedwaterpump. The 72 hour allowed outage time is reasonable, based on redundant capabilities affordedby the auxiliamy feedwater system, time needed for repairs, and the low probability of a DBAoccurring during this time period. Two auxiliary feedwater pumps and flow pathls remain tosupply feedwater to the steam generators.MILLSTONE -UNIT 3B 3/4 7-2bMILLTON -NIT B /4 -2bAmendment No. -!-02-, 4-39, -0, LBDCR 12-MIP3-010September 20, 2012PLANT SY STEMSBASESAUXILIARY FEED WATER SYSTEM (Continued)If all thr'ee AFW pumps are inoperable in MODE 1, 2, or 3, the unit is in a seriouslydegraded condition with no safety related means for conducting a cooldown, and only limitedmeans for conducting a cooldown with non safety related equipment. In such a condition, the unitshould not be perturbed by any action, including a power change, that might result in a trip. Theseriousness of this condition requires that action be started immediately to restore oneAFW pumpto OPERABLE status. Required ACTION e. is modified by a Note indicating that all requiredMODE changes or power reductions are suspended until one AFW pump is restored toOPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into aless safe conditio~n.SR 4.7.1.2.1 a. verifies the correct alignment for manual, power operated, and automaticvalves in the auxiliaiy¢ feedwater water and steam supply flow paths to provide assurance that theproper flow paths exist for auxiliary feedwater operation. This SR does not apply to valves thatare locked, sealed, or otherwise secured in position, since these valves are verified to be in thecorrect position prior to locking, sealing, or securing. This SR also does not apply to valves thatcannot be inadvertently misalign~ed, such as check valves. This Surveillance does not require anytesting or valve manipulations; rather, it involves verification that those valves capable ofpotentially being mispositioned are in the correct position. The surveillance fr'equency iscontrolled under the Surveillance Frequency Control Program.*The SR is modified by a Note that states one or more auxiliary feedwater pumps may beconsidered OPERABLE during alignment and operation for steam generator level control, if it iscapable of being manually (i.e., remotely or locally, as appropriate) realigned to the auxiliaryfeedwater mode of operation, provided it is not otherwise inoperable. This exception to pumpOPERABILITY allows the pump(s) and associated valves to be out of their normal standbyalignment and temporarily incapable of automatic initiation without declaring the pump(s)inoperable. Since auxiliary feedwater may be used during STARTUP, SI{UTDOWN, HOTSTANDBY operations, and HOT SHUTDOWN operations for steam generator level control, andthese mmaual operations are an accepted function of the auxiliatry feedwater system,OPERABILITY (i.e., the intended safety function) continues to be maintained.MILLSTONE -UNIT 3 B3472 mnmn oB 3/4 7-2cAmendment No. LBDCR 14-MiP3-006July 8, 2014AUXILIARY FEED WATER SYSTEM (Continued)Surveillance Requirement 4.7.1.2.1 .b, which addresses periodic surveillance testing of theAFW pumps to detect gross degradation caused by impeller structural damage or other hydrauliccomponent problems, is required by the ASME GM Code. This type of testing may beaccomplished by measuring the pump developed head at only one point on the pumpcharacteristic curve. This verifies both that the measured performance is within an acceptabletolerance of the original pumps baseline performance and that the performance at the test flow isgreater than or equal to the performance assumed in the unit safety analysis. The surveillancerequirements are specified in the Inservice Testing Program, which encompasses the ASME OMCode. The ASME GM Code provides the activities and frequencies necessary to satisfy therequirements.This surveillance is modified by a note to indicate that the test can be deferred for thesteam driven AFW pump until suitable plant conditions are established. This deferral is requiredbecause steam pressure is not sufficient to perform the test until after MODE 3 is entered.However, the test, if required, nmst be performed prior to entering MODE 2.Surveillance Requirement 4.7.1.2.1 .c demonstrates that each AFW pump starts on receiptof an actual or simulated actuation signal. The surveillance frequency is controlled under theSurveillance Frequency Control Program. The actuation logic is tested as part of the EngineeredSafety Feature Actuation System (ESFAS) testing, and equipment performance is monitored aspart of the Inservice Testing Program.Surveillance Requirement 4.7.1.2.2 demonstrates the AFW System is properly aligned byverifying the flow path to each steam generator prior to entering MODE 2 after more than 30 daysin any comnbination of MODE 5 or 6 or defueled. OPERABILITY of the AFW flow paths must beverified before sufficient core heat is generated that would require operation of the AFW Systemduring a subsequent shutdown. To further ensure AEW System alignmaent, the OPERABILITY ofthe flow paths is verified following extended outages to determnine that no misalignment of valveshas occurred. The frequency is reasonable, based on engineering judgenment, and otheradministrative controls to ensure the flow paths are OPERABLE.MILLSTONE -UNIT 3 B3472B 3/4 7-2d LBDCR 14-MP3-006July 8, 2014PLANT SYSTEMSBASES3/4.7.1.3 DEM1hERALIZED WATER STORAGE TANKThe OPERABILITY of the demineralized water storage tank (DWST) with a 334,000gallon minimum measured water volume ensures that sufficient water is available to maintain thereactor coolant system at HOT STANDBY conditions for 7 hours with steam discharge to theatmosphere, concurrent with a total loss-of-offsite power, and with an additional 6-hour cooldownperiod to reduce reactor coolant temperature to 350°F. The 334,000 gallon required water volumecontains an allowance for tank inventory not usable because of tank discharge line location, othertank physical characteristics, and surveillance measurement uncertainty considerations. Theinventory requirement is conservatively based on 120°F water temperature which maximizesinventory required to remove RCS decay heat. In the event of a feedline break, this inventoryrequirement includes an allowance for 30 minutes of spillage before operator action is credited toisolate flow to the line break.If the combined condensate storage tank (CST) and DWST inventory is being credited,there are 50,000 gallons of unusable CST inventory due to tank discharge line location, otherphysical characteristics, level measurement uncertainty and potential measurement bias error dueto the CST nitrogen blanket. To obtain the Surveillance Requirement 4.7.1.3.2's DWST andCST combined volume, this 50,000 gallons. of unusable CST inventory has been added to the334,000 gallon DWST water volume specified in LCO 3.7.1.3 resulting in a 384,000 gallons 0requirement (334,000 + 50,000 = 384,000 gallons).3/4.7.1.4 SPECIFIC ACTIVITYThe limitations on Secondary Coolant System specific activity ensure that the resultantoffsite radiation dose will be limited to 10 CFR 50.67 and Regulatory Guide 1.183 dose guidelinevalues in the event of a steam line rupture. This dose also includes thae effects of a coincident1 gpm primary-to-secondary tube leak in the steam generator of the affected steam line. Thesevalues are consistent with the assumptions used in the safety analyses.MILLSTONE -UNIT 3 B 3/4 7-2e LBDCR No. 08.-MP3-032Octobher 28, 2008PLANT SYSTEMSBASES3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVESBACKGROUNDThe main steam line isolation valves (MSIVs) isolate steam flow from the secondary side of thesteam generators following a high energy line break (HELB). MSIV closure terminates flowfrom the unaffected (intact) steam generators.One MSIV is located in each main steam line outside, but close to, containment. The MSIVs aredownstream from the main steam safety valves (MSSVs) and auxiliary feedwater (AFW) pumpturbine steam supply, to prevent MSSV and AFW isolation from the steam generators by MSIVclosure. Closing the MSIVs isolates each steam generator from the others, and isolates theturbine, Steam Bypass System, and other auxiliary steam supplies from the steam generators.The MSIVs close on a main steam isolation signal generated by low steam generator pressure,high containment pressure, or steam line pressure negative rate (high). The MSIVs fail closed onloss of control or actuation power.Each MSIV has an MSIV bypass valve. Although these bypass valves are normally closed, theyreceive the same emergency closure signal as do their associated MSIVs. The MSIVs may alsobe actuated manually.A description of the MSIVs is found in the FSAR, Section 10.3.APPLICABLE SAFETY ANALYSISThe design basis of the MSIVs is established by the containment analysis for the large steam linebreak (SLB) inside containment, discussed in the FSAR, Section 6.2. It is also affected by theaccident analysis of the SLB events presented .in the FSAR, Section 15.1.5. The design precludesthe blowdown of more than one steam generator, assuming a single active component failure(e.g., the failure of one MSIV to close on demand).The limiting temperature case for the containment analysis is the SLB inside containment, at102% power with mass and energy releases based on offsite power available following turbinetrip, and failure of the MSIV on the affected steam generator to close.At hot zero power, the steam generator inventory and temperature are at their maximum,maximizing the analyzed mass and energy release to the containment. Due to reverse flow andfailure of the MSIV to close, the additional mass and energy in the steam headers downstreamfrom the other MSIV contribute to the total release. With the most reactive rod cluster controlassembly assumed stuck in the fully withdrawn position, there is an increased possibility that thecore will become critical and return to power. The reactor is ultimately shut down by the boricacid injection delivered by the Emergency Core Cooling System.MILLSTONE -UNIT 3B3/73AmnetNoB 3/4 7-3Amendment No. LBDCR No.-0)4-MP3-0 15February 24, 2005PLANT SYSTEMSBASES3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued)The accident analysis compares several different SLB events against different acceptance criteria.The large SLB outside containment upstream of the MSIVs is limiting for offsite dose, although abreak in this short section of main steam header has a very low probability. The large SLBupstream of the MSIV at hot zero power is the limiting case for a post trip return to power. The ,analysis includes scenarios with offsite power available and with a loss of offsite power followingturbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolantthrough the steam generators, maximizing the Reactor Coolant System cooldown. With a loss ofoffsite power, the response of mitigating systems is delayed. Significant single failuresconsidered include failure of an MSIV to close.The MSIVs serve only a safety function and remain open during POWER OPERATION. Thesevalves operate under the following situations:a. An HELB inside containment. In order to maximize the mass and energy release intocontainment, the analysis assumes that the MSIV in the affected steam generator remainsopen. For this accident scenario, steam is discharged into containment from all steamgenerators until the remaining MSIVs close. After MSIV closure, steam is discharged intocontainment only from the affected steam generator and from the residual steam in themain steam header downstream of the closed MSIVs in the unaffected loops. Closure ofthe MSIVs isolates the break from the unaffected steam generators.b. A break outside of containment and upstream from the MSIVs is not a containmentpressurization concern. The uncontrolled blowdown of more than one steam generatormust be prevented to limit the potential for uncontrolled RCS cooldown and positivereactivity addition. Closure of the MSIVs isolates the break and limits the blowdown to asingle steam generator.c. A break downstream of the MSIVs will be isolated by the closure of the MSIVs.d. Following a steam generator tube rupture, closure of the MSIVs isolates the rupturedsteam generator from the intact steam generators. In addition to minimizing radiologicalreleases, this enables the operator to maintain the pressure of the steam generator with theruptured tube below the MSSV setpoints, a necessary step toward isolating the flowthrough the rupture.e. The MSIVs are also utilized during other events, such as a feedwater line break. Thisevent is less limitinig so far as MSIV OPERABILITY is concerned.MILLSTONE -UNIT 3B 3/4 7-4MILLTONE- UNT 3 3/47-4Amendment No. 4-1-9, 41-3-6, PLANT SYSTEMS10/19/i00BASES3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued)LCOThis [CO requires that four MSIVs in the steam lines be OPERABLE. The MSIVs areconsidered OPERABLE when the isolation times are within limits, and they closeon an isolation actuation signal.This LCO provides assurance that the MSIVs will perform their design safetyfunction to mitigate the consequences of accidents that could result in offsiteexposures comparable to the 1OCFRIOO limits or the NRC Staff approved licensingbasis.APPLICABILITYThe MSIVs must be OPERABLE in MODE 1 and in MODES 2, 3, and 4 except when closedand deactivated when there is significant mass and energy in the RCS and steamgenerators. When the MSIVs are closed, they are already performing the safetyfunction.In MODES 1, 2, and 3 the MSIVs are required to close within 10 seconds to ensurethe accident analysis assumptions are met. In MODE 4 the MSIVs are required toclose within 120 seconds to ensure the accident analysis assumptions are met.*i An engineering evaluation has determined that a Reactor Coolant System (RCS)temperature greater than or equal to 320°F is required to provide sufficientsteam energy to provide the motive force to operate the MSIVs. Therefore, belowan RCS temperature of 320°F the MSIVs are not OPERABLE and are required to beclosed.In MODE 5 or 6, the steam generators do not contain much energy because theirtemperature is below the boiling point of water; therefore, the MSIVs are notrequired for isolation of potential high energy secondary system pipe breaks inthese MODES.ACTIONSMODE 1With one MSIV inoperable in MODE 1, action must be taken to restore OPERABLEstatus within 8 hours. Some repairs to the MSIV can be made with the unit hot.The 8 hour Completion Time is reasonable, considering the low probability of anaccident occurring during this time period that would require a closure of theMSIVs.The 8 hour Completion Time is greater than that normally allowed for containmentisolation valves because the MSIVs are valves that isolate a closed systempenetrating containment. These valves differ from other containment isolationvalves in that the closed system provides a passive barrier for containmentO isolation.MILLSTONE -UNIT 3 B 3/4 7-5 Amendment No. 1 85 PLANT SYSTEMS10119100BASES3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued)If the MSIV cannot be restored to OPERABLE status within 8 hours, the plantmust be placed in a MODE in which the LCO does not apply. To achieve thisstatus, the unit must be placed in MODE 2 within 6 hours. The ComPletionTimes are reasonable, based on operating experience, to reach MODE 2 and toclose the MSIVs in an orderly manner and without challenging plant systems.MODES 2. 3. and 4Since the MSIVs are required to be OPERABLE in MODES 2, 3, and 4, theinoperable MSIVs may either be restored to OPERABLE status or closed. Whenclosed, the MSIVs are already in the position required by the assumptions inthe safety analysis. The MSIVs may be opened to perform SurveillanceRequirement 4.7.1.5.2.The 8 hour Completion Time is consistent with that allowed in MODE 1.For inoperable MSIVs that cannot be restored to OPERABLE status within thespecified Completion Time, but are closed, the inoperable MSIVs must beverified on a periodic basis to be closed. This is necessary to ensure thatthe assumptions in the safety analysis remain valid. The 7 day verificationtime is reasonable, based on engineering judgment, in view of MSIV statusindications available in the control room, and other administrative controls,to ensure that these valves are in the closed position.If the MSIVs cannot be restored to OPERABLE status or are not closed withinthe associated Completion Time, the unit must be placed in a MODE in which theLCO does not apply. To achieve this status, the unit must be placed at leastin MODE 3 within 6 hours, and in MODE 5 within the next 30 hours. The allowedCompletion Times are reasonable, based on operating experience, to reach therequired unit conditions from MODE 2 conditions in an orderly manner andwithout challenging unit systems. The Action Statement is modified by a noteindicating that separate condition entry is allowed for each MSIV.SURVEILLANCE REQUIREMENTS4.7.1.5.1 DELETEDMILLSTONE -UNiT 3 B 3/4 7-6 Amendment No. 7$,185 PLANT SYSTEMS10/19100BASESSURVEILLANCE REQUIREMENTS (continued)4.7.1.5.2 This surveillance demonstrates that MSIV closure time is less than10 seconds (120 seconds for MODE 4 only) on an actual or simulated actuationsignal, when tested pursuant to Specification 4.0.5. A simulated signal isdefined as any of the following engineering safety features actuation systeminstrumentation functional units per Technical Specifications Table 4.3-2:4.a.1) manual initiation, individual, 4.a.2) manual initiation system, 4.c.containment pressure high-2, 4.d. steam line pressure low, or 4.e. steam linepressure -negative rate high. The MSIV closure time is assumed in theaccident analyses. This surveillance is normally performed upon returning theplant to operation following a refueling outage. The test is normallyconducted in MODES 3 or 4 with the plant at suitable (appropriate) conditions(e.g., pressure and temperature). The MSIVs should not be tested at power,since even a part stroke exercise increases the risk of valve closure when theunit is generating power.This surveillance requirement is modified by an exception that will allowentry into and operation in MODES 3 and 4 prior to performing the test toestablish conditions consistent with those under which the acceptancecriterion was generated. Successful performance of this test within therequired frequency is necessary to operate in MODES 3 and 4 with the MSIVsopen, to enter MODE 2 from MODE 3, and for plant operation in MODE 1. If thissurveillance has not been successfully performed within the requiredfrequency, the MSIVs. are inoperable and are required to be closed.In MODE 4 only, the MSIVs can be considered OPERABLE if the closure time isless than 120 seconds. An engineering evaluation has determined that a RCStemperature greater than or equal to 320°F is required to provide sufficientsteam energy to provide the motive force to operate the MSIVs. Therefore,below an RCS temperature of 320°F the MSIVs are not OPERABLE and are requiredto be closed.MILLSTONE -UNIT 3B 3/4 7-6aMILLTON -NIT B /4 -5aAmendment No. X~g 185 REVERSE OF PAGE B 3/4 7-6aINTENTIONALLY LEFT BLANK LBDCR No. 04-MP3--015February 24, 2005PLANT SYSTEMSBASES3/4.7.1.6 STEAM GENERATOR ATMOSPHERIC RELIEF BYPASS LINESThe OPERABILITY of the *steam generator atmospheric relief bypass valve (SGARBV)lines provides a method to recover from a steam generator tube rupture (SGTR) event dulringwhich the operator i's required to perform a-limited coo ldbwn establish adequate sub cooling asanecessary step to *limit the primary to secondary break flow into* the r, ptured steam generator..The time required to limit the primary to"secondary break flow for an SGTR event is more criticalthan the time required to cooldown to RHR entry conditions. Because of these time constraints,these valves afnd associated flow paths must be OPERABLE from the control room. The numberof SGA.RB Vs requiredi to be OPERABLE from the control room to satisfy the S GTR accident.analysis requires consideration of single failure criteria; Four SGARBV are required to beOPER~ABLE to ensure the credited steam release pathways available to conduct a unit cooldownfollowing a SGTR."For other design events, the SGARBVs provide a safety grade method for cooling the unit toresidual heat removal (RHR) entry conditions should the preferred heat sinik via the steam bypasssystem or the steam generator atmospheric relief valves be unavailable. Prior to operator action tocooldown, the main steam safety valves (MS SVs) are assumed to operate automatically to relievesteam and maintain the, steam generator pressure below design limits.Each SGARIBV line consists of one SGARBV and an associated block valve (main steamatmospheric relief isolation valve, 3MSS*MOV18SA/B/C/D). These block valves are used in theevent a steam generator atmospheric relief valve (S GARY) or SGARBV fails to close. Becauiseof the electrical power relationship .b.etw~en the SGARV and the block v~alys,.if a b~iqok yaly.e, ismaintained closed, the SGARBV flow path is inoperable because of single failure consideration.The bases for the required ACTIONS can be found in NUREG 1431, Rev. 1.The LCO APPLICABILITY and ACTION statements uses the terms "MODE 4 whensteam generator is relied *upon for heat removal" and "in MODE 4 without reliance upon steamgenerator for heat removal." This means that those steam generators which are credited for decayheat removal to comply with LCO 3.4.1.3 (Reactor Coolant System, HOT SHUTDOWN) shallhave an OPERABLE SGARBV line. See Bases Section 3/4.4.1 for more detail.3/4.7..2 DELETEDMILLSTONE -UNIT 3 B 3/4 7-7 Amendment No. 4-46, -448, 1-54-, 2-4,Acknowledged by NRC letter dated 08/25/05. LBDCR 3-22-02March 14, 2002PLANT SYSTEMSBASES3/4.7.3 REACTOR PLANT COMPONENT COOLING WATER SYSTEMThe OPERABILITY of the Reactor Plant Component Cooling Water. System ensures thatsufficient cooling capacity is. available for continued operation of safety-related equipment duringnormal and accident conditions. The redundant cooling capacity of this system, assuming a singlefailure, is. consistent with the assumptions used in. the safety analyses.The Charging Pump/Reactor Plant Componenit Cooling Water Pump.Ventilation System isrequired to be available to. support reactor plant component cooling water pump operation. TheCharging Pump/Reactor Plaint Component Cooling Water Pump Ventilation System consists oftwo redundant trains, each capablle of providing 100% of the required flow. Each train has. a twoposition, and "Auto," renmote control S'witch. With the remote control switches for each trainin the "Auto" position, the system is capable of automatically transferring operation to theredundant train in the event of a low flow condition in the..operating train. The associated fans donot receive any safety related automatic start.signals (e.g., Safety Injection Signal).Placing the remote control switch for a Charging Pump/Reactor Plant Component CoolingWater Pump Ventilation Train in the "Off' position to start the redundant train or to perform postmaintenance testing to verify availability of the redundant train will not affect the availability ofthat train, provided appropriate administrative controls have been established to ensurethe remote.control switch is immediately returned to the "Auto" position after the completion of the specifiedactivities or in response to plant conditions. These administrative controls include the use of anapproved procedure and a designated individual .at the control switch for the respective ChargingPumpReaetor" Planit Comrponeni Cooling'Water PUmp Ventilatiori Train Who6 apidly respondto instructions from procedures, or control room personnel, based on plant conditions.3/4.7.4 SERVICE WATER SYSTEMThe OPERABILITY of the Service Water System ensures that 'sufficient cooling capacityis available for contintied operation of safety-related equipmen~t during nonmal land accidentconditions. The redundant.cooling Capacity of this system, assuming a single failure, is consistentwith the assumptions used in the safety analyses.An OPERABLE service water loop requires one OPERABLE service water pump and .associated strainer. Two OPERABLE service water loops, with one OPERABLE service waterpump and associated strainer per loop, will provide sufficient core (and containment) decay heatremoval during a design basis accident coincident with a loss of offsite power and a single failure.MILLSTONE -UNIT 3 B 3/4 7-7a Amendment No. 4-4-~,' Acknowledged by NRC letter dated 08/25/05 LBDCR No. 13-MP3-002May 2, 2013PLANT SYSTEMSBASES3/4.7.5 ULTIMATE HEAT SINKBACKGROUNDThe ultimate heat sink (UIIS) for Millstone Unit No. 3 is Long Island Sound. The Long IslandSound is connected to the Atlantic Ocean and provides the required 30 day supply of water. Itserves as a heat sink for both safety and nonsafety-related cooling systems. Sensible heat isdischarged to the UHS via the service water (SW) and circulating water (CWV) systems.The basic performance requirement is that a 30 day supply of water be available, and that thedesign basis temperatures of safety related equipment not be exceeded.Additional information on the design and operation of the system, along with a list of componentsserved, can be found in References 1, 2, and 3.APPLICABLE SAFETY ANALYSESThe UIHS is the sink for heat removed from the reactor core following all accidents andanticipated operational occurrences in which the unit is cooled down and placed on residual heatremoval (RTIR) operation. With UHS as the normal heat sink for condenser cooling via the CWSystem, unit operation at full power is its maximum heat load. Its maximum post accident heatload occurs <1 hour after a design basis loss of coolant accident (LOCA). Near this time, the unitswitches from injection to recirculation and the containment recirculation system removes thecore decay heat.The operating limits are based on conservative heat transfer analyses for the worst case LOCA.References 1, 2, and 3 provide the details of the assumptions used in the analysis, which includeworst expected meteorological conditions, conservative uncertainties .when calciulating decayheat, and worst case single active failure (e.g., single failure of a man-made structure).The limitations on the temperature of the UTHS ensure that the assumption for temperature used inthe analyses for cooling of safety related components by the SW system are satisfied. Theseanalyses ensure that under normal operation, plant cooldown, or accident conditions, allcomponents cooled directly or indirectly by SW will receive adequate cooling to perform theirdesign basis functions.The UHS satisfies Criterion 3 of 10 CFR 50.3 6(c)(2)(ii).LCOThe UHS is required to be OPERABLE and is considered OPERABLE if it contains a sufficientvolume of water at or below the maximum temperature that would allow the SW System tooperate for at least 30 days following the design basis LOCA without the loss of net positiveMILLSTONE -UNIT 3B347-AmnetNo43-B 3/4 7-8Amendment No. 4-36 REVERSE OF PAGE B 3/4 7-8INTENTIONALLY LEFT BLANK LBDCR No. 13-MP3-002May 2, 2013PLANT SYSTEMSBASESLCO (Continued)suction head (NP SH), and without exceeding the maximum design temperature of the*equipment served by the SW System. To meet this condition, the UHS temperature shouldnot exceed 80°F during normal unit operation.While the use of any supply side SW temperature indication is adequate to ensurecompliance with the analysis assumptions, precision instruments installed at the inlet to thereactor plant closed cooling water (RPCCW) (CCP) heat exchanges will normally be used.Therefore, instrument uncertainty need not be factored into the surveillance acceptancecriteria. All in-service instruments must be within the limit. If all of the precisioninstruments are out of service, alternative instruments that measure SW supply sidetemperature will be used. In this case, an appropriate instrument uncertainty will besubtracted from the acceptance criteria.Since Long Island Sound temperature changes relatively slowly and in a predictable fashionaccording to the tides, it is acceptable to monitor this temperature daily when there is ample(>5°F) margin to the limit. When within 50F of the limit, the temperature shall be monitoredevery 6 hours to ensure that tidal variations are appropriately captured.APPLICABILITYIn MODES 1, 2, 3, and 4, the UHS is required to support the OPERABILITY of theequipment serviced by the UHS and required to be OPERABLE in these MODES.In MODE 5 or 6, the OPERABILITY requirements of the uHS are determined by thesystems its supports.ACTIONIf the UHS is inoperable, the unit must be placed in a MODE in which the LCO does notapply. To achieve this status, the unit must be placed inl at least HOT STANDBY within6 hours and in COLD SHUTDOWN within the following 30 hours.The allowed outage times are reasonable, based on operating experience, to reach therequired unit conditions from full power conditions in an orderly manner and withoutchallenging unit systems.MILLSTONE -UNIT 3 B 3/4 7-9 Amendment No. 4-36, LBDCR 13-MP3-002May 2, 2013PLANT SYSTEMSBASESSURVEILLANCE REQUIREMENTSThis surveillance requirement verifies that the UHS is capable of providing a 30 day coolingwater supply to safety related equipment without exceeding its design basis temperature. Thissurveillance requirement verifies that the water temperature of the UHS is < 80°F.REFERENCES1. FSAR, Section 6.2, Containment Systems2. FSAR, Section 9.2, Water Systems3. FSAR, Section 15.6, Decrease in Reactor Coolant Inventory3/4.7.6 DELETED3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEMBACKGROUNDThe control room emergency ventilation system provides a protected environment from whichdoperators can control the unit following an uncontrolled release of radioactivity, hazardous 0chemicals, or smoke. Additionally, the system provides temperature control for the control room :envelope (CRE) during normal and post-accident operations.The control room emergency ventilation system is comprised of the CRE emergency air filtrationsystem and a temperature control system..The control room emergency air filtration system consists of two redundant systems thatrecirculate and filter the air in the CRE and a CRE boundary that limits the inleakage of unfilteredair. Each control room emergency air filtration system consists of a moisture separator, electricheater, prefilter, upstream high efficiency particulate air (IiEPA) filter, charcoal adsorber,downstream 1-EPA filter, and fan. Additionally, ductwork, valves or dampers, andinstrumentation form part of the system.The CRE is the area within the confines of the CRE boundary that contains the spaces that controlroom occupants inhabit to control the unit during normal and accident conditions. This areaencompasses the control room, and other non-critical areas including adjacent support offices,MILLSTONE -UNIT 3 B 3/4 7-10 Amendment No. 44l9, 4-36, 444, g--t4 O LBDCR No...08-MP3-014October 21, 2008PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)BACKGROUND (Continued)toilet and utility rooms. The CRE is protected during normal operation, natural events, andaccident conditions. The CRE boundary is the combination of walls, floor, ceiling, ducting,valves, doors, penetrations and equipment that physically form the CRE. The OPERABILITYof the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into theCRE will not exceed the inleakage assumed in the licensing basis analysis of design basisaccident (DBA) consequences to CRE occupants. The CRE and its boundary are defined inthe Control Room Envelope Habitability Program and UFSAR Section 6.4.2.1.Normal OperationA portion of the control room emergency ventilation system is required to operate duringnorrnial operations to ensure the temperature of the control room is maintained at or below95°0F.Post Accident OperationThe control room emergency ventilation systemn'is re quired to operate during post-accidentoperations to ensure the temperature of the CRE is maintained and to ensure the CRE willremain habitable during and following accident conditions.The following event occurs upon receipt of a control building isolation (CBI) signal or a signalindicating high radiation in the air supply duct to the CRE.The control room emergency ventilation system will automatically start in theemergency mode (filtered pressurization whereby outside air is diverted through thefilters to the CRE to maintain a positive pressure).APPLICABLE SAFETY ANALYSISThe OPERABILITY of the Control Room Emergency Ventilation System ensures that: (1) theambient air temperature does not exceed the allowable temperature for continuous-duty ratingfor the equipment and instrumentation cooled by this system, and (2) the CRE will remainMILLSTONE -UNIT 3B 3/4 7-11MILLTONE- UNT 3 3/4-11Amendment No. 4-3-6, 2-1-, LBDCR No._08-MP3-014October 21, 2008PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)APPLICABLE SAFETY ANALYSIS (Continued)habitable for occupants during and following all credible accident conditions. TheOPERABILITY of this system in conjunction with control room design provisions is based onlimiting the radiation exposure to CRE occupants. For all postulated design basis accidents,the radiation exposure to CRE occupants shall be 5 rem TEDE or less, consistent with therequirements of 10 CFR 50.67. This limitation is consistent with the requirements of GeneralDesign Criterion 19 of Appendix A, 10 CFR Part 50.LIMITING CONDITION FOR OPERATIONTwo independent control room emergency air filtration systems are required to beOPERABLE to ensure that at least one is available in the event the other system is disabled.Total system failure, such as from a loss of both ventilation trains or from an inoperable CREboundary, could result in exceeding a dose of 5 rem TEDE to the CRE occupants in the eventof a large radioactive release.A control room emergency air filtration system is OPERABLE when the associated:a. Fan is OPERABLE;b. HEPA filters and charcoal adsorbers are not excessively restricting flow and arecapable of performing their filtration, functions; andc. moisture separator, heater, ductwork, valveS, and dampers are OPERABLE, and aircirculation can be maintained.In order for the CREVs to be considered OPERABLE, the CRE boundary must be maintainedsuch that the CRE occupant dose from a large radioactive release does not exceed thecalculated dose in the licensing basis consequence analyses for DBAs, and that CREoccupants are protected from hazardous chemicals and smoke.TS LCO 3.7.7 is modified by a footnote allowing the CRE boundary to be openedintermittently under administrative controls. This footnote only applies to openings in theCRE boundary that can be rapidly restored to the design condition, such as doors, hatches,MILLSTONE -UNIT 3B 3/4 7-12MILLTON -NIT B /4 -12Amendment No. 14-6, -2093, 2--9, LBDCR No.-0O8-MP3-014October 21, 2008PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)LIMITING CONDITION FOR OPERATION (Continued)floor plugs, and access panels. For entry and exit through doors, the administrative controlof the opening is performed by the person(s) entering or exiting the area. For otheropenings, these controls should be proceduralized and consist of stationing a dedicatedindividual at the opening who is in continuous communication with the operators in theGRE. This individual will have a method to rapidly close the opening and to restore theCRE boundary to a condition equivalent to the design condition when a need for CREisolation is indicated.Operation of the Control Room Emergency Ventilation System in the emergency mode iscredited for design basis accident mitigation. The fuel handling accident analyses assumethe emergency mode will be established within 30 minutes of a fuel handling accident. Theother applicable design basis accidents (e.g., large break loss of coolant accident) assumethe emergency mode will be established within 101 minutes of the accident. Even thoughmanual operator action to establish the emergency mode could be credited within these timeperiods, the system has been designed to automatically establish the required equipmentalignment upon receipt of a Control Building Isolation signal. Therefore, when stopping aControl Room Emergency Filter Fan by placing the control switch in OFF, the fan remainsOPERABLE. The administrative controls associated-with the procedure in use to stop thefan are sufficient to ensure the associated control switch is returned to the AUTO position.In addition, the Emergency Operating Procedure will ensure a Control Room EmergencyFilter fan is running in the emergency mode post accident well within the credited accidentmitigation time frame.Control Room inlet isolation valves 3HVC*AOV25 and 3HVC*A0V26 are maintainedopen with air isolated whenever Technical Specification 3.7.7 is applicable. The onlyprocedural guidance to close 31H1VC*AO V25 when this specification is applicable is in thealarm response procedure for smoke in the control room air inlet ventilation duct. Thealarm response procedure will provide direction to establish the filtered recirculation modeof operation by restoring air and closing 3HVC*AOV25. During this limited time period,both Control Room Emergency Filtration trains remain OPERABLE, but degraded. Eventhough 3HVC*AOV25 is closed, it is a fail open valve and will automatically open on aControl Building Isolation signal, making it OPERABLE. However, should it to fail open,the system will not function. Therefore, it is not single failure proof and is degraded.Operation in this condition should be minimized.MILLSTONE -UNIT 3B 3/4 7-12aMILLTON -UIT B 34 712aAmendment No. 3-6, -2O)3, 2-1-, REVERSE OF PAGE B 3/4 7-12aINTENTIONALLY LEFT BLANK LBDCR 10-MP3-003February 23, 2010PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)APPLICABILITYIn MODES 1, 2, 3, and 4.During movement of recently irradiated fuel assemblies.ACTIONS a., b., and c. of this specification are applicable at all times during plantoperation in MODES 1, 2, 3, and 4. ACTIONS d. and e. are applicable during movementof recently irradiated fuel assemblies. The CREVs is required to be OPERABLE duringfuel handling involving handling recently irradiated fuel (i.e., fuel that has occupied partof a critical reactor core within the previous 350 hours*).An analysis was completed that analyzed a bounding drop of a non-spent fuel component. Theanalysis showed that the amount of fuel damage from this drop resulted in control room dose lessthan 5 rem TEDE without operation of the control room ventilation system.ACTIONSMODES 1, 2. 3. and 4a. With one control room emergency air filtration system inoperable for reasons other thanan inoperable CRE boundary, action must be taken to restore the inoperable system to anOPERABLE status within 7 days. In this condition, the remaining control roomemergency air filtration system is adequate to perform the CRE occupant protectionfunction. However, the overall reliability is reduced because a single failure in theOPERABLE train could result in a loss of the control room emergency air filtrationsystem function. The 7-day completion time is based on the low probability of a DBAoccurring during this time period, and the ability of the remaining train to provide therequired capability.If the inoperable train cannot be restored to an OPERABLE status within 7 days, the unitmust be placed in at least HOT STANDBY within the next 6 hours and in COLDSHUTDOWN within the following 30 hours. These completion times are reasonable,based on operating experience, to reach the required unit condition from full powerconditions in an orderly manner and without challenging unit systems.*During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuelassemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a criticalreactor core within the previous 525 hours.MILLSTONE -UNIT 3B 3/4 7-13MILLTONE- UNT 3 3/47-13Amendment No. 36, N3-3, LBDCR 07-MP3-033June 25, 2007PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)ACTIONS (Continued)b. With both control room emergency air filtration systems inoperable, except due to an inoperableCRE boundary, at least one control room emergency air filtration system must be restored toOPERABLE status within 1 hour, or the unit must be in HOT STANDBY within the next 6hours and in COLD SHUTDOWN within the following 30 hours. These completion times arereasonable, based on operating experience, to reach the required unit conditions from fullpower conditions in an orderly manner and without challenging unit systems.c. With one or more control room emergency air filtration systems inoperable due to aninoperable CRE boundary, (1) action must be immediately initiated to implementmitigating actions; (2) action must be taken within 24 hours to verify mitigating actions*ensure CRE occupant exposures to radiological and chemical hazards will not exceedlimits, and mitigating actions are taken to smoke hazards; and (3) the CREboundary must be restored to OPERABLE status within 90 days. Otherwise, the unit mustbe in HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within thefollowing 30 hours.If the unfiltered inleakage of potentially contaminated air past the CRE boundary and intothe CRE can result in CRE occupant radiological dose greater than the calculated dose ofthe licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), orinadequate protection of CRE occupants-ffom chemicals or smoke, the CREboundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundarywithin 90 days.During the period that the CRE boundary is considered inoperable, action must be initiatedto implement mitigating actions to lessen the effect on CRE occupants from the potentialhazards of a radiological or chemical event or a challenge from smoke. Actions must betaken within 24 hours to verify that in the event of a DBA, the mitigating actions willensure that CRE occupant radiological exposures will not exceed the calculated dose ofthe licensing basis analyses of DBA consequences, and that CRE occupants are protectedfrom hazardous chemicals and smoke. These mitigating actions (i.e., actions that are takento offset the consequences of the inoperable CRE boundary) should be preplanned forimplementation upon entry into the condition, regardless of whether entry is intentional orunintentional. The 24 hour Completion Time is reasonable based on the low probability ofa DBA occurring during this time period, and the use of mitigating actions. The 90 dayCompletion Time is reasonable based on the determination that the mitigating actions willensure protection of CRE occupants within analyzed limits while limiting the probabilitythat CRE occupants will have to implement protective measures that may adversely affectMILLSTONE -UNIT 3B 3/4 7-13aMILLSONE UNI 3 B3/4 -13aAmendment No. 36, 8--, 2413, 2-2-9, LBDCR 12-MP3-010September 20, 2012PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)ACTIONS (Continued)their ability to control the reactor and maintain it in a safe shutdown condition in the eventof a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, planand possibly repair, and test most problems with the CRE boundary.Immediate action(s), in accordance with the LCO ACTION Statements, means that therequired action should be pursued without delay and in a controlled manner.During movement of recently irradiated fuel assembliesd. With one control room emergency air filtration system inoperable, action must be taken torestore the inoperable system to an OPERABLE status within 7 days. After 7 days, either* initiate and maintain operation of the remaining OPERABLE control room emergency airfiltration system in the emergency mode or suspend the movement of fuel. Initiating andmaintaining operation of the OPERABLE train in the emergency mode ensures:(i) OPERABILITY of the train will not be compromised by a failure of the automaticactuation logic; and (ii) active failures will be readily detected.e. With both control room emergency air filtration systems inoperable, or with the trainrequired by ACTION 'd' not capable of being powered by an OPERABLE emergencypower source, actions must be taken to suspend all operations involving the movement ofrecently irradiated fuel assemblies. This action places the unit in a condition thatminimizes risk. This action does not preclude the movement of fuel to a safe position.SURVEILLANCE REQUIREMENTS4.7.7.aThe CRE environment should be checked periodically to ensure that the CRE temperature controlsystem is functioning properly. The surveillance frequency is controlled under the SurveillanceFrequency Control Program. It is not necessary to cycle the CRE ventilation chillers. The CRE ismanned during operations covered by the technical specifications. Typically, temperatureaberrations will be readily apparent.4.7.7.bStandby systems should be checked periodically to ensure that they function properly. Thesurveillance frequency is controlled under the Surveillance Frequency Control Program.1MILLSTONE -UNIT 3B/4-bAmnetNoB 3/4 7-13bAmendment No. LBDCR 12-MP3-010September 20, 2012PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)SURVEILLANCE REQUIREMENTS (Continued)This surveillance requirement verifies a system flow rate of 1,120 cfln -20%. Additionally, thesystem is required to operate for at least 10 continuous hours with the heaters energized. Theseoperations are sufficient to reduce the buildup of moisture on the adsorbers and HEPA filtersdue to the humidity in the ambient air.4.7.7.cThe performance of the control room emergency filtration systems should be checkedperiodically by verifying the 1HEPA filter efficiency, charcoal adsorber efficiency, minimumflow rate, and the physical properties of the activated charcoal. The frequency is as specified inthe Surveillance Frequency Control Program and following painting, fire, or chemical release inany ventilation zone communicating with the system.ANSI N5 10-1980 will be used as a procedural guide for surveillance testing.Any time the OPERABILITY of a JiEPA filter or charcoal adsorber housing has been affectedby repair, maintenance, modification, or replacement activity, post maintenance testing inaccordance with SR 4.0.1 is required to demonstrate OPERABILITY.4.7.7.c.lThis surveillance verifies that the system satisfies the in-place penetration and bypass leakagetesting acceptance criterion of less than 0.05% in accordance with Regulatory Position C.5.a,C.5.c, and C.5.d of Regulatory Guide 1.52, Revision 2, March 1978, while operating the systemat a flow rate of 1,120 cfm+/-+ 20%. ANSI N510-1980 is used in lieu of ANSI N510-1975referenced in the regulatory guide.4.7.7.c.2This surveillance requires that a representative carbon sample be obtained in accordance withRegulatory Position C.6.b of Regulatory Guide 1.52, Revision 2, March 1978 and that alaboratory analysis verify that the representative carbon sample meets the laboratory testingcriteria of ASTM D3803-89 and Millstone Unit 3 specific parameters. The laboratory analysis isrequired to be performed within 31 days after removal of the sample. ANSI N510-1980 is usedin lieu of ANSI N510-1975 referenced in Revision 2 of Regulatory Guide 1.52.MILLSTONE -UNIT 3B 3/4 7-14MILSTOE UNT 3B /4714Amendment No. -!-3-, 4-84, _2-06 LBDCR 12-MP3-010September 20, 2012PLANT SYSTEMSBASES314.7.7 CONTROL ROOM EMERGENCY VENTILATION sYSTEM (Continued)SURVEILLANCE REGUIREMENTS (Continued)4.7.7.c.3This surveillance verifies that a system flow rate of 1,120 cfrn + 20%, during system operationwhen testing in accordance with ANSI N5 10-1980.4.7.7.dAfter 720 hours of charcoal adsorber operation, a representative carbon sample must beobtained in accordance with Regulatory Position C.6.b of Regulatory Guide 1.52, Revision 2,March 1978, and a laboratory analysis must verify that the representative carbon sample meetsthe laboratory testing criteria of ASTM D3803-89 and Millstone Unit 3 specific parameters.The laboratory analysis is required to be performed within 31 days after removal of the sample.ANSI N510-1980 is used in lieu of ANSI N510-1975 referenced in Revision 2 of RegulatoryGuide 1.52.The maximum surveillance interval is 900 hours, per Surveillance Requirement 4.0.2. The720 hours of operation requirement originates from Nuclear Regulatory Guide 1.52, Table 2,Note C. This testing ensures that the charcoal adsorbency capacity has not degraded belowacceptable limits as well as providing trending data.4.7.7.e. 1This surveillance verifies that the pressure drop across the combined IHEPA filters and charcoaladsorbers banks at less than 6.75 inches water gauge when the system is operated at a flow rateof 1,120 cfmn -20%. The surveillance frequency is controlled under the SurveillanceFrequency Control Program.4.7.7.e.2Deleted.4.7.7.e.3This surveillance verifies that the heaters can dissipate 9.4 4- 1 kW at 480V when tested inaccordance with ANSI N510-1980. The surveillance frequency is controlled under theSurveillance Frequency Control Program. The heater kW measured must be corrected to itsnameplate rating. Variations in system voltage can lead to measurements of kW which cannotbe compared to the nameplate rating becaus~e the output kW is proportional to the square of thevoltage.MILLSTONE -UNIT 3MILSTOE -UNI 3B 314 7-15 Amendment No. 4-3-6,4-1-84-,--84, 2-0-3,20 LBDCR 07-MP3-033June 25, 2007PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)SURVEILLANCE REOUIREMENTS (Continued)4.7.7.fFollowing the complete or partial replacement of a HEPA filter bank, the OPERABILITY of thecleanup system should be confirmed. This is accomplished by verifying that the cleanup systemsatisfies the in-place penetration and bypass leakage testing acceptance criterion of less than0.05% in accordance with ANSI N5 10-1980 for a DOP test aerosol while operating the system ata flow rate of 1,120 cfm d 20%.4.7.7.g_Following the complete or partial replacement of a charcoal adsorber bank, the OPERABILITYof the cleanup system should be confirmed. This is accomplished by verifying that the cleanupsystem satisfied the in-place penetration and bypass leakage testing acceptance criterion of lessthan 0.05% in accordance with ANSI N5I10-1 980 for a halogenated hydrocarbon refrigerant testgas while operating the system at a flow of 1,120 cfmn +/- 20%.4.7.7.h OThis Surveillance verifies the OPERABILITY of the CR3 boundary by testing for unfiltered airinleakage past the CR3 boundary and into the CR3. The details of the testing are specified in theControl Room Envelope Habitability Program.The CR3_ is considered habitable when the radiological dose to CR3 occupants calculated in thelicensing basis analyses of DBA consequences is no more than 5 rem TEDE and the CR3occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfilteredair inleakage into the CR3 is no greater than the flow rate assumed in the licensing basis analysesof DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate,ACTION c. must be entered. ACTION c. allows time to restore the CR3 boundary toOPERABLE status provided mitigating actions can ensure that the CR3 remains within thelicensing basis habitability limits for the occupants following an accident. Compensatorymeasures are discussed in Regulatory Guide 1.196, which endorses, with exceptions, NEI 99-03.These compensatory measures may also be used as mitigating actions as required by ACTION c.Temporary analytical methods may also be used as compensatory measures to restoreOPERABILITY. Options for restoring the CR3 boundary to OPERABLE status include changingthe licensing basis DBA consequence analysis, repairing the CR3 boundary, or a combination ofthese actions. Depending upon the nature of the problem and the corrective action, a full scopeinleakage test may not be necessary to establish that the CR3 boundary has been restored toOPERABLE status.MILLSTONE -UNIT 3 B 3/4 7-16 Amendment No. .-34, _20-3, _206, O LBDCtR-07-MP3-033June 25, 2007PLANT SYSTEMSBASES3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

References:

(1) Nuclear Regulatory Guide 1.52, Revision 2(2) MP3 UFSAR, Table 1.8-1, NRC Regulatory Guide 1.52(3) NRC Generic Letter 9 1-04(4) Condition Report (CR) #M3-99-027 1(5) NEI 99-03, "Control Room Habitability Assessment"(6) Letter from Eric 3. Leeds (NRC)'to James W. Davis (NEI) dated January 30, 2004, "NEIDraft White paper, Use of Generic Letter 91-18 Process and Alternative Source Terms inthe Context of Control Room Habitability."3/4.7.8 DELETEDMILLSTONE -UNIT 3B3/7-7AedntN.4-6B 3/4 7-17Amendment No. LBDCR No. 06-MP3-026October 15, 2006THIS PAGE INTENTIONALLY LEFT BLANKMILLSTONE -UNIT 3B 3/4 7-18Amendment No. 4-36, 20-3, 2-1-9NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026October 15, 2006THIS PAGE INTENTIONALLY LEFT BLANK.ILLSTONE -UNIT. 3B 3/4 7-19... Amendment No. 3-6, 2O-4, 24-9NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026October 15, 2006THIS PAGE INTENTIONALLY LEFT BLANK ..MILLSTONE -UNIT 3B 3/4 7-20.Amendment No.4--36,4--84-, 20-3, 9NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026October 15, 2006* THIS PAGE INTENTIONALLY LEFT BLANKO -UNIT 3B 3/4 7-21Amendment No. 4-3~6, -2Ot-, -246NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026October 15, 2006THIS PAGE INTENTIONALLY LEFT BLANKMILLSTONE TJN{IT 3B 3/4 7-22.Amendment No. 4-36NRC Verbal Acknowledgement: 07/05/07 LBDCR 12-MiP3-010September 20, 2012PLANT SYSTEMSBASES3/4.7.9 AUXILIARY BUILDING FILTER SYSTEMThe OPERABILITY of the Auxiliary Building Filter System, and associated filters andfans, ensures that radioactive materials leaking from the-~equipment within the charging pump,component cooling water pump and heat exchanger areas following a LOCA are filtered prior toreaching the environmnent. Periodic operation of the system with the heaters operating for at least10 continuous hourns is sufficient to reduce the buildup of moisture on the ads orbers and 1-EPAfilters. The surveillance frequency is controlled under the Surveillance Frequency ControlProgram. The operation of thtis system and the resultant effect on offsite dosage calculations wasassumed in the safety analyses. ANSI N510-1980 will be used as a procedural guide forsurveillance testing. Laboratory testing of methyl iodide penetration shall be performed inaccordance with ASTM D3 803-89 aind Millstone Untit 3 specific parameters. The heater kWmeasured must be corrected to its nameplate rating. Variations in system voltage can lead tomeasurements of kW which cannot be compared to the nameplate rating because the output kW isproportional to the square of the voltage.The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System isrequired to be available to support the Auxiliary Building Filter System and the SupplementaiyLeak Collection and Release System (SLCRS). The Charging Pump/Reactor Plant ComponentCooling Water Pump Ventilation System consists of two redundant trains, each capable ofproviding 100% of the required flow. Each train has a two position, "Off' and "Auto," remotecontrol switch. With the remote control switches for each train in the "Auto" position, the systemis capable of automatically transferring operation to the redundant train in the event of a low flowcondition in the operating train. The associated fans do not receive any safety related automaticstart signals (e.g. Safety Injection Signal).Placing the remote control switch for a Charging Pump/Reactor plant Component CoolingWater Pump Ventilation Train in the "Off' position to start the redundant train or to perform postmaintenance testing to verify availability of the redundant train will not affect the availability ofthat train, provided appropriate administrative controls have been established to ensure the remotecontrol switch is immediately returned to the "Auto" position after the completion of the specifiedactivities or in response to plant conditions. These administrative controls include the use Of anapproved procedure and a designated individual at the control switch for the respective ChargingP~ump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respondto instructions from procedures, or control room personne, based on plant conditions.MILLSTONE -UNIT 3 B 3/4 7-23 Amendment No. &-7, 9, -!3, -!-84, LBDCR March 12, 2012PLANT SYSTEMSBASES6LCO 3.7.9 ACTION statement:With one Auxiliary Building Filter System inoperable, restoration to OPERABLE statuswithin 7 days is required.The 7 days restoration time requirement is based on the following: The risk contribution isless for an inoperable Auxiliary Building Filter System, than for the charging pump or reactorplant component cooling water (RPCCW) systems, which have a 72 hour restoration timerequirement. The Auxiliamyr Building Filter System is not a direct support system for the chargingpumps or RPCCW pumps. Because the pump area is a colmmon area, and as long as the other trainof the Auxiliary Building Filter System remains OPERABLE, the 7 day restoration timne limit isacceptable based on the low probability of a DBA occurring during the time period and the abilityof the remaining train to provide the required capability. A concurrent failure of both trains wouldrequire entry into LCO 3.0.3 due to the loss of functional capability. The Auxiliary Building FilterSystem does support the Supplementary Leak Collection and Release System (SLCRS) and theLCO ACTION statement time of 7 days is consistent with that specified for SLCRS (See LCO3.6.6.1).Any time the OPERABILITY of a I{EPA filter or charcoal adsorber housing has beenaffected by repail; maintenance, modification, or replacement activity, post maintenance testing inaccordance with SR 4.0.1 is required to demonstrate OPERABILITY.Surveillance Requirement 4.7.9.c OSurveillance requirement 4.7.9.c requires that after 720 hours of operation a charcoalsample must be taken and the sample must be analyzed within 31 days after removal.The 720 hours of operation requirement originates from Regulatory¢ Guide 1.52, Revision2, March 1978, Table 2, Note "c", which states that "Testing should be perfonne~d (1) initially, (2)at least once per 18 months thereafter for systems maintained in a stanmdby status or after 720hours of system operations, and (3) following painting, fire, or chemical release in any ventilationzone cormmunicating with the system." This testing ensures that the charcoal adsorbencycapacity has not degraded below acceptable limits as well as providing trending data. The 720hour figure is an arbitramyj numaber which is equivalent to a 30 day period. This criteria is directedto filter systems that are normally in operation and also provide emergency air cleaning functionsin the event of a Design Basis Accident. The applicable filter units are not normaally in operationand sample canisters are typically removed due to the 18 month criteria.3/4.7.10 SNUJBBERSAll snubbers are required OPERABLE to ensure that the structural integrity of the ReactorCoolant System and all other safety-related systems is maintained .during and following a seismicor other event initiating dynamic loads. For the purpose of declaring the affected systemOPERABLE with the inoperable snubber(s), an engineering evaluation may be performed, inaccordance with Section 50.59 of 10 CFR Part 50.MILLSTONE -UNIT 3 B 3/4 7-23 a Amendment No. 8-7-, 4-1--9, 4-1-6, -184 Q LBDCR 12-MP3-003March 12, 2012THIS PAGE INTENTIONALLY LEFT BLANKO@} MILLSTONE -UNIT 3B 3/4 7-24Amendment No. 4-6, -7,4-1-9, 43-6, LBDCR 12-MP3-003March 12, 2012PLANT SYSTEMSBASES3/4.7.11 DELETED314.7.14 DELETED0/MILLSTONE -UNIT 3B 3/4 7-25Amendment Nos. g-g,--84, 4-1-, 4-19,1362 14 LBDCR No. 04-MP3-015* February 24, 20053/4.8 ELECTRICAL POWER SYSTEMSBASESI.:3/4.8.1. 3/4.8.2 and 3/4.8.3 A.C. SOURCES, D.C. SOURCES, and ONSITE POWERDISTRIBUTIONThe OPERABILITY of the A.C. and D.C. power sources and associated distributionsystems during operation ensures that sufficient power will be available to supply the safety-related equipment required for: (1) the safe shutdown of the facility, and (2) the mitigation andcontrol of accident conditions within the facility. The minimum specified independent andredundant A.C. and D.C. power sources and distribution systems satisfy the requirements ofGeneral Design Criterion 17 of Appendix A to 10 CFR Part 50.LCO 3.8.1.l.aLCO 3.8.1.1l.a requires two independent offsite power sources. With both the RSST and* the NSST available, either power source may supply power to the Vital busses to meet the intentof Technical Specification 3.8.1.1. The FSAR, and Regulatory Guide 1.32, 1.6, and 1.93 providethe basis for requirements concerning off-site power sources. The basic requirement is to have*two independent offsite power sources. The requirement to have a fast transfer is not Specificallystated. An automatic fast transfer is required for plants without a generator output trip breaker,where power from the NSST is lost on a turbine trip. The surveillance requirement for transferfrom the nonnal circuit' to the alternate circuit is required for a transfer from the NS ST to theRSST in the event Of an electrical failure. There is no specific requirement to have an automatictransfer from the RSST to the NSST...S~i The ACTION requirements specified for the levels of degradation of the power sources;provide restriction upon continued facility operation commensurate with the level of degradation.The OPERBI-BLITY of the power sources are consistent with tche initi'al' conditiotn a~rpti'ons ofthe safety analy~ses anid are based upon. rnain~tainig at !east set of onsite AL., and.D.C. power sb~itees arid associa~ted' distrbtiofin systehs OPERABLE dturing accident conditions:coincident with an assumed loss-of-offsite power and single failure :of the other onsite A.C.source. The A.C. and D.C. source allowable out-of-service times are based in part on RegulatoryGuide 1.93, "Availability of Electrical Power Sources," December 1974. Technical Specification3.8.1.1 ACTION Statements b.2 and: c.2 provide an allowance to avoid unnecessary testing of theother OPERABLE diesel generator. If it can be determined that the cause of the inoperable diesel:generator does no~t exist on the OPERABLE diesel generator, Surveillance Requirement4.8.1.1.2.a.5 does not have to be performed. If the cause of inoperability exists on the otherOPERABLE diesel generator, the other OPERABLE diesel generator would be declaredinoperable upon discovery, ACTION Statement e. would be entered, and appropriate actions willbe taken. Once the failure is corrected, the common cause failure no longer exists, and thlerequired ACTION Statements (b., c., and e.) will be satisfied.If it can not be determined that the cause of the inoperable diesel generator* does not existon the remaining diesel generator, performance of Surveillance Requirement 4.8.1.1 .2.a.5, withinthe allowed time period, suffices to provide assurance of continued OPERABILITY of the dieselgenerator. If the inoperable diesel generator is restored to OPERABLE status prior to thedetermination of the impact on the other diesel generator, evaluation will continue of the possiblecommon cause failure. This continued evatuation is noO i MILLSTONE.- UNIT 3 B 3/4 8-1 Amendment No. 4-1-2,-1,-z0,* Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-01 5February 24, 20053/4.8 ELECTRICAL POWER SYSTEMSBASESlonger under the time constraint imposed while in ACTION Statements b.2 or c.2.The determination of the existence of a common cause failure that would affect theremaining diesel generator will require an evaluation of.the current failure and the applicability tothe remaining diesel generator. Examples that would not be a common cause failure include, butare not limited to:1. Preplanned preventative maintenance or testing; or2. An inoperable support system With no potential common mode failure for theremaining diesel generator; or3. An independently testable component with no potential common mode failure for theremaining diesel generator.'When one diesel generator is inoperable, there is an additional ACTION requirement (b.3and c.3) to verify that all required systems, subsystems, trains, compon~ents addevices, thatdepend on the remaining OPERABLE diesel generator as a source of emergency power, are alsoOPERABLE, and that the steam-driven auxiliary feedwater pump is OPERABLE. Thisrequirement is intended to provide assurance that a loss-of-offsite power event will not result in a.complete loss of safety function of critical systems during the period One of the diesel generatorsis inoperable. The term, verify, as used in this context means to administratively check byexamining logs or other information to determine if certain components are out-of-service formaintenance or other reasons. It does not mean to perform the Surveillance Requirements neededto demonstrate the OPERABILITY of the component.if one Mill~triie Uniit No iS3 diesl Nisinoperaible ini MODES 1 tlhroutghi 4, a 72hour allowed outa~ge time :is :provcided by.ACTQNStat~emt to~allowi restoratiori :of the dieselgenerator, provided" the requirements oi ACTION Statements bi~l, b.2, and b.l3 ar-e met. Thisallowed outage time can be extended to 14 days if the additional requirements contained inACTION Statement b.4 are also met. ACTION Statement b.4 requires verification that theMillstone Unit No. 2 diesel generators are OPERABLE as required by the applicable MillstoneUnit No. 2 Technical Specification (2 diesel generators in MODES 1 through 4, and 1 dieselgenerator in MODES 5 and 6) and the Millstone Unit No. 3 SBO diesel generator is available.The term verify, as used in this context, means to administratively check by examining logs orother information to determine if the required Millstone Unit No. 2 diesel generators 'and the.Millstone Unit No. 3 SBO diesel generator are out of service for maintenance or other reasons. Itdoes not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITYof the required Millstone Unit No. 2 diesel generators or availability of the Millstone Unit No. 3SBO diesel generator.When using the 14 day allowed outage time provision and the Millstone Unit No. 2 dieselgenerator requirements and/or Millstone Unit No. 3 SBO diesel generator requirements .are notmet, 72 hours is allowed for restoration of the required Millstone Unit No. 2 diesel generators andthe Millstone Unit No. 3 SBO diesel generator. If any of the required Millstone Unit No. 2 dieselgenerators and/or Millstone Unit No. 3 SBO diesel generator are not restored Within 72 hours, andone Millstone Unit No. 3 diesel generator is still inoperable, Millstone Unit No. 3 is required toshut down.MILLSTONE -UNIT 3 B 3/4 8-l a Amendment No.14-t-,24-0,Acknowledged by NRC letter dated 08/25/05 LBDCR 14-MP3-013October 16, 20143/4.8 ELECTRICAL POWER SYSTEMSBASESThe 14 day allowed outage time for one inoperable Millstone Unit No. 3 diesel generatorwill allow perfonrmance of extended diesel generator maintenance and repair activities (e.g., dieselinspections) while the plant is operating. To minimize plant risk when using this extended allowedoutage time the following additional Millstone Unit No. 3 requirements must be met:1) The charging pump and charging pump cooling pump in operation shall be poweredfrom the bus not associated with the out of service diesel generator. In addition, thespare charging pump will be available to replace an inservice charging pump ifnecessary.2) The extended diesel generator outage shall not be scheduled when adverse orinclement weather conditions and/or unstable grid conditions are predicted orpresent.3) The availability of the Millstone Unit No. 3 SBO DG shall be verified by testperformance within 30 days prior to allowing a Millstone Unit No. 3 EDG to beinoperable for greater than 72 hours.4) All activity in the switchyard shall be closely monitored and controlled. No electivemaintenance within the switchyard that could challenge offsite power availabilityshall be scheduled.5) A contingency plan shall be available (OP 33 14J, Auxiliary Building EmergencyVentilation and Exhaust) to provide alternate room cooling to the charging and CCPpump area (24' 6" Auxiliary Building) in the event of a failure of the ventilationsystem prior to commencing an extended diesel generator outage.In addition, the plant configuration shall be controlled during the diesel generatormaintenance and repair activities to minimize plant risk consistent with the Configuration RiskManagement Program, as required by 10 CFR 50.65(a) (4).The OPERABILITY of the minimum specified A.C. and D.C.. power sources andassociated distribution systems during shutdown and REFUELING ensures that: (1) the facilitycan be maintained in the shutdown or REFUELING condition for extended time periods, and (2)sufficient instrumentation and control capability is available for monitoring and maintaining theunit status.The Surveillance Requirements for demonstrating the OPERABILITY of the dieselgenerators are in accordance with the recommendations of Regulatory Guides 1.9, "Selection ofDiesel Generator Set Capacity for Standby Power Supplies," March 10, 1971; 1.108, "PeriodicTesting of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear PowerPlants," Revision 1, August 1977; and 1.137, "Fuel-Oil Systems for Standby Diesel Generators,"Revision 1, October 1979. The surveillance frequencies for demonstrating OPERABILITY of thediesel generators are in accordance with the Surveillance Frequency Control Program.LCO 3.8.1.1 ACTION statement b.3 and c.3Required ACTION Statement b.3 and c.3 requires that all systems, subsystems, trains,components, and devices that depend on the remaining OPERABLE diesel as a source ofemergency power be verified OPERABLE.MILLSTONE -UNIT 3 B 3/4 8-lb Amendment No. 1-1-2., , LBDCR 12-MP3-010September 20, 20123/4.8 ELECTRICAL POWER SYSTEMSBASES3/4.8.1, 3/4.8.2, and 3/4.8.3 A.C. SOURCES, D.C. SOURCES, AND ONSITE POWERDISTRIBUTIONTechnical Specification 3.8.1.1 .b. 1 requires each of the diesel generator day tanks contain aminimum volume of 278' gallons. Technical Specification 3.8.1 .2.b.l requires a minimum volumeof 278 gallons be contained in the required diesel generator day tank. This capacity ensures that aminimum usable volume of 189 gallons is available. This volume permits operation of the dieselgenerators for approximately 27 minutes with the diesel generators loaded to the 2,000 hourrating of 5335 kw. Each diesel generator has two independent fuel oil transfer pumps. The shutofflevel of each fuel oil transfer pump provides for approximately 60 minutes of diesel generatoroperation at the 2000 hour rating. The pumps start at day tank levels to ensure the minimum levelis maintained. The loss of the two redundant pumps would cause day tank level to drop below theminimum value.Technical Specification 3.8.1.1i .b.2 requires a minimum volume of 32,760 gallons be contained ineach of the diesel generator's fuel storage systems. Technical Specification 3.8.1 .2.b.2 requires aminimum volume of 32,760 gallons be contained in the required diesel generator's fuel storagesystem. This capacity ensures that a minimum usable volume (29,180 gallons) is available topermit operation of each of the diesel generators for approximately three days with the dieselgenerators loaded to the 2,000 hour rating of 5335 kW. The ability to cross-tie the diesel generatorfuel oil supply tanks ensures that one diesel generator may operate up to approximately six days.Additional fuel oil can be supplied to the site within twenty-four hours after contacting a fuel oilsupplier.Suspending positive reactivity additions that could result in failure to meet the minimum SDM orboron concentration limit is required to assure continued safe operation. Introduction of coolantinventory must be from sources that have a boron concentration greater than that what would berequired in the RCS for minimum SDM or refueling boron concentration. This may result in anoverall reduction in RCS boron concentration, but provides acceptable margin to maintainingsubcritical operation. Introduction of temperature changes including temperature increases whenoperating with a positive MTC must also be evaluated to ensure they do not result in a loss ofrequired SDM.Suspension of these activities does not preclude completion of actions to establish a safeconservative condition. These actions minimize the probability of the occurrence of postulatedevents. It is further required to immediately initiate action to restore the required AC and DCelectrical power source and distribution subsystems and to continue this action until restoration isaccomplished in order to provide the necessary power to the unit Safety systems.Surveillance Requirements 4.8.1.1.2.a.6, 4.8.1.1.2.b.2, and 4.8.1.1.2.jThe Surveillances 4.8.1.l.2.a.6 and 4.8.l.1.2.b.2 verify that the diesel generators are capable ofsynchronaizing with the offsite electrical system and loaded to greater than or equal to continuousrating of the machine. A minimum time of 60 minutes is required to stabilize engine temperatures,wlhileMILLSTONE -UNIT 3MILSTOE UM 3B 3/4 8-ilc Amendment No. 9-7, -I4t-, -t-3-7, 4-94, 24-Q, 2-LBDCR 12-MIP3-010September 20, 20123/4.8 ELECTRICAL POWER SYSTEMSBASESminimizing the time that the diesel generator is connected to the offsite source. SurveillanceRequirement 4.8.1.1 .2.j requires demonstration that the diesel generator can start and runcontinuously at full load capability for an interval of not less than 24 hours, _ 2 hours of which areat a load equivalent to 110% of the continuous duty rating and the remainder of the time at a loadequivalent to the continuous duty rating of the diesel generator. The load band is provided toavoid routine overloading of the diesel generator. Routine overloading may result in morefr'equent teardown inspections in accordance with vendor recommendations in order to maintaindiesel generator OPERABILITY. The load band specified accounts for instrumentationinaccuracies, operational control capabilities, and human factor characteristics. The note (*)acknowledges that a mnomentatmy transient outside the load range shall not invalidate the test. Thesurveillance flequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.8.1 .1.2.a.5, 4.8.1.1 .2.b.1, 4.8.1.1.2.g.4.b, 4.8.1.1.2.g.5, and4.8.1.1.2.g.6.bSeveral diesel generator surveillance requirements specify that the emergency diesel generatorsare started from a standby condition. Standby conditions for a diesel generator means the dieselengine coolant and lubricating oil are being circulatced and temperatures are maintained withindesign ranges. Design ranges for standby temperatures are greater than or equal to the lowtemperature alann setpoints and less than or equal to the standby "keep-wanln" heater shutofftemperatures for each respective sub-system. The surveillance frequency is controlled under theSurveillance Frequency Control Program.Surveillance Requirement 4.8.1.1 .2.jThe existing "standby condition" stipulation contained in specification 4.8.1.1 .2.a.5 is supersededwhen performing the hot restart demonstration required by 4.8.1.1 .2.j.Any time the OPERABILITY of a diesel generator haes been affected by repair, maintenance, orreplacement activity, or by modification that could affect its interdependency, post maintenancetesting in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. The surveillancefrequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3B 3/4 8-1dMILLTO1SE -UNIT3 B3/4 -idAmendment No. 9-7-, 14-2, 4-3-7, 1-94, 4-0 LBDCR 12-MP3-010September 20, 2012ELECTRICAL POWER SYSTEMSBASESA.C. SOURCES. D.C. SOURCES, and ONSITE POWER DISTRIBUTION (Continued)The Surveillance Requirement for demonstrating the OPERABILITY of the station batt~eries arebased on the recommendations of Regulatory Guide 1.129, "Maintenance Testing andReplacement of Large Lead Storage Batteries for Nuclear Power Plants," February 1978, andIEEE Std 450-1975 & 1980, "IEEE Recolmmended Practice for Maintenance, Testing, andReplacement of Large Lead Storage Batteries for Generating Stations and Substations." Sections5 and 6 of IEEE Std 450-1980 replaced Sections 4 and 5 oflIEEE Std 450-1975. Guidance onbypassing weak cells, if required, is in accordance with section 7.4 of IEEE 450-2002. Thebalance of IEEE Std 450-1975 applies. The surveillance frequency is controlled under theSurveillance Frequency Control Program.Verifying average electrolyte temperature above the minimum for which the battery was sized,total battery terminal voltage on float charge, connection resistance values, and the performanceof battery service and discharge tests ensures the effectiveness of the charging system, the abilityto handle high discharge rates, and compares the battery capacity at that time with the ratedcapacity.Table 4.8-2a specifies the normal limits for each designated pilot cell and each connected cell forelectrolyte level, float voltage, and specific gravity. The limits for the designated pilot cells floatvoltage and specific gravity, greater than 2.13 volts and 0.015 below the manufacturer's fullcharge specific gravity or a battery charger current that had stabilized at a low val[ue, ischaracteristic of a charged cell with adequate capacity. The nonnal limits for each connected cellfor float voltage and specific gravity, greater than 2.13 volts and not more than 0.020 below themanufacturer's full charge specific gravity with an average specific gravity of all the connectedcells not more than 0.010 below the manufacturer's full charge specific gravity,.ensures theOPERABILITY and capability o~f the battery.with a battery cell's parameter outside the normal limit but within the allowable valuespecified in Table 4.8-2a is permitted for up to 7 days. During this 7-day period: (l)the allowablevalues for electrolyte level ensures no physical damage to the plates with an adequate electrontransfer capability; (2) the allowable value for the average specific gravity of all the cells, notmore than 0.020 below the manufacturer's recommended full charge specific gravity, ensures thatthe decrease in rating will be less than the safety margin provided in sizing; (3) the allowablevalue for an individual cell's specific gravity, ensures that an individual cell's specific gravity willnot be more than 0.040 below the manufacturer's full charge specific gravity and that the overallcapability of the battery will be maintained within an acceptable limit; and (4) the allowable valuefor an individual cell's float voltage, greater than 2.07 volts, ensures the battery's capability toperform its design function.If the required power sources or distribution systems are not OPERABLE in MODES 5 and 6,operations involving CORE ALTERATIONS, positive reactivity changes, movem-ent of recentlyirradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within theMIfLLSTONE -UNIT 3B348-AmnetNoB 3/4 8-2Amenchnent No. LB3DCR 10-MP3-003February 23, 2010ELECTRICAL POWER SYSTEMSBASESA.C. SOURCES. D.C. SOURCES. and ONSITE POWER DISTRIBUTION (Continued)previous 350 hours*), crane operation with loads over the fuel storage pooi, or operations with apotential for draining the reactor vessel are required to be suspended.3/4.8.4 DELETEDI*During fuel assembly cleaning evolutions that involve the handling or cleaning of twofuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part ofa critical reactor core within the previous 525 hours.MILLSTONE -UNIT 3B 3/4 8-3MILSTOE UNT 3B /4 -3Amendment No. , 89, -I-5-3, 4-7-, 49-2, REVERSE OF PAGE B 3/4 8-3INTENTIONALLY LEFT BLANK 06/28/063/4.9 REFUELING OPERATIONSBASES --. .. ..3/4.9.1 BORON CONCENTRATIONThe limitations on reactivity conditions during REFUELING ensure that: (1) the reactorwill remain subcritical during CORE ALTERATIONS, and (2) a uniform boron concentration ismaintained for reactivity control in the water volume having direct access to the reactor vessel,The value of 0.95 or less for Keff includes a 1% Ak/k conservative allowance for uncertainties.Similarly, the boron concentration value specified in the CORE OPERATING LIMITS REPORTincludes a conserx~ative uncertainty allowance of 50 ppm boron. The boron concentration,specified in the CORE OPERAT[NG LIMITS REPORT, provides for boron concentraitionmeasurement uncertainty between the spent fuel pool and the RWST. The locking closed of the.required valves during refueling operations precludes the possibility of uncontrolled borondilution of the filled portion of the RCS. This action prevents flow to the RCS of unborated waterby closing flow paths from sources of unborated water.MODE ZERO shall be the Operational MODE where all fuel assemblies have beenremoved from containment to the Spent Fuel Pool. Technical Specification Table 1.2 definesMODE 6 as "Fuel in the reactor vessel with the vessel head closure bolts less than fully tensionedor with the head removed." With no fuel in the vessel the definition for MODE 6 no longerapplies. The transition from MODE 6 to MODE ZERO occurs when the last fuel assembly of afull core off load has been transferred to the Spent Fuel Pool and has cleared the transfer canalwhile in transit to a storage location. This will:* Ensure Technical Specifications regarding sampling the transfer canal boron concentrationare observed (4.9.-1.1.2);.* Ensure that MODE 6 Technical Specification requirements are not relaxed prematurelyduring fuel movement in containment.Concerning ACTION a., suspension of CORE ALTERATIONS and positive reactivityadditions shall not preclude moving a component to a safe position. Operations that individuallyadd limited positive reactivity (e.g., temperature fluctuations from inventory addition ortemperature control fluctuations) but when combined with all other operations affecting corereactivity (e.g., intentional boration) result in overall net negative reactivity addition, are notprecluded by this action.MILLSTONE -UNIT 3B 3/4 9-1MiLLSONE -UNIT B 3/ 9-1Amendment No. , 60, 14-8, 41-9, 230 LBDCR No. 10-MP3-006March 9, 20103/4.9 REFUELING OPERATIONSBASES3/4.9.1.2 BORON CONCENTRATION [N SPENT FUEL POOLDuring normal Spent Fuel Pool operation, the spent fuel racks are capable of maintainingKeff at less than or equal to 0.95 in an unborated water environment. This is accomplished inRegion 1, 2, and 3 storage racks by the combination of geometry of the rack spacing, the use offixed neutron absorbers in some fuel storage regions, the limits on fuel burnup, fuel enrichmentand minimum fuel decay time, and the use of blocking devices in certain fuel storage locations.The boron requirement in the spent fuel pool specified in 3.9.1.2 ensures that in the eventof a fuel assembly handling accident involving either a single dropped or misplaced fuelassembly, the Keff of the Spent fuel storage racks will remain less than or equal to 0.95.3/4.9.2 INSTRUMENTATIONThe source range neutron flux monitors are used during refueling operations to monitorthe core reactivity condition. The installed source range-neutron flux monitors are part of theNuclear Instrumentation System (NIS). These detectors are located external to the reactor vesseland detect neutrons leaking from the core.There are two sets of source range neutron flux monitors:(1) Westinghouse source range neutron flux monitors, and(2) Gamma-Metrics source range neutron flux monitors.The Westinghouse monitors are the normal source range monitors used during refueling*activities. Gamma-Metrics source range neutron flux monitors are an acceptable equivalentcontrol room indication for the Westinghouse source range neutron flux Monitors in MODE 6,including CORE Alterations, as follows:with the core in place within the reactor vessel or,with the Gamma Metrics source range neutron flux monitor(s) coupled to the core.Reactor Engineering shall determine whether each monitor is coupled to the core.This limiting condition for operation requires two source range neutron flux. monitors beOPERABLE to ensure that redundant monitoring capability is available to detect changes in corereactivity. To be OPERABLE, each monitor must provide visual indication in the control room. Inaddition, at least one of the two monitors must provide an OPERABLE audible count ratefunction in the control room and containment.MILLSTONE -UNIT 3 B 3/4 9-la Amendment No. 42, 60, 4-58, -204,21-9, 2T3 LBDCR No. 1 0-MP3-006March 9, 20103/4.9 REFUEL[NG OPERATIONSBASESThe limiting condition for operation is satisfied .with either two Westinghouse sourcerange neutron flux monitors OPERABLE, or with any combination that contains oneOPERABLE Westinghouse source range neutron flux monitor (to provide audible indication) andone OPERABLE Gamma-Metrics source range neutron flux monitor that is coupled to the core.With only one Westinghouse source range neutron flux monitor OPERABLE and noGamma-Metrics source range neutron flux monitors oPERABLE, ACTION a. must be entered.With both Westinghouse source range neutron flux monitors inoperable and one or more Gamma-Metrics source range neutron flux monitors OPERABLE and coupled to the core, ACTIONb.must be entered, since the Gamma-Metrics source range neutron flux monitors are incapable ofproviding audible indication in the containment.Concemning ACTION a., with only one of the required source range neutron flux monitor"OPERABLE, redundancy has been lost.. Since these instruments are the only direct means ofmonitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant intothe RCS with borOn concentration less than required to meet the minimum boron concentration ofLCO 3.9.1.1 must be suspended immediately. Suspending positive reactivity additions that couldresult in failure to meet the minimum boron concentration limit is required to assure continuedsafe operation. Introduction of coolant inventory must be from sources that have a boronconcentration greater than that what would be required in the RCS for minimum refueling boronconcentration. This may result in an overall reduction in RCS boron concentration, but providesacceptable margin to maintaining subcritical operation. Performance of ACTION a. shallnotpreclude completion of movement of a component to a safe position.3/4.9.3 DECAY TIMEThe minimum requirement for reactor subcriticalityprior to movement of irradiated fuelassemblies in the reactor vessel ensures that sufficient time has elapsed to allow the radioactivedecay of the short-lived fission products. This decay time is consistent with the assumptions usedin the safety analyses.MILLSTONE -UNIT 3 B349lB 3/4 9-1b LBDCR No. 10-MP3-006March 9, 20103/4.9 REFUIELING OPERATIONSBASES3/4.9.4 CONTAINMENT BUILDING PENETRATIONSS The requirements on containment penetration closure and OPERABILITY ensure that arelease of radioactive material within containment to the environment will be minimized. TheOPERABILITY, closure restrictions, and administrative controls are sufficient to minimize therelease of radioactive material from a fuel element rupture based upon the lack of containmentpressurization potential during the movement of fuel within containment. The containment purgevalves are containment penetrations and must satisfy, all requirements specified for a containmentpenetration. ,:This specification is applicable during the movement of new and spent fuel assemblies within thecontainment building. The fuel handling accident analyses assume that during a fuel handlingaccident some of the fuel that is dropped and some of the fuel impacted upon is damaged.Therefore, the movement of either new or irradiated fuel can cause a fuel handling accident, andthis specification is applicable whenever new or irradiated fuel is moved within the containment.Containment penetrations, including the personnel access hatch doors and equipment accesshatch, can be open during the movement of fuel provided that sufficient administrative controlsare in place such that any 0f these containment penetrations can be closed within 30 minutes.Following a Fuel Handling Accident, each penetration, including the equipment access hatch, isclosed such that a containment atmosphere boundary can be established. However, if it isdetermined that closure of all containment penetrations would represent a significant radiologicalhazard to the personnel involved, the decision may be made to forgo the closure of the affectedpenetration(s). The containment atmosphere boundary is established when any penetration whichprovides direct access to the outside atmosphere is closed such that at least one barrier betweenthe containment atmosphere and the outside atmosphere is established. Additional actionsbeyond establishing the containment atmosphere boundary, such as installing flange bolts for theequipment access hatch or a containment penetration, are not necessary.Administrative controls for opening a containment penetration require that one or moredesignated persons, as needed, be available for isolation of containment from the outsideatmosphere. Procedural controls are also in place to ensure cables or hoses which pass through acontainment opening can be quickly removed. The location of each cable and hose isolationdevice for those cables and hoses which pass through a containment opening is recorded to ensuretimely closure of the containment boundary. Additionally, a closure plan is developed for eachcontainment opening which includes an estimated time to close the containment opening. A logof personnel designated for containment closure is maintained, including identification of whichcontainment openings each person has responsibility for closing. As necessary, equipment will bepre-staged to support timely closure of a containment penetration.MILLSTONE -UNIT 3 B349I mnmn o 3B 3/4 9-1cAmendment No. [ March 17, 20043/4.9 REFUELING OPERATIONSBASES3/4.9.4 CONTAINMENT BUILDING PENETRATIONS (Continued)The ability to close the equipment access hatch penetration within 30 minutes is verified eachrefueling outage prior to the first fuel movement in containment with the equipment access hatchopen. Prior to opening a containment penetration, a review of containment penetrations currentlyopen is performed to verify that sufficient personnel are designated such that all containmentpenetrations can be closed within 30 minutes. Designated personnel may have other duties,however, they must be available such that their assigned containment openings can be closedwithin 30 minutes. Additionally, each new work activity inside containment is reviewed toconsider its effect on the closure of the equipment access hatch, at least one personnel accesshatch door, and/or other open containment penetrations. The required number of designatedpersonnel are continuously available to perform closure of their assigned containment openingswhenever fuel is being moved within the containment.Controls for monitoring radioactivity within containment and in effluent paths from containmentare maintained consistent with General Design Criterion 64. Local area radiation monitors,effluent discharge radiation monitors, and containment gaseous and particulate radiation monitorsprovide a defense-in-depth monitoring of the containment atmosphere and effluent releases to theenvironment. These monitors are adequate to identify the need for establishing the containmentatmosphere boundary. When containment penetrations are open during a refueling outage underadministrative control for extended periods of time, routine grab samples of the containmentatmosphere, equipment access hatch, and personnel access hatch will be required.The containment atmosphere is monitored during normal and transient operations of the reactorplant by the containment structure particulate and gas monitor located in the upper level of theAuxiliary Building or by grab sampling. Normal effluent discharge paths are monitored duirirngplant operation by the ventilation particulate samples and gasmonitors in the Auxiliary Building.,Administrative controls are also in place to ensure that the containment atmosphereboundary is established if adverse weather conditions which could present a potential missilehazard threaten the plant. Weather conditions are monitored during fuel movement whenever acontainment penetration, including the equipment access hatch and personnel access hatch, isopen and a storm center is within the plant monitoring radius of 150 miles.The administrative controls ensure that the containment atmosphere boundary can bequickly established (i.e. within 30 minutes) upon determination that adverse weather conditionsexist which pose a significant threat to the Millstone Site. A significant threat exists when ahurricane warning or tornado warning is issued which applies to the Millstone Site, or if anaverage wind speed of 60 miles an hour or greater is recorded by plant meteorological equipmentat the meteorological tower. If the meteorological equipment is inoperable, information from theNational Weather Service can be used as a backup in determining plant wind speeds. Closure ofcontainment penetrations, including the equipment access hatch penetration and at least onepersonnel access hatch door, begin immediately upon determination that a significant threatexists.MILLSTONE -UNIT 3B 3/4 9-2MILLTON -NIT3 B3/49-2Amendment No, 4-9-7-, 219 LBDCR 04-MP3-013November 29, 20043/4.9 REFUELING OPERATIONSBASES3/4.9.5 DELETED3/4.9.6 DELETED3/4.9.7 DELETED3/4.9.8 RESIDUAL HEAT REMOVAL AND COOLANT CIRCULATION3/4.9.8.1 HIGH WATER LEVELBACKGROUN.DThe purpose of the Residual Heat Removal (RH-R) System in MODE 6 is to remove decay heatand sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to providemixing of borated coolant and to prevent boron stratification. Heat is removed fr'om the RCS bycirculating reactor coolant through the RHR heat exchanger(s), where the heat is transferred to theReactor Plant Component Cooling Water System. The coolant is then returned to the RCS via theRCS cold leg(s). Operation of the RHR system for normal cooldown or decay heat removal ismanually accomplished from the control room. The heat removal is manually accomplished fromthe control room. The heat removal rate is adjusted by controlling the flow of reactor coolantthrough the RHR heat exchanger(s) and the bypass. Mixing of the reactor coolant is maintainedby this continuous circulation of reactor coolant through the RHR system.MILLSTONE -UNIT 3B 3/4 9-2aAmendment No. 2-1-,Acknowledged by NRC Letter dated 04/12/06 06/28/063/4.9 REFUELING OPERATIONSBASES3/4.9.8.1 Ii-UGH WATER LEVEL (continued)APPLICABLE SAFETY ANALYSESIf the reactor coolant temperature is not maintained below 200°F, boiling of the reactor coolantcould result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of thereactor coolant could lead to a reduction in boron concentration in the coolant due to boronplating out on components near the areas of the boiling activity. The loss of reactor coolant andthe reduction of boron concentration in the reactor coolant would eventually challenge theintegrity of the fuel cladding, which is fission product barrier. One train of the RHR system isrequired to be operational in MODE 6, with the water level > 23 ft above the top of the reactorvessel flange to prevent this challenge. The LCO does permit deenergizing the RI-R pump forshort durations, under the conditions that the boron concentration is not diluted. This conditionaldeenergizing of the RHR pump does not result in a challenge to the fission product banrier.APPLICABILITYOne RI-R loop must be OPERABLE and in operation in MODE 6, with the water level _ 23 ftabove the top of the reactor vessel flange, to provide decay heat removal. The 23 ft level wasselected because it corresponds to the 23 ft requirement established for fuel movement inLCO 3.9.10, "Water Level -- Reactor Vessel." Requirements for the RH-R system in otherMODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5,Emergency Core Cooling Systems (ECCS). RHiR loop requirements in MODE 6 with the waterlevel < 23 ft are located in LCO 3.9.8.2, "Residual Heat Removal (RHR) and CoolantCirculation--Low Water Level."LIMITING CONDITION FOR OPERATIONThe requirement that at least one RHR loop be in operation ensures that: (1) sufficient coolingcapacity is available to remove decay heat an maintain the water in the reactor vessel below 140°Fas required during the REFUELING MODE, and (2) sufficient coolant circulation is maintainedthrough the core to minimize the effect of a boron dilution incident and prevent stratification.An OPERABLE RHR loop includes an RIIR pump, a heat exchanger, valves, piping, instrumentsand controls to ensure an OPERABLE flow path. An operating RI-R flow path should be capableof determining the low-end temperature. The flow path starts in one of the RCS hot legs and isreturned to the RCS cold legs.The LCO is modified by a Note that allows the required operating RHR loop to be removed fromoperation for up to 1 hour per 8 hour period, provided no operations are permitted that woulddilute the RCS boron concentration by introduction of coolant into the RCS with boronconcentration less than required to meet the minimaum boron concentration of LCO 3.9.1.1I.Boron concentration reduction with coolant at boron concentrations less than required to assurethe RCS boron concentration is maintained is prohibited because uniform concentrationdistribution cannot be ensured without forced circulation. This permits operations such as coremapping or alterations in the vicinity of the reactor vessel hot leg nozzles and RCS to RI-Risolation valve testing. During this 1 hour period, decay heat is removed by natural convection tothe large mass of water in the refueling cavity.MILLSTONE -UNIT 3B 3/4 9-3MILLTONE- UIT 3B 3/9-3Amendment No. 4-1-7-, _2--9-, 230 LBDCR 12-MP3-01i0September 20, 20123/4.9 REFUELING OPERATIONSBASES3/4.9.8.1 HIGH WATER LEVJEL (continued)ACTIONSRHR loop requirements are met by haying one RER loop OPERABLE and in operations, exceptas penmitted in the Note to the LCO.If RHR ioop requirements are not met, there will be no forced circulation to provide mixing toestablish uniform boron concentrations. Suspending positive reactivity additions that could resultin failure to meet the minimnum boron concentration limit is required to assure continued safeoperation. Introduction of coolant inventory must be from sources that have a boron concentrationgreater than that what would be required in the RCS for minimum refueling boron concentration.This may result in an overall reduction in RCS boron concentration, but provides acceptablemargin to maintaining subcritical operation.If RHR loop requirements are not met, actions shall be taken immediately to suspend loading ofirradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removalfrom the core occurs by natural convection to the heat sink provided by the water above the core.A minimumn refueling water level of 23 ft above the reactor vessel flange provides an adequateavailable heat sink. Suspending any operation that would increase decay heat load, such asloading a fuel assembly, is a prudent action under this condition.If RI-R loop requirements are not met, actions shall be initiated and continued in order to satisfyRI-R loop requirements. With the unit in MODE 6 and the refueling water level >_ 23 ft above thetop of the reactor vessel flange, corrective actions shall be initiated immediately.If RtRR loop requirements are not met, all containment penetrations providing direct access fromthe containment atmosphere to the outside atmosphere must be closed within 4 hours. With theRK-R loop requirements not met, the potential exists for the coolant to boil and release radioactivegas to the containment atmosphere. Closing containment penetrations that are open to the outsideatmosphere ensures dose limits are not exceeded.The Completion Time of 4 hours is reasonable, based on the low probability of the coolant boilingin that time.Surveillance RequirementThis Surveillance demonstrates that the RI-R loop is in operation and circulating reactor coolant.The flow rate is deternined by the flow rate necessary to provide sufficient decay heat removalcapability and to prevent thermal and boron stratification in the core. The surveillance frequencyis controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3B 3/4 9-4MILLTONE- UNT 3 3/49-4Amendment No. 44)-7, 2a-1-9-, 2 April 12, 1995.BASES3/4.9.8.2 LOW WATER LEVELBACKGROUNDThe purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from theReactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant,and to prevent boron stratification. Heat is removed from the RCS by circulating reactor coolantthrough the RHR heat exchangers where the heat is transferred to the Component Cooling WaterSystem. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHRSystem for normal cooldown decay heat removal is manually accomplished from the controlroom. The heat removal rate is adjusted by controlling the flow of reactor coolant through theRHR heat exchanger(s) and the bypass lines. Mixing of the reactor coolant is maintained by thiscontinuous circulation of reactor coolant through the RHR system.APPLICABLE SAFETY ANALYSESIf the reactor coolant temperature is not maintained below 200°F, boiling of the reactor coolantcould result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of thereactor coolant could lead to a reduction in boron concentration in the coolant due to the boronplating out on components near the areas of the boiling activity. The loss of reactor coolant andthe reduction of boron concentration in the reactor coolant will eventually challenge the integrityof the fuel cladding, which is a fission product barrier. Two trains of the RIIR System arerequired to be OPERABLE, and one train in operation, in order to prevent this challenge.LIMITING CONDITION FOR OPERATIONIn MODE 6, with the water leveI< 23 ft above the top of the reactor vessel flange, both RHRloops must be OPERABLE. Additionally, one loop of RUR must be in operation in order toprovide:a. Removal of decay heat;b. Mixing of borated coolant to minimize the possibility of criticality; andc. Indication of reactor cooling temperature.The requirement to have two RHIR loops OPERABLE when there is less than 23 feet of waterabove the reactor vessel flange ensures that a single failure of the operating RHR loop will notresult in a complete loss of residual heat removal capability. With the reactor vessel headremoved and at least 23. feet of water above the reactor pressure vessel flange, a large heat sink isavailable for core cooling. Thus, in the event of a failure of the operating RHR loop, adequatetime is provided to initiate emergency procedure to cool the core.MILLSTONE -UNIT 3"B34- mnmn o 0B 3/4 9-5Amendment No. 107 06/28/063/4.9 REFUELING OPERATIONS[BASES3/4.9.8.2 LOW WATER LEVEL (continued)An OPERABLE RHR loop consists of an RHR pump, a heat exchanger, valves, piping,instruments, and controls to ensure an OPERABLE flow path. An operating RHR flow pathshould be capable of determining the low end temperature. The flow path starts in one of the RCShot legs and is returned to the RCS cold legs.APPLICABILITYTwo RHR loops are required to be OPERABLE, and one RHR loop must be in operation inMODE 6, with the water level < 23 ft above the top of the reactor vessel flange, to proviide decayheat removal. Requirements for the RHR System in other MODES are covered by LCOs inSection 3.5, Emergency Core Cooling Systems (ECCS). RHR loop requirements in MODE 6with the water level _ 23 ft are located in LCO 3.9.8.1, "Residual Removal (RHR) AND CoolantCirculation--High WCater Level."ACTIONSa. If less than the required number of RI-R loops are OPERABLE, actions shall beimmediately initiated and continued until the RHR loop is restored to OPERABLE statusand to operation, or until _ 23 ft of water level is established above the reactor vesselflange. When the water level is _ 23 ft above the reactor vessel flange, the Applicabilitychanges to that of LCO 3.9.8.1, and only one RHIR loop is required to be OPERABLE andin operation. An immediate Completion Time is necessary for an operator to initiatecorrective action.b. If no RHR loop is in operation, there will be no forced circulation to provide mixing toestablish uniform boron concentrations. Suspending positive reactivity additions thatcould result in failure to meet the minimum boron concentration limit is required to assurecontinued safe operation. Introduction of coolant inventory must be from sources thathave a, boron concentration greater than that what would be required in the RCS forminimum refueling boron concentration. This may result in an overall reduction in RCSboron concentration, but provides acceptable margin to maintaining subcritical operation.If no RH-R loop is in operation, actions shall be initiated immediately, and continued, to restore.one RHR loop to operation. Since the unit is in ACTIONS 'a' and 'b' concurrently, therestoration of two OPERABLE RITR loops and one operating RH-R loop should be accomplishedexpeditiously.If no RtHR loop is in operation, all containment penetrations providing direct access from thecontainment atmosphere to the outside atmosphere must be closed within 4 hours. With the RHRloop requirements not met, the potential exists for the coolant to boil and release radioactive gasto the containment atmosphere. Closing containment penetrations that are open to the outsideatmosphere ensures that dose limits are not exceeded.MILLSTONE -UNIT 3B 3/4 9-6MILSTNE UIT B3/4-6Amendment No. 230 LBDCR 12-IvP3-010September 20, 20123/4.9 REFUELING OPERATIONSBASESThe Completion Time of 4 hours is reasonable, based on the low probability of the coolant boilingin that time.Surveillance RequirementThis Surveillance demonstrates that one RIIR loop is in operation and circulating reactor coolant.The flow rate is detennined by the flow rate necessary to provide sufficient decay heat removalcapability and to prevent thermal and boron stratification in the core. In addition, during operationof the RHR loop with the water level in the vicinity of the reactor vessel nozzles, the RHR pumpsuction requirements must be met. The surveillance frequency is controlled under theSurveillance Frequency Control Program.MILLSTONE -UNIT 3B 3/4 9-7MILLTON -NIT3 B3/49-7Amendment No. 4-05, 49-l-, 23-0 LIBDCR No. 06-MP3-026October 15, 2006+3/4.9 R FiFITFLFNG OPER ATiONSBASES3/4.9.10 AND 3/4.9.11 WATER LEVEL -REACTOR VES SEL AND STORAGE POOLThe restrictions on minimum water level ensure that sufficient water depth is available toremove at least 99% of the assumed iodine gap activity released from the rupture of an irradiatedfuel assembly. The minfimum water depth is consistent with the assumptions of the safetyanalysis.MILLSTONE -UNIT 313 3/4 9-8 Amendment No. 3?-9, -!-0-7, 4-58, 4-84-, -I-89,-20-., 24t-9NRC Verbal Ackn~owledgement: 07/05/07 LBDCR No. 07-MiP3-037July 12, 2007REFUELING OPERATIONSBASES3/4.9.13 SPENT FUEL POOL -REACTIVTYDuring normal spent fuel pool operation, the spent fuel racks are capable of maintainingKeff at less than or equal to 0.95 in an unborated water environment.Maintaining Keff~ at less than or equal to 0.95 is accomplished in Region 1 3-OUT-OF-4storage racks by the combination of geometry of the rack spacing, the use of fixed neutronabsorbers in the racks, a maximum nominal 5 weight percent fuel enrichment, and the use ofblocking devices in certain fuel storage locations, as specified by the interface requirementsshown in Figure 3.9-2.Maintaining Keff at less than or equal to 0.95 is accomplished in Region 1 4-OUT-OF-4storage racks by the combination of geometry of the rack spacing, the use of fixed neutronabsorbers in the racks, and the limits on fuel enrichment/fuel burnup specified in Figure 3.9-1.Maintaining Keff at less than or equal to 0.95 is accomplished in Region 2 storage racks bythe combination of geometry of the rack spacing, the use of fixed neutron absorbers in the racks,and the limits on fuel enrichment/fuel burnup and fuel decay time specified in Figure 3.9-3.Maintaining Keff at less than or equal to 0.95 is accomplished in Region 3 storage racks bythe combination of geometry of the rack spacing, and the limits on fuel enrichment/fuel burnupand fuel decay time specified in Figure 3.9-4 for assemblies used exclusively in the pre-uprate ](3411 Mwt) cores and Figure 3.9-5 for assemblies used in the post-update (3650 Mwt) cores.Fixed neutron absorbers are not credited in the Regioni 3 fuel storage racks.The limitations described by Figures 3.9-1, 3.9-2, 3.9-3, 3.9-4, and 3.9-5 ensure that the [reactivity of the fuel assemblies stored in the spent fuel pool are conservatively within theassumptions of the safety analysis.Administrative controls have been developed and instituted to verif~y that the fuelenrichment, fuel bumup, fuel decay times, and fuel interface restrictions specified in Figures3.9-1, 3.9-2, 3.9-3, 3.9-4, and 3.9-5 as well as restrictions specified in the Note on Figures 3.9-3and 3.9-5 are complied with.3/4.9.14 SPENT FUEL POOL -STORAGE PATTERNThe limitations of this specification ensure that the reactivity conditions of the Region 13-OUT-OF-4 storage racks and spent fuel pool keff will remain less than or equal to 0.95.The Cell Blocking Devices in the 4th location of the Region 1 3-OUT-OF-4 storageracks are designed to prevent inadvertent placement and/or storage of fuel assemblies in theblocked locations. The blocked location remains empty to provide the flux trap to maintainreactivity control for fuel assemblies in adjacent and diagonal locations of the STORAGEPATTERN.STORAGE PATTERN for the Region 1 storage racks will be established and expandedfrom the walls of the spent fuel pool per Figure 3..9-2 to ensure definition and control of theRegion 1 3-OUT-OF-4 Boundary to other Storage Regions and minimize the number ofboundaries where a fuel misplacement incident can occur.MILLSTONE -UNIT 3MILSTOE -UNI 3B 3/4 9-9 Amendment No. :39, 410-5, 4lOg, -8, 4189, 2O-REVERSE OF PAGE B 3/4 9-9INTENTIONALLY LEFT BLANK 3/4.10 SPECIAL TEST EXCEPTIONS July 30, 2002BASES3/4.10.1 SHUTDOWN MARGINThis speci~altest,.ex~ception provides that..a minimum amount, of control rodworth is immedia~tely..available for reactivity control, when~tests are performed.for control rod worth, measurement.. Thi~s..sPecial .test exception .is requi~red topermit the periodicvyeri~fication of the actual versus predicted core reactivitycondition occurring as.a result-of fuel .burnup or fuel cycling operations.3/4.10.2 GRouP HEIGHT, INSERTION, AND POWER DISTRIBUTION LIMITS.This special .test except~ion, permits ind~ividual control .rods to be positioned-outside of their normal.-group: heights. and i~nsertion limits during the performance.of such PHYSICS TESTS as those required to: (1) measure control rod. worth,and (2) determine the reactor stability index and damping factor under xenonoscillation, condi~tions.i " ..""-3/4.10.3 PHYSICS TESTSThis special test exception permits PHYSICS TESTS to be performed at lessthan or equal to 5% of RATED THERMAL POWER with. the RCS Tavg slightly lower thannormally allowed so that the fundamental nuclear characteristics of thecore and related instrumentation can be verified.. In order for various cha~rac-teristics t~o be accurately measured, it *is at times necessary to operateoutside the normal restrictions of these Technical Specifications. For instance,to measure the moderator temperature coefficient at BOL, it is necessary toposition the various control rods at heights which may not normally be allowedby Specification 3.1.3.6 which in turn may cause the RCS ITv to fall slightlybelow the minimum temperature of Specification 3.1.1.4.3/4.10.4 REACTOR COOLANT LOOPSThis special test exception permits reactor criticality under no flowconditions and is required to perform certain STARTUP and PHYSICS TESTS whileat low THERMAL POWER levels.3/4.10.5 DELETEDMILLSTONE -UNIT 3B 314 10-IMILLTON -NIT B /4 0-1Amendment No. 7J7, 207 Juiy 30, 200-2THIS PAGE INTENTIONALLY LEFT BLANKMILLTON -NIT B /4 0-2Amendment No. XJ7, 207~iMILLSTONE -UNIT 3B 3/4 10-2 November 28, 20003/4.11 DELETEDBASES3/4.11.1 -DELETED3/4.11.2 -DELETED3/4/11/3 -DELETEDMILLSTONE -UNIT 3 B341- mnmn o 8B 3/4 11-1Amendment No= 188 ZUUUJThis page intentionally left blankMILLSTONE -UNIT 3 B341- mnmn o 8B 3/4 11-2Amendment NOo 188 November 28, 2000This page intentionally left blankMILLSTONE -UNIT 3B 3/4 11-3MILL TON -NIT B /4 1-3Amendment No. , 188 REVERSE OF PAGE B 3/4 11-3INTENTIONALLY LEFT BLANK .}}