ULNRC-04721, Technical Specification Bases Revision 3

Technical Specification Bases Revision 3

ML022590616
Person / Time
Site:	Callaway
Issue date:	08/30/2002
From:	Blosser J AmerenUE
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
ULNRC-04721
Download: ML022590616 (195)

Text

4 Union Electric One Ameren Plaza 1901 Chouteau Avenue PO Box 66149 St. Louis, MO 63166-6149 3146213222 August 30, 2002 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Mail Stop P1-137 Washington, DC 20555-0001 Ladies and Gentlemen: ULNRC-04721 wAmeren DOCKET NUMBER 50-483 UE CALLAWAY PLANT UNION ELECTRIC COMPANY TECHNICAL SPECIFICATION BASES REVISION 3 Furnished herewith is the signed original and 10 copies of Revision 3 to the Callaway Plant Technical Specification Bases in accordance with 10 CFR 50.4(b)(6).

Pursuant to 10 CFR 50.71(e), the Technical Specification Bases has been revised to include all of the changes made since our revision 2 issue, October 20, 2001 to August 30, 2002.

If there are any questions, please contact us.

Very truly yours, John D. Blosser "Manager,Regulatory Affairs BFH/mlo

Enclosure:

Directions for Replacement Pages

Attachment:

Revision 3 pages to Callaway Plant Technical Specification Bases a subsidaryofAmeren Corporation

ULNRC-04721 August 30, 2002 Page 2 cc: U. S. Nuclear Regulatory Commission (Original and 1 copy)

Attn: Document Control Desk Mail Stop P1-137 Washington, DC 20555-0001 Mr. Ellis W. Merschoff Regional Administrator U.S. Nuclear Regulatory Commission Region IV 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011-4005 Senior Resident Inspector Callaway Resident Office U.S. Nuclear Regulatory Commission 8201 NRC Road Steedman, MO 65077 Mr. Jack N. Donohew (2 copies)

Licensing Project Manager, Callaway Plant Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop 7E1 Washington, DC 20555-2738 Manager, Electric Department Missouri Public Service Commission PO Box 360 Jefferson City, MO 65102 Deputy Director Department of Natural Resources PO Box 176 Jefferson City, MO 65102 Mr. John ONeill Shaw, Pittman, Potts & Trowbridge 2300 N. Street N.W.

Washington, DC 20037

August 30, 2002 DIRECTIONS FOR INSERTING REVISION 3 TO TS BASES Remove and insert pages as listed below. Dashes (-) in the remove or insert column of the directions indicate no actions required.

REMOVE INSERT LIST OF EFFECTIVE PAGES 1, Revision 2h 1, Revision 3 2, Revision 2h 2, Revision 3 3, Revision 2h 3, Revision 3 4, Revision 2h 4, Revision 3 5, Revision 2h 5, Revision 3 6, Revision 2h 6, Revision 3 7, Revision 2h 7, Revision 3 8, Revision 2h 8, Revision 3 9, Revision 2h 9, Revision 3 10, Revision 2h 10, Revision 3 11, Revision 2h 12, Revision 2h 13, Revision 2h BASES PAGES Chapter 3.0 Bases B 3.0-11, Revision 2e B 3.0-11, Revision 3 B 3.0-12, Revision 2e B 3.0-12, Revision 3 B 3.0-13, Revision 2e B 3.0-13, Revision 3 B 3.0-14, Revision 2e B 3.0-14, Revision 3 Chapter 3.1 Bases B 3.1.3-6, Revision 2d B 3.1.3-6, Revision 3 Page 1 of 7

August 30, 2002 DIRECTIONS FOR INSERTING REVISION 3 TO TS BASES REMOVE INSERT Chapter 3.2 Bases B 3.2.1-10, Revision 2d B 3.2.1-10, Revision 3 Chapter 3.3 Bases B 3.3.1-4, Revision 2b B 3.3.1-4, Revision 3 B 3.3.1-5, Revision 2b B 3.3.1-5, Revision 3 B 3.3.1-6, Revision 2b B 3.3.1-6, Revision 3 B 3.3.1-7, Revision 2b B 3.3.1-7, Revision 3 B 3.3.1-8, Revision 2b B 3.3.1-8, Revision 3 B 3.3.1-9, Revision 2b B 3.3.1-9, Revision 3 B 3.3.1-10, Revision 2b B 3.3.1-10, Revision 3 B 3.3.1-11, Revision 2b B 3.3.1-11, Revision 3 B 3.3.1-12, Revision 2b B 3.3.1-12, Revision 3 B 3.3.1-13, Revision 2b B 3.3.1-13, Revision 3 B 3.3.1-14, Revision 2b B 3.3.1-14, Revision 3 B 3.3.1-15, Revision 2b B 3.3.1-15, Revision 3 B 3.3.1-16, Revision 2b B 3.3.1-16, Revision 3 B 3.3.1-17, Revision 2b B 3.3.1-17, Revision 3 B 3.3.1-18, Revision 2b B 3.3.1-18, Revision 3 B 3.3.1-19, Revision 2b B 3.3.1-19, Revision 3 B 3.3.1-20, Revision 2b B 3.3.1-20, Revision 3 B 3.3.1-21, Revision 2b B 3.3.1-21, Revision 3 B 3.3.1-22, Revision 2b B 3.3.1-22, Revision 3 B 3.3.1-23, Revision 2b B 3.3.1-23, Revision 3 B 3.3.1-24, Revision 2b B 3.3.1-24, Revision 3 B 3.3.1-38, Revision 2f B 3.3.1-38, Revision 3 B 3.3.1-39, Revision 2f B 3.3.1-39, Revision 3 B 3.3.1-40, Revision 2f B 3.3.1-40, Revision 3 B 3.3.1-41, Revision 2f B 3.3.1-41, Revision 3 B 3.3.1-42, Revision 2f B 3.3.1-42, Revision 3 B 3.3.1-43, Revision 2f B 3.3.1-43, Revision 3 B 3.3.1-44, Revision 2f B 3.3.1-44, Revision 3 B 3.3.1-45, Revision 2f B 3.3.1-45, Revision 3 Page 2 of 7

August 30, 2002 DIRECTIONS FOR INSERTING REVISION 3 TO TS BASES REMOVE INSERT Chapter 3.3 Bases (Continued)

B 3.3.1-46, Revision 2g B 3.3.1-46, Revision 3 B 3.3.1-47, Revision 2g B 3.3.1-47, Revision 3 B 3.3.1-48, Revision 2g B 3.3.1-48, Revision 3 B 3.3.1-49, Revision 2g B 3.3.1-49, Revision 3 B 3.3.1-50, Revision 2g B 3.3.1-50, Revision 3 B 3.3.1-51, Revision 2g B 3.3.1-51, Revision 3 B 3.3.1-52, Revision 2g B 3.3.1-52, Revision 3 B 3.3.1-53, Revision 2g B 3.3.1-53, Revision 3 B 3.3.1-54, Revision 2g B 3.3.1-54, Revision 3 B 3.3.1-55, Revision 2g B 3.3.1-55, Revision 3 B 3.3.1-56, Revision 2g B 3.3.1-56, Revision 3 B 3.3.1-57, Revision 2g B 3.3.1-57, Revision 3 B 3.3.1-58, Revision 2g B 3.3.1-58, Revision 3 B 3.3.1-59, Revision 2g B 3.3.1-59, Revision 3 B 3.3.1-60, Revision 2g B 3.3.1-60, Revision 3 B 3.3.1-61, Revision 2g B 3.3.1-61, Revision 3 B 3.3.1-62, Revision 2g B 3.3.1-62, Revision 3 B 3.3.2-3, Revision 2b B 3.3.2-3, Revision 3 B 3.3.2-4, Revision 2b B 3.3.2-4, Revision 3 B 3.3.2-5, Revision 2b B 3.3.2-5, Revision 3 B 3.3.2-6, Revision 2b B 3.3.2-6, Revision 3 B 3.3.2-7, Revision 2b B 3.3.2-7, Revision 3 B 3.3.2-8, Revision 2b B 3.3.2-8, Revision 3 B 3.3.2-9, Revision 2b B 3.3.2-9, Revision 3 B 3.3.2-10, Revision 2b B 3.3.2-10, Revision3 B 3.3.2-11, Revision 2b B 3.3.2-11, Revision 3 B 3.3.2-12, Revision 2b B 3.3.2-12, Revision 3 B 3.3.2-13, Revision 2b B 3.3.2-13, Revision 3 B 3.3.2-14, Revision 2b B 3.3.2-14, Revision 3 B 3.3.2-15, Revision 2b B 3.3.2-15, Revision 3 B 3.3.2-16, Revision 2b B 3.3.2-16, Revision 3 B 3.3.2-17, Revision 2b B 3.3.2-17, Revision 3 Page 3 of 7

August 30, 2002 DIRECTIONS FOR INSERTING REVISION 3 TO TS BASES REMOVE INSERT Chapter 3.3 Bases (Continued)

B 3.3.2-18, Revision 2b B 3.3.2-18, Revision 3 B 3.3.2-19, Revision 2b B 3.3.2-19, Revision 3 B 3.3.2-20, Revision 2b B 3.3.2-20, Revision 3 B 3.3.2-21, Revision 2b B 3.3.2-21, Revision 3 B 3.3.2-22, Revision 2b B 3.3.2-22, Revision 3 B 3.3.2-23, Revision 2b B 3.3.2-23, Revision 3 B 3.3.2-24, Revision 2b B 3.3.2-24, Revision 3 B 3:3.2-25, Revision 2b B 3.3.2-25, Revision 3 B 3.3.2-26, Revision 2b B 3.3.2-26, Revision 3 B 3.3.2-27, Revision 2b B 3.3.2-27, Revision 3 B 3.3.2-28, Revision 2b B 3.3.2-28, Revision 3 B 3.3.2-29, Revision 2b B 3.3.2-29, Revision 3 B 3.3.2-30, Revision 2b B 3.3.2-30, Revision 3 B 3.3.2-31, Revision 2b B 3.3.2-31, Revision 3 B 3.3.2-32, Revision 2b B 3.3.2-32, Revision 3 B 3.3.2-33, Revision 2b B 3.3.2-33, Revision 3 B 3.3.2-34, Revision 2b B 3.3.2-34, Revision 3 B 3.3.2-35, Revision 2b B 3.3.2-35, Revision 3 B 3.3.2-36, Revision 2b B 3.3.2-36, Revision 3 B 3.3.2-37, Revision 2b B 3.3.2-37, Revision 3 B 3.3.2-38, Revision 2b B 3.3.2-38, Revision 3 B 3.3.2-39, Revision 2b B 3.3.2-39, Revision 3 B 3.3.2-40, Revision 2b B 3.3.2-40, Revision 3 B 3.3.2-41, Revision 2b B 3.3.2-41, Revision 3 B 3.3.2-42, Revision 2b B 3.3.2-42, Revision 3 B 3.3.2-43, Revision 2b B 3.3.2-43, Revision 3 B 3.3.2-44, Revision 2b B 3.3.2-44, Revision 3 B 3.3.2-45, Revision 2b B 3.3.2-45, Revision 3 B 3.3.2-46, Revision 2b B 3.3.2-46, Revision 3 B 3.3.2-47, Revision 2b B 3.3.2-47, Revision 3 B 3.3.2-60, Revision 2b B 3.3.2-60, Revision 3 B 3.3.2-61, Revision 2b B 3.3.2-61, Revision 3 Page 4 of 7

August 30, 2002 DIRECTIONS FOR INSERTING REVISION 3 TO TS BASES REMOVE INSERT Chapter 3.3 Bases (Continued)

B 3.3.9-1, Revision 2f B 3.3.9-1, Revision 3 B 3.3.9-2, Revision 2f B 3.3.9-2, Revision 3 B 3.3.9-3, Revision 2f B 3.3.9-3, Revision 3 B 3.3.9-4, Revision 2f B 3.3.9-4, Revision 3 B 3.3.9-5, Revision 2f B 3.3.9-5, Revision 3 B 3.3.9-6, Revision 2f B 3.3.9-6, Revision 3 B 3.3.9-7, Revision 2f B 3.3.9-7, Revision 3 B 3.3.9-8, Revision 2f B 3.3.9-8, Revision 3 Chapter 3.4 Bases B 3.4.1-4, Revision 2h B 3.4.1-4, Revision 3 B 3.4.5-3, Revision 2f B 3.4.5-3, Revision 3 B 3.4.5-5, Revision 2f B 3.4.5-5, Revision 3 B 3.4.5-6, Revision 2f B 3.4.5-6, Revision 3 B 3.4.6-2, Revision 2f B 3.4.6-2, Revision 3 B 3.4.6-3, Revision 2f B 3.4.6-3, Revision 3 B 3.4.6-4 Revision 2f B 3.4.6-4, Revision 3 B 3.4.6-5, Revision 2f B 3.4.6-5, Revision 3 B 3.4.7-3, Revision 2f B 3.4.7-3, Revision 3 B 3.4.7-4 Revision 2f B 3.4.7-4, Revision 3 B 3.4.7-5, Revision 2f B 3.4.7-5, Revision 3 B 3.4.8-2, Revision 2f B 3.4.8-2, Revision 3 B 3.4.8-3, Revision 2f B 3.4.8-3, Revision 3 B 3.4.8-4 Revision 2f B 3.4.8-4, Revision 3 B 3.4.9-2, Revision 2c B 3.4.9-2, Revision 3 Chapter 3.5 Bases B 3.5.2-4, Revision 2h B 3.5.2-4, Revision 3 B 3.5.2-5, Revision 2h B 3.5.2-5, Revision 3 B 3.5.2-6, Revision 2h B 3.5.2-6, Revision 3 Page 5 of 7

August 30, 2002 DIRECTIONS FOR INSERTING REVISION 3 TO TS BASES REMOVE INSERT Chapter 3.5 Bases (Continued)

B 3.5.2-12, Revision 2h B 3.5.2-12, Revision 3 B 3.5.5-1, Revision 2h B 3.5.5-1, Revision 3 B 3.5.5-2, Revision 2h B 3.5.5-2, Revision 3 B 3.5.5-3, Revision 2h B 3.5.5-3, Revision 3 B 3.5.5-4, Revision 2h B 3.5.5-4, Revision 3 Chapter 3.7 Bases B 3.7.5-9, Revision 2a B 3.7.5-9, Revision 3 B 3.7.5-10, Revision 2a B 3.7.5-10, Revision 3 B 3.7.6-1, Revision 0 B 3.7.6-1, Revision 3 B 3.7.6-2, Revision 2 B 3.7.6-2, Revision 3 B 3.7.6-3, Revision 0 B 3.7.6-3, Revision 3 Chapter 3.8 Bases B 3.8.2-5, Revision 2f B 3.8.2-5, Revision 3 B 3.8.2-6, Revision 2f B 3.8.2-6, Revision 3 B 3.8.5-5, Revision 2f B 3.8.5-5, Revision 3 B 3.8.8-4, Revision 2f B 3.8.8-4 Revision 3 B 3.8.8-5, Revision 2f B 3.8.8-5, Revision 3 B 3.8.10-5, Revision 2f B 3.8.10-5, Revision 3 B 3.8.10-6, Revision 2f B 3.8.10-6, Revision 3 Chapter 3.9 Bases B 3.9.1-3, Revision 2f B 3.9.1-3, Revision 3 B 3.9.1-4 Revision 2f B 3.9.1-4, Revision 3 B 3.9.3-2, Revision 2f B 3.9.3-2, Revision 3 B 3.9.3-3, Revision 2f B 3.9.3-3, Revision 3 B 3.9.3-4 Revision 2f B 3.9.3-4, Revision 3 B 3.9.5-2, Revision 2f B 3.9.5-2, Revision 3 Page 6 of 7

August 30, 2002 DIRECTIONS FOR INSERTING REVISION 3 TO TS BASES REMOVE INSERT Chapter 3.9 Bases (Continued)

B 3.9.5-3, Revision 2f B 3.9.5-3, Revision 3 B 3.9.5-4, Revision 2f B 3.9.5-4, Revision 3 B 3.9.6-2, Revision 2f B 3.9.6-2, Revision 3 B 3.9.6-3, Revision 2f B 3.9.6-3, Revision 3 B 3.9.6-4, Revision 2f B 3.9.6-4, Revision 3 Page 7 of 7

BASES LIST OF EFFECTIVE PAGES I,

-Page No. Revision Page No. Revision Table of Contents Chapter 3.1 Bases 1 0 B 3.1.1-1 0 2 0 B 3.1.1-2 0 3 0 B 3.1.1-3 0 4 0 B 3.1.1-4 0 B 3.1.1-5 0 B 3.1.1-6 0 Chapter 2.0 Bases B 3.1.2-1 0 B 3.1.2-2 0 B 2.1.1-1 2 "B3.1.2-3 0 B 2.1.1-2 0 B 3.1.2-4 0 B 2.1.1-3 0 B 3.1.2-5 0

B 2.1.1-4 0 B 3.1.3-1 B 2.1.2-1 0 B 3.1.3-2 0 B 2.1.2-2 0 "B3.1.3-3 0

B 2.1.2-3 0 B 3.1.3-4 0

B 3.1.3-5 B 3.1.3-6 0 B 3.1.3-7 0

Chapter 3.0 Bases B 3.1.4-1 0

B 3.1.4-2 0 B 3.0-1 0 B 3.1.4-3 0

B 3.0-2 0 B 3.1.4-4 0

B 3.0-3 0 B 3.1.4-5 0 B 3.0-4 0 -B.3.1.4-6 0 B 3.0-5 0 B 3.1.4-7 0

B 3.0-6 0 B 3.1.4-8 B 3.0-7 0 B 3.1.4-9 0 B 3.0-8 0 B 3.1.5-1 B 3.0-9 0 B 3.1.5-2 0 B 3.0-10 0 B 3.1.5-3 0 B 3.0-11 3 B 3.1.5-4 0 B 3.0-12 3 B 3.1.6-1 0

B 3.0-13 3 B 3.1.6-2 0 0

B 3.0-14 3 B 3.1.6-3 0 B 3.1.6-4 B 3.1.6-5 I Revision 3 08/30/02

BASES LIST OF EFFECTIVE PAGES Page No. Revision Page No. Revision Chapter 3.1 Bases' Chapter 3.2 Bases (continued) (continued)

B 3.1.7-1 0 B 3.2.3-1 0 B 3.1.7-2 0 B 3.2.3-2 1 B 3.1.7-3 0 B 3.2.3-3 0 B 3.1.7-4 1 B 3.2.4-1 0 B 3.1.7-5 B 3.2.4-2 0 B 3.1.7-6 B 3.2.4-3 0 B 3.1.7-7 0 B 3.2.4-4 0 B 3.1.8-1 0 B 3.2.4-5 0 B 3.1.8-2 0 B 3.2.4-6 0 B 3.1.8-3 0 B 3.2.4-7 0 B 3.1.8-4 0 B 3.1.8-5 0 B 3.1.8-6 1 Chapter 3.3 Bases B 3.1.8-7 0 B 3.3.1-1 B 3.3.1-2 Chapter 3.2 Bases B 3.3.1-3 B 3.3.1-4 B 3.2.1-1 0 B 3.3.1-5 B 3.2.1-2 0 B 3.3.1-6 B 3.2.1-3 0 B 3.3.1-7 B 3.2.1-4 0 B 3.3.1-8 B 3.2.1-5 0 B 3.3.1-9 B 3.2.1-6 0 B 3.3.1-10 B 3.2.1-7 0 B 3.3.1-11 B 3.2.1-8 0 B 3.3.1-12 B 3.2.1-9 2 B 3.3.1-13 B 3.2.1-10 3 B 3.3.1-14 B 3.2.1-11 0 B 3.3.1-15 B 3.2.2-1 0 B 3.3.1-16 B 3.2.2-2 0 B 3.3.1-17 B 3.2.2-3 0 B 3.3.1-18 B 3.2.2-4 0 B 3.3.1-19 B 3.2.2-5 0 B 3.3.1-20 B 3.2.2-6 0 B 3.3.1-21 B 3.2.2-7 0 B 3.3.1-22 2 Revision 3 08/30/02

BASES LIST OF EFFECTIVE PAGES Page No. Revision Page No. Revision Chapter 3.3 Bases Chapter 3.3 Bases (continued) (continued)

B 3.3.1-23 3 B 3.3.1-59 3 B 3.3.1-24 3 B.3.3.1-60 3 B 3.3.1-25 0 B.3.3.1-61 3 B 3.3.1-26 0 B.3.3.1-62 3 B 3.3.1-27 0 B 3.3.2-1 0 B 3.3.1-28 0 B 3.3.2-2 0 B 3.3.1-29 0 B 3.3.2-3 3 B 3.3.1-30 1 B 3.3.2-4 3 B 3.3.1-31 0 B 3.3.2-5 3

B 3.3.1-32 0 B 3.3.2-6 3 B 3.3.1-33 0 B 3.3.2-7 3

B 3.3.1-34 0 B 3.3.2-8 3

B 3.3.1-35 0 B 3.3.2-9 3

B 3.3.1-36 0 B 3.3.2-10 3

B 3.3.1-37 0 B 3.3.2-11 3 B 3.3.1-38 3 B 3.3.2-12 3

B 3.3.1-39 3 B 3.3.2-13 3

B 3.3.1-40 3 B 3.3.2-14 3

B 3.3.1-41 3 B 3.3.2-15 3

B 3.3.1-42 3 B 3.3.2-16 3

B 3.3.1-43 3 B 3.3.2-17 3 B 3.3.1-44 3 B 3.3.2-18 3

B 3.3.1-45 3 B 3.3.2-19 3.

B 3.3.1-46 3 B 3.3.2-20 3

B 3.3.1-47 3 B 3.3.2-21 3

B 3.3.1-48 3 B 3.3.2-22 3

B 3.3.1-49 3 B 3.3.2-23 3

B 3.3.1-50 3 B 3.3.2-24 3

B 3.3.1-51 3 B 3.3.2-25 3

B 3.3.1-52 3 B 3.3.2-26 3 B 3.3.1-53 3 B 3.3.2-27 3

B 3.3.1-54 3 B 3.3.2-28

.3 B 3.3.1-55 3 B 3.3.2-29 3

B 3.3.1-56 3 B 3.3.2-30 3

B 3.3.1-57 3 B 3.3.2-31 3 3 B 3.3.2-32 B 3.3.1-58 3 Revision 3 08/30102

BASES LIST OF EFFECTIVE PAGES Page No. Revision Page No. Revision Chapter 3.3 Bases Chapter 3.3 Bases (continued) (continued)

B 3.3.2-33 3 B 3.3.3-7 B 3.3.2-34 3 B 3.3.3-8 B 3.3.2-35 3 B 3.3.3-9 B 3.3.2-36 3 B 3.3.3-10 B 3.3.2-37 3 B 3.3.3-11 B 3.3.2-38 3 B 3.3.3-12 B 3.3.2-39 3 B 3.3.3-13 B 3.3.2-40 3 B 3.3.3-14 B 3.3.2-41 3 B 3.3.3-15 B 3.3.2-42 3 B 3.3.3-16 B 3.3.2-43 3 B 3.3.3-17 B 3.3.2-44 3 B 3.3.4-1 B 3.3.2-45 3 B 3.3.4-2 B 3.3.2-46 3 B 3.3.4-3 B 3.3.2-47 3 B 3.3.4-4 B 3.3.2-48 2 B 3.3.4-5 B 3.3.2-49 2 B 3.3.4-6 B 3.3.2-50 2 B 3.3.5-1 B 3.3.2-51 2 B 3.3.5-2 B 3.3.2-52 2 B 3.3.5-3 B 3.3.2-53 2 B 3.3.5-4 B 3.3.2-54 2 B 3.3.5-5 B 3.3.2-55 2 B 3.3.5-6 B 3.3.2-56 2 B 3.3.5-7 B 3.3.2-57 2 B 3.3.5-8 B 3.3.2-58 2 B 3.3.6-1 B 3.3.2-59 2 B 3.3.6-2 B 3.3.2-60 3 B 3.3.6-3 B 3.3.2-61 3 B 3.3.6-4 B 3.3.2-62 2 B 3.3.6-5 B 3.3.3-1 0 B 3.3.6-6 B 3.3.3-2 0 B 3.3.6-7 B 3.3.3-3 0 B 3.3.6-8 B 3.3.3-4 0 B 3.3.7-1 B 3.3.3-5 0 B 3.3.7-2 B 3.3.3-6 0 B 3.3.7-3 4 Revision 3 08/30/02

I BASES LIST OF EFFECTIVE PAGES Page No. Revision Page No. Revision Chapter 3.3 Bases Chapter 3.4 Bases (continued) (continued)

B 3.3.7-4 B 3.4.3-5 0 B 3.3.7-5 B 3.4.3-6 0 B 3.3.7-6 B 3.4.3-7 0 B 3.3.7-7 B 3.4.4-1 0 B 3.3.7-8 B 3.4.4-2 0 B 3.3.8-1 B 3.4.4-3 0 B 3.3.8-2 B 3.4.5-1 0 B 3.3.8-3 B 3.4.5-2 0 B 3.3.8-4 B 3.4.5-3 3 B 3.3.8-5 B 3.4.5-4 "0 B 3.3.8-6 B 3.4.5-5 3 B 3.3.8-7. B 3.4.5-6 3 B 3.3.9-1 B 3.4.6-1 0 B 3.3.9-2 B 3.4.6-2 3 B 3.3.9-3 B 3.4.6-3 3 B 3.3.9-4 B 3.4.6-4 3 B 3.3.9-5 B 3.4.6-5 3 B 3.3.9-6 B 3.4.7-1 0 B 3.3.9-7 B 3.4.7-2 0 B 3.3.9-8 B 3.4.7-3 3 B 3.4.7-4 3 B 3.4.7-5 3 Chapter 3.4 Bases 0 B 3.4.8-1 0 B 3.4.8-2 3 B 3.4.1-1 0 B 3.4.8-3 3 B 3.4.1-2 0 B 3.4.8-4 3 B 3.4.1-3 0 B 3.4.9-1 0 B 3.4.1-4 3 B 3.4.9-2 3 B 3.4.1-5 0 B 3.4.9-3 0 B 3.4.2-1 0 B 3.4.9-4 0 B 3.4.2-2 2 B 3.4.10-1 2 B 3.4.2-3 0 B 3.4.10-2 2 B 3.4.3-1 0 B 3.4.10-3 0 B 3.4.3-2 0 B 3.4.10-4 2 B 3.4.3-3 0 B 3.4.11-1 2 B 3.4.3-4 0 B 3.4.11-2 2 5 Revision 3 08/30/02

BASES LIST OF EFFECTIVE PAGES Page No. Revision Page No. Revision Chapter 3.4 Bases Chapter 3.4 Bases (continued) (continued)

B 3.4.11-3 B 3.4.15-5 2 B 3.4.11-4 B 3.4.15-6 0 B 3.4.11-5 B 3.4.15-7 0 B 3.4.11-6 B 3.4.16-1 1 B 3.4.11-7 B 3.4.16-2 B 3.4.11-8 B 3.4.16-3 0 B 3.4.12-1 B 3.4.16-4 0 B 3.4.12-2 B 3.4.16-5 0 B 3.4.12-3 B 3.4.12-4 B 3.4.12-5 B 3.4.12-6 Chapter 3.5 Bases B 3.4.12-7 B 3.4.12-8 B 3.5.1-1 B 3.4.12-9 B 3.5.1-2 B 3.4.12-10 B 3.5.1-3 B 3.4.12-11 B 3.5.1-4 B 3.4.12-12 B 3.5.1-5 B 3.4.12-13 B 3.5.1-6 B 3.4.13-1 B 3.5.1-7 B 3.4.13-2 B 3.5.1-8 B 3.4.13-3 B 3.5.2-1 B 3.4.13-4 B 3.5.2-2 B 3.4.13-5 B 3.5.2-3 B 3.4.13-6 B 3.5.2-4 B 3.4.14-1 B 3.5.2-5 B 3.4.14-2 B 3.5.2-6 B 3.4.14-3 B 3.5.2-7 B 3.4.14-4 B 3.5.2-8 B 3.4.14-5 B 3.5.2-9 B 3.4.14-6 B 3.5.2-10 B 3.4.14-7 B 3.5.2-11 B 3.4.15-1 B 3.5.2-12 B 3.4.15-2 B 3.5.3-1 B 3.4.15-3 B 3.5.3-2 B 3.4.15-4 B 3.5.4-4 6 Revision 3 08/30/02

BASES LIST OF EFFECTIVE PAGES Page No. Revision .Page No. Revision Chapter 3.5 Bases Chapter 3.6 Bases (continued) (continued)

B 3.5.4-5 0 B 3.6.4-2 0 B 3.5.4-6 0 B 3.6.4-3 0 B 3.5.5-1 3 B 3.6.5-1 0 B 3.5.5-2 3 B 3.6.5-2 0 B 3.5.5-3 3 B 3.6.5-3 0 B 3.5.5-4 3 B 3.6.5-4 0 B 3.6.6-1 0 B 3.6.6-2 0 Chapter 3.6 Bases B 3.6.6-3 0 B 3.6.6-4 0 B 3.6.1-1 B 3.6.6-5 0 B 3.6.1-2 B 3.6.6-6 0 B 3.6.1-3 B 3.6.6-7 0 B 3.6.1-4 B 3.6.6-8 0 B 3.6.2-1 B 3.6.6-9 B 3.6.2-2 B 3.6.6-10 B 3.6.2-3 B 3.6.6-11 0 B 3.6.2-4 B 3.6.7-1 0 B 3.6.2-5 B 3.6.7-2 0 B 3.6.2-6 B 3.6.7-3 0 B 3.6.2-7 B 3.6.8-1 00 B 3.6.3-1 B 3.6.8-2 0 B 3.6.8-3 0 B 3.6.3-2 B 3.6.8-4 0 B 3.6.3-3 B 3.6.3-4 B 3.6.8-5 B 3.6.3-5 B 3.6.3-6 B 3.6.3-7 Chapter 3.7 Bases B 3.6.3-8 B 3.6.3-9 B 3.7.1-1 0 B 3.7.1-2 1 B 3.6.3-10 B 3.7.1-3 1 B 3.6.3-11 B 3.7.1-4 1 B 3.6.3-12 B 3.6.3-13 B 3.7.1-5 B 3.6.3-14 B 3.7.2-1 0 B 3.6.4-1 B 3.7.2-2 0 7 Revision 3 08/30/02

BASES LIST OF EFFECTIVE PAGES Page No. Revision Page No. Revision Chapter 3.7 Bases Chapter 3.7 Bases (continued) (continued)

B 3.7.2-3 B 3.7.8-5 B 3.7.2-4 B 3.7.9-1 B 3.7.2-5 B 3.7.9-2 B 3.7.2-6 B 3.7.9-3 B 3.7.3-1 B 3.7.9-4 B 3.7.3-2 B 3.7.10-1 B 3.7.3-3 B 3.7.10-2 B 3.7.3-4 B 3.7.10-3 B 3.7.3-5 B 3.7.10-4 B 3.7.4-1 B 3.7.10-5 B 3.7.4-2 B 3.7.10-6 B 3.7.4-3 B 3.7.10-7 B 3.7.4-4 B 3.7.11-1 B 3.7.4-5 B 3.7.11-2 B 3.7.5-1 B 3.7.11-3 B 3.7.5-2 B 3.7.12-1 B 3.7.5-3 B 3.7.13-1 B 3.7.5-4 B 3.7.13-2 B 3.7.5-5 B 3.7.13-3 B 3.7.5-6 B 3.7.13-4 B 3.7.5-7 B 3.7.13-5 B 3.7.5-8 B 3.7.13-6 B 3.7.5-9 B 3.7.13-7 B 3.7.5-10 B 3.7.14-1 B 3.7.6-1 B 3.7.15-1 B 3.7.6-2 B 3.7.15-2 B 3.7.6-3 B 3.7.15-3 B 3.7.7-1 B 3.7.16-1 B 3.7.7-2 B 3.7.16-2 B 3.7.7-3 B 3.7.16-3 B 3.7.7-4 B 3.7.17-1 B 3.7.7-5 B 3.7.17-2 B 3.7.8-1 B 3.7.17-3 B 3.7.8-2 B 3.7.18-1 B 3.7.8-3 B 3.7.18-2 B 3.7.8-4 B 3.7.18-3 8 Revision 3 08/30/02

BASES LIST OF EFFECTIVE PAGES Page No. ' Revision Page No. Revision Chapter 3.8 Bases Chapter 3.8 Bases (continued)

B 3.8.1-1 B 3.8.3-4 B 3.8.1-2 B 3.8.3-5 B 3.8.1-3 B 3.8.3-6 B 3.8.1-4 B 3.8.3-7 0 B 3.8.1-5 B 3.8.3-8 0 B 3.8.1-6 B 3.8.3-9 0 B 3.8.1-7 B 3.8.4-1 0 B 3.8.1-8 B 3.8.4-2 0 B 3.8.1-9 B 3.8.4-3 0 B 3.8.1-10 B 3.8.4-4

• 0 0

1 B 3.8.1-11 B 3.8.4-5 0 B 3.8.1-12 B 3.8.4-6 -, 0 B 3.8.1-13 B 3.8.4-7 0 B 3.8.1-14 B 3.8.4-8 0 B 3.8.1-15 B 3.8.5-1 0 B 3.8.1-16 B 3.8.5-2 0 B 3.8.1-17 B 3.8.5-3 0 B 3.8.1-18 B 3.8.5-4 0 B 3.8.1-19 B 3.8.5-5 3 B 3.8.1-20 B 3.8.6-1 0 B 3.8.1-21 B 3.8.6-2 0 B 3.8.1-22 B 3.8.6-3 0 B 3.8.1-23 B 3.8.6-4 0 B 3.8.1-24 B 3.8.6-5 B 3.8.1-25 B 3.8.6-6 3 B 3.8.1-26 B 3.8.7-1 0 B 3.8.1-27 B 3.8.7-2 00 B 3.8.2-1 B 3.8.7-3 0 B 3.8.2-2 B 3.8.7-4 0 B 3.8.2-3 B 3.8.8-1 B 3.8.2-4 B 3.8.8-2 0 B 3.8.2-5 B 3.8.8-3 0 B 3.8.2-6 B 3.8.8-4 B 3.8.3-1 B 3.8.8-5 B 3.8.3-2 B 3.8.9-1 B 3.8.3-3 B 3.8.9-2 9 Revision 3 08/30/02

BASES LIST OF EFFECTIVE PAGES Page No. Revision Page No. Revision Chapter 3.8 Bases Chapter 3.9 Bases (continued) (continued)

B 3.8.9-3 0 B 3.9.5-3 3 B 3.8.9-4 0 B 3.9.5-4 3 B 3.8.9-5 0 B 3.9.6-1 0 B 3.8.9-6 0 B 3.9.6-2 3 B 3.8.9-7 0 B 3.9.6-3 3 B 3.8.9-8 0 B 3.9.6-4 3 B 3.8.9-9 0 B 3.9.7-1 0 B 3.8.10-1 0 B 3.9.7-2 0 B 3.8.10-2 0 B 3.9.7-3 0 B 3.8.10-3 0 B 3.8.10-4 0 B 3.8.10-5 3 B 3.8.10-6 3 Chapter 3.9 Bases 3.9.1-1 0 3.9.1-2 1 3.9.1-3 3 3.9.1-4 3 3.9.2-1 0 3.9.2-2 0.

3.9.2-3 0 3.9.3-1 1 3.9.3-2 3 3.9.3-3 3 3.9.3-4 3 3.9.4-1 0 3.9.4-2 0 3.9.4-3 2 3.9.4-4 2 3.9.4-5 2 3.9.5-1 0 3.9.5-2 3 10 Revision 3 08/30/02

SR Applicability B 3.0 BASES SR 3.0.2 As stated in SR 3.0.2, the 25% extension also does not applyto the initial (continued) . portion of a periodic Completion Time that requires performance on a "Alonceper ..." basis. The 25% extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial actionjis considered a single action with a single Completion Time. One reason for not allowing the 25% extension' to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.

The provisions of SR 3.0.2 are not intended to be used repeatedly merely as an operational convenience to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.

SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been co'mpleted within the specified Frequency. A delay period of up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met.

This delay period provides adequate time-to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance'before complying with Required Actions or other remedial measures that might preclude completion of the Surveillance.

The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance,' the s'afet, significance of the delay in completing the

'required Surveillance, and the recognition'that the most probable result of any particular Surveillance being performed is the verification of conforman6e with'the'requirements. When'a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requiremrents of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in- accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed When'specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the Surveillance.

(continued)

CALLAWAY PLANT -B 3.0-11 Revision 3

SR Applicability B3.0 BASES SR 3.03 However, since there is not a time interval specified, the missed (continued) Surveillance should be performed at the first reasonable opportunity.

SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions.

Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals. While up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit "conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants."

This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the' safest course of action. All missed Surveillance will be placed in the licensee's Corrective Action Program.

If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and (continued)

CALLAWAY PLANT B 3.0-12 Revision 3

SR Applicability B 3.0 BASES SR 3.0.3 the Completion Times of the Required Actions for the applicable'LCO

"(continued) Conditions begin immediately upon the failure of the Surveillance.

Satisfactory completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.

.SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.

This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit.

The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or

-component to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.

However, in certain circumstances, failing to meet anSR will not result in SR 3.0.4 restricting a MODE change or other specified condition change.

When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions of the Applicability. However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes.

The provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown.

The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, (continued)

CALLAWAY PLANT B 3.0-13 - Revision 3

SR Applicability B 3.0 BASES SR 3.0.4 in the Surveillance, or both. This allows performance of Surveillances (contined) when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCO Applicability, would have its Frequency specified such that it is not "due" until the specific conditions needed are met.

Alternately, the Surveillance may be stated in the form of a Note as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.

SR 3.0.4 is only applicable when entering MODE 4 from MODE 5, MODE 3 from MODE 4, Mode 2 from MODE 3, or MODE I from MODE 2.

Furthermore, SR 3.0.4 is applicable when entering any other specified condition in the Applicability only while operating in MODES 1, 2, 3, or 4.

The requirements of SR 3.0.4 do not apply in MODES 5 and 6, or in other specified conditions of the Applicability (unless in MODES 1, 2, 3, or 4) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.

CALLAWAY PLANT B 3.0-14 Revision 3

MTC B 3.1.3 BASES SURVEILLANCE SR 3.1.3.1 (continued)

REQUIREMENTS The BOC MTC value for ARO will be inferred from isothermal temperature coefficient measurements obtained during the physics tests after refueling. The ARO value can be directly compared to the BOC MTC limit of the LCO. If required, measurement results and predicted design values can be used to establish administrative withdrawal limits for control banks.

SR 3.1.3.2 In similar fashion, the LCO demands that the MTC be less negative than the specified value for EOC full power conditions. This measurement may be performed at any THERMAL POWER, but its results must be extrapolated to the conditions of RTP and all banks withdrawn in order to make a proper comparison with the LCO value. Because the RTP MTC value will gradually become more negative with further core depletion and boron concentration reduction, a 300 ppm SR value of MTC should necessarily be less negative than the EOC LCO limit. The 300 ppm SR value is sufficiently less negative than the EOC LCO limit value to ensure that the LCO limit will be met when the 300 ppm Surveillance criterion is met.

SR 3.1.3.2 is modified by three Notes that include the following requirements:

1. The SR is required to be performed once each cycle within 7 effective full power days (EFPDs) after reaching the equivalent of an equilibrium RTP all rods out (ARO) boron concentration of 300 ppm.

2. If the 300 ppm Surveillance limit is exceeded, it is possible that the EOC limit on MTC could be reached before the planned EOC.

Because the MTC changes slowly with core depletion, the Frequency of 14 effective full power days is sufficient to avoid exceeding the EOC limit. (The 25% extension allowed by SR 3.0.2 applies to this frequency.)

3. The Surveillance limit for RTP boron concentration of 60ppm is conservative. If the measured MTC at 60ppm is less negative than the 60 ppm Surveillance limit, the EOC limit will not be exceeded because of the gradual manner in which MTC changes with core burnup.

(continued)

CALLAWAY PLANT B 3.1.3-6 Revision 3

MTC B 3.1.3 BASES REFERENCES 1. 10 CFR 50, AppendixA, GDC 11.

2. FSAR, Chapter 15.

3. WCAP-9272-P-A, 'Westinghouse Reload Safety Evaluation Methodology," July 1985.

CALLAWAY PLANT B 3.1.3-7 Revision 0

F (Z) (F, Methodology)

B 3.2.1 BASES SURVEILLANCE SR 3.2.1.1 (continued)

REQUIREMENTS If THERMAL POWER has been increased by > 10% RTP since the last determination of Fc (Z), another evaluation of this factor is required within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after achieving equilibrium conditions (to ensure that Fc (z) values are being reduced sufficiently with power increase to stay within the LCO limits)...

The Frequency of 31 EFPD is adequate to monitor the change of power distribution with core burnup because such changes are slow and well controlled when the plant is operated in accordance with the Technical Specifications (TS).

SR 3.2.1.2 The nuclear design process includes calculations performed to determine that the core can be operated within the F,(Z) limits. Because flux maps are taken in equilibrium conditions, the variations in power distribution resulting from normal operational maneuvers are not present in the flux map data. These variations are, however, conservatively calculated by considering a wide range of unit maneuvers in normal operation.

The maximum peaking factor increase over steady state values, calculated as a function of core elevation, Z, is called W(Z). Multiplying the measured total peaking factor, F,8 (Z), by W(Z) gives the maximum Fj(z) calculated to occur in normal operation, Fw (Z).

The limit with which Fw (z) is compared varies inversely with power and directly with the function K(Z) provided in the COLR.

The W(Z) curve is provided in the COLR for discrete core elevations.

Flux map data are typically taken fo'r 30 to 75 core elevations. Fw (Z) evaluations are not applicable for the following axial core regions, measured iin percent of c:6re height:

a. Lower core region,'from 0 to'15% inclusive; and

b. Upper core region, from 85 to 100% inclusive.

The top and bottom 15% of the co"re are'excluded from the evaluation because of the low probability that these regions would be more limiting in the safety analyses and because of the difficulty of making a precise measurement in these regions.

(continued)

CALLAWAY PLANT . B 3.2.1-9 A P B Revision 2

F (Z) (F1Methodology)

B 3.2.1 BASES SURVEILLANCE SR 3.2.1.2 (continued)

REQUIREMENTS This Surveillance has been modified by a Note that may require that more frequent surveillances be performred. When Fc (Z) is measured, an evaluation of the expression below is required to account for any increase to FJ(Z) that may occur and cause the F3(Z) limit to be exceeded before the next required Fo(Z) evaluation.

If the two most recent F(z) evaluations show an increase in the expression maximum over z FF(Z)1

[K(Z)J it is required to meet the F,(Z) limit with the last Fw (Z) increased by the appropriate factor specified in the COLR, or to evaluate F(Z) more frequently, each 7 EFPD. (The 25% extension allowed by SR 3.0.2 applies to this frequency.) These alternative requirements prevent F"(Z) from exceeding its limit for any significant period of time without detection.

Performing the Surveillance in MODE 1 prior to exceeding 75% RTP, or at a reduced power at any other time, and verifying the inferred results for 100% RTP meet the 100% RTP F,(Z) limit, provides assurance that the F.(Z) limit will be met when RTP is achieved, because peaking factors are generally decreased as power level is increased.

Fk(Z) is verified at power levels > 10% RTP above the THERMAL POWER of its last verification, within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after achieving equilibrium conditions to ensure that F,(Z) is within its limit at higher power levels.

The Surveillance Frequency of 31 EFPD is adequate to monitor the change of power distribution with core burnup. The Surveillance may be done more frequently if required by the results of FJ(Z) evaluations.

The Frequency of 31 EFPD is adequate to monitor the change of power distribution because such a change is sufficiently slow, when the plant is operated in accordance with the TS, to preclude adverse peaking factors between 31 day surveillances.

(continued)

CALLAWAY PLANT B 3.2.1-10 Revision 3

RTS Instrumentation B 3.3.1 BASES BACKGROUND Signal Process Control and Protection System (continued)

Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments. The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses. If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the SSPS for decision evaluation. Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing.. Some unit parameters provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit computer, and one or more control systems.

Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails, such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic.

Generally, if a parameter is used for input to the SSPS and a control unction, four channels with a two-out-ofnfour logic are sufficient to provide fthe required reliability and redundancy. The circuit must be able to "withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Again, a single failure will neither cause nor prevent the protection function actuation.

These requirements are described in IEEE-279-1971 (Ref. 3). The actual number of channels required for each unit parameter is specified in Reference 1.

• , - - .Two logic channels are required to' eniure no single random failure of a logic channel will disable the RTS. The logic channels are designed such that testing required while the reactor is at power may be accomplished without causing trip.

(continued)

CALLAWAY PLANT IB 3.3.1-3 , Revision 0

RTS Instrumentation B 3.3.1 BASES BACKGROUND Trip Setpoints and Allowable Values (continued)

The Trip Setpoints are the nominal value's at which the bistables are set.

'Any bistable is considered to be properly adjusted when the "as left" value is within the two-sided tolerance band for calibration accuracy (typically

+/- 15'mV).

The 'Trip Setpoints listed in Table B 3.3.'1-1 and used in the bistables are based on the analytical limits stated in Reference 2. The selection of

'these Trip Setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those RTS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 4), the Allowable Values specified in Table 3.3.1-1 in the accompanying LCO are conservatively adjusted with respect to the analytical limits. A detailed description of the methodology used to calculate the Trip Setpoints, including their explicit uncertainties, is provided in Reference 6. The actual nominal Trip Setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a COT. One example of such a change in measurement error is drift during the surveillance interval. If the measured setpoint does not exceed the Allowable Value, the bistable is considered OPERABLE.

Setpoints in accordance with the Allowable Value ensure that design limits are not violated during AOOs (and that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed).

Note that in the accompanying LCO 3.3.1, the Allowable Values of Table 3.3.1-1 are the LSSS.

Until such time as the issues raised by OL#1230 are reviewed and approved by the NRC, the typical relationship discussed above (consistent with the setpoint methodology discussed in Reference 6) between the nominal Trip Setpoint in Table B 3.3.1-1 and the Allowable Value in Table 3.3.1-1 for Functiohs 14.a and 14.b, SG Water Level Low Low (Adverse Containment Environment, Normal Containment Environment), will not be met. The nominal Trip Setpoint in Table B 3.3.1-1 has been increased by 6.8% of narrow range instrument span to address the SG mid-deck plate algebraic bias raised by Westinghouse NSAL-02-03. The affected bistables have been readjusted to the nominal Trip Setpoints listed in Table B 3.3.1-1 and have been "as left" within the two-sided band for calibration accuracy discussed above. Under a corresponding administrative change, an increase of 6.8% of narrow range instrument span has been added to the Allowable Values (see (continued)

CALLAWAY PLANT B 3.3.1-4 Revision 3

RTS Instrumentation B 3.3.1 BASES BACKGROUND Trip Setpoints and Allowable Values (continued)

Table 3.3.1-1) in the associated procedures for determining channel OPERABILITY. This administrative control will remain in place until OL#1 230'is approved and implemented..

Each channel of the process control equipment can be tested on line to verify that the signal or setpoint accuracy is within the specified allowance requirements. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated. SRs for the channels are specified in the SRs section.

The Allowable Values listed in Table 3.3.1-1 are based on the methodology described in Reference 6, and reviewed in support of Amendments 15, 43, 57, 84, 102, and 125, which incorporates all of the known uncertainties applicable for each channel. The magnitudes of these -uncertainties are factored into the determination of each Trip Setpo0int. All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes.

Solid State Protection System The SSPS equipment is used for the decision logic processing of outputs from the signal processing equipment bistables. To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide reactor trip and/or ESF actuation for the Unit. If both trains are taken out of service or placed in test, a reactor trip will result. Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements. The system has been designed to trip in the event of a loss of power, directing the unit to a safe shutdown condition.

- The'SSPS performs the decision logic for actuating a reactor trip or ESF actuation, generates the electrical output signal that will initiate the

• required trip or'actuation, and provides the status, permissive, and annunciator output signals to the main control room of the unit.

The bistable outputs from the signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various unit upset and accident transients. If a required logic matrix combination is completed, the system will initiate a (continued)

CALLAWAY PLANT B 3.3.1-5

• Revision 3

RTS Instrumentation B 3.3.1 BASES BACKGROUND Solid State Protection System (continued) reactor trip or send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition. Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.

Reactor Trip Switchgear The RTBs are in the electrical power supply line from the control rod drive motor generator set power supply to the CRDMs. Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods and control rods to fall into the core by gravity. Each RTB is equipped with a bypass breaker to allow testing of the RTB while the unit is at power.

During normal operation the output from the SSPS is a voltage signal that energizes the undervoltage coils in the RTBs and bypass breakers, if in use. When the required logic matrix combination is completed, the SSPS output voltage signal is removed, the undervoltage coils are de-energized, the breaker trip lever is actuated by the de-energized undervoltage coil, and the RTBs and bypass breakers are tripped open. This allows the shutdown rods and control rods to fall into the core. In addition to the de-energization of the undervoltage coils, each reactor trip breaker is also equipped with an automatic shunt trip device that is energized to trip the breaker open upon receipt of a reactor trip signal from the SSPS. Either the undervoltage coil or the shunt trip mechanism is sufficient by itself, thus providing a diverse trip mechanism.

The decision logic matrix Functions are described in the functional diagrams included in Reference 1. In addition to the reactor trip or ESF, these diagrams also describe the various "permissive interlocks" that are associated with unit conditions.

Each train has a built in testing device that can test the decision logic matrix Functions and the actuation devices while the unit is at power.

When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed. The testing device is semiautomatic to minimize testing time.

(continued)

CALLAWAY PLANT B 3.3.1-6 Revision 3

RTS Instrumentation B 3.3.1 BASES (continued)

APPLICABLE The RTS functions to maintain the applicable Safety Limits during all SAFETY AQOs and mitigates the consequences of DBAs in all MODES in which ANALYSES, the Rod Control System is capable of rod withdrawal or one or more rods LCO, AND are not fully inserted.

APPLICABILITY Each of the analyzed accidents and transients can be detected by one or more RTS Functions. The accident analysis described in Reference 2 takes credit for most RTS trip Functions. RTS trip Functions not specifically credited in the accident analysis are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These RTS trip Functions may provide protection for conditions that do not require dynamic'transient analysis to demonstrate Function performance. They may also serve as backups to RTS trip Functions that were credited in the accident analysis.

The LCO requires all instrumentation performing an RTS Function, listed "inTable 3.3.1-1 in the accompanying LCO, to be OPERABLE. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.

The LCO generally requires OPERABILITY of three or four channels in each instrumentation Function, two channels of Manual Reactor Trip in each logic Function, and two trains in each Automatic Trip Logic Function.

Four OPERABLE instrumentation channels in a two-out-of-four configurationare required when one RTS channel is also used as a control system input. This configuration accounts for the possibility of the shared channel failing in such a manner that it creates a transient that requires RTS action. In this case, the RTS will still provide protection, even with a random failure of one of the other three protection channels.

Three operable instrumentation channels in a two-out-of-three configuration are generally required when there is no potential for control system and protection system interaction that could simultaneously create a need for RTS trip and disable one RTS channel. The two-out-of-three and two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing a reactor trip. In cases where an

• oinoperable channel is placed in the tripped condition indefinitely to satisfy the Required A6tion of an LCO, the logic configurations are reduced to "one-out-of-two and one-out-of-three where tripping of an additional channel, for any reason, would result in a reactor trip. To allow for surveillance testing or setpoint adjustment of other channels while in this condition, several Required Actions allow the inoperable channel to be bypassed. Bypassing the inoperable channel creates a two-out-of-two or two-out-of-three logic configuration allowing a channel to be tripped for testing without causing a reactor trip. Specific exceptions to the above general philosophy exist and are discussed below.

(continued)

CALLAWAY PLANT B 3.3.1-7 CLW3-,Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE Reactor Trip System Functions SAFETY ANALYSES, The safety analyses and OPERABILITY requirements applicable to each LCO, AND RTS Function are discussed below:

APPLICABILITY (continued) 1. Manual Reactor Trip The Manual Reactor Trip ensures that the control room operator can initiate a reactor trip at any time by using either of two reactor trip switches in the control room. A Manual Reactor Trip accomplishes the same results as any one of the automatic trip Functions. It is used by the reactor operator to shut down the reactor whenever any parameter is rapidly trending toward its Trip Setpoint.

The LCO requires two Manual Reactor Trip channels to be OPERABLE. Each channel is controlled by a manual reactor trip switch. Each channel activates the reactor trip breaker in both trains. Two independent channels are required to be OPERABLE so that no single random failure will disable the Manual Reactor Trip Function.

In MODE I or 2, manual initiation of a reactor trip must be OPERABLE. These are the MODES in which the shutdown rods and/or control rods are partially or fully withdrawn from the core.

In MODE 3, 4, or 5, the manual initiation Function must also be OPERABLE if one or more shutdown rods or control rods are withdrawn or the Rod Control System is capable of withdrawing the shutdown rods or the control rods. In this condition, inadvertent control rod withdrawal (automatic rod withdrawal is no longer available) is possible. In MODE 3, 4, or 5, manual initiation of a reactor trip does not have to be OPERABLE if the Rod Control System is not capable of withdrawing the shutdown rods or control rods and if all rods are fully inserted. If the rods cannot be withdrawn from the core and all of the rods are fully inserted, there is no need to be able to trip the reactor. In MODE 6, neither the shutdown rods nor the control rods are permitted to be withdrawn and the CRDMs are disconnected from the control rods and shutdown rods. Therefore, the manual initiation Function is not required.

2. Power Range Neutron Flux' The NIS power range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS (continued)

CALLAWAY PLANT B 3.3.1-8 Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE Power Range Neutron Flux -(continued)

SAFETY ANALYSES, power range detectors provide input to the Rod Control System "LCO,AND and the Steam Generator (SG) Water Level Control System.

APPLICABILITY Therefore, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other "channels providing the protection function actuation. Note that this Functionr also provides a signal to prevent rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the'transient and eliminate the need to trip the reactor.

a. Power Range Neutron Flux - High T*he Power Range Neutron Flux - High trip Function ensures that protection is provided, from all power levels, against a pr6sitive reactivity excursion leading to DNB during power operations and will prevent fuel melting, providingprotection for the safety limit on linear heat rate.

These excursions can be caused by rod withdrawal or reductions in RCS temperature.

The LCO requires all four of the Power Range Neutron Flux - High channels to be OPERABLE (two-out-of-four trip logic). The Trip Setpoint is _<109% RTP.

In MODE I or 2, when a positive reactivity excursion could occur, the Power Range Neutron Flux - High trip must be OPERABLE. This Function will terminate the reactivity excursion and shut down the reactor prior to reaching a power level that could damage the fuel. In MODE 3, 4, 5, Sor 6, the NIS power range detectors cannot detect neutron levels. -In these MODES, the Power Range Neutron Flux Higt does not have to be OPERABLE because the reactor is shut down and reactivity excursions into the power range are extremre'ly unlikely. Other RTS Functions and administrative controls provide protection against reactivity additions when in MODE 3, 4, 5, or 6.

b. Power Range Neutron Flux - Low The LCO'requirement for the Power Range Neutron Flux Low trip Function ensures that protection is provided

'against a po*sitive ieactivity excursion from low power or subcritical conditi6rs.

(continued)

CALLAWAY PLANT B 3.3.1-9 Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE b. Power Range Neutron Flux - Low (continued)'

SAFETY ANALYSES, The LCO requires all four of the Power Range Neutron LCO, AND Flux - Low channels to be OPERABLE (two-out-of-four trip APPLICABILITY logic). The Trip Setpoint is

• 25% RTR In MODE 1, below the Power Range Neutron Flux (P-10 setpoint), and in MODE 2, the Power Range Neutron Flux Low trip must be OPERABLE. This Function may be manually blocked by the operator when two out of four power range channels are greater than 10% RTP (P-10 setpoint). This Function is automatically unblocked when three out of four power range channels are below the P-10 setpoint. Above the P-10 setpoint, positive reactivity additions are mitigated by the Power Range Neutron Flux High trip Function.

In MODE 3, 4, 5, or 6, the Power Range Neutron Flux Low trip Function does not have to be OPERABLE because the reactor is shut down and the NIS power range detectors cannot detect neutron levels in this range. Other RTS trip Functions and administrative controls provide protection against positive reactivity additions or power excursions in MODE 3, 4, 5, or 6.

3. Power Range Neutron Flux Rate The Power Range Neutron Flux Rate trip uses the same channels as discussed for Function 2 above.

Power Range Neutron Flux - High Positive Rate The Power Range Neutron Flux - High Positive Rate trip Function ensures that protection is provided against rapid increases in neutron flux that are characteristic of an RCCA drive rod housing rupture and the accompanying ejection of the RCCA. This Function compliments the Power Range Neutron Flux - High and Low Setpoint trip Functions to ensure that the criteria are met for a rod ejection from the power range.

The LCO requires all four of the Power Range Neutron Flux - High Positive Rate channels to be OPERABLE (two-out-of-four trip logic). The Trip Setpoint is

• 4% RTP with a time constant > 2 seconds.

(continued)

CALLAWAY PLANT B 3.3.1-10 Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE Power Range Neutron Flux - High Positive Rate (continued)

SAFETY ANALYSES,, In MODE 1 or 2, when there is a potential to add a large amount LCO, AND of positive reactivity from a rod ejection accident (REA), the Power APPLICABILITY Range Neutron Flux- High Positive Rate trip must be OPERABLE In MODE 3, 4, 5, or 6, the Power Range Neutron Flux- High Positive Rate trip Function does not have to be OPERABLE because other RTS trip Functions and administrative controls will provide protection against positive reactivity additions. Also, since only the shutdown banks may be withdrawn in MODE 3, 4, or 5,

"-theremaining complement of control bank worth ensures a sufficient degree of SDM in the event of an REA. In MODE 6, no rods are withdrawn and the SDM is increased during refueling operations. The reactor vessel head is also removed or the closure bolts are detensioned preventing any pressure buildup. In addition, the NIS power range detectors cannot detect neutron

-levels present in this mode.

4. Intermediate Range Neutron Flux The Intermediate Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition during startup (automatic rod withdrawal is no longer available). This trip Function provides redundant protection to the Power Range Neutron Flux - Low Setpoint trip Function. The NIS intermediate I

range detectors are located external to the reactor vessel and i measure neutrons leaking from the core. The NIS intermediate range detectors do not provide any input to control systems. Note that this Function also provides a signal to prevent rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.

The LCO requires two chahnels of Intermediate Range Neutron Flux to be OPERABLE. Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function (one-out-of-two trip logic). The Trip Setpoint is *< 25% RTP.

Because this trip Function is important only during startup, there is generally no need to disable channels for testing while the Function is required to be OPERABLE. Therefore, a third channel is unnecessary. - -,

_InMODE 1 bel6w the P-10 setpoint, and in MODE 2 above the

- 'P-6 setpoint; when there is a potential for an uncontrolled RCCA bank rod withdrawal accident during*reactor startup, the (continued)

CALLAWAY PLANT B 3.3.1-11 ,Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE 4. Intermediate Range Neutron Flux (continued)

SAFETY ANALYSES, Intermediate Range Neutron' Flux trip must be OPERABLE.

LCO, AND Above the P-10 setpoint, the Power Range Neutron Flux - High APPLICABILITY Setpoint trip and the Power Range Neutron Flux - High Positive Rate trip provide core protection for a rod withdrawal accident. In MODE 2 below the P-6 setpoint, the Source Range Neutron Flux tripFunction provides core protection for reactivity accidents. In MODE 3, 4, or 5, the Intermediate Range Neutron Flux trip does not have to be OPERABLE because the control rods must be fully inserted and only the shutdown rods may be withdrawn. The reactor cannot be started up in this condition. The core also has the required SDM to mitigate the consequences of a positive reactivity addition accident. In MODE 6, all rods are fully inserted and the core has a required increased SDM. Also, the NIS ' -*

intermediate range detectors cannot detect neutron levels present in this MODE.

5. Source Range Neutron Flux The LCO requirement for the Source Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition during startup (automatic rod withdrawal is no longer available). This trip Function provides redundant protection to the Power Range Neutron Flux- Low and Intermediate Range Neutron Flux trip Functions. In MODES 3, 4, and 5, administrative controls also prevent the uncontrolled manual withdrawal of rods.

The NIS source range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS source range detectors do not provide any inputs to control systems. The source range trip is the only RTS automatic protection function required in MODES 3, 4, and 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. Therefore, the functional capability at the Trip Setpoint is assumed to be available.

The LCO requires two channels of Source Range Neutron Flux to be OPERABLE. Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function. This Function uses one-out-of-two trip logic. The Trip Setpoint is

5 1.0 E5 cps. The outputs of the Function to RTS logic are not required OPERABLE in MODE 6 or when all rods are fully inserted and the Rod Control System is incapable of rod withdrawal.

(continued)

• ,CALLAWAY PLANT B 3.3.1-12 Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE 5. Source Range Neutron Flux (continued)

SAFETY ANALYSES, The Source Range Neutron Flux trip Function provides protection LCO -AND - for control rod withdrawal from subcritical, boron dilution, and APPLICABILITY, control rod ejection events.

In MODE 2 when below the P-6 setpoint, the Source Range Neutron Flux trip must be OPERABLE. Above the P-6 setpoint, the Intermediate Range Neutron Flux trip and the Power Range SNeutron Flux- Low trip will provide core protection for reactivity accidents. Above the P-6 setpoint, the NIS source range neutron "fluxreactor trip may be manually blocked. When the source range trip is blocked, the high voltage to the detectors is also removed.

In MODES 3, 4, and 5 with the Rod Control System capable of rod "withdrawalor one or more rods not fully inserted, the Source Range Neutron Flux trip Function must also be OPERABLE. If the Rod Control System is capable of rod withdrawal, the Source Range Neutron Flux trip must be OPERABLE to provide core protection against a rod withdrawal accident. If the Rod Control

- System is not capable of rod withdrawal, the source range detectors are not required t0 trip the reactor. However, their "monitoring Function must be OPERABLE to monitor core neutron levels and provide inputs to the BDMS as addressed in LCO 3.3.9, "Boron'Dilution Mitigation System (BDMS)," to protect against "inadvertentreactivity changes that may occur as a result of events like an uncontrolled boron dilution. The requirements for the NIS

• " - - source range detectors in MODE 6 are addressed in LCO 3.9.3, "Nuclear Instrumentation."

"' 6*. Overtemperature AT The Overtemperature AT trip Function is provided to ensure that the design limit DNBR is met. This trip Function also limits the range over which the' Overpower AT trip Function must provide "protection. The inputs to the Overtemperature AT trip include pressure, coolant temperature, axial power distribution, and

• "reactor power as indicated by loop AT assuming full reactor coolant flow.' Protection from violating the DNBR limit is assured for those transients that are slow with respect to delays from the core to the measurement system. The Overtemperature AT trip Function uses eacht loop's AT as a measure of reactor power and is compared with a setpoint that is automatically varied with the

'following parameters:'

(continued)

CALLAWAY PLANT B 3.3.1-13 ýRevision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE 6. Overtemperature AT (continued)

SAFETY ANALYSES,' reactor coolant average temperature - the Trip Setpoint is LCO, AND varied to correct for changes in coolant density and APPLICABILITY specific heat capacity with changes in coolant temperature; pressurizer pressure - the Trip Setpoint is varied to correct for changes in system pressure; and axial power distribution f(AI) - the Trip Setpoint is varied to account for imbalances in the axial power distribution as detected by the NIS 'upper and lower power range detectors. If axial peaks are greater than the design limits, as indicated by the difference between the upper and lower NIS 1ower range detectors, the Trip Setpoint is reduced.

Dynamic compensation is included for system piping delays from the core to the temperature measurement system.

ATo and T', as used in the Overtemperature AT trip, represent the 100% RTP values as measured by the plant for each loop. For the startup of a refueled core until reset to actual measured values (at 90-100% RTP), AT, is initially set at a value which is conservatively lower than the last measured 100% RTP AT. for each loop. Setting AT, and T' to the measured value of AT, and T' normalizes each loop's Overtemperature AT trip to the RCS loop conditions existing at the time of measurement, thus the trip reflects the equivalent full power conditions assumed for the OTAT trip in the accident analyses. These differences in vessel AT and Tag can result from several factors, two of them being measured RCS loop flows greater than Minimum Measured Flow and asymmetric power distributions between quadrants. While RCS loop flows are not expected to change, radial power redistribution between quadrants may occur resulting in small changes in loop specific vessel AT and Tavg values. Accurate determination of the loop-specific vessel AT and Tavg values are made when performing the Incore/Excore quarterly recalibration under steady state conditions (i.e., power distributions not affected by xenon or other transient conditions).

The time constants used in the lag compensation of measured AT (T 3) and measured Tavg (,r) are set at 0 seconds. This setting corresponds to the 7300 NLL card values used for lag compensation of these signals. Safety analyses that credit Overtemperature AT for protection must account for these field adjustable lag cards as well as all other first order lag contributions (continued)

CALLAWAY PLANT B 3.3.1-14 Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE 6. Overtemperature AT (continued)

SAFETY ANALYSES, (i.e.,ý the combined RTD/thermowell response time and the scoop LCO, AND transport delay and thermal lag). The safety analyses use a total

-,APPLICABILITY first order lag of less than or equal to 6 seconds.

The Overtemperature AT trip Function is calculated for each loop as described in Note 1 of Table 3.3.1-1. Trip occurs if Overtemperature AT is indicated in two loops. The pressure and temperature signals are used for other control functions; thus, the

• actuation logic must be able to withstand an input failure to the

-control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Note that this Function also prqvides a signal to generate a turbine runback prior to reaching the Trip Setpoint. A turbine runback will reduce turbine power and reactor power,-either through automatic rod insertion or through operator action. A reduction'in power will normally alleviate the Overtemperature AT condition and may prevent a reactor trip.

The LCO requires all four channels of the Overtemperature AT trip Function to be OPERABLE (two-out-of-four trip logic). Note that the Overtemperature AT Function receives input from channels shared with other RTS Functions. Failures that affect multiple Functions require entry into the Conditions applicable to all

-affected Functions.

In MODE I or 2, the Overtemperature AT trip must be OPERABLE to prevent DNB., In MODE 3, 4, 5, or 6, this trip Function does not have to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about DNB.

7. Overpower AT The Overpower AT trip Function ensures that protection is provided to ensure the integrity of the fuel (i.e., no fuel pellet

.melting and less than 1% cladding strain) under all possible

. overpower conditions. This trip Function also limits the required S. range of the Overtemperature AT trip Function and provides a backup to the Power Range Neutron Flux - High Setpoint trip. The Overpower AT trip Function ensures that the allowable heat generation rate (kW/ft) of the fuel is not exceeded. The Overpower AT trip also provides protection to mitigate the consequences 0of small steamline breaks, as reported in Reference 11, and the decrease in feedwater temperature event (Ref. 13). It uses the AT of each loop as a measure of reactor (continued)

ICALLAWAY PLANT - Revision 3 B 3.3.1-15

RTS Instrumentation B 3.3.1 BASES APPLICABLE 7. Overpower AT (continued),

SAFETY ANALYSES power with a setpoint that is automatically varied with the following LCO, AND parameters:

APPLICABILITY reactor coolant average temperature - the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature; and rate of change of reactor coolant average temperature including dynamic compensation for the delays between the core and the temperature measurement system.

ATo and T", as used in the Overpower AT trip, represent the 100%

RTP values as measured by the plant for each loop. For the startup of a refueled core until reset to actual measured values (at 90-100% RTP), AT, is initially set at a value which is conservatively lower than the last measured 100% RTP AT%for each loop. Setting ATo and T to the measured value of ATo and T" normalizes each loop's Overpower AT trip to the RCS loop conditions existing at the time of measurement, thus the trip reflects the equivalent full power conditions assumed for the OPAT trip in the accident analyses. These differences in vessel AT and Tayg can result from several factors, two of them being measured RCS loop flows greater than Minimum Measured Flow and asymmetric power distributions between quadrants. While RCS loop flows are not expected to change, radial power redistribution between quadrants may occur resulting in small changes in loop-specific vessel AT and Tavg values. Accurate determination of the loop-specific vessel AT and Tag values are made when performing the Incore/Excore quarterly recalibration under steady state conditions (i.e., power distributions not affected by xenon or other transient conditions).

The time constants used in the lag compensation of measured AT (,r3) and measured Tayg (-Ts) are set at 0 seconds. This setting corresponds to the 7300 NLL card values used for lag compensation of these signals. Safety analyses that credit Overpower AT for protection must account for these field adjustable lag cards as well as all other first order lag contributions (i.e., the combined RTD/ thermowell response time and the scoop transport delay and thermal lag). The safety analyses use a total first order lag of less than or equal to 6 seconds.

(continued)

CALLAWAY PLANT B 3.3.1-16 Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE 7. Overpower AT (continued)

SAFETY

• ANALYSES, The Overpower AT trip Function is calculated for each loop as per LCO, AND ý, Note 2of Table 3.3.1-1. Trip occurs if OverpowerAT is indicated APPLICABILITY in two loops. The actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the remaining channels providing the protection function actuation. Note that this Function also provides a signal to generate a turbine runback prior to reaching the Trip Setpoint. A turbine runback will reduce turbine power and reactor power. A reduction in power will normally alleviate the Overpower AT condition and may prevent a "reactortrip.

The LCO requires four channels of the Overpower AT4rip Function to be OPERABLE (two-out-of-four trip logic). Note that the Overpower AT trip Function receives input from channels shared with other RTS Functions. Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions.

In MODE 1 or 2, the OverpowerAT trip Function must be OPERABLE. These are the only times that enough heat is

-generated in the fuel to be concerned about the heat generation rates and overheating of the fuel. In MODE 3, 4, 5, or 6, this trip Function does not have to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about fuel overheating and fuel damage.

8. Pressurizer Pressure The same sensors provide input to the Pressurizer Pressure High and - Low trips and the Overtemperature AT trip. The Pressurizer Pressure channels are also used to provide input to the Pressurizer Pressure Control System; thus, the actuation logic must be able to withstand an input failure to the control system, I I which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.

a. Pressurizer Pressure - Low ThePressurizer Pressure - Low trip Function ensures that protection is provided against violating the DNBR limit due to low pressure.

(continued)

CALLAWAY PLANT 113 3.3.1-17  ; Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE a. Pressurizer Pressure - Low (continued)

SAFETY ANALYSES, The LCO requires four channels of Pressurizer Pressure LCO, AND Low to be OPERABLE (two-out-of-four trip logic). The Trip APPLICABILITY Setpoint is _>1885 psig.

In MODE 1, when DNB is a major concern, the Pressurizer Pressure - Low trip must be OPERABLE. This trip Function is automatically enabled on increasing power by the P-7 interlock (NIS power range P-10 or turbine impulse pressure greater than 10% of full power equivalent (P-1 3)).

On decreasing power, this trip Function is automatically blocked below P-7. Below the P-7 setpoint, there is insufficient heat production to generate DNB conditions.

b. Pressurizer Pressure - High The Pressurizer Pressure - High trip Function ensures that protection is provided against overpressurizing the RCS.

This trip Function operates in conjunction with the pressurizer PORVs and safety valves to prevent RCS overpressure conditions.

The LCO requires four channels of Pressurizer Pressure High to be OPERABLE (two-out-of-four trip logic). The Trip Setpoint is < 2385 psig.

The Pressurizer Pressure - High Allowable Value is selected to be below the pressurizer safety valve actuation pressure and above the power operated relief valve (PORV) setting. This setting minimizes challenges to safety valves while avoiding unnecessary reactor trip for those pressure increases that can be controlled by the PORVs.

In MODE 1 or 2, the Pressurizer Pressure - High trip must be OPERABLE to help prevent RCS overpressurization and minimize challenges to the PORVs and safety valves.

In MODE 3, 4, 5, or 6, the Pressurizer Pressure - High trip Function does not have to be OPERABLE because transients that could cause an overpressure condition will be slow to occur. Therefore, the operator will have sufficient time to evaluate unit conditions and take corrective actions. Additionally, low temperature overpressure protection systems provide overpressure (continued)

CALLAWAY PLANT B 3.3.1-18 Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE b. Pressurizer Pressure - High (continued)

SAFETY

-ANALYSES, protection when the temperature of one or more RCS LCO, AND loops is below 275 0 F.

APPLICABILITY.

9. Pressurizer Water Level - High The Pressurizer Water Level - High trip Function provides a backup signal for the Pressurizer Pressure - High trip and also provides protection against water relief through the pressurizer safety valves. These valves are designed to pass steam in order to achieve their design energy removal rate. A reactor trip is actuated prior to the pressurizer becoming water solid. The LCO requires three channels of Pressurizer Water Level - High to be

.. . , OPERABLE (two-out-of-three trip logic). The Trip Setpoint is

_<92% of instrument span. The pressurizer level channels are used as input to the Pressurizer Level Control System. A fourth channel is not required to address control/protection interaction concerns. The level channels do not actuate the safety valves, and the high pressure reactor trip is set below the safety valve setting. Therefore, with the slow rate of charging available, pressure overshoot due to level channel failure cannot cause the

-safety valve to lift before reactor high pressure trip.

In MODE 1,when there is,a potential for overfilling the pressurizer, the Pressurizer Water Level - High trip must be OPERABLE. This trip Function is automatically enabled on increasing power by the P-7 interlock. On decreasing power, this trip Function is

,-automatically blocked belowP-7. Below the P-7 setpoint, transients that could raise the pressurizer water level will be slow and the operator will have sufficient time to evaluate unit conditions and take corrective actions.

10. Reactor Coolant Flow - Low The Reactor Coolant Flow - Low trip Function ensures that protection is provided against violating the DNBR limit due to low flow in one or more RCS loops, while avoiding reactor trips due to normal variations in loop flow. Above the P-7 setpoint, the reactor trip on low flow in two or more RCS loops is automatically enabled. Above the P-8 setpoint, a loss of flow in any RCS loop

, will actuate a reactor trip., Each RCS loop has three flow detectors to monitor flow. The flow signals are not used for any control system input. .- ,

(continued)

- CALLAWAY PLANT

• 1B 3.3.1-19 . Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE 10. Reactor Coolant Flow - Low (continued)

SAFETY ANALYSES, The LCO requires three Reactor Coolant Flow - Low channels per LCO, AND loop to be OPERABLE in MODE 1 above P-7 (two-out-of-three trip APPLICABILITY logic). The Trip Setpoint is > 90% of loop Minimum Measured Flow (MMF = 95,660 gpm).

In MODE I above the P-8 setpoint, a loss of flow in one RCS loop could result in DNB conditions in the core because of the higher power level. In MODE 1 below the P-8 setpoint and above the P-7 setpoint, a loss of flow in two or more loops is required to actuate a reactor trip because of the lower power level and the greater margin to the design limit DNBR. Below the P-7 setpoint, all reactor trips on low flow are automatically blocked since there is insufficient heat prcduction to generate DNB conditions.

11. Not used.

12. Undervoltage Reactor Coolant Pumps The Undervoltage RCP reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops. There is one potential transformer (PT), with a primary to secondary ratio of 14400:120, connected in parallel with the 13.8 kV power supply (PA system) to each RCP motor at the motor side of the supply breaker. Each PT secondary side is connected to an undervoltage relay and time delay relay, as well as a separate underfrequency relay. The undervoltage relays provide output signals to the SSPS which trips the reactor, if permissive P-7 issatisfied (i.e., greater than 10% of rated thermal power), when the voltage at one out of two RCP motors on both PA system buses drops below 10584 Vac (corresponding to 88.2 Vac at the undervoltage relay). The time delay relay prevents spurious trips caused by transient voltage perturbations. This trip Function will generate a reactor trip before the Reactor Coolant Flow - Low Trip Setpoint is reached.

The LCO requires two Undervoltage RCP channels per bus to be OPERABLE, a total of four channels. The Trip Setpoint is

> 10,584 Vac.

In MODE I above the P-7 setpoint, the Undervoltage RCP trip must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since the core is not producing sufficient power to generate DNB conditions. Above the (continued)

CALLAWAY PLANT B 3.3.1-20 Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE- 12. Undervoltage Reactor Coolant Pumps (continued)

SAFETY ANALYSES, P-7 setpoint, the reactor trip on Undervoltage-RCPs is' LCO, AND - automatically enabled.

APPLICABILITY .

13. Underfrequency Reactor Coolant Pumps The Underfrequency RCP reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops from a major network "frequency disturbance. An underfrequency condition will slow down the pumps, thereby reducing their coastdown time following a pump trip. An adequate coastdown time is required so that reactor heat can be removed immediately after reactor trip. There is one potential transformer (PT), with a primary to secondary ratio

-of 14400:120, connected in parallel with the 13.8 kV power supply

, , -. (PA system) to each RCP motor at the motor side of the supply breaker. Each PT secondary side is connected to an undervoltage relay and time delay relay; as well as a separate underfrequency relay. The underfrequency relays provide output signals to the SSPS which trips the reactor, if permissive P-7 issatisfied (i.e.,

, greater than 10% of rated thermal power), when the frequency at one out of two RCP, motors on both PA system buses drops below 57.2 Hz. The time delay set on the underfrequency relay prevents spurious trips caused by transient frequency perturbations. This trip Function will generate a reactor trip before the Reactor Coolant Flow - Low Trip Setpoint is reached.

The LCO requires two Underfrequency RCP channels per bus to be OPERABLE, a total of four channels. The Trip Setpoint is

> 57.2 Hz.

In MODE 1 above the P-7-setpoint, the Underfrequency RCP trip must be OPERABLE.-. Below the P-7 setpoint, all reactor trips on

, loss of flow are automatically blocked since the core is not producing sufficient power to generate DNB conditions. Above the P-7 setpoint, the reactor trip on Underfrequency-RCPs is automatically enabled. -' -,

"14. Steam Generator Water Level - Low Low

" -The SG Water Level - Low Low trip Function ensures that protection is provided against a loss of heat sink and actuates the

,AFW System priorto uncovering the SG tubes. The SGs are the heat sink for the reactor. In order to act as a heat sink, the SGs must contin a minimum amount of water. A narrow range low low (continued)

CALLAWAY PLANT B 3.3.1-21 Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE 14. Steam Generator Water Level - Low Low (continued)

SAFETY ANALYSES, level in any SG is indicative of a loss of heat sink for the reactor.

LCO, AND The level transmitters also provide input to the SG Level Control APPLICABILITY System. Therefore, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the' protection function actuation. This Function also performs the ESFAS function of starting the AFW pumps on low low SG level. 'As discussed in Reference 7, the SG Water Level - Low Low trip function has been modified to allow a lower Trip Setpoint under normal containment environmental conditions and a delayed trip when THERMAL POWER is less than or equal to 22.41% RTP. The EAM/iTTD circuitry reduces the potential for inadvertent trips via the Environmental Allowance Modifier (EAM), enabled on containment pressure exceeding its setpoint, and the Trip Time Delay ('TD), enabling time delays dependent on vessel AT as listed in Table B 3.3.1-1. Because the SG Water Level transmitters (d/p cells) are located inside containment, they may experience adverse environmental conditions due to a feedline break. The EAM function is used to monitor the presence of adverse containment conditions (elevated pressure) and enables the Steam Generator Water Level Low-Low (Adverse) trip setpoint to reflect the increased transmitter uncertainties due to this harsh environment. The EAM enables a lower Steam Generator Water Level - Low-Low (Normal) trip setpoint when these conditions are not present, thus allowing more margin to trip for normal operating conditions. The TTD delays reactor trip on SG Water Level Low-Low, thereby providing additional operational margin during early power ascension by allowing the operator time to recover level when the primary side load is sufficiently small to not require an earlier trip.

The TTD continuously monitors primary side power using Vessel AT. Scaling of the Vessel AT channels is dependent on the loop specific values for AT,, discussed under the OTAT and OPAT trips. Two time delays are provided, based on the primary side power level; the magnitude of the trip delay decreases with increasing power. If the EAM or TTD trip functions have inoperable required channels, it is acceptable to place the inoperable channels in the tripped condition and continue operation. Placing the inoperable channels in the trip mode enables the Steam Generator Water Level - Low-Low (Adverse) function, for the EAM, or removes the trip delay-for the TTD. If the Steam Generator Water Level - Low-Low (Normal) trip function has an inoperable required channel, the inoperable channel must be tripped.

(continued)

CALLAWAY PLANT B 3.3.1-22 Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE 14: Steam Generator Water Level - Low Low (continued)

SAFETY ANALYSES,. -, The LCO requires four channels of SG Water Level - Low Low per LCO, AND . SG to be OPERABLE because these channels are shared

-*,?APPLICABILITY -between protection and control. All SG Water Level-Low Low reactor trip Functions use two-out-of-four logic. As with other protection functions, the single failure criterion applies. The Trip

.Setpoints for the SG Water Level Low-Low (Adverse Containment Environment) and (Normal Containment Environment) bistables

- are > 20.2% and > 14.8% of narrow range span, respectively. The Trip Setpoints for the Vessel AT (Power-I) and (Power-2) bistables are _ Vessel AT Equivalent to 12.41% RTP and _<Vessel AT Equivalent to 22.41% RTP, respectively, with corresponding trip time delays'of_< 232 seconds and _ 122 seconds. The Trip

- Setpoint for the Containment Pressure - Environmental Allowance Modifier bistables is _<1.5 psig.

In MODE 1 or 2, when the reactor requires a heat sink, the SG Water Level - Low Low trip must be OPERABLE. The normal source of water for the SGs is provided by the Main Feedwater (MFW) Pumps (not safety related). The MFW Pumps are only in operation in MODE 1 or 2. The AFW System is the safety-related source of water to ensure that the SGs remain the heat sink for

-the reactor. During normal startups and shutdowns the MFW System orAFW System provides feedwater to maintain SG level.

In MODE 3, 4, 5, or 6, the SG Water Level - Low Low Reactor Trip Function does not have to be OPERABLE because the reactor is not operating or even critical (see LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation," for Applicability of SG Water Level - Low Low ESFAS Functions).

15. Not used.

- - 1ý1

16. Turbine Trip

a. Turbine Trip - Low Fluid Oil Pressure The Turbine Trip - Low Fluid Oil Pressure trip Function anticipates the loss of heat removal capabilities of the "secondarysystem following a turbine trip. This trip Function acts to minimize the pressure/temperature

'transient on the reactor. Any turbine trip from a power level below the P-9 setpoint, 50% power, will-not actuate a reactor trip. Three pressure switches monitor the control oil pressure in the Turbine Electrohydraulic Control (continued)

CALLAWAY PLANT IB 3.3.1-23  ; Revision 3

RTS Instrumentation B 3.3.1 BASES APPLICABLE a. Turbine Trip - Low Fluid Oil Pressure (continued)

SAFETY ANALYSES, System. A low pressure condition sensed by "

LCO, AND two-out-of-three pressure switches will actuate a reactor APPLICABILITY trip. These pressure switches do not provide any input to the control system. The unit is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure - High trip Function and RCS integrity is ensured by the pressurizer safety valves.

The LCO requires three channels of Turbine Trip - Low Fluid Oil Pressure to be OPERABLE in MODE 1 above P-9. The Trip Setpoint is > 598.94 psig.

Below the P-9 setpoint, a turbine trip does not actuate a reactor trip. In MODE 2, 3, 4, 5, or 6, there is no potential for a turbine trip, and the Turbine Trip - Low Fluid Oil Pressure trip Function does not need to be OPERABLE.

b. Turbine Trip - Turbine Stop Valve Closure The Turbine Trip - Turbine Stop Valve Closure trip Function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip. The trip Function anticipates the loss of secondary heat removal capability that occurs when the stop valves close. Tripping the reactor in anticipation of loss of secondary heat removal acts to minimize the pressure and temperature transient on the reactor. Any turbine trip from a power level below the P-9 setpoint, 50% power, will not actuate a reactor trip. This trip Function will not and is not required to operate in the presence of a single channel failure. The unit is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure - High trip Function, and RCS integrity is ensured by the pressurizer safety valves. This trip Function is diverse to the Turbine Trip - Low Fluid Oil Pressure trip Function. Each turbine stop valve is equipped with one limit switch that inputs to the RTS. If all four limit switches indicate that the stop valves are all closed, a reactor trip is initiated.

(continued)

CALLAWAY PLANT B 3.3.1-24 Revision 3

RTS Instrumentation B 3.3.1 BASES ACTIONS F.1 and F.2 (continued)

Condition F applies to the Intermediate Range Neutron Flux trip when

• THERMAL POWER is above the P-6 setpoint and below the P-10

" ',setpoint and one channel is inoperable. Above the P-6 setpoint and below the P-10 setpoint, the NIS intermediate range detectors perform the monitoring and protection functions. If THERMAL POWER is greater than the P-6 setpoint but less than the P-1 0 setpoint, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is allowed to reduce THERMAL POWER below the P-6 setpoint or increase THERMAL POWER above the P-10 setpoint. The NIS Intermediate Range Neutron Flux channels must be OPERABLE when the power level is above the capability of the source range, P-6, and below the capability of the power range, P-10. IfTHERMAL POWER is greater than the P-10 setpoint, the NIS power range detectors perform the monitoring and protection functions and the intermediate range is not required. The - I-.

Completion Times allow for a slow and controlled power adjustment above P-10 or below P-6 and take into account the redundant capability afforded by the redundant OPERABLE channel, the overlap of the Power Range detectors, and the low probability of another intermediate range channel failure during this period. This action does not require the inoperable channel to be tripped because the Function uses one-out-of-two logic. Tripping one channel would trip the reactor. Thus, the Required Actions specified in this Condition are only applicable when channel failure does not result in reactor trip.

-G.1 and G.2 Condition G applies to two inoperable Intermediate Range Neutron Flux trip channels in MODE 2 when THERMAL POWER is above the P-6 setpoint and below the P-10 setpoint. Required Actions specified in this Condition are only applicable when channel failures do not result in reactor trip. Above the P-6 setpoint and below the P-10 setpoint, the NIS intermediate range detectors perform the monitoring and protection

• functions. With no intermediate range channels OPERABLE, the Required Actions are to suspend operations involving positive reactivity

- . additions immediately. This will preclude any power level increase since there are no OPERABLE Intermediate Range Neutron Flux channels.

The operator must also reduce THERMAL POWER below the P-6 setpoint within two hours. -This may require the use of the NIS source

.* - -.range channels or the neutron flux channels discussed in LCO 3.3.3, "Post Accident Monitoring (PAM) Instrumentation," with action to reduce power below the count rate equivalent to the P-6 setpoint.

"(continued)

-CALLAWAY PLANT "B13.3.1-37 .Revision 0

RTS Instrumentation B 3.3.1 BASES ACTIONS GA and G2 (continued)

Below P-6, the Source Range Neutron Flux channels will be able to monitor the core power level. The Completion Time of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> will allow a slow and controlled power reduction to less than the P-6 setpoint and takes into account the low probability, of occurrence of an event during this period that may require the protection afforded by the NIS Intermediate Range Neutron Flux trip.

Required Action G.1 is modified by a Note to indicate that normal plant control operations that individually add limited positive reactivity (i.e.,

temperature or boron concentration fluctuations associated with RCS inventory management or temperature control) are not precluded by this Action, provided the SDM limits specified in the COLR are met and the requirements of LCOs 3.1.5, 3.1.6, and 3.4.2 are met.

H.A Not used.

1.1 Condition I applies to one inoperable Source Range Neutron Flux trip channel when in MODE 2 below the P-6 setpoint. With the unit in this Condition, below P-6, the NIS source range performs the monitoring and protection functions. With one of the two channels inoperable, operations involving positive reactivity additions shall be suspended immediately.

This will preclude any power escalation. With only one source range channel OPERABLE, core protection is severely reduced and any actions that add positive reactivity to the core must be suspended immediately.

Required Action 1.1 is modified by a Note to indicate that normal plant control operations that individually add limited positive reactivity (i.e.,

temperature or boron concentration fluctuations associated with RCS inventory management or temperature control) are not precluded by this Action, provided the SDM limits specified in the COLR are met, the requiremenits of LCOs 3.1.5, 3.1.6, and 3.4.2 are met, and the initial and critical boron concentration assumptions in FSAR Section 15.4.6 (Ref. 16) are satisfied. Introduction of reactor makeup water into the RCS from the Chemical and Volume Control System mixing tee is not permitted when one source range neutron flux channel is inoperable.

(continued)

CALLAWAY PLANT I B 3.3.1-38 Revision 3

RTS Instrumentation B 3.3.1 BASES ACTIONS J. 1 (continued)

Condition J applies to two inoperable Source Range Neutron Flux trip channels when in MODE 2 below the P-6 setpoint or in MODE 3, 4, or 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. With the unit in this Condition, below P-6, the NIS source range performs the monitoring and protection functions. With both source range channels inoperable, the Reactor Trip Breakers (RTBs) must be opened immediately. With the RTBs open, the core is in a more stable condition.

K.1, K.2.1, and K.2.2 Condition.K applies to pne inoperable source range channel in MODE 3, 4, or 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. With the unit in this Condition, below P-6, "theNIS source range performs the monitoring and protection functions.

With one of the source range channels inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is allowed to restore it to an OPERABLE status. If the channel cannot be returned to an OPERABLE status, action must be initiated within the same 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> to fully insert all rods. One additional hour is allowed to place the Rod Control System in a condition incapable of rod withdrawal (e.g., by "de-energizingall CRDMs, by opening the RTBs, or de-energizing the motor generator,(MG) sets). Once these ACTIONS are completed, the core is in a more stable condition. The allowance of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> to restore the channel to OPERABLE status, and the additional hour to place the Rod Control System in a condition incapable of rod withdrawal, are justified in Reference 5. Normal plant control operations that individually add limited positive reactivity (i.e., temperature or boron concentration fluctuations associated with RCS inventory management or temperature control) are permitted provided the SDM limits specified in the COLR are met and the initial and critical boron concentration assumptions in FSAR Section 15.4.6 (Ref. 16) are satisfied. Introduction of reactor makeup water into the RCS from the Chemical and Volume Control System mixing te)e is not permitted When'one source range neutron flux channel is

'inoperable.

L.1, L.2, and L.3

.Not used.

S.,

f I , (continued)

CALLAWAY PLANT B 3.3.1-39 Revision 3

RTS Instrumentation B 3.3.1 BASES ACTIONS M.1 and M.2 (continued)

Condition M applies to the following reactor trip Functions:

Pressurizer Pressure - Low; Pressurizer Water Level - High; Reactor Coolant Flow - Low; Undervoltage RCPs; and Underfrequency RCPs.

With one channel inoperable, the ihnop'-d-ble channel must be placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. For the Pressurizer Pressure - Low, Pressurizer Water Level - High, Undervoltage RCPs, and Underfrequency RCPs trip Functions, placing the channel in the tripped condition when above the P-7 setpoint results in a partial trip condition requiring only one additional channel to initiate a reactor trip. For the Reactor Coolant Flow

- Low trip Function, placing the channel in the tripped condition when above the P-8 setpoint results in a partial trip condition requiring only one additional channel in the same loop to initiate a reactor trip. For the Reactor Coolant Flow - Low trip Function, two tripped channels in two RCS loops are required to initiate a reactor trip when below the P-8 setpoint and above the P-7 setpoint. These Functions do not have to be OPERABLE below the P-7 setpoint because there are no loss of flow trips below the P-7 setpoint. There is insufficient heat production to generate DNB conditions below the P-7 setpoint. The 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowed to place the channel in the tripped condition is justified in Reference 5. An additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is allowed to reduce THERMAL POWER to below P-7 if the inoperable' channel cannot be restored to OPERABLE status or placed in trip within the specified Completion Time.

Allowance of this time interval takes into consideration the redundant capability provided by the remaining redundant OPERABLE channels, and the low probability of occurrence of an event during this period that may require the protection afforded by the Functions associated with Condition M.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> while performing routine surveillance testing of the oth~e channels. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> time limit is justified in Reference 5.

(continued)

CALLAWAY PLANT B 3.3.1-40 Revision 3

RTS Instrumentation B 3.3.1 BASES ACTIONS N.1 and N.2 (continued)

Not used.

0.1 and 0.2 Condition 0 applies to the Turbine Trip- Low Fluid Oil Pressure trip Function. With one channel inoperable, the inoperable channel must be placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. If placed in the tripped condition, this results in a partial trip condition requiring only one additional channel to initiate a reactor trip. If the channel cannot be restored to OPERABLE status or placed in the tripped condition, then power must be reduced below the P-9 setpoint within the next 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

The 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowed to place the inoperable, channel in the tripped condition and the 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> allowed for reducing power are justified in Reference 5.

The Required Actions have been modified by a Note that allows placing an inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> while performing routine surveillance testing of the other channels. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> time limit is justified in Reference 5.

P.1 and P.2 Condition P applies to the Turbine Trip -Turbine Stop Valve Closure trip Function. With one or more channel(s) inoperable, the inoperable channel(s) must be placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. For the Turbine Trip - Turbine Stop Valve Closure trip Function, four of four channels are required to initiate a reactor trip; hence, more than one channel may be placed in trip. If the channels cannot be restored to OPERABLE status or placed in the tripped condition, then power must be reduced below the P-9 setpoint within the next 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. The 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowed to place the inoperable channels in the tripped condition and the 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> allowed for reducing power are justified in Reference 5.

Q.1 and Q.2 Condition Q applies to the SI Input from ESFAS reactor trip and the RTS Automatic Trip Logic in MODES I and 2. These actions address the train orientation of the RTS for these Functions. With one.train inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to restore the train to OPERABLE status (Required Action Q.1) or the unitmust be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The Completion lime of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (Required Action Q.1) is reasonable (continued)

CALLAWAY PLANT B 3.3.1-41 C PA B 3 Revision 3

RTS Instrumentation B 3.3.1 BASES ACTIONS Q.1 and Q.2 (continued) considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function and given the low probability of an event during this interval. The Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (Required Action Q.2) is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems.

The Required Actions have been modified by a Note that allows bypassing one train up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for stirveillance testing, provided the other train is OPERABLE.

R.1 and R.2 Condition R applies to the RTBs in MODES 1 and 2. These actions address the train orientation of the RTS for the RTBs. With one train inoperable, 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is allowed to restore the train to OPERABLE status or the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Completion Times are equal to the time allowed by LCO 3.0.3 for shutdown actions in the event of a complete loss of RTS Function. Placing the unit in MODE 3 results in Condition C entry if one RTB train is inoperable and the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted.

The Required Actions have been modified by three Notes. Note 1 allows one train to be bypassed for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for RTB surveillance testing, provided the other train is OPERABLE. Note 2 allows one RTB to be bypassed only for the time required for performing maintenance on undervoltage or shunt trip mechanisms per Condition U if the other RTB train is OPERABLE. Note 3 allows one RTB to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for logic surveillance testing per Condition Q provided the other train is OPERABLE. The time limits are justified in References 5 and 12.

S.1 and S.2 Condition S applies to the P-6 and P-10 interlocks. With one or more required channel(s) inoperable, the associated interlock must be verified to be in its required state for the existing unit condition within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Verifying the interlock status manually, e.g., by observation of the associated (continued)

CALLAWAY PLANT B 3.3.1-42 Revision 3

RTS Instrumentation B 3.3.1 BASES ACTIONS S.1 and S.2 (continued) permissive annunciator window, accomplishes the interlock's Function.

The Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is based on operating experience and the minimum amount of time allowed for manual operator actions. The Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 3 frorm full power in an orderly manner and without challenging unit systems. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Completion Times are equal to the time allowed by LCO 3.0.3 for shutdown actions in the event of a complete loss of RTS Function.

T.1 and T.2 Condition T applies to the P-7, P-8, P-9, and P-13 interlocks. -With one--or more required channel(s) inoperable, the associated interlock must be verified to be in its required state for the existing unit condition within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or the unit must be placed in MODE 2 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

These actions are conservative for the case where power level is being raised. Verifying the interlock status manually, e.g., by observation of the associated permissive annunciator window, accomplishes the interlock's Function. The Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is based on operating experience and the minimum amount of time allowed for manual operator actions. The Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 2 from full power in an orderly manner and without challenging unit systems.

U.1 and U.2 Condition U applies to the RTB Undervoltage and Shunt Trip

'Mechanisms, or diverse trip features, in MODES 1 and 2. With one of the

• *diverse trip features inoperable, it must be restored to an OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or the unit must be placed in a MODE where the

,,' requirement does not apply. This is accomplished by placing the unit in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (54 hours6.25e-4 days <br />0.015 hours <br />8.928571e-5 weeks <br />2.0547e-5 months <br /> total time). The Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is a reasonable time, based on operating experience, to

• , reach MODE 3 from full power in an orderly manner and without challenging unit systems.

With the unit in MODE 3, Condition Cis entered if the inoperable trip mechanism has not been restored and the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted. The affected RTB shall not be bypassed while one of the diverse features is inoperable except for the time required to perform maintenance to restore the (continued)

-. CALLAWAY PLANT I - B 3.3.1-43 .. ,.,Revision 3

RTS Instrumentation B 3.3.1 BASES ACTIONS U.1 and U.2 (continued) inoperable trip mechanism to OPERABLE status, consistent with Reference 12.

The Completion Time of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> for Required Action U. 1 is reasonable considering that in this Condition there is one remaining diverse trip feature for the affected RTB, and one OPERABLE RTB capable of performing the safety function and given the low probability of an event occurring during this interval.

V.1 Not-used.

W.1 and W.2 Condition W applies to the Trip Time Delay (TTD) circuitry enabled for the SG Water Level - Low Low trip Function when THERMAL POWER is less than or equal to 22.41% RTP in MODES 1 and 2. With one or more Vessel AT Equivalent (Power-n, Power-2) channel(s) inoperable, the associated Vessel AT channel(s) must be placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. If the inoperability impacts the Power-1 and Power-2 portions of the TTD circuitry (e.g., Vessel AT RTD failure), both the Power-1 and Power-2 bistables in the affected protection set(s) are placed in the tripped condition. However, if the inoperability is limited to either the Power-I or Power-2 portion of the TTD circuitry, only the corresponding Power-1 or Power-2 bistable in the affected protection set(s) is placed in the tripped condition. With one or more TTD circuitry delay timer(s) inoperable, both the Vessel AT (Power-I) and Vessel AT (Power-2) channels are tripped. This automatically enables a zero time delay for that protection channel with either the normal or adverse containment environment level bistable enabled. The Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is based on Reference 7. If the inoperable channel cannot be placed in the tripped condition within the specified Completion Time, the unit must be placed in a MODE where this Function is not required to be OPERABLE. An additional six hours is allowed to place the unit in MODE 3.

(continued)

CALLAWAY PLANT B 3.3.1-44 Revision 3

RTS Instrumentation B 3.3.1 BASES ACTIONS X.1 and X.2 (continued)

Condition X applies to the Environmental Allowance Modifier (EAM) circuitry for the SG Water Level - Low Low trip Function in MODES 1 and 2. With one or more EAM channel(s) inoperable, they must be placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Placing an EAM channel in trip automatically enables the SG Water Level - Low Low (Adverse Containment Environment) bistable for that protection channel, with its higher SG level Trip Setpoint (a higher trip setpoint means a reactor trip would occur sooner). The Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is based on Reference 7. If.the inoperable channel cannot be placed in the tripped condition within the specified Completion lime, the unit must be placed in a MODE where this Function is not required to be OPERABLE. An additional six hours is allowed to place the unit in MODE 3.

SURVEILLANCE The SRs for each RTS Function are identified by the SRs column of

- REQUIREMENTS . Table 3.3.1-1 for that Function.

---A Note has been added stating that Table 3.3.1-1 determines which SRs apply to which RTS Functions.

Note that each channel of process protection supplies both trains of the RTS. When testing Channel I, Train A and Train B must be examined.

Similarly, Train A and Train B must be examined when testing Channel II, Channel III, and Channel IV. The CHANNEL CALIBRATIONs and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.

. t SR 3.3.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read

..approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in "oneof the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

(continued)

SCALLAWAY PLANT  :.B 3.3.1-45 ALWYLTB315Revision 3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.1 (continued)

REQUIREMENTS Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing eq*Jipment has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

S R 3.3.1.2 SR 3.3.1.2 compares the calorimetric heat balance calculation to the power range channel output every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. If the calorimetric heat balance calculation results exceed the power range channel output by more than +2% RTP, the power range channel is not declared inoperable, but must be adjusted. The power range channel output shall be adjusted consistent with the calorimetric heat balance calculation results if the calorimetric calculation exceeds the power range channel output by more than +2% RTP. If the power range channel output cannot be properly adjusted, the channel is declared inoperable.

If the calorimetic is performed at part-power (<40% RTP), adjusting the power range channel indication in the increasing power direction will assure a reactor trip below the power range high safety analysis limit (SAL) of*< 118% RTP in FSAR Table 15.0-4 (Reference 10). Making no adjust to the power range channel in the decreasing power direction due to a part-power calorimetric assures a reactor trip consistent with the safety analyses.

This allowance does not preclude making indicated power adjustments, if desired, when the calorimetric heat balance calculation power is less than the power range channel output. To provide close agreement between indicated power and to preserve operating margin, the power range channels are normally adjusted when operating at or near full power during steady-state conditions. However, discretion must be exercised if the power range channel output is adjusted in the decreasing power direction due to a part-power calorimetric (<40% RTP). This action could introduce a non-conservative bias'at higher power levels which could delay an NIS reactor trip until power is above the power range high SAL.

The cause of the non-conservative bias is the decreased accuracy of the calorimetric at reduced power conditions. The primary error contributor to (continued)

CALLAWAY PLANT B 3.3.1-46 Revision 3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.2 (continued)

REQMJIREMENTS .

the instrument uncertainty for a secondary side power calorimetric measurement is the feedwater flow measurement, which is determined by a AP measurement across a feedwater venturi. While the measurement uncertainty remains constant in AP span as power decreases, when translated into flow the uncertainty increases as a square term. Thus, a 1% flow error at 100% power can approach a 10% flow error at 30% RTP even though the AP error has not changed. To assure a reactor trip below the power range high SAL, the power range neutron flux - high trip setpoint is first set at _<85% RTP prior to adjusting the power range channel output in the decreasing power direction whenever the calorimetric power is > 20% RTP and <40% RTP. To assure a reactor trip below the power range high SAL, the power range neutron flux - high trip setpoint is first set a < 70% RTP prior to adjusting the power range II channel output in the decreasing power direction whenever the calorimetric power is Ž 15% RTP and <20% RTP. Adjustments in the increasing power direction do not require a prior decrease in the trip setpoint. Following a plant shutdown, it is permissible to reduce the power range neutron flux - high trip setpoint prior to startup. This would anticipate the potential need for a decreasing power direction adjustment, thereby obviating the need to suspend power escalation for the purpose of first reducing the trip setpoint. Before the power range neutron flux high trip'setpoint isre"-set to its nominal full power value (_<109% RTP),

the power range channel calibration must be confirmed based on a calorimetric performed at Ž-40% RTP.

The Note to SR 3.3.1.2 clarifies that this Surveillance is required only if the reactor power is >15% RTP and that 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are allowed for performing the first Surveillance after reaching 15% RTP. A power level of 15% RTP is choseri based on plant stability, i.e., automatic rod control capability (manual rod c6ntrol is normally used at Callaway) and the turbine generator synchronized to the grid. The 24-hour allowance after "increasing THERMAL POWER above 15% RTP provides a reasonable time to attain a icheduled power plateau, establish the requisite conditions, performr the' required calorimetric measurement, and make any required adjustments in a controlled, orderly manner and without "introducingthe potential for-extended operation at high power levels with instrumentation that'has not been ,erified to be OPERABLE for subsequent use. I The Frequency of every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is adequate. It is based on unit operating experience, considering instrumeift reliability and operating history.data for instrument drift: Together these factors demonstrate that

-a' difference bet ween th-e calorimetric heat balance calculation and the (continued)

CALLAWAY PLANT ý -B 3.3.1 -47 Revision 3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.2 (continued)

REQUIREMENTS power range channel output of more than +2% RTP is not expected in any 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period.

In addition, control room operators periodically monitor redundant indications and alarms to detect deviations in channel outputs.

SR 3.3.1.3 SR 3.3.1.3 compares the incore system to the NIS channel output every 31 EFPD. If the absolute difference is > 2%, the NIS channel is still OPERABLE, but must be readjusted. The excore NIS channel shall be

-*. adjusted if the absolute difference between the incore and excore AFD is

> 2%. The purpose of the comparison is to check for differences that result from core power distribution changes that may have occurred since the last required adjustment or incore-excore calibration (SR 3.3.1.6).

If the NIS channel cannot be properly readjusted, the channel is declared inoperable. This Surveillance is performed to verify the f(AI) input to the Overtemperature AT Function.

The Note to SR 3.3.1.3 clarifies that the Surveillance is required only if reactor power is > 50% RTP and that 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is allowed for performing the first Surveillance after reaching 50% RTP. This Note allows power ascensions and associated testing to be conducted in a controlled and orderly manner, at conditions that provide acceptable results and without introducing the potential for extended operation at high power levels with instrumentation that has not been verified to be OPERABLE for subsequent use. Due to such effects as shadowing from the relatively deep control rod insertion and, to a lesser extent, the axially-dependent radial leakage which varies with power level, the relationship between the incore and excore indications of axial flux difference (AFD) at lower power levels is variable. Thus, it is acceptable to defer the calibration of the excore AFD against the incore AFD until more stable conditions are attained (i.e., withdrawn control rods and a higher power level). The AFD is used as an input to the Overtemperature AT reactor trip function and for assessing compliance with LCO 3.2.3, "AXIAL FLUX DIFFERENCE."

Due to the DNB benefits gained by administratively restricting the power level to 50% RTP, no limits on AFD are imposed below 50% RTP by LCO 3.2.3; thus, the proposed change is consistent with the LCO 3.2.3 "requirements below 50% RTR Similarly, sufficient DNB margins are realized through operation below 50% RTP that the intended function of the Overtemperature AT reactor trip function is maintained, even though the excore AFD indication may not exactly match the incore AFD (continued)

CALLAWAY PLANT B 3.3.1-48 Revision 3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.3 (continued)

REQUIREMENTS indication. Based on plant operating experience, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is a reasonable time frame to limit operation above 50% RTP while completing the procedural steps associated with the surveillance in an orderly manner.

The Frequency of every 31 EFPD is adequate. It is based on unit operating experience, considering instrument reliability and operating history data for instrument drift. Also, the slow changes in neutron flux during the fuel cycle can be detected during this interval.

SR 3.3.1.4 "SR3.3.1.4 is the performance of a TADOT every 31 days on a STAGGERED TEST-BASIS. This test shall verify OPERABILITY by

-actuation of the end devices. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The RTB test shall include separate verification of the undervoltage and shunt trip mechanisms. -Independent verification of RTB undervoltage and shunt trip Function is not required for the bypass breakers. No capability is provided for performing such a test at power. The

-independent test for bypass breakers is included in SR 3.3.1.14. The bypass breaker test shall include a local manual shunt trip only. A Note has been added to indicate that this test must be performed on the bypass breaker prior to placing it in service.,

The Frequency of every 31 days on a STAGGERED TEST BASIS is adequate. It is based'on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.1.5 SR 3.3.1.5 is the pevryance of an ACTUAGTION LOGIC TEST. The SSPS is tested every 31 days on a STAGGERED TEST BASIS, using the semiautomatic tester. The train being tested is placed in the bypassed condition, thus preventing inadvertent actuation. Through the

, senmiautomatic tester, all possible logic combinations, with and without (continued)

CALLAWAY PLANT B 3.3.1-49 --Revision 3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.5 (continued)

REQUIREMENTS applicable permissives, are tested for each protection function, including operation of the P-7 permissive which is a logic function only. The Frequency of every 31 days on a STAGGERED TEST BASIS is adequate. It is based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.1.6 SR 3.3.1.6 is a calibration of the excore channels to the incore channels.

If the measurements do not agree, the excore channels are not declared inoperable but must be calibrated to agree with the incore detector measurements. If the excore channels cannot be adjusted, the channels are declared inoperable. This Surveillance is performed to verify the f(AI) input to the Overtemperature AT Function.' Determination of the loop specific vessel AT and Tavg values should be made when performing this calibration, under steady state conditions (ATo and 1' [T" for Overpower AT] when at 100% RTP).

A Note modifies SR 3.3.1.6. The Note states that this Surveillance is required only if reactor power is > 75% RTP and that 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after achieving equilibrium conditions with THERMAL POWER > 75% RTP is allowed for performing the first surveillance. Equilibrium conditions are achieved when the core is sufficiently stable at intended operating conditions to perform flux mapping.

The SR is deferred until a scheduled testing plateau above 75% RTP is attained during a power ascension. During a typical power ascension, it is usually necessary to control the axial flux difference at lower power levels through control rod insertion. After equilibrium conditions are achieved at the specified power plateau, a flux map must be taken and the required data collected. The data is typically analyzed and the appropriate excore calibrations completed within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after achieving equilibrium conditions. An additional time allowance of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is provided during which the effects of equipment failures may be remedied and any required re-testing may be performed.

The allowance of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after equilibrium conditions are attained at the testing plateau provides sufficient time to allow power ascensions and associated testing to be conducted in a controlled and orderly manner at conditions that provide acceptable results and without introducing the potential for extended operation at high power levels with instrumentation that has not been verified to be OPERABLE for subsequent use.

(continued)

CALLAWAY PLANT B 3.3.1-50 Revision 3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.6 (continued)

REQUIREMENTS The Frequency of.92 EFPD is adequate. It is based on industry operating experience, considering instrument reliability and operating history data for instrument drift.

SR 3.3.1.7 SR 3.3.1.7 is the performance of a COT every 92 days.

A COT is performed on each required channel to ensure the channel will perform the intended Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the

-change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

Setpoints must be within the Allowable Values specified in Table 3.3.1-1.

SR 3.3.1.7 is modified by two Notes. Note 1 provides a 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> delay in the requirement to perform this Surveillance for source range

- instrumentation when entering MODE 3 from MODE 2. This Note allows a normal shutdown to proceed without a delay for testing in MODE 2 and for a short time in MODE 3 until the Applicability is exited and SR 3.3.1.7

-is no longer required to be performed. If the unit is to be in MODE 3 with the Rod Control System capable of rod withdrawal of one or more rods not fully inserted for > 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, this Surveillance must be performed prior to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after entry into MODE 3. Note 2 requires that the quarterly COT for the source range instrumentation shall include verification by observation of the associated permissive annunciator window that the P-6 and P-1 0 interiocks are in their required state for the existing unit conditions. * - ,

The Frequency of 92 days is justified in Reference 5.

SR -3.3.1.8 SR 3.3.1.8 is the performance of a COT as described in SR 3.3.1.7 and it

- - -. -is modified by the same Note that this test shall include verification that the P-6 ,nd P-10 interlocks are in theirrequired state for the existing unit conditions by observation of the associated permissive annunciator (continued)

CALLAWAY PLANT SB-3.3.1-51 -Revision 3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.8 (continued)

REQUIREMENTS window. A successful test of the required contact(s) of a channel relay may be performed by the verification of the"change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The Frequency is modified by a Note that allows this surveillance to be satisfied if it has been performed within 92 days of the Frequencies prior to reactor startup, 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after reducing power below P-10, and four hours after reducing power below P-6, as discussed below. The Frequency of "prior to reactor startup" ensures this surveillance is performed prior to critical operations and applies to the source, intermediate and power range low instrument channels., The Frequency of "12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after reducing power below P-1 0" (applicable to intermediate and power range low channels) and "4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after reducing power below P-6" (applicable to source range channels) allows a normal shutdown to be completed and the unit removed from the MODE of Applicability for this surveillance without a delay to perform the testing required by this surveillance. The Frequency of every 92 days thereafter applies if the plant remains in the MODE of Applicability after the initial performances of prior to reactor startup, 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after reducing power below P-10, and four hours after reducing power below P-6. The MODE of Applicability for this surveillance is < P-10 for the power range low and intermediate range channels and < P-6 for the source range channels. Once the unit is in MODE 3, this surveillance is no longer required. If power is to be maintained < P-10 for more than 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> or

< P-6 for more than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, then the testing required by this surveillance must'be performed prior to the expiration of the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> or 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> limit, as applicable. These time limits are reasonable, based on operating experience, to complete the required testing or place the unit in a MODE where this surveillance is no longer required. This test ensures that the NIS source, intermediate, and power range low channels are OPERABLE prior to taking the reactor critical and after reducing power into the applicable MODE (< P-10 or < P-6) for the periods discussed above.

SR 3.3.1.9 SR 3.3.1.9 is the performance of a TADOT and is performed every 92 days, as justified in Reference 5. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical (continued)

CALLAWAY PLANT B 3.3.1-52 Revision 3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.9 (continued)

REQUIREMENTS Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

This SR is modified by a Note that excludes verification of setpoints from the TADOT. Setpoint verification is accomplished during the CHANNEL CALIBRATION.

SR 3.3.1.10

-A CHANNEL CALIBRATION is performed every 18 months, or approximately at every refueling.. CHANNEL CALIBRATION is a complete check of the.instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the setpoint methodology.

"TheFrequency of 18 months is based on the assumed calibration interval in the determination of the magnitude of equipment drift in the setpoint methodology SR 3.3.1.10 is modified by a Note stating that this test shall include verification that the time constants are adjusted to the prescribed values where applicable. This does not include verification of time delay relays.

These are verified via response time testing per SR 3.3.1.16. See the

• discussion of AT, in the Applicable Safety Analyses for the Overtemperature AT and Overpower AT trip functions. Whenever an RTD is replaced in Function 6, 7, or 14.c, the next required CHANNEL CALIBRATION of the RTDs is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element.

The CHANNEL CALIBRATION of Function 6, Overtemperature AT, includes the axial flux difference penalty circuitry in the 7300 Process Protection System cabinets-, but does not include the power range neutron detectors. SR 3.3.1.11 and its Notes 1 and 3 govern the performance and timing of the power range neutron detector plateau voltage verification.

Although not required for any safety function, the CHANNEL CALIBRATION of Function 10, Rea'ctor Coolant Flow-Low, will ensure proper performance and normalization of the RCS flow indicators.

(continued)

-- - .CALLAWAY PLANT ,13 3.3.1-53 ý 1-Revision 3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.11 REQUIREMENTS (continued) SR 3.3.1.11 is the performance of a CHANNEL CALIBRATION, as described in SR 3.3.1.10, every 18 months. This SR is modified by three Notes. Note 1 states that neutron detectors are excluded from the CHANNEL CALIBRATION. Neutron detectors are excluded from the CHANNEL CALIBRATION because it is impractical to set up a test that demonstrates and adjusts neutron detector response to known values of the parameter (neutron flux) that the channel monitors. Note 1 applies to the source range proportional counters, intermediate range ion chambers, and power range ion chambers in the Nuclear Instrumentation System (NIS). Note 2 states that this test shall include verification that the time constants are adjusted to the prescribed values where applicable.

Detector plateau curves are obtained, evaluated, and compared to manufacturer's data for the intermediate and power range neutron detectors. The testing of the source range neutron detectors consists of obtaining integral bias curves, evaluating those curves, and comparing the curves to previous data. Note 3 states that the power and intermediate range detector plateari voltage verification is not required to be current until 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after achieving equilibrium conditions with THERMAL POWER > 95% RTP. Equilibrium conditions are achieved when the core is sufficiently stable at intended operating conditions to perform a meaningful detector plateau voltage verification. The allowance of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after equilibrium conditions are attained at the testing plateau provides sufficient time to allow power ascension testing to be conducted in a controlled and orderly manner at conditions that provide acceptable results and without introducing the potential for extended operation at high power levels with instrumentation that has not been verified to be OPERABLE for subsequent use. The source range integral bias curves are obtained under the conditions that apply during a plant outage.

The 18 month Frequency is based on past operating experience, which has shown these components usually pass the Surveillance when--

performed on the 18 month Frequency. The conditions for obtaining the source range integral bias curves and the power and intermediate range detector plateau voltages are described above. The other remaining portions of the CHANNEL CALIBRATIONS may be performed either during a plant outage or during plant operation.

SR 3.3.1.12 I-'

Not used.

At*

(continued)

CALLAWAY PLANT B 3.3.1-54 Revision 3

RTS Instrumentation B 3.3.1 A

BASES SURVEILLANCE SR 3.3.1.13 REQUIREMENTS

, (continued). SR 3.3.1.13 is the performance of a COT of RTS interlocks every 18 months. A successful test of the required contact(s) of a channel relay "maybe performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical

-Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The Frequency is based on the known reliability of the interlocks and the multichannel redundancy available, and has been shown to be acceptable through operating experience.

SR 3.3.1.14 SR 3.3.1.14 is the performance of a TADOT of the Manual Reactor Trip, the SI Input from ESFAS, and the Reactor Trip Bypass Breaker undervoltage trip mechanisms. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This TADOT is performed every 18 months.

The Manual Reactor Trip TADOT shall independently verify the OPERABILITY of the undervoltage and shunt trip handswitch contacts for both the Reactor Trip Breakers and Reactor Trip Bypass Breakers. The Reactor Trip Bypass Breaker test shall include testing of the automatic undervoltage trip mechanism.

The Frequency is based on the known reliability of the Functions and the multichannel redundancy available, and has been shown to be acceptable through operating experience.

"TheSR is modified by a Note that excludes verification of setpoints from the TADOT. The Functions affected have no setpoints associated with them.

(continued)

"CALLAWAYPLANT B 3.3.1-55 "Revision3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.15 REQUIREMENTS (continued) SR 3.3.1.15 is the performance of a TADOT of Turbine Trip Functions. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This TADOT is performed prior to exceeding the P-9 interlock whenever the unit has been in MODE 3. This Surveillance is not required if it has been performed within the previous 31 days. Verification of the Trip Setpoint does not have to be performed for this Surveillance.

Performance of this test will ensure that the turbine trip Function is

.,OPERABLE prior to exceeding the P-9 interlock.

SR 3.3.1.16 SR 3.3.1.16 verifies that the individual channel actuation response times are less than or equal to the maximum values assumed in the accident analysis. Response time verification acceptance criteria are included in Reference 8. No credit was taken in the' safety analyses for those channels with response times listed as N.A. No response time testing requirements apply where N.A. is listed in Reference 8. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor until loss of stationary gripper coil voltage (at which point the rods are free to fall).

The safety analyses include the sum of the following response time components:

(a) Process delay times (e.g., scoop transport delay and thermal lag associated with the narrow range RCS RTDs used in the OTAT, OPAT, and SG low-low Vessel AT (Power-I, Power-2) functions) which are not testable; (b) Sensing circuitry delay time from the time the trip setpoint is reached at the sensor until a reactor trip is generated by the SSPS; (continued)

CALLAWAY PLANT B 3.3.1-56 Revision 3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.16 (continued)

REQUIREMENTS (c) Any intentional time delay set into the trip circuitry (e.g.,

undervoltage relay time delay, NLL cards (lag, lead/lag, rate/lag) and NPL cards (PROM logic cards for trip time delay) associated with the OTAT, OPAT, and SG low-low level Vessel AT (Power-I, Power-2) trip functions, and NLL cards (lead/lag) associated with the low pressurizer pressure reactor trip function) to add margin or prevent spurious trip signals; (d) For the undervoltage RCP trip function, back EMF delay from the time of the loss of the bus voltage until the back EMF voltage generated by the bus loads has decayed; (e), The time delay for the reactor trip breakers to open; and

- (f) -The time delay for the control rod drive stationary gripper coil

-- - voltage to decay and the RCCA grippers to mechanically release making the rods free to fall (i.e., gripper release time measured during the performance of SR 3.1.4.3).

For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), the response time verification is performed with the time constants set at their nominal values. Time constants are verified during the performance of SR 3.3.1.10. The response time may be verified by a series of overlapping tests, or other verification (e.g., Ref. 9 and Ref. 15),

such that the entire response time is verified.

Response time may be verified by actual response time tests in any series of sequential,-overlapping, or total channel measurements, or by the summation of allocated sensor, signal processing, and actuation logic response times with actual response time tests on the remainder of the chalnnel. Allocations for sensor response times may be obtained from:

1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests); (2) inplace, onsite, or offsite (e.g. vendor) test measurements; or (3) utilizing vendor engineering specifications.

-o- -WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor

- Response lime Testing Requirements," provides the basis and methodology for using allocated sensor response times in the overall

. - verification of the channel response time for specific sensors identified in the WCAR' Response time verification for other sensor types must be dejnonstrated by test.

. WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection "Channel Response Time Tests," provides the basis and methodology for (continued)

-- CALLAWAY PLANT IB 3.3.1-57 ,Revision 3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.16 (continued)

REQUIREMENTS using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.

The allocations for sensor, signal conditioning, and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in References 9 and 15 may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.

As appropriate, each channel's response time must be verified every 18 months on a STAGGERED TEST BASIS. Each verification shall include at least one train such that both trains are verified at least once per 36 months. Testing of the final actuation devices (i.e., reactor trip breakers) is included in the verification. Testing of the final actuation devices measures the time delay for the reactor trip breakers to open.

The time delay for the control rod drive stationary gripper coil voltage to decay and the RCCA grippers to mechanically release making the rods free to fall (i.e., gripper release time) is measured during the performance of SR 3.1.4.3 which verifies rod drop time from the beginning of decay of stationary gripper coil voltage. For surveillance testing performance, gripper release time is not included in the reactor trip system instrumentation response time testing due to the difficulty in determining the precise point at which the rods are free to fall. SR 3.1.4.3 specifies a readily quantifiable time to use as a separation point for field measurements, i.e., "from the beginning of decay of stationary gripper coil voltage." The rod drop time measurement in SR 3.1.4.3 begins at the time the rod control power cabinet regulator board circuit for a specific rod group is grounded, causing the board to reduce the stationary gripper coil current to zero releasing the rod group. This is essentially the same time at which the reactor trip breaker's opening would interrupt current to the stationary gripper coil. The response time definition, "until loss of stationary gripper coil voltage, " is less quantifiable. However, the definition's provision for overlapping testing allows this testing approach since the total response time is determined. The safety analyses are satisfied as long as both surveillances, response time and rod drop time, are met. Some portions of the response time testing cannot be performed during unit operation because equipment operation is required to measure response times. Experience has shown that these components usually pass this Surveillance when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

(continued)

CALLAWAY PLANT B 3.3.1-58 Revision 3

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.16 (continued)

REQUIREMENTS SR 3.3.1.16 is modified by a Note stating'that neutron detectors are excluded from RTS RESPONSE TIME testing. This Note is necessary because of the difficulty in generating an appropriate detector input signal.

Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response. Response time of the neutron flux signal portion of the channel shall be verified from detector output or input to the first electronic component in the channel.

SREFERENCES - 1. FSAR, Chapter 7.

2. FSAR, Chapter 15.

3. IEEE-279-1971.

4. 10 CFR 50.49.

5. Callaway OLAmendment No. 17 dated September 8, 1986.

6. Callaway Setpoint Methodology Report, SNP (UE)-565 dated May 1, 1984. . -I

7. 'Callaway OL Amendment No. 43 dated April 14, 1989.

8. FSAR Section 16.3, Table 16.3-1.

9. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," January 1996.

10. FSAR Table 15.0-4. I 11.- WCAP-9226, "Reactor Core Response to Excessive Secondary Steam Releases," Revision 1, January 1978.

12.- NRC Generic Letter 85-09 dated May 23, 1985.

13. FSAR Section 15.1.1.

14. RFR- 18637A.

15:. WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," October 1998.

16. FSAR Section 15.4.6.

CALLAWAY PLANT B 3.3.1-59 - Revision 3

RTS Instrumentation B 3.3.1 Table B 3.3.1-1 (Page 1 of 3)

FUNCTION NOMINAL TRIP SETPOINT(a)

1. Manual Reactor Trip N.A.

2. Power Range Neutron Flux

a. High < 109% RTP

b. Low < 25% RTP

3. Power Range Neutron Flux Rate <4% RTP with time S-J High Positive Rate constant > 2 sec.

4. Intermediate Range Neutron Flux < 25% RTP

5. Source Range Neutron Flux < 1.0E5 CPS

6. Overtemperature AT See Table 3.3.1-1 Note 1.

7. Overpower AT See Table 3.3.1-1 Note 2.

8. Pressurizer Pressure

a. Low > 1885 psig

b. High < 2385 psig

9. Pressurizer Water Level - High < 92% of instrument span

> 90% of loop minimum

10. Reactor Coolant Flow - Low measured flow (MMF=95,660 gpm)

(continued)

(a) The inequality sign only indicates conservative direction. The as-left.value will be within a two-sided calibration tolerance band on either side of the nominal value. This also applies to the Overtemperature AT and Overpower AT K values per Reference 14.

CALLAWAY PLANT B 3.3.1-60 Revision 3

RTS Instrumentation B 3.3.1 Table B 3.3.1-1 (Page 2 of 3)

- FUNCTION NOMINAL TRIP SETPOINT (a)

11. Not used.

12. Undervoltage RCPs >Ž10,584 Vac

13. Underfrequency RCPs >57.2 Hz

14. Steam Generator (SG) Water Level Low-Low t- ?

a. Steam Generator Water Level Low-Low (Adverse

>27.0% of narrow range instrument span I

Containment Environment)

b. Steam Generator Water Level Low-Low (Normal Containment

> 21.6% of narrow range instrument span I

Environment)

c. Vessel AT Equivalent including "delaytimers - Trip Time Delay (1) Vessel AT (Power-1) < Vessel AT Equivalent to 12.41% RTP (with a time delay

< 232 sec.)

(2) Vessel AT (Power- 2) < Vessel AT Equivalent to 22.41% RTP (with a time delay

<122 sec.)

d. Containment Pressure

• 1.5 psig Environmental Allowance Modifier

15. Not used.

(continued)

(a) The inequality sign only indicates conservative direction. The as-left value will be within a two-sided calibration tolerance band on either side of the nominal value. This also applies to the Overtemper'aturie AT and Overpower AT K values per Reference 14.

CALLAWAY PLANT B 3.3.1-61 *, Revision 3

RTS Instrumentation B 3.3.1 Table B 3.3.1-1 (Page 3 of 3)

FUNCTION NOMINAL TRIP SETPOINT (a)

16. Turbine Trip

a. Low Fluid Oil Pressure > 598.94 psig

b. Turbine Stop Valve Closure > 1% open

17. Safety Injection (SI) Input from N.A.

Engineered Safety Feature Actuation System (ESFAS)

18. Reactor Trip System Interlocks

a. Intermediate Range Neutron > 1.OE-10 amps Flux, P-6

b. Low Power Reactor Trips Block, N.A.

P-7

c. Power Range Neutron Flux, P-8 < 48% RTP

d. Power Range Neutron Flux, P-9 < 50% RTP

e. Power Range Neutron Flux, 10% RTP P-1 0

f. Turbine Impulse Pressure, P-13 < 10% Turbine Power

19. Reactor Trip Breakers N.A.

20. Reactor Trip Breaker Undervoltage and N.A.

Shunt Trip Mechanisms

21. Automatic Trip Logic N.A.

(a) The inequality sign only indicates conservative direction. The as-left value will be within a two-sided calibration tolerance band on either side of the nominal value. This also applies to the Overtemperature AT and Overpower AT K values per Reference 14.

.4 CALLAWAY PLANT B 3.3.1-62 Revision 3

ESFAS Instrumentation B 3.3.2 BASES BACKGIROUND Signal Processing Equipment (contin ued)

Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments. The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control

, board, and comparison of measured input signals with setpoints established by safety analyses. If the measured value of a unit parameter "exceedsthe predetermined setpoint, an output from a bistable is forwarded to the SSPS for decision evaluation. Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing. Some unit parameters provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit computer, and one or more control systems.

Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic.

Generally, if a parameter is used for input to the SSPS and a control

• function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy. The circuit must be able to withstand both an input failure to the control system, which may then

• require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Again, a single failure will neither cause nor prevent the protection function actuation.

-.-These requirements are described in IEEE-279-1971 (Ref. 4). The actual number of channels required for each unit parameter is specified in Reference 2..

Trip Setpoints and Allowable Values The Trip Setpoints are the nominal values at which the bistables are set.

Any bistable is considered to be properly adjusted when the "as left" value is within the two-sided tolerance band for calibration accuracy (typically

+/-15 mV).

4 (continued)

. I ,CALLAWAY PLANT B 3.3.2-2 ,* Revision 0

I ESFAS Instrumentation B 3.3.2 BASES BACKGROUND Trip Setpoints and Allowable Values (continued)

The Trip'Setpoints listed in Table B 3.3.2-1 and used in the bistables are based on the analytical limits stated in Reference 3. The selection of these Trip Setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 5), the Allowable Values specified in Table 3.3.2-1 in the accompanying LCO are conservatively adjusted with respect to the analytical limits. A detailed description of the methodologies used to calculate the Trip Setpoints, including their explicit uncertainties, is provided in Reference 6. The BOP methodology used for Function 6.h is a similar square-root-sum-of squares (SRSS) methodology as used for the RTS setpoints. The actual nominal Trip Setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a COT., One example of such a change in measurement error is drift during the surveillance interval. If the measured setpoint does not exceed the Allowable Value, the bistable is considered OPERABLE.

Setpoints in accordance with the Allowable Value ensure that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed.

Until such time as the issues raised by OL#1230 are reviewed and approved by the NRC, the typical relationship discussed above (consistent with the setpoint methodology'discussed in Reference 6) between the nominal Trip Setpoint in Table B 3.3.2-1 and the Allowable Value in Table 3.3.2-1 for Functions 5.e.(1), 5.e.(2), 6.d.(1), and 6.d.(2),

SG Water Level Low-Low (Adverse Containment Environment, Normal Containment Environment), will not be met. The nominal Trip Setpoint in Table B 3.3.2-1 has been increased by 6.8% of narrow range instrument span to address the SG mid-deck plate algebraic bias raised by Westinghouse NSAL-02-03. The affected bistables have been readjusted to the nominal Trip Setpoints listed in Table B 3.3.2-1 and have been "as left" within the two-sided band for calibration accuracy discussed above.

Under a corresponding administrative change, an increase of 6.8% of narrow range instrument span has been added to the Allowable Values (continued)

CALLAWAY PLANT B 3.3.2-3 Revision 3

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND Trip Setpoints and Allowable Values (continued)

(see Table 3.3.2-!1) in the associated procedures for determining channel OPERABILITY. This administrative control will remain in place until OL#1230 is approved and implemented.

Each channel can be tested on line to verify that the signal processing equipment and setpoint accuracy is within the specified allowance requirements. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument

t. signal. The process equipment for the channel in test is then tested, verified, and calibrated. SRs for the channels are specified in the SR

--,* . *section.. -.

The Allowable.Values listed in Table 3.3.2-1 are based on the methodologies described in Reference 6, which incorporate all of the known uncertainties applicable for each channel. The magnitudes of these uncertainties are factored into the determination of each Trip Setpoint. All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these

, uncertainty magnitudes.

Solid State Protection System The SSPS equipment is used for the decision logic processing of outputs

-from the signal processing equipment bistables. To meet the redundancy

- requirements, two trains of SSPS, each performing the same functions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide ESF actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result.

Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements.

- .The SSPS performs the decision logic for most ESF equipment actuation;

- -generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room of the unit.

, The bistable outputs from the signal processing equipment are sensed by the SSPSequipment and combined into logic matrices that represent combinations indicative of various transients. If a required logic matrix S ~ combination is completed, the system will send actuation signals via masterand slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition. Examplesare given in the Applicable Safety Analyses, LCO, and Applicability sedtions of this Bases.

S (continued)

- - CALLAWAY PLANT ..'," - - B 3.3.2-4 'Revision 3

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND 'Solid State Protection System (continued)

Each SSPS train has a built in testing device that can automatically test the decision logic matrix functions and the actuation devices while the unit is at power. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed. The testing device is semiautomatic to minimize testing time.

The actuation of ESF components is accomplished through master and slave relays. The SSPS energizes the master relays appropriate for the condition of the unit. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices. The master and slave relays are routinely tested to ensure operation. The test of the master relays energizes the relay, which then operates the contacts and applies a low voltage to the associated slave relays. The low voltage is not sufficient to actuate the slave relays but only demonstrates signal path continuity. The SLAVE RELAY TEST actuates the devices if their operation will not interfere'with continued unit operation. For the latter case, actual component operation is prevented by the SLAVE RELAY TEST circuit, and slave relay contact operation is verified by a continuity check of the circuit containing the slave relay.

Balance of Plant (BOP) ESFAS The BOP ESFAS processes signals from SSPS, signal processing equipment (e.g., LSELS), and plant radiation monitors to actuate certain ESF equipment. There are two redundant trains of BOP ESFAS (separation groups I and 4), and a third separation group (separation group 2) to actuate the Turbine Driven Auxiliary Feedwater pump and reposition automatic valves (turbine steam supply valves, turbine trip and throttle valve) as required. The separation group 2 BOP-ESFAS cabinet is considered to be part of the end device (the Turbine Driven Auxiliary Feedwater pump) and its OPERABILITY is addressed under LCO 3.7.5, "Auxiliary Feedwater (AFW) System." The redundant trains provide actuation for the Motor Driven Auxiliary Feedwater pumps (and reposition automatic valves as required, i.e., steam generator blowdown and sample line isolation valves, ESW supply valves, CST supply valves),

Containment Purge Isolation, Control Room Emergency Ventilation, and Emergency Exhaust Actuation functions.

The BOP ESFAS has a built-in automatic test insertion (ATI) feature which continuously tests the system logic' 'Any fault detected during the testing causes an alarm on the main control room overhead annunciator (continued)

CALLAWAY PLANT B 3.3.2-5 Revision 3

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND Balance of Plant (BOP) ESFAS (continued) system to alert operators to the problem. Local indication shows the test step where the fault was detected.

APPLICABLE Each of the analyzed accidents can be detected by one or mo-re'ESFAS SAFETY Functions. One of the ESFAS Functions is the primary actuation signal ANALYSES, for that accident. An ESFAS Function may be the primary actuation LCO, AND signal for more than one type of accident. An ESFAS Function may also APPLICABILITY be a secondary, or backup, actuation signal for one or more other accidents. For example, Pressurizer Pressure - Low is a primary actuation signal for small loss of coolant accidents (LOCAs) and a backup actuation signal for steam line breaks (SLBs) outside containment.

Functions such ,as manual initiation, not specificallycredited in the accident safety analysis, are qualitatively credited. These Functions may provide protection for conditions'that do not require dynamic transient analysis to demonstrate Function performance. These Functions may also serve as' backups to Functions that were credited in the accident analysis (Ref. 3).

The LCO requires all instrumentation performing an ESFAS Function to be OPERABLE. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.

The LCO generally requires OPERABILITY of three or four channels in each instrumentation function and two channels in each logic and manual initiation function. The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance or

'testing without causing an ESFAS initiation. In cases where an inoperable channel is placed in the tripped condition indefinitely to satisfy the Required Action of an LCO, the logic configurations are reduced to one-out-of-two and one-out-of-three where tripping of an additional channel, for any reason, would result in an ESFAS initiation. To allow for surveillance testing or setpoint adjustment of other channels while in this condition, several Required Actions allow the inoperable channel to be bypassed. Bypassing the inoperable channel creates a two-out-of-two or two-out-of-three logic configuration allowing a channel to be tripped for testing without causing an ESFAS initiation. Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.

The required channels of ESFAS instrumentation provide unit protection in the event of any of the analyzed accidents. ESFAS protection functions are as follows:

(continued)

PLANT .*B 3.3.2-6 AL P Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 1. Safety Injection SAFETY ANALYSES Safety Injection (SI) provides two primary functions:

LCO, AND APPLICABILITY 1. Primary side water addition to ensure maintenance or (continued) recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to < 2200oF); and

2. Boration to ensure recovery and maintenance of SDM (keff < 1.0).

These functions are necessary to mitigate the effects of high energy line breaks (HELBs) both inside and outside of containment. The SI signal is also used to initiate other Functions such as:

0 Phase A Isolation; 0 Reactor Trip;

• Turbine Trip;

• Feedwater Isolation;

• Start of motor driven auxiliary feedwater (AFW) pumps; 0 Isolation of SG blowdown and sample lines;

• Enabling automatic switchover of Emergency Core Cooling Systems (ECCS) suction to containment recirculation sumps, coincident with RWST low-low 1 level;

• Emergency DG start;

• Initiation of LSELS LOCA sequencer,

• Containment Cooling;

• Emergency Exhaust System in the LOCA (SIS) mode;

• Start of ESW and CCW pumps; and

• Hydrogen mixing fans start in slow speed.

(continued)

CALLAWAY PLANT B 3.3.2-7 Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 1. Safety Injection (continued)

SAFETY .

ANALYSES,-. These other functions ensure:

LCOAND APPLICABILITY , Isolation of nonessential systems through containment penetrations;

• . Trip of the turbine and reactor to limit power generation;

- -Isolation of main feedwater (MFW) to limit secondary side mass losses;

. . Start of AFW to ensure secondary side cooling capability, Isolation of SG blowdown and sample lines to limit - ,

uncontrolled SG blowdown;

"* *Enabling ECCS suction from the refueling water storage tank (RWST) switchover on low-low I RWST level to ensure continued cooling via use of the containment

- recirculation sumps;

• : Emergency loads for LOCA are properly sequenced and

-,-" powered;

• Containment cooling to preserve containment integrity;

• -

• Emergency Exhaust System operation in the LOCA (SIS)

"modeto maintain the auxiliary building at a negative pressure and filter its exhaust; Start of ESW and CCW to service safety-related systems; and

,, -Hydrogenrmixing fans start in slow speed to protect the

- -. -mixing fan motors.

a. Safety Injection - Manual Initiation The LCO requires one channel per train to be OPERABLE.

The operator can initiate SI at any time by using either of two switches in the control room. This action will cause actuation of all components in the same manner as any of the automatic actuation signals.

,- . (continued)

- CALLAWAY PLANT B 3.3.2-8 -, - ,. Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE a. Safety Injection - Manual Initiation (continued)

SAFETY ANALYSES, The LCO for the Manual Initiation Function ensures the LCO, AND proper amount of redundancy is maintained in the manual APPLICABILITY ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability.

Each channel consists of one switch and the interconnecting wiring to the actuation logic cabinet. Each switch actuates both trains. This configuration does not allow testing at power.

b. Safety Injection -Automatic Actuation Logic and Actuation Relays (SSPS)

This LCO requires two trains to be OPERABLE. Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.

Manual and automatic initiation of SI must be OPERABLE in MODES 1, 2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. Manual Initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a SI, actuation is simplified by the use of the manual actuation switches. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.

These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. Unit pressure and temperature are very low ahd many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.

(continued)

CALLAWAY PLANT B 3.3.2-9 Revision 3

ESFAS Instrumentation B 3.3.2 BASES

,APPLICABLE c.- -Safety Injection - Containment Pressure - High 1 SAFETY - "

ANALYSES, This signal provides protection against the following LCO, AND accidents:

APPLICABILITY (continued)

• SLB inside containment;

• iLOCA; and

• Feed line break inside containment.

Containment Pressure - High 1 provides no input to any control functions. Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a

-.two-out-of-three logic. The transmitters (dip cells) and electronics are located outside of containment with the sensing line (high pressure side of the transmitter) located

.inside containment.

Thus, the high pressure Function will not experience any adverse environmental conditions and the Trip Setpoint reflects only steady state instrument uncertainties. The Trip Setpoint is _ 3.5 psig.

Containment Pressure - High I must be OPERABLE in

-MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment.

d. Safety Injection - Pressurizer Pressure - Low This signal provides protection against the following accidents:

• Inadvertent opening of a steam generator (SG)

• atmospheric steam dump valve or safety valve;

• SLB; A spectrum of rod cluster control assembly ejection "accidents (rod ejection);

- Inadvertent opening of a pressurizer PORV or safety valve; (continued)

,CALLAWAY PLANT -,B 3.3.2-10 I ýRevision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE d. Safety Injection - Pressurizer Pressure - Low (continued)

SAFETY ANALYSES; ° LOCAs; and LCO, AND APPLICABILITY SG Tube Rupture.

The pressurizer pressure channels provide both control and protection functions: input to the Pressurizer Pressure Control System, reactor trip, SI, and automatic PORV actuation. Therefore, the actuation logic must be able to withstand both an input failure to control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.

The transmitters are located inside containment, with the taps in the vapor space region of the pressurizer, and thus possibly experiencing adverse environmental conditions (LOCA, SLB inside containment, rod ejection). Therefore, the Trip Setpoint reflects the inclusion of both steady state and adverse environment instrument uncertainties. The Trip Setpoint is > 1849 psig.

This Function must be OPERABLE in MODES 1, 2, and3 (above P-11 and below P-11 unless the Safety Injection Pressurizer Pressure - Low Function is blocked) to mitigate the consequences of an HELB inside containment. This signal may be manually blocked by the operator below the P-11 setpoint. Automatic SI actuation below this pressure setpoint is then performed by the Containment Pressure High 1 signal.

This Function is not required to be OPERABLE in MODE 3 below the P-11 setpoint. Other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation.

e. Safety Injection - Steam Line Pressure Steam Line Press'are - Low Steam Line Pressure - Low provides protection against the following accidents:

(continued)

CALLAWAY PLANT B 3.3.2-11 Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE Steam Line Pressure - Low (continued).

SAFETY ANALYSES,-' *SLB;i Fe a LCO, AND Feed line break; and APPLICABILITY Inadvertent opening of an SG atmospheric steam dump valve or an SG safety valve.

Steam Line Pressure - Low provides no input to any control functions. Thus, three OPERABLE channels on each steam line are sufficient to satisfy the protective requirements with a two-out-of-three logic on each steam line.

With the transmitters located inside Area 5 (the steam tunnel), it is possible for them to experience adverse environmental conditions during a secondary side break. Therefore, the Trip Setpoint reflects both steady state and adverse environment instrument uncertainties. The Trip Setpoint is> 615 psig.

This Function is anticipatory in nature and has a lead/lag ratio of 50/5.

Steam Line Pressure - Low must be OPERABLE in MODES, 1, 2, and 3 (above P-1I and below P-11 unless the Safety Injection - Steam Line Pressure Low Function is blocked) when a secondary side break or stuck open valve could result in the rapid

- depressurization of the steam lines. This signal

-, may be manually blocked by the operator below the P-11 setpoint. Below P-11, feed line break is not a concern. Inside containment SLB will be

-, - terminated by automatic SI actuation via

'Containment Pressure - High 1, and outside

-containment SLB will be terminated by the Steam

. Line Pressure - Negative Rate - High signal for

- - steam line isolation. This Function is not required to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of

, the unit to have a significant effect on required plant Sequipment.

(continued)

,-, -CALLAWAY PLANT ",-,B 3.3.2-12 ,Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE- 2. Containment Spray SAFETY ANALYSES, Containment Spray provides three primary functions:

LCO, AND APPLICABILITY 1. Lowers containment pressure and temperature after an (continued) HELB in containment;

2. Reduces the amount of radioactive iodine in the containment atmosphere; and

3. Adjusts the pH of the water in the containment recirculation sumps after a large break LOCA, in conjunction with the Recirculation Fluid pH Control (RFPC) system.

These functions are necessary to:

Ensure the pressure boundary integrity of the containment structure; Limit the release of radioactive iodine to the environment in the event of a failure of the containment structure; and Minimize corrosion of the components and systems inside containment following a LOCA.

The containment spray actuation signal starts the containment spray pumps and aligns the discharge of the pumps to the containment spray nozzle headers in the upper levels of containment. Water is initially drawn from the RWST by the containment spray pumps. When the RWST reaches the low-low 2 level setpoint, the spray pump suctions are manually realigned to the containment recirculation sumps if continued containment spray is required. Containment spray is actuated'by Containment Pressure-High 3.

a. Containment Spray - Manual Initiation The operator can initiate containment spray at any time from the control room by simultaneously turning two containment spray actuation switches in the same train.

Because an inadvertent actuation of containment spray could have such serious consequences, two switches must be turned simultaneously to initiate containment spray.

There are two sets of two switches each in the control room. Simultaneously turning the two switches in either set will actuate containment spray in both trains in the (continued)

," CALLAWAY PLANT B 3.3.2-13 Re'vision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE. a. Containment Spray - Manual Initiation (continued)

SAFETY ANALYSES, same manner as the automatic actuation signal. Two LCO, AND Manual Initiation switches in each train are required to be APPLICABILITY OPERABLE to ensure no single failure disables the Manual Initiation Function. Note that Manual Initiation of containment spray also actuates Phase B containment isolation.

b. - Containment Spray - Automatic Actuation Logic and "ActuationRelays (SSPS)

Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b....

Manual and automatic initiation of containment spray must be OPERABLE in MODES 1, 2, and 3 when there is a potential for an accident to occur, and sufficient energy in

-the primary or secondary systems to pose a threat to containment integrity due to overpressure conditions.

Manual initiation is also required in MODE 4, even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA. However, because of the large number of components actuated on a containment spray, actuation is simplified by the use of the manual actuation switches. Automatic actuation logic and

. actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary and secondary systems to result in containment overpressure. In MODES 5 and 6, there is also adequale time for the operators to evaluate unit conditions and respond, to

., mitigate the consequences of abnormal conditions by c manually starting individual components.

-C. Containment Spray,- Containment Pressure

-This signal provides protection against a LOCA or an SLB

-, . . ... inside containment. -The transmitters (d/p cells) are located outside of containment with the sensing line (high

, - . pressure side of the transmitter) located inside containment. The transmitters and electronics are located

<-, . outside of containment. Thus, they will not experience any "adverseenvironmental conditions and the Trip Setpoint' (continued)

,, CALLAWAY PLANT B13 3.3.2-14 Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE c. Containment Spray - Containment Pressure (continued)

SAFETY ANALYSES, reflects only steady state instrument uncertainties. The LCO, AND Trip Setpoint is < 27.0 psig.

APPLICABILITY This is one of the only Functions that requires the bistable output to energize to perform its required action (see also ESFAS Function 7.b). It is not desirable to have a loss of power actuate containment spray, since the consequences of an inadvertent actuation of containment spray could be serious. Note that this Function also has the inoperable channel placed in bypass rather than trip to decrease the probability of an inadvertent actuation.

Four channels are used in a two-out-of-four logic configuration. This configuration is called the Containment Pressure-High 3 Setpoint. Additional redundancy is warranted because this Function is energize to trip.

Containment Pressure-High 3 must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to pressurize the containment and reach the Containment Pressure-High 3 setpoint.

3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment. This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of

a large break LOCA.

There are two separate Containment Isolation signals, Phase A and Phase B. Phase A isolation isolates all automatically isolable process lines, except component cooling water (CCW), at a relatively low containment pressure indicative of primary or secondary system leaks. For these types of events, forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required) method of decay heat removal. Since CCW is required to support RCP operation, not isolating CCW on the low pressure PhaseA signal enhances unit safety by allowing operators to use forced RCS circulation to cool the unit. Isolating CCW on the low pressure signal may force the (continued)

CALLAWAY PLANT B 3.3.2-15 Revision 3

I ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 3. Containment Isolation (continued)

SAFETY

. ANALYSES, use of feed and bleed cooling, which could prove more difficult to LCO, AND control.

APPLICABILITY Phase A containment isolation is actuated automatically by SI, or manually via the automatic actuation logic. All process lines penetrating containment, with the exception of CCW, are isolated.

CCW is not isolated at this time to permit continued operation of the RCPs with cooling water flow to the thermal barrier heat exchangers, motor air coolers, and upper and lower bearing

'coolers. All process lines not equipped with remote operated isolation valves are manually closed, or otherwise isolated, prior to reaching MODE 4.

Manual Phase A Containment Isolation is accomplished by either of two switches in the control room. Either switch actuates both trains. Manual or automatic actuation of PhaseA Containment Isolation also actuates Containment Purge Isolation.

The Phase B signal isolates CCW. This occurs at a relativelyhigh containment pressure that is indicative of a large break LOCA or an SLB. For these events, forced circulation using the RCPs is no longer desirable. Isolating the CCW at the higher pressure does not pose a challenge to the containment boundary because the CCW System is a closed loop inside containment. Although some system components do not meet all of the ASME Code requirements applied to the containment itself, the system is continuously pressurized to a pressure greater than the Phase B setpoint. Thus, routine operation demonstrates the integrity of the system pressure boundary for pressures exceeding the Phase B setpoint. Furthermore, because system pressure exceeds the Phase B setpoint, any system leakage prior to initiation of Phase B isolation would be into containment. Therefore, the combination of CCW System design and Phase B isolation ensures the CCW System is not a potential path for radioactive release from containment.

Phase B containment isolation is actuated by Containment Pressure - High 3, or manually, via the automatic actuation logic, aslpreviously discussed. For containment pressure to reach a value high enough to actuate Containment Pressure - High 3, a large break LOCA or,SLB must have occurred and containment spray must have been actuated. RCP operation will no longer be required and CCW to the RCPs is, therefore, no longer necessary.

(continued)

Revision 3 B 3.3.2-16 CALLAWAY PLANT B 3.3.2-16 - , Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 3. Containment Isolation (continued)

SAFETY ANALYSES, The RCPs can be operated with seal injection flow alone and LCO, AND without CCW flow to the thermal barrier heat exchanger.

APPLICABILITY Manual Phase B Containment Isolation is accomplished by the same-switches that actuate Containment Spray. When the two switches in either set are turned simultaneously, Phase B Containment Isolation and Containment Spray will be actuated in both trains.

a. Containment Isolation - PhaseA Isolation (1) Phase A Isolation - Manual Initiation Manual Phase A Containment Isolation is actuated by either of two switches in the control room. Either switch actuates both trains.

(2) Phase A Isolation - Automatic Actuation Logic and Actuation Relays (SSPS)

Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

Manual and automatic initiation of Phase A Containment Isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. Manual initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is-available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a Phase A Containment Isolation, actuation is simplified by the use of the manual actuation switches. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require PhaseA Containment Isolation. There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.

(continued)

CALLAWAY PLANT B 3.3.2-17 Revision 3

ESFAS Instrumentation B 3.3.2 BASES

-- APPLICABLE (3) Phase A Isolation - Safety Injection SAFETY:

ANALYSES, Phase A Containment Isolation is also initiated by LCO, AND all Functions that initiate SI.

APPLICABILITY (continued) The Phase A Containment Isolation requirements for these Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1.

Instead, Function 1, SI, is referenced for all initiating Functions and requirements.

b. Containment Isolation - Phase B Isolation Phase B Con tainment Isolation is accomplished by Manual Initiation, Automatic Actuation Logic and Actuation Relays, and by Containment Pressure channels (the same channels that actuate Containment Spray, Function 2).

The Containment Pressure trip of Phase B Containment Isolation is energized to trip in order to minimize the potential of spurious trips that may damage the RCPs.

(1) Phase B Isolation - Manual Initiation (2) - Phase B Isolation -Automatic Actuation Logic and Actuation Relays (SSPS)

Manual and automatic initiation of Phase B containment isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. Manual initiation is also required in MODE 4 even though automatic actuation is not required. In thisMODE, adequate time is available to manually actuate required components in the event of a DBA. However, because of the large number of components actuated on a Phase B containment isolation, actuation is simplified by the use of the manual actuation switches. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase B containment isolation. There also is

--adequate time for the operator to evaluate unit conditions d6d manually actuate individual isolation (continued)

.: CALLAWAY PLANT B 3.3.2-18 . Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE (2) Phase B Isolation -Automatic Actuation Logic and SAFETY Actuation Relays (SSPS) (continued)

ANALYSES, LCO, AND valves in response to abnormal or accident APPLICABILITY conditions.

(3) Phase B Isolation - Containment Pressure The basis for containment pressure MODE applicability and the Trip Setpoint are as discussed for ESFAS Function 2.c above.

4. Steam Line Isolation

'V . 11 Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment. Rapid isolation of the steam lines will limit the steam break accident to the blowdown from one SG, at most. For an SLB upstream of the main steam isolation valves (MSIVs), inside or outside of containment, closure of the MSIVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of the MSIVs, closure of the MSIVs terminates the accident as soon as the steam lines depressurize. Steam Line Isolation also mitigates the effects of a feed line break and ensures a source of steam for the turbine driven AFW pump during a feed line break.

a. Steam Line Isolation - Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two pushbuttons in the control room and either pushbutton can initiate action to immediately close all MSIVs. The LCO requires two channels to be OPERABLE.

b. Steam Line Isolation -Automatic Actuation Logic and Actuation Relays (SSPS)

Automatic actuation logic and actuation relays in the SSPS consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

c. Steam Line Isolation - Automatic Actuation Logic and Actuation Relays (MSFIS)

As discussed in Reference 13, the Main Steam and Feedwater Isolation System (MSFIS) includes three (continued)

CALLAWAY PLANT B 3.3.2-19 Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE c., Steam Line Isolation -Automatic Actuation Logic and "SAFETY Actuation Relays (MSFIS) (continued)

ANALYSES, LCO, AND redundant programmable logic controllers (PLCs) per logic APPLICABILITY train, arranged in a two-out-of-three voting configuration for each train. The three PLCs in each train operate in parallel, each receiving all of the input signals. Each of the outputs from each PLC drives a relay. The relay contacts

_are arranged in a two-out-of-three voting scheme, requiring that at least two PLCs agree upon the output before that

.train can initiate an isolation function. Each train requires a minimum of two PLCs to be OPERABLE.

Manual and automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the RCS and SGs to have an SLB or other accident. This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSIVs are closed. In MODES 4, 5, and 6, there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.

d. Steam Line Isolation - Containment Pressure - High 2 This Function actuates closure of the MSIVs in the event of a LOCA or an SLB inside containment to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment. The transmitters (d/p cells) are located outside containment with the sensing line (high pressure side of the transmitter) located inside containment. Containment Pressure

.. ,, -,. High 2 provides no input to any control functions. Thus, three OPERABLE channels are sufficient to satisfy protective requirements with two-out-of-three logic. The transmitters and electronics are located outside of containment. Thus, they will not experience any adverse environmental conditions, and the Trip Setpoint reflects only steady state instrument uncertainties. The Trip Setpoint is < 17.0 psig.

.Containment Pressure - High 2 must be OPERABLE in MODES 1, 2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing (continued)

Revision 3 B 3.3.2-20 PLANT CALLAWAY PLANT B 3.3.2-20 J,,;Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABILITY Sd. Steam Line Isolation - Containment Pressure - High 2 SAFETY (continued)

ANALYSES, LCO, AND detection and closure of the MSIVs. The Steam Line APPLICABILITY Isolation Function is required to be OPERABLE in .

MODES 2 and 3 unless all MSIVs are closed. In MODE 4, the increase in containment pressure following a pipe break would occur over a relatively long time period such that manual action could reasonably be expected to provide protection and ESFAS Function 4.d need not be OPERABLE. In MODES 5 and 6, there is not enough energy in the primary and secondary sides to pressurize the containment to the Containment Pressure - High 2 setpoint.

e. Steam Line Isolation - Steam Line Pressure (1) Steam Line Pressure - Low Steam Line Pressure - Low provides closure of the MSIVs in the event of an SLB to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment. This Function provides closure of the MSIVs in the event of a feed line break to ensure a supply of steam for the turbine driven AFW pump.

Steam Line Pressure - Low was discussed previously under SI Function I.e and the Trip Setpoint is the same.

Steam Line Pressure - Low Function must be OPERABLE in MODES 1, 2, and 3 (above P-11 "andbelow P-11 unless safety injection on low steam line pressure is blocked), with any main steam isolation valve open, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator below the P-11 setpoint. If not blocked below P-11, the function must be OPERABLE. When blocked, an inside containment SLB will be terminated by automatic actuation via Containment Pressure High 2. Stuck valve transients and outside containment SLBs will be terminated by the Steam Line Pressure - Negative Rate - High signal for Steam Line Isolation below P-11 when SI has been (continued)

CALLAWAY PLANT B 3.3.2-21 Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE (1) Steam Line Pressure - Low (continued)

SAFETY ANALYSES, manually blocked. The Steam Line Isolation

- LCO, AND - - Function is required in MODES 2 and 3 unless all

-APPLICABILITY, MSIVs are closed. This Function is-not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have a significant effect on required plant equipment.

(2) Steam Line Pressure - Negative Rate - High Steam Line Pressure - Negative Rate - High provides closure of the MSIVs for an SLB when

- less than the P-11 setpoint, to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment.

When the operator manually blocks the Steam Line Pressure - Low main steam isolation signal when less than the P-11 setpoint, the Steam Line Pressure - Negative Rate - High signal is automatically enabled. Steam Line Pressure Negative Rate - High provides no input to any control functions. Thus, three OPERABLE channels on each steam line are sufficient to satisfy requirements with a two-out-of-three logic.

Steam Line Pressure - Negative Rate - High must be OPERABLE in MODE 3 when less than the P-11 setpoint (may be blocked below P-11 when safety injection on low steam line pressure is not blocked),

when a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). In MODES 1 and 2, and in MODE 3, when above the P-11 setpoint, this signal is automatically disabled and the Steam Line

-Pressure - Low signal is automatically enabled.

The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless all MSIVs are closed. In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary

-- sides to have an SLB or other accident that would result in a release of significant enough quantities

. of energy to cause a cooldown of the RCS.

(continued)

CALLAWAY PLANT B 3.3.2-22 Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABILITY (2) Steam Line Pressure - Negative Rate -High SAFETY (continued)

ANALYSES, LCO, AND While the transmitters may experience elevated APPLICABILITY ambient temperatures due to an SLB, the trip function is based on rate of change, not the absolute accuracy of the indicated steam pressure.

Therefore, the Trip Setpoint reflects only steady state instrument uncertainties. The Trip Setpoint is

_<100 psi with a rate/lag controller time constant

> 50 seconds.

5. Turbine Trip and Feedwater Isolation Theprimary functions of the Turbine Trip and Feedwater Isolation signals are to prevent damage to the turbine due to water in the steam lines and to stop the excessive flow of feedwater into the SGs. These Functions are necessary to mitigate the effects of a high water level in the SGs, which could result in carryover of water into the steam lines and excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows.

The Function is actuated when the level in any SG exceeds the high high setpoint and performs the following functions:

Trips the main turbine; Trips the MFW pumps, closing the pump discharge valves; and Initiates feedwater isolation.

This Function is actuated by SG Water Level - High High, or by an SI signal. The RTS also initiates a turbine trip signal whenever a reactor trip (P-4) is generated. In the event of SI, the unit is taken off line and the turbine generator must be tripped. The MFW System is also taken out of operation and the AFW System is automatically started. The SI signal was previously discussed.

While the above discussion applies to both turbine trip and feedwater isolation in response to excessive feedwater in MODES 1 and 2, feedwater isolation on SG lowlow level is required for events in MODES 1, 2, and 3 where the assurance of AFW delivery to the intact steam generators is paramount in the accident analysis. The analyses for the Loss of Non-Emergency (continued)

CALLAWAY PLANT B 3.3.2-23 Revision 3

ESFAS Instrumentation B 3.3.2 BASESI APPLICABLE* 5. Turbine Trip and Feedwater Isolation (continued)

SAFETY ANALYSES, AC Power, Loss of Normal Feedwater, and Feedwater System LCO, AND Pipe Break events credit feedwater isolation on SG low-low level.

APPLICABILITY Given the location of the feedwater check valves inside containment downstream of the point where AFW connects to the main feedwater piping, closure of the main feedwater isolation valves (MFIVs) is required to assure AFW flow is not diverted.

The Applicable MODES for the feedwater isolation function on SG low-low level are consistent with those for the MFIVs (LCO 3.7.3) and AFW System (LCO 3.7.5).

a. Turbine Trip and Feedwater Isolation -Automatic Actuation Logic and Actuation Relays (SSPS)

Automatic Actuation Logic and Actuation Relays in the SSPS consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

b. Feedwater Isolation -Automatic Actuation Logic and Actuation Relays (MSFIS)

Automatic Actuation Logic and Actuation Relays in the MSFIS consist of the same features and operate in the same manner as described for ESFAS Function 4.c.

c. Turbine Trip and Feedwater Isolation - Steam Generator Water Level - High High (P-14)

This signal provides protection against excessive feedwater flow. The ESFAS SG water level instruments provide input to the SG Water Level Control System.

Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then function actuation) and a single the protection arequire failureqin the other channels providing the protection function actuation. Thus, four OPERABLE channels per SG are required to satisfy the requirements with a two-out-of-four logic in any SG resulting in actuation signal generation.

The transmitters (d/p cells) are located inside containment.

However, the events that this Function protects against cannot cause a severe environment in containment.

.Therefore, the Trip Setpoint reflects only steady state (continued)

Revision 3 PLANT B 3.3.2-24 Revision 3

• ."CALLAWAY CALLAWAY PLANT B 3.3.2-24

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE c. Turbine Trip and Feedwater Isolation - Steam Generator SAFETY Water Level - High High (P-14) (continued)

ANALYSES, LCO, AND instrument uncertainties. The Trip Setpoint is< 78% of APPLICABILITY narrow range span.

d. Turbine Trip and Feedwater Isolation - Safety Injection Turbine Trip and Feedwater Isolation are also initiated by all Functions that initiate SI. The Feedwater Isolation Function requirements for these Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 1, SI, is referenced for all initiating functions and requirements. ;7

e. Feedwater Isolation - Steam Generator Water Level - Low Low SG Water Level - Low Low provides protection against a loss of heat sink by ensuring the isolation of normal feedwater and AFW delivery to the steam generators.

Given the location of the feedwater line check valves inside containment downstream of the point where AFW connects to the main feedwater piping, closure of the MFIVs is required to assure AFW flow is not diverted. A feedwater line break or a loss of MFW would result in a loss of SG water level. SG Water Level - Low Low provides input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system, which may then require a protection function actuation, and a single failure in the other channels providing the protection function actuation.

Thus, four OPERABLE channels are required to satisfy the requirements with two-out-of-four logic (the Environmental Allowance Modifier (EAM) and Trip Time Delay (TTD) functions also use a two-out-of-four logic). Two-out-of-four low level signals in any SG initiates feedwater isolation. As discussed in Reference 11, the SG Water Level - Low Low trip Function has been modified to allow a lower Trip Setpoint under normal containment environmental conditions and a delayed trip when THERMAL POWER is less than or equal to 22.41% RTRP The EAM/TTD circuitry reduces the potential for inadvertent trips via the EAM, enabled on containment (continued)

CALLAWAY PLANT B 3.3.2-25 Revision 3

ESFAS Instrumentation B 3.3.2 BASES

. APPLICABLE e. Feedwater Isolation - Steam Generator Water Level - Low

""SAFETY Low (continued)

ANALYSES, LCO, AND pressure exceeding its setpoint, and the TTD, enabling APPLICABILITY time delays dependent on vessel AT as listed in Table B 3.3.2-1., Because the SG Water Level transmitters (d/p cells) are located inside containment, they may experience adverse environmental conditions due to a feedline break.

The EAM function is used to monitor the presence of "adversecontainment conditions (elevated pressure) and enables the Steam Generator Water Level - Low Low (Adverse) trip setpoint to reflect the increased transmitter uncertainties due to~this harsh environment. The EAM enables a lower' Steam Generator Water Level - Low Low (Normal) trip setpoint when these conditions are not present, thus allowing more margin to trip for normal operating conditi6ns. The TTD delays feedwater isolation on SG Water Level Low Low, thereby providing additional operating margin during early power ascension by allowing the operator time to recover level when the primary side load is sufficiently small to not require an earlier isolation.

The TTD continuously monitors primary side power using Vessel AT. Scaling of the Vessel AT channels is dependent on the loop-specific values forATo, discussed under the OTAT, and OPAT trips. Two time delays are provided, based on the primary side power levels; the magnitude of the trip delay decreases with increasing power.. If the EAM or TTD trip functions have inoperable required channels, it is acceptable to place the inoperable channels in the tripped condition and continue operation.

Placing the inoperable channels in the trip mode enables the Steam Generator Water Level - Low Low (Adverse)

Fun6tioh, for the EAM, or removes the trip delay for the TTD. If the Steam Generator Water Level - LowLow (Normal) trip Function has an inoperable required channel, the inoperable channel must be tripped.

The SG Water Level - Low Low Trip Setpoints are chosen to reflect both' steady state and adverse environment instrument behavior. The Trip Setpoints for the Steam Generator Water Level- Low Low (Adverse Containment Environment) and (Normal Containment Environment)

'-p bistables are > 20.2% and > 14.8% of narrow range span, respectively. The Trip Setpoints for the Vessel AT (Power-I) and (Power-2) bistables are *: Vessel AT Equivalent to 12.41% RTP and < Vessel AT Equivalent to (continued)

CALLAWAY PLANT -B 3.3.2-26 S Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE e. Feedwater Isolation - Steam Generator Water Level - Low SAFETY Low (continued)

ANALYSES, LCO, AND 22.41% RTP, respectively, with corresponding trip time APPLICABILITY delays of*< 232 seconds and < 122 seconds. The Trip Setpoint for the Containment Pressure - Environmental Allowance Modifier bistables is < 1.5 psig.

Turbine Trip and Feedwater Isolation Function 5.c, SG Water Level - High High, and Feedwater Isolation Function 5.e.(3), SG Water Level LOw-Low Vessel AT Equivalent, must be OPERABLE in MODES 1 and 2 except when all MFIVs are closed. In MODES 3, 4, 5, and 6, Functions 5.c and 5.e.(3) are not required to be OPERABLE. All other Turbine Trip and Feedwater Isolation Functions must be OPERABLE in MODE 1, MODE 2 (except when all MFIVs are closed), and MODE 3 (except when all MFIVs are closed).

6. Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available. The system has two motor driven pumps and a turbine driven pump, making it available during normal unit operation, during a loss of AC power, a loss of MFW, and during a Feedwater System pipe break. The normal source of water for the AFW System is the condensate storage tank (CST). A loss of suction pressure, coincident with an auxiliary feedwater actuation signal (AFAS), will automatically realign the pump suctions to the safety related Essential Service Water (ESW) System. The AFW System is aligned so that upon a pump start, flow is initiated to the respective SGs immediately.

a. Auxiliary Feedwater - Manual Initiation Manual initiation of Auxiliary Feedwater can be accomplished from the control room. Each of the three AFW pumps has a pushbutton for manual AFAS initiation.

The LCO requires three channels to be OPERABLE.

b. Auxiliary Feedwater - Automatic Actuation Logic and Actuation Relays (SSPS)

Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

(continued)

CALLAWAY PLANT B 3.3.2-27 Revision 3

ESFAS Instrumentation B 3.3.2 BASES

-APPLICABLE c. Auxiliary Feedwater - Automatic Actuation Logic and SAFETY 'Actuation Relays (BOP ESFAS)

ANALYSES, LCO,ANDI Automatic actuation logic and actuation relays consist of APPLICABILITY similar features and operate in a similar manner as

.1 (continued) described for SSPS in ESFAS Function 1.b.

d. Auxiliary Feedwater - Steam Generator Water Level Low Low SG Water Level - Low Low provides protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. SG Water Level - Low Low provides input to S.. 4*

a -A . the SG Water Level Control System. Therefore, the .....

actuation logic must be able to withstand bothan input failure to the control system, which may then require a protection function actuation, and a single failure in the other channels providing the protection function actuation.

Thus, four OPERABLE channels are required to satisfy the requirements with two-out-of-four logic (the Environmental Allowance Modifier (EAM) and Trip Time Delay (TTD) functions also use a two-out-of-four logic). Two-out-of-four low level signals in any SG starts the motor-driven AFW pumps;,in two SGs starts the turbine-driven AFW pump.

As discussed in Reference 11, the SG Water Level Low Low tripFunction has been modified to allow a lower Trip Setpoint under normal containment environmental conditions and a delayed trip when THERMAL POWER is less than or equal to 22.41% RTP.

The EAM/TTD circuitry reduces the potential for inadvertent trips via the EAM, enabled on containment pressure exceeding its setpoint, and the TTD, enabling time delays dependent on vessel AT as listed in Table B 3.3.2-1. Because the SG Water Level transmitters (d/p cells) are located inside containment, they may experience adverse environmental conditions due to a feedline break.

The'EAM function is used to monitor the presence of adverse containment conditions (elevated pressure) and enables the Steam Generator Water Level - Low Low (Adverse) trip setpoint to reflect the increased transmitter uncertainties due to this harsh environment. The EAM enables a lower Steam Generator Water Level - Low Low (Normal) trip setpoint when these conditions are not present, thus allowing more margin to trip for normal (continued)

, CALLAWAY PLANT .I--B 3.3.2-28 Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE d. Auxiliary Feedwater - Steam Generator Water Level SAFETY Low Low. (continued)

ANALYSES, LCO, AND operating conditions. The TTD delays AFW actuation on APPLICABILITY SG Water Level - Low Low, thereby providing additional operational margin during early power ascension by allowing the operator time to recover level when the primary side load is sufficiently small to not require an earlier actuation. The TTD continuously monitors primary side power using Vessel AT. Scaling of the Vessel AT channels is dependent on the loop-specific values forATo, discussed under the OTAT and OPAT trips. Two time delays are provided, based on the primary side power level; the magnitude of the trip delay decreases with increasing power. If the EAM or TTD trip functions have inoperable required channels, it is acceptable to place the inoperable channels in the tripped condition and continue operation. Placing the inoperable channels in the trip mode enables the Steam Generator Water Level Low Low (Adverse) Function, for the EAM, or removes the trip delay for the TTD. If the Steam Generator Water Level

- Low Low (Normal) trip Function has an inoperable required channel, the inoperable channel must be tripped.

The Trip Setpoint reflects the inclusion of both steady state and adverse environment instrument uncertainties. The Trip Setpoints for the SG Water Level - Low Low (Adverse Containment Environment) and (Normal Containment Environment) bistables are > 20.2% and > 14.8% of narrow range span, respectively. The Trip Setpoints for the Vessel AT (Power-) and (Power-2) bistables are < Vessel AT Equivalent to 12.41% RTP and < Vessel AT Equivalent to 22.41%' RTP, respectively, with corresponding trip time delays of< 232 seconds and < 122 seconds. The Trip Setpoint for the Containment Pressure - Environmental Allowance Modifier bistables is < 1.5 psig.

e. Auxiliary Feedwater - Safety Injection An SI signal starts the motor driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.

(continued)

CALLAWAY PLANT B 3.3.2-29 Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE f. Auxiliary Feedwater - Loss of Offsite Power SAFETY ANALYSES, The loss of offsite power (LOP) is detected by a.voltage LCO, AND drop on each ESF bus. The LOP is sensed and processed

• APPLICABILITY by the circuitry for LOP DG Start (Load Shedder and

-(continued) Emergency Load Sequencer) and fed to BOP ESFAS by relay actuation. Loss of power to either ESF bus will start the turbine driven AFW pump, to ensure that at least one SG contains enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip, and automatically isolate the SG blowdown and sample lines. In addition, once the diesel generators are started and up to speed, the motor driven AFW pumps will be sequentially loaded onto the diesel generator buses. -

Functions 6.a through 6.f must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor, "exceptFunction 6.d.(3) which must be OPERABLE in only MODES 1 and 2.- Vessel AT is used to limit the allowed trip time delay only~when greater than 12.41% RTR Below 12.41%RTP the maximum time delay is permitted; therefore, no OPERABILITY requirements should be imposed on the Vessel AT channels in MODE 3. SG Water Level - Low Low in any operating SG will cause the motor driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level - LowLow in any two operating SGs will cause the turbine driven pump to start. These Functions do not have to be OPERABLE in MODES 5 and6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because eitherAFW or residual heat removal (RHR)-will be available to remove decay heat or sufficient time is available to manually place either system in operation.

g. Auxiliary Feedwater - Trip of All Main Feedwater Pumps ATrip of all MFW pumps is an indication of a loss of MFW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure. Each turbine driven MFW pump Jis equipped with two pressure switches (one in

.separation group 1 and one in separation group 4) on the oil line for the speed control system. Alow pressure signal from'either of these pressure switches indicates a trip of (continued)

CALLAWAY PLANT SB 3.3.2-30 --,Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE g. Auxiliary Feedwater - Trip of All Main Feedwater Pumps SAFETY (continued)

ANALYSES, LCO, AND that pump. Two OPERABLE channels per pump satisfy APPLICABILITY redundancy requirements with one-out-of-two logic on both pumps required for signal actuation. A trip of all MFW pumps starts the motor driven AFW pumps to ensure that at least one SG is available with water to act as the heat sink for the reactor.

Function 6.g must be OPERABLE in MODES 1 and 2. This ensures that at least one SG is provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident. In MODES 3, 4, and5, the MFW pumps may be normally shut down, and thus pump trip is not indicative of a condition requiring automatic AFW initiation. Note (n) of Table 3.3.2-1 allows the blocking of this trip function just before shutdown of the last operating main feedwater pump and the restoration of this trip function just after the first main feedwater pump is put into service following its startup trip test. This limits the potential for inadvertent AFW actuations during normal startups and shutdowns.

h. Auxiliary Feedwater - Pump Suction Transfer on Suction Pressure - Low A low pressure signal in the AFW pump suction line protects the AFW pumps against a loss of the normal supply of water for the pumps, the CST. Three pressure switches are located on the AFW pump suction line from the CST. Alow pressure signal sensed by any two of the three switches coincident with an auxiliary feedwater actuation signal will cause the-emergency supply of water for the pumps to be aligned. ESW (safety grade) is automatically lined up to supply the AFW pumps to ensure an adequate supply of water for the AFW System to maintain at least one of the SGs as the heat sink for reactor decay heat and sensible heat removal.

Since the detectors are located in an area not affected by HELBs or high radiation, they will not experience any adverse environmental conditions and the Trip Setpoint reflects only steady state instrument uncertainties. The Trip Setpoint is > 21.71 psia.

(continued)

CALLAWAY PLANT B 3.3.2-31 Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE h. Auxiliary Feedwater - Pump Suction Transfer on Suction SAFETY Pressure - Low (continued)

ANALYSES, LCO, AND This Function must be OPERABLE in MODES 1, 2, and 3 APPLICABILITY. to ensure a safety grade supply of water for the AFW System to maintain the SGs as the heat sink for the reactor. This Function does not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.

In MODE 4, AFW automatic suction transfer does not need to be OPERABLE because RHR will already be in operation,-or sufficient time is available to place RHR in operation, to remove decay heat.

7. Automatic Switchover to Containment Sump At the end of the injection phase of a LOCA, the RWST will be nearly empty. Continued cooling must be provided by the ECCS to remove decay heat. The source of water for the RHR pumps is automatically switched to the containment recirculation sumps.

• The low head residual heat removal (RHR) pumps and containment spray pumps draw the water from the containment recirculation sumps, the RHR pumps pump the water through the RHR heat exchanger, inject the water back into the RCS, and supply the cooled water to the other ECCS pumps. Switchover from the RWST to the containment sumps must occur before the RWST empties to prevent damage to the RHR pumps and a loss of core cooling capability. For similar reasons, switchover must not occur before there is sufficient water in the containment sumps to support ESF pump suction.

a. Automatic Switchover to Containment Sump - Automatic Actuation Logic and Actuation Relays.(SSPS)

Automatic actuation logic and actuation relays consist of S. the same features and operate in the same manner as described for ESFAS Function 1.b.

b. Automatic Switchover to Containment Sump - Refueling Water Storage Tank (RWST) Level - Low Low Coincident With Safety Injection During the injection phase of a LOCA, the RWST is the source of water for all ECCS pumps. A lowlow level in the RWST coincident with an SI signal provides protection (continued)

CALLAWAY PLANT B 3.3.2-32 Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE b. Automatic Switchover to Containment Sump - Refueling SAFETY Water Storage Tank (RWST) Level - Low Low Coincident ANALYSES, With Safety Injection (continued)

LCO, AND APPLICABILITY against a loss of water for the ECCS pumps and indicates the end of the injection phase of the LOCA. The RWST is equipped with four level transmitters. These transmitters provide no control functions. Therefore, a two-outof-four logic is adequate to initiate the protection function actuation. Although only three channels would be sufficient, a fourth channel has been added for increased reliability.

The RWST - Low Low Trip Setpoint is selected to ensure switchover occurs before the RWST empties, to prevent ECCS pump damage.

The transmitters are located in an area not affected by HELBs or post accident high radiation. Thus, they will not experience any adverse environmental conditions and the Trip Setpoint reflects only steady state instrument uncertainties. The Trip Setpoint is> 36% of span.

Automatic switchover occurs only if the RWST low low level signal is coincident with SI. This prevents accidental switchover during normal operation. Accidental switchover could damage ECCS pumps if they are attempting to take suction from an empty sump. The automatic switchover Function requirements for the SI Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.

This Function must be OPERABLE in MODES 1, 2, 3, and 4 when there is a potential for a LOCA to occur, to ensure a continued supply of water for the ECCS pumps.

This Function is not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting systems, pumps, and other equipment to.

mitigate the consequences of an abnormal condition or accident. System pressure and temperature are very low -

and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.

(continued)

CALLAWAY PLANT B 3.3.2-33 Revision 3

ESFAS Instrumentation B 3.3.2 BASES SAPPLICABLE 8. Engineered Safety Feature Actuation System Interlocks

-SAFETY ANALYSES, To allow some flexibility in unit operations, several interlocks are LCO, AND included as part of the ESFAS. These interlocks permit the

-. APPLICABILITY operator to block some signals, automatically enable other

.- (continued) signals, prevent some actions from occurring, and cause other actions to occur. The interlock Functions back up manual actions to ensure bypassable functions are in operation under the conditions assumed in the safety analyses.

a. Engineered Safety Feature Actuation System Interlocks Reactor Trip, P-4 The P-4 interlock is enabled when a reactor trip breaker (RTB) and its associated bypass breaker are open....

Manual reset of SI following a 60 second time delay, in conjunction with P-4, generates an automatic SI block.

This Function allows operators to take manual control of SI systems after the initial phase of injection is complete.

Once SI is blocked, automatic actuation of SI cannot occur until the RTBs have been manually closed.

The functions of the P-4 interlock are:

Trips the main turbine; Isolates MFW with coincident low Ta,;

Prevents automatic reactuation of SI after a manual reset of SI; Allows arming of the steam dump valves and transfers the steam dump from the load rejection Ta,- controller to the plant trip controller, and

• Prevents opening of the MFW isolation valves if they were closed on SI or SG Water Level - High High.

Each of the above Functions is interlocked with P-4 to avert or reduce the continued cooldown of the RCS

--following a-reactor trip. An excessive cooldown of the RCS following a r6actor trip could cause an insertion of positive reactivity with a subsequent increase in core power. To

-avoid-sucha situation, the noted Functions have been I, interlocked with P-4 as part of the design of the unit control (continued)

S CALLAWAY PLANT .ýB 3.3.2-34 . Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE a. Engineered Safety Feature Actuation System Interlocks SAFETY Reactor Trip, P-4 (continued)

ANALYSES, LCO, AND and protection system. The feedwater isolation function on APPLICABILITY P-4 with coincident low Tavg may be blocked iising a bypass switch to prevent undue cycling of the FWIVs and AFW pumps.

None of the noted Functions serves a mitigation function in the unit licensing basis safety analyses. Only the turbine trip Function is explicitly assumed since it is an immediate consequence of the reactor trip Function. Neither turbine trip, nor any of the other four Functions associated with the reactor trip signal, is required to show that the unit "licensing basis safety analysis acceptance criteria are met.

The RTB position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts. Therefore, this Function has no adjustable trip setpoint with which to associate a Trip Setpoint and Allowable Value.

This Function must be OPERABLE in MODES 1, 2, and3 when the reactor may be critical or approaching criticality.

b. Engineered Safety Feature Actuation System Interlocks Pressurizer Pressure, P-11 The P-11 interlock permits a normal unit cooldown and depressurization without actuation of SI or main steam line isolation. With two-out-of-three pressurizer pressure channels (discussed previously) less than the P-11 setpoint, the operator can manually block the Pressurizer Pressure - Low and Steam Line Pressure - Low SI signals and the Steam Line Pressure - Low steam line isolation signal (previously discussed). When the Steam Line Pressure - Low steam line isolation signal is manually blocked, a main steam isolation signal on Steam Line Pressure - Negative Rate - High is automatically enabled.

This provides protection for an SLB by closure of the MSIVs. With two-out-of-three pressurizer pressure channels above the P-11 setpoint, the Pressurizer Pressure - Low and Steam Line Pressure - Low SI signals and the Steam Line Pressure - Low steam line isolation signal are automatically enabled. The operator can also enable these trips by use of the respective manual unblock (continued)

CALLAWAY PLANT B 3.3.2-35 Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE b. Engineered Safety Feature Actuation System Interlocks SAFETY Pressurizer Pressure, P-11 (continued)

-ANALYSES, LCO, AND' '(reset) buttons. When the Steam Line Pressure - Low APPLICABILITY steam line isolation signal is enabled, the main steam

-- isolation on Steam Line Pressure - Negative Rate - High is disabled. The Trip Setpoint reflects only steady state instrument uncertainties. The Trip Setpoint is< 1970 psig.

This Function must be OPERABLE in MODES 1, 2, and3 to allow an orderly cooldown and depressurization of the unit without the actuation of SI or main steam isolation.

This Function does not have to be OPERABLE in MODE 4, 5, or 6 because system pressure must already be below

,the P-11 :setpoint for the requirements of the heatup and cooldown curves to be met.

9. Automatic Pressurizer PORV Actuation For-the inadvertent ECCS actuation at power event (a Condition II event), the safety analysis (Ref. 15) credits operator actions from

-the main control room to terminate flow from the normal charging pump (NCP) and to open at least one PORV block valve (assumed to initially be closed) and assure the availability of the PORV for automatic pressure relief. Analysis results indicate that water relief through the pressurizer safety valves, which could result in the Condition II event degrading into a Condition III event if the safetyvalves did not reseat, is precluded if operator actions are taken within the times assumed in the Reference 15 analysis to terminate NCP flow and to assure at least one PORV is available for automatic pressure relief. The assumed operator action times conservatively bound the times measured during simulatoriexercises. Therefore, automatic PORV operation is an assumed safety function in MODES 1, 2, and 3. ThePORVs are

,equipped with automatic actuation circuitry and manual control capability., The PORVs are considered OPERABLE in either the automatic or manual mode, as long as the automatic actuation circuitry is OPERABLE and the PORVs can be made available for automatic pressure relief by timely operator actions (Ref. 15) to Sopen the associated block valves (if closed) and to assure the PORV handswitches are in the automatic operation position. The automatic mode is the preferred configuration, as this provides the required pressure relieving capability without reliance on operator actions.

(continued)

D 0.0.4-0V Vl.;VI01I

,, UA/"LL/'AVV/'T r-L..V1 I U "

I ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 9. -Automatic Pressurizer PORV Actuation (continued)

SAFETY ANALYSES, a. Automatic Pressurizer PORV Actuation - Automatic LCO, AND Actuation Logic and Actuation Relays (SSPS) (continued)

APPLICABILITY Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for Function 1.b, except that the LCO is not applicable in MODE 4 as discussed below for Function 9.b.

b. Automatic Pressurizer PORV Actuation - Pressurizer Pressure - High This signal provides protection against an inadvertent ECCS actuationat power event. Pressurizer pressure provides both control and protection functions: input to the Pressurizer Pressure Control System, reactor trip, SI, and automatic PORV actuation. Therefore, the actuation logic must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four opening logic. The Trip Setpoint is <2335 psig.

The automatic PORV opening logic is satisfied when two out-of-four (2/4) pressurizer pressure channels exceed their setpoint. Continued operation is allowed with one inoperable channel in the tripped condition. In this case, the automatic opening logic would revert to one-out-of three'(1/3). A single failure (e.g., failed bistable card) in one of the remaining three channels could result in both PORVs opening and remaining open since the automatic closure logic requires three-out-of-four (3/4) channels to reset, which could not be satisfied with two inoperable channels. However, this event can be terminated by PORV block valve closure and the consequences of this event are bounded by the analysis of a stuck open pressurizer safety valve in Reference 16. Therefore, automatic PORV closure is not a required safety function and the OPERABILITY requirements are satisfied by four OPERABLE pressurizer pressure channels.

Consistent with the Applicability of LCO 3.4.11, "Pressurizer PORVs," the LCO for Function 9 is not applicable in MODE 4 when both pressure and core (continued)

CALLAWAY PLANT B 3.3.2-37 Revision 3

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE b. Automatic Pressurizer PORV Actuation - Pressurizer SAFETY Pressure6- High (continued)

ANALYSES, LCO, AND energy are decreased and transients that could cause an APPLICABILITY overpressure condition will be slow to occur. This is also consistent with the Applicability of Functions 1.c, U.d, and I.e. LCO 3.4.12 addresses automatic PORV actuation instrumentation requirements in MODES 4 (with any RCS cold leg temperature <275oF), 5, and 6 with the reactor vessel head in place.

The ESFAS instrumentation satisfies Criterion 3 of 10CFR50.36(c)(2)(ii).

ACTIONS A Note has been added in the ACTIONS to clarify the application of

t Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1.

In the event a channel's Trip Setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected. When the Required Channels in Table 3.3.2-1 are specified on a per steam line, per SG, per pump, etc., basis, then the Condition may be entered separately for each steam line, SG, pump, etc., as appropriate.

When the number of inoperable channels in a trip function exceed those specified in one or other related Conditions associated with a trip function, then the unit is outside the safety analysis. Therefore, LCO3.0.3 should be immediately entered if applicable in the current MODE of operation.

A.1 Condition A applies to all ESFAS protection functions.

Condition A addresses the situation where one or more channels or trains for one or more Functions: are inoperable at the same time. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection furictions affected. The' Completion Times are those from the referenced Conditions and Required Actions.

B.1, B.2.1, and B.2.2 Condition B applies to manual initiation of:

II (continued)

CALLAWAY PLANT B 3.3.2-38 Revision 3

ESFAS Instrumentation B 3.3.2 BAS ES ACTIONS B.1, B.2.1, and B.2.2 (continued)

• SI; Containment Spray; Phase A Isolation; and Phase B Isolation.

This action addresses the train orientation of the SSPS for the functions

-listed above. If a channel or train isý inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> are allowed to return it to an OPERABLE status. Note that for containment spray and Phase B isolation, failure of one or both channels in one train renders the train inoperable. Condition B, therefore, encompasses botli-situatioids.

The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each Function, and the low probability of an event occurring during this interval. If the channel or train cannot be restored to OPERABLE, status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (54 hours6.25e-4 days <br />0.015 hours <br />8.928571e-5 weeks <br />2.0547e-5 months <br /> total time)' and in MODE 5 within an additional 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> (84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> total time). The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1, C.2,'C.3.1, and C.3.2 Condition C applies to the automatic actuation logic and actuation relays for the following functions:

• SI;

• Containment Spray;

• Phase A Isolation;

• Phase B Isolation; and

• Automatic Switchover to Containment Sump.

This action addresses the train orientation of the SSPS and the master and slave relays. Containment Isolation PhaseA is the primary si*nal to ensure closing of the containment purge supply and exhaust valves. If (continued)

.,CALLAWAY PLANT B 3.3.2-39 Revision 3

ESFAS Instrumentation B 3.3.2 BASES ACTIONS C.1, C.2, C.3.1, and C.3.2 -(continued) one Phase A train is inoperable, operation may continue as long as the

-Required Action to place and maintain containment purge supply and exhaust valves in their closed position is met. Required Action C.1 is modified by a Note that this Action is only required if Containment Phase A Isolation (Function 3.a.(2)) is inoperable. If one train is inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to restore the train to OPERABLE status.

The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply.

This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> total time) and in MODE 5 within an additional 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> (42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> total time). The Completion Times are reasonable,.based on.

operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing, provided the other train is OPERABLE. 'This allowance is based on the reliability analysis assumption of Reference 8 that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is the average time required to perform channel surveillance.

D.1, D.2.1, and 0.2.2 Condition D applies to:

0 Containment Pressure - High 1; 0 Pressurizer Pressure - Low-,

• Steam Line Pressure - Low;

• Containment Pressure - High 2; Steam Line Pressure - Negative Rate - High; SG Water Level - Low Low (Adverse Containment Environment);

° SG Water Level - Low Low (Normal Containment Environment);

and

• Pressurizer Pressure - Highi.

(continued)

-:CALLAWAY PLANT B 3.3.2-40 Revis~ion 3

ESFAS Instrumentation B 3.3.2 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued)

If one channel is inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to restore the channel to OPERABLE status or to place it in the tripped condition. Generally this Condition applies to functions that operate on two-out-of-three logic (excluding Pressurizer Pressure - Low, Pressurizer Pressure - High, and SG Water Level - Low Low (Adverse and Normal Containment Environment)). Therefore, failure of one channel (i.e., with the bistable not tripped) places the Function in a two-out-of-two configuration. The inoperable channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.

Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing of other channels. The 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowed to restore the channel to OPERABLE status or to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> allowed for testing, are justified in Reference 8.

E.1, E.2.1, and E.2.2 Condition E applies to:

• Containment Spray Containment Pressure - High 3; and

• Containment Phase B Isolation Containment Pressure - High 3.

None of these signals has input to a control function. Thus, two-out-of-three logic is necessary to meet acceptable protective requirements. However, a two-out-of-three design would require tripping a failed channel. This is undesirable because a single failure would then cause spurious containment spray initiation. Spurious spray actuation is undesirable because of the cleanup problems presented. Therefore, these channels are designed with two-out-of-four logic so that a failed channel may be bypassed rather than tripped. Note that one channel may be bypassed and still satisfy the single failure criterion. Furthermore, (continued)

CALLAWAY PLANT B 3.3.2-41 Revision 3

ESFAS Instrumentation B 3.3.2 BASES ACTIONS E.1, E.2.1, and E.2.2 (continued) with one channel bypassed, a single instrumentation channel failure will not spuriously initiate containment spray.

To avoid the inadvertent actuation of containment spray and Phase B containment isolation, the inoperable channel should not be placed in the tripped condition. Instead it is bypassed. Restoring the channel to OPERABLE status, or placing the inoperable channel in the bypassed condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, is sufficient to assure that the Function remains OPERABLE and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The Completion Time is further justified based on the low probability of an event occurring during this interval. Failure to restore the inoperable

-... ,channel to OPERABLE status, or place it in the bypassed condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, requires the unit be-placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the'next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.

The Required Actions are modified by a Note that allows one additional channel to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing Placing a second channel in the bypassed condition for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for testing purposes is acceptable based on the results of Reference 8.

F.1, F.2.1, and F.2.2 Condition F applies to:

• Manual Initiation of Steam Line Isolation; and P-4 Interlock.

For the Manual Initiation and the P-4 Interlock Functions, this action addresses the train orientation of the SSPS. If a channel or train is inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> are allowed to return it to OPERABLE status. The specified Completion Time is reasonable considering the nature of these

,- - Functions, the available redundancy,,and the low probability of an event occurring during this interval. If the.Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODEA4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reacli,the required unit conditions from full power in an orderly manner (continued)

.. CALLAWAY PLANT B 3.3.2-42 .. Revision 3

ESFAS Instrumentation B 3.3.2 BASES ACTIONS F.1, F.2.1, and F.2.2 (continued) and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.

G.1, G.2.1, and G2.2 Condition G applies to the automatic actuation logic and actuation relays (SSPS) for the Steam Line Isolation, Turbine Trip and Feedwater Isolation, and AFW actuation Furnctions. Condition G also applies to the MSFIS automatic actuation logic.

The action addresses the train orientation of the actuation logic for these functions. If one train is inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to restore the train to OPERABLE status. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. If the train cannot be returned to OPERABLE status, the unit must be brought to MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of the protection channels and actuation functions. In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.

The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing provided the other train is OPERABLE. This allowance is based on the reliability analysis (Refs. 8 and 13) assumption that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is the average time required to perform channel surveillance.

H.1 Condition H applies to the automatic logic and actuation relays (SSPS) for the Automatic Pressurizer PORV Actuation Function.

The Required Action addresses, the impact on the ability to mitigate an inadvertent ECCS actuation at.power event that requires the availability of at least one pressurizer PORV for automatic pressure relief. With one or more automatic actuation logic trains inoperable, the associated pressurizer PORV(s) must be, declared inoperable immediately. This (continued)

CALLAWAY PLANT B 3.3.2-43 Revision 3

ESFAS Instrumentation "B3.3.2 BASES ACTIONS H.1 (continued) requires that Condition B or E of LCO 3.4.11, "PressurizerPORVs," be

- ,- entered immediately depending on the number of PORVs inoperable.

The Required Action is modified by a Note that allows one train to be

• *bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for, surveillance testing provided the other train is OPERABLE. This allowance is based on the reliability analysis (Refs. 8 and 13) assumption that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is the average time required to perform channel surveillance.

1.1 and 1.2 Condition I applies to:

SG Water Level - High High (P-14).

If one channel is inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to restore the channel to

• OPERABLE status or to place it in the tripped condition. If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-three logic will result in actuation. The 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Completion Time is justified in Reference 8. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> requires the unit to be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an

"*. orderly manner and without challenging unit systems. In MODE 3, this Function is no longer required OPERABLE.

'The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing of other channels. The 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowed to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> allowed for an inoperable channel to be in the bypassed condition for testing, are justified in Reference 8.

J.1 and'J.2 Condition J applies to the AFW pump start on trip of all MFW pumps.

.. This action addresses the train orientation of the BOP ESFAS for the auto start function of the AFW System on loss of all MFW pumps. The OPERABILITY-of the AFW Systemmust be assured by providing automatic start of the AFW System pumps. If a channel is inoperable, 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is allowed to place it in the tripped condition. If the channel cannot be tripped in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, 6 additional hours are allowed to place the unit in (continued)

CALLAWAY PLANT I B 3.3.2-44 . Revision 3

ESFAS Instrumentation B 3.3.2 BASES ACTIONS J.1 and J.2 (continued)

MODE 3. The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, the unit does not have any analyzed transients-or conditions that require the explicit use of the protection function noted above. The Required Actions are modified by a Note that allows the in-operable channel to be bypassed for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing of other channels.

K.1, K.2, K.3.1, and K.3.2 Condition K applies to:

"- RWST Level - Low Low Coincident with Safety Injectioff.-

RWST Level - Low Low Coincident With SI provides actuation of switchover to the containment recirculation sumps. Note that this Function requires the bistables to energize to perform their required action'. The failure of up to two channels will not prevent the operation of this Function. This Action Statement limits the duration that an RWST level channel could be tripped, due to its being inoperable or for testing, in order to limit the probability for automatic switchover to an empty containment sump upon receipt of an inadvertent safety injection signal (SIS), coincident with a single failure of another RWST level channel, or for premature switchover to the sump after a valid SIS. This sequence of events would start the RHR pumps, open the containment sump RHR suction valves and, after meeting the sump suction valve open position interlock, the RWST RHR suction valves would close. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> restoration time for an inoperable channel is consistent with that given in other Technical Specifications affecting RHR operability, e.g., for one ECCS train inoperable and for one diesel generator inoperable.

The Completion Times are justified in Reference 8. If the channel cannot be placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and returned to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the unit must be brought to MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 5 within the next 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The allowed Comp!etion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, the unit does not have any analyzed transients or conditions that require the explicit use of the protection function noted above. The "RequiredActions are modified by a Note that allows placing an inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing of other channels. This bypass allowance is justified in Reference 8.

(continued)

CALLAWAY PLANT B 3.3.2-45 Revision 3

ESFAS Instrumentation B 3.3.2 BASES ACTIONS L., L.2.1, and L.2.2 (continued)

Condition L applies to the P-11 interlock.

With one or more required channel(s) inoperable, the operator must verify

• . that the interlock is in the required state for the existing unit condition by observation of the associated permissive annunciator window. This

-action manually accomplishes the function of the interlock. Determination must be made within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is equal to the time allowed by LCO 3.0.3 to initiate shutdown actions in the event of a complete loss of ESFAS function. If the interlock is not in the required state (or placed in the required state) for the existing unit condition, the

-unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of this interlock.

M.1 and M.2 Condition M applies to the Trip Time Delay (TTD) circuitry enabled for the SG Water Level-Low Low trip Functions when THERMAL POWER is less than or equal to 22.41% RTP in MODES I and 2. With one or more Vessel AT Equivalent (Power-I, Power-2) channel(s) inoperable, the associated Vessel AT channel(s) must be placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. If the inoperability impacts the Power-1 and Power-2 portions of the TTD circuitry (e.g., Vessel AT RTD failure), both the ower-1 and Power-2 bistables in the affected protection set(s) are placed in the tripped condition. However, if the inoperability is limited to either the Power-1 or Power-2 portion of the TTD circuitry, only the

. corresponding Power-1 or Power-2 bistable in the affected protection

, . set(s) is placedin the tripped condition. With one or more TTD circuity

, delay timer(s) inoperable, both the Vessel AT (Power-I) and Vessel AT (Power-2) channels are tripped. This automatically enables a zero time delay for that protection 6hannel with either the normal or adverse containment environment level bistable enabled. The Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is based on Reference 11. If the inoperable channel cannot be placed in the tripped condition within the specified Completion Time, the unit must be placed in a MODE where this Function is not required to be OPERABLE. The unit must be placed in MODE 3 within an addifional six hours.

CAL YP T B(continued)

,CALLAWAY PLANT B 3.3.2-46 - Revision 3

ESFAS Instrumentation B 3.3.2 BASES ACTIONS N.1, N.2.1, and N.2.2 (continued)

Condition N applies to the Environmental Allowance Modifer (EAM) circuitry for the SG Water Level-Low Low trip Functions in MODES 1, 2, and 3. With one or more EAM channel(s) inoperable, they must be placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Placing an EAM channel in trip automatically enables the SG Water Level-Low Low (Adverse Containment Environment) bistable for that protection channel, with its higher SG level Trip Setpoint (a higher trip setpoint means a feedwater isolation or an AFW actuation would occur sooner). The Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is based on Reference 11. If the inoperable channel cannot be placed in the tripped condition within the specified Completion Time, the unit must be placed in a MODE where this Function is not required to be OPERABLE. The unit must be placed in MODE 3 within an additional six hours and in,MODE 4 within the following six hours.

0.1 and 0.2 Condition 0 applies to the Auxiliary Feedwater Pump Suction Transfer on Suction Pressure - Low trip Function. The Condensate Storage Tank is the highly reliable and preferred suction source for the AFW pumps. This function has a two-out-of-three trip-logic. -Therefore, continued operation is allowed with one inoperable chaniel until the performance of the next monthly COT on one of the other channels, as long as the inoperable channel is placed in trip within .1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Condition 0 is modified by a Note stating that LCO 3.0:4 is not applicable. MODE changes are permitted with an inoperable channel.

P.1 Condition P applies to the Auxiliary Feedwater Manual Initiationtrip Function. The associated auxiliary feedwater pump(s) must be declared inoperable immediately when one or more channel(s) is inoperable.

Refer to LCO 3.7.5, "Auxiliary Feedwater (AFW) System."

Q.1 and Q.2 Condition Q applies to the Auxiliary Feedwater Balance of Plant ESFAS automatic actuation logic and actuation relays. With one train inoperable, the unit must be brought to MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The Required Actions are modified by a Note that allows one train to be bypassed for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing provided the other train is OPERABLE.

(continued)

CALLAWAY PLANT B 3.3.2-47 Revision 3

ESFAS Instrumentation B 3.3.2 Table B 3.3.2-1 (Page 3 of 5)

FUNCTION NOMINAL TRIP SETPOINT (a)

5. Turbine Trip and Feedwater Isolation

a. Automatic Actuation Logic and N.A.

Actuation Relays (SSPS)

b. Automatic Actuation Logic and N.A.

Actuation Relays (MSFIS)

c. SG Water Level - High High, _ 78% of narrow range instrument span (P-14)

d. Safety Injection See Function 1 (Safety Injection).

e. SG Water Level Low-Low See Function 6.d, SG Water Level Low-Low.

6. Auxiliary Feedwater

a. Manual Initiation N.A.

b. Automatic Actuation Logic and N.A.

Actuation Relays (SSPS)

c. Automatic Actuation Logic and N.A.

Actuation Relays (BOP ESFAS)

d. SG Water Level - Low Low (1) Steam Generator Water "*-Z27.0% of narrow range Level - Low Low Sinstrument span I (Adverse Containment Environment)

(continued)

(a) - The inequality sign only indicates conservative direction. The as-left value will be within a two-sided calibration tolerance band on either side of the nominal value.

CALLAWAY PLANT ,13 3.3.2-60 Revision 3

I ESFAS Instrumentation B 3.3.2 Table B 3.3.2-1 (Page 4 of 5)

FUNCTION NOMINAL TRIP SETPOINT (a)

d. SG Water Level - Low Low (continued)

(2) Steam Generator Water 21.6% of narrow range Level - Low Low instrument span (Normal Containment Environment)

(3) Vessel AT Equivalent including delay timers Trip Time Delay (a) Vessel AT < Vessel AT Equivalent (Power-I) to 12.41% RTP (with a time delay g 232 sec.)

(b) Vessel AT < Vessel AT Equivalent (Power-2) to 22.41% RTP (with a time delay < 122 sec.)

(4) Containment Pressure < 1.5 psig Environmental Allowance Modifier

e. Safety Injection See Function 1 (Safety Injection).

f. Loss of Offsite Power N.A.

g. Trip of all Main Feedwater N.A.

Pumps

h. Auxiliary Feedwater Pump > 21.71 psia Suction Transfer on Suction Pressure - Low (continued)

(a) The inequality sign only indicates conservative direction. The as-left value will be within a two-sided calibration tolerance band on either side of the nominal value.

CALLAWAY PLANT B 3.3.2-61 Revision 3

BDMS B 3.3.9 B 3.3 INSTRUMENTATION B 3.3.9 Boron Dilution Mitigation System (BDMS)

"BASES-.

BACKGROUND The primary purpose of the BDMS is tomitigate the consequences of the inadvertent addition of unborated primary grade water into the Reactor Coolant System (RCS) when the plant is in MODES 2 (below P-6 setpoint), 3, 4, and,5.

The BDMS utilizes two channels of source range instrumentation. Each source range channel provides a signal to its microprocessor, which continuously records the counts per minute. At the end of each discrete one-minute interval, an algorithm compares the average counts per minute value (flux rate) of that 1 minute interval with the average counts per minute value for the previous nine, 1 minute intervals. If the flux rate during a 1 minute interval is greater than or equal to 1.7 times the flux rate during any of the prior nine 1 minute intervals, the BDMS provides a signal to initiate mitigating actions.

Upon detection of a flux multiplication by either source range instrumentation train, an alarm is sounded to alert the operator and valve

-movement is automatically.initiated to terminate the dilution and start boration. Valves that isolate the refueling water storage tank (RWST) are opened to supply borated water to the suction of the centrifugal charging pumps, and valves whichisolate the Volume Control Tank are closed to terminate the dilution.

APPLICABLE The BDMS senses abnormal increases in source range counts per minute SAFETY (flux rate) and actuates'VCT and RWST valves to mitigate the L._ ANALYSES -consequences of an inadvertent boron dilution event as described in.

Reference 1. The accident analyses rely on automatic BDMS actuation to mitigate the consequences of inadvertent boron dilution events in MODES 3, 4, and 5. The MODE 2 analysis in Reference I credits the source range reactor trip function, in conjunction with operator action. The operation of one RCS loop in MODES 2 (below P-6 setpoint), 3, 4, and5 provides adequate flow to ensure mixing, prevent stratification, and produce gradual reactivity changes during RCS boron concentration reductions. The reactivity change rate associated with boron reduction will, thterefore, be within the transient mitigation capability of the BDMS.

"Withno reactor coolant lob1 in operation in the above MODES,.boron dilutions must be terminated and dilution sources isolated. The boron dilution analysis in these MODES takes credit for the mixing volume

4 associated with having at least one reactor coolant loop in op6ration.

(continued)

CALLAWAY PLANT B 3.3.9-1 Revision 3

BDMS B 3.3.9 BASES APPLICABLE The event is successfully terminated after the volume of water from the SAFETY normally closed RWST suction isolation valves to the RCS via the normal ANALYSES charging flow path is purged and inadvertent criticality is avoided. The (continued) primary success path for mitigation is fulfilled when the VCT suction path is isolated; however, the analysis also accounts for the volume of CVCS piping from the RWST to the RCS that must be purged since its boron content is dependent on time in cycle life and may itself represent a dilution source.

The BDMS satisfies Criterion 3 of 10CFR50.36(c)(2)(ii).

LCO LCO 3.3.9 provides the requirements for OPERABILITY of the instrumentation that provides control room indication of core neutron levels, and that mitigates the corisequence~s of a boron dilution event.

Two redundant trains are required to be OPERABLE to provide protection against single failure. In addition, LCO 3.3.9 requires that one RCS loop shall be in operation.

Because the BDMS utilizes the source range instrumentation in its detection system, the OPERABILITY of that portion of the detection system is also part of the OPERABILITY of the Reactor Trip System. The flux multiplication algorithm, the alarms, and signals to the motor control centers for the suction valves all must be OPERABLE for a train in the system to be considered OPERABLE. As'required for this LCO, the BDMS extends to, and includes, the RWST suction isolation valves (BNLCV0112D, E) and the VCT suction isolation valves (BGLCV0112B, C).

With insufficient RCS mixing volume, i.e. no RCS loop in operation, Condition C must be entered.

APPLICABILITY The BDMS must be OPERABLE in MODES 2 (below P-6 setpoint), 3, 4, and 5 because the safety analysis identifies this system as the primary means to-mitigate an inadvertent boron dilution of the RCS in MODES 3, 4, and 5 and the P-6 setpoint establishes the point at which RTS protection is shifted to the intermediate 'range neutron flux channels.

The BDMS OPERABILITY requirements are not applicable in MODES I and 2 (above P-6 setpoint) because an inadvertent boron dilution would

'be terminated by Overtemperature AT or operator action. The

"-Overtemperature AT trip Function is discussed in LCO 3.3.1, "RTS Instrumentation."

(continued)

CALLAWAY PLANT B 3.3.9-2 Revision 3

BDMS B 3.3.9 BASES APPLICABILITY In MODE 6, a dilution event is precluded by locked valves (BGV0178 and (continued) BGV0601) that isolate the RCS from the potential source ofunborated water (according to LCO 3.9.2, "Unborated Water Source Isolation Valves").,

The Applicability is modified by a Note that allows the boron dilution flux multiplication signal to be blocked during reactor startup in MODE 2 (below P-6 setpoint) and MODE 3. Blocking the flux multiplication signal is acceptable during startup provided the reactor trip breakers are closed with the intent to withdraw rods for startup. The P-6 interlock provides a backup block signal to the source range flux multiplication circuit.

ACTIONS The most common cause of channel inoperability is outright failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by the unit specific calibration procedure. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination of setpoint drift is generally made during the performance of a COT when the process instrumentation is set up for adjustment to bring it to within specification. If the Trip Setpoint is less conservative than the tolerance specified by the calibration procedure, the channel must be declared inoperable immediately and the appropriate Condition entered.

A.1 With one train of the BDMS inoperable, Required Action A.1 requires that the inoperable train must be restored to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, the remaining BDMS train is adequate to provide protection. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on the BDMS Function and is consistent with Engineered Safety Feature Actuation System Completion Times for loss of one redundant train. Also, the remaining OPERABLE train provides continuous indication of core power status to the operator, has an alarm function, and sends a signal to both trains of the BDMS to assure system actuation.

Administrative controls require operator awareness during all reactivity manipulations. These administrative controls include:

- Reactivity management briefs of the Control Room Operations Staff (typically conducted at the beginning of each shift);

- Use of self-verification techniques by all licensed operators performing core reactivity.manipulations; (continued)

CALLAWAY PLANT IB 3.3.9-3 Revision 3

BDMS B 3.3.9 BASES ACTIONS A.1 (continued)

- Peer checks for all reactivity manipulations during routine operations and for all positive reactivity additions during transient or off-normal operations;

- Off-normal procedures are available that address reactor makeup control system (RMCS) malfunctions-and potential loss of shutdown margin (SDM).

During any and all rod motion, operators monitor all available indications of nuclear power. During RCS boron concentration change evolutions, operators observe the various indications and alarms provided in the RMCS design for monitoring proper system operation as discussed in FSAR Section 15.4.6 (Reference 1). Introduction of reactor makeup water into the RCS from the Chemical and Volume Control System mixing tee is not permitted when one BDMS train is inoperable.

B.1, B.2, B.3.1, and B.3.2 With two trains inoperable, or the Required Action and associated Completion Time of Condition A not met, the initial action (Required Action B.1) is to suspend all operations involving positive reactivity additions immediately. This includes withdrawal of control or shutdown rods and intentional boron dilution.

Required Action B.2 verifies the SDM according to SR 3.1.1.1 within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter. This action is intended to confirm that no unintended boron dilution has occurred while the BDMS was inoperable, and that the required SDM has been maintained. The specified Completion Time takes into consideration sufficient time for the initial determination of SDM and other information available in the control room related to SDM.

Required Action B.3.1 requires valves listed in LCO 3.9.2 (Required Action A.2), BGV0178 and BGV0601, to be secured to prevent the flow of unborated water into the RCS. Once it is recognized that two trains of the BDMS are inoperable, the operators will be aware of the possibility of a boron dilution, and the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is adequate to complete the requirements of LCO 3.9.2. The recurring 31 day verification of Required Action B.3.2 ensures these valves remain closed for an extended Condition B entry.

Required Action B.1 is modified by a Note which permits plant temperature changes provided the temperature change is accounted for (continued)

CALLAWAY PLANT B 3.3.9-4 Revision 3

BDMS B 3.3.9 BASES ACTIONS B.1, B.2, B.3.1, and B.3.2 (continued). .

in the calculated SDM. Introduction of temperature changes, including temperature increases when a positive MTC exists, must be evaluated to ensure they do not result in a loss of required SDM.

C.1 and C.2 Condition C is entered with no RCS loop in operation. The operation of

-.one RCS loop provides adequate flow to ensure mixing, prevent stratification, and produce gradual reactivity changes during RCS boron concentration reductions. The reactivity change rate associated with boron reduction will, therefore, be within the transient mitigation capability of the Boron Dilution Mitigation System (BDMS). With no reactor coolant loop in operation, dilution sources must be isolated. The boron dilution analysis takes credit for the mixing volume -associated with having at least one reactor coolant loop in operation.

Required Action C.1 requires that valves BGV0178 and BGV0601 be closed and secured to prevent the flow of unborated water into the RCS.

The4 hour Completion Time is adequate to perform these local valve manipulations. The recurring 31 day verification of Required Action C.2 ensures these valves remain closed and secured for an extended Condition C entry.

SURVEILLANCE The BDMS trains are subject to a CHANNEL CHECK, valve closure in REQUIREMENTS MODE 5, COT, CHANNEL CALIBRATION,-and Response Time Testing.

In addition, the requirement to verify one RCS loop in operation is subject to periodic surveillance.

SR 3.3.9.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures that S- ,gross failure of source range instrumentation has not occurred.

A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similarparameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations

, between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious.

A CHANNEL CHECK will detect gross channel failure; thus, it is key to

, .verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

(continued)

CALLAWAY PLANT SB 3.3.9-5 *- . Revision 3

BDMS B 3.3.9 BASES SURVEILLANCE SR 3.3.9.1 (continued)

REQUIREMENTS Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.9.2 SR 3.3.9.2 requires that valve BGV0178 be secured and closed prior to entry into MODE 5. Specification 3.9.2 requires that this valve also be secured and closed in MODE 6. Closing BGV0178 satisfies theboron dilution accident analysis assumption that flow orifice BGFOO010 limits the dilution flow rate to no more than 150 gpm in MODE 5. This Surveillance demonstrates that the valve is closed through a system walkdown. SR 3.3.9.2 is modified by a Note stating that it is only required to be performed in MODE 5. This Note requires that the surveillance be performed prior to entry into MODE 5 and every 31 days while in MODE 5. The 31 day frequency is based on engineering judgment and is considered reasonable in view of othei administrative controls that will ensure that the valve opening is an unlikely possibility.

SR 3.3.9.3 SR 3.3.9.3 requires the performance of a COT every 92 days, to ensure that each train of the BDMS and associated trip setpoints are fully operational. A successful test of the required contact(s) of a channel relay may be performed by the verification of the'change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay., This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This test shall include verification that the boron dilution flux multiplication setpoint is equal to or less than an increase of 1.7 times the count rate within a10 minute period. The 1.7 flux multiplication setpoint is a nominal value. SR 3.3.9.3 is met if the measured setpoint is within a two-sided calibration tolerance band on either side of the nominal value. SR 3.3.9.3'is modified by a (continued)

CALLAWAY PLANT B 3.3.9-6 Revision 3

BDMS B 3.3.9 BASES SURVEILLANCE SR 3.3.9.3 (continued)

REQUIREMENTS Note that provides a 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> delay in the requirement to perform this Surveillance after reducing power below the P-6 interlock. This Note

- allows a delay in the performance of the COT to reflect the delay allowed for the source range channels. -If the plant is to remain below the P-6 setpoint for more than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, this Surveillance must be performed prior to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after reducing power below the P-6 setpoint. The Frequency of 92 days is consistent with the requirements for source range channels in Reference 2.-..

SR 3.3.9.4 SR 3.3.9.4 is the performance of a CHANNEL CALIBRATION every 18 months. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. The SR is modified by a Note that neutron detectors are excluded from the CHANNEL CALIBRATION. Neutron detectors are excluded from the CHANNEL CALIBRATION because it is impractical to set up a test that demonstrates and adjusts neutron detector response to known values of the parameter (neutron flux) that the channel monitors.

The Note applies to the source range proportional counters in the Nuclear Instrumentation System (NIS).

The testing of the source range neutron detectors consists of obtaining integral bias curves, evaluating those curves, and comparing the curves previous data. The 18 month Frequency is based on operating experience and on the need to obtain integral bias curves under the conditions that apply during a plant outage. The other remaining portions of the CHANNEL CALIBRATION may be performed either during a plant outage or during plant operation.

SR 3.3.9.5 SR 3.3.9.5 is the performance of a response time test every 18 months to verify that, on a simulated or actual boron dilution flux multiplication signal, the centrifugal charging pump suction valves from the RWST open and the CVCS volume control tank discharge valves close in the required time of < 30 seconds to reflect the analysis requirements of Reference 1.

The Frequency is based on operating experience and consistency with the typical industry refueling cycle.

(continued)

CALLAWAY PLANT ", B 3.3.9-7 Revision 3

BDMS B 3.3.9 BASES SURVEILLANCE SR 3.3.9.6 REQUIREMENTS (continued) SR 3.3.9.6 requires verification every'12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> that one RCS loop is in operation. Verification may include flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing adequate mixing. The Frequency of,12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS loop performance.

REFERENCES 1. FSAR, Section 15.4.6.

2. Callaway OLAmendment No. 17 dated September 8, 1986.

CALLAWAY PLANT B 3.3.9-8 Revision 3

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES APPLICABILITY perturbations where actions to control pressure variations might be (continued) counterproductive. Also, since they represent transients initiated from power levels < 100% RTP,-an increased DNBR margin exists to offset the temporary pressure variations.,

Another set of limits on DNB related parameters is provided in SL 2.1.1, "Reactor Core SLs." Those limits are less restrictive than the limits of this LCO, but violation of a Safety Limit (SL) merits a stricter, more severe Required Action.

ACTIONS A.1 RCS pressure and RCS average temperature are controllable and S-* - - measurable parameters. With one or both of these parameters not within .

LCO limits, action must be taken to restore parameter(s).

-RCS total flow rate is not a controllable parameter and is not expected to

- 'vary during steady state operation. Ifthe indicated RCS total flow rate is below the LCO limit, power must be reduced, as required by Required Action B.1, to restore DNB margin and reduce the potential for violation of the accident analysis limits.

The 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Completion Time for restoration of the parameters provides sufficient time to adjust plant parameters, to determine the cause for the off normal condition, and to restore the readings within limits, and is based on plant operating experience.

• B.1 If Required Action A.1 is not met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant muist be brought to at least MODE 2

- - within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. In MODE 2, the reduced power condition eliminates the

-* potential for violation of the accident analysis bounds. The Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable to reach the required plant conditions in an "orderlymanner.

(continued)

CALLAWAY PLANT I B 3.4.1-3 CLAAPLT3- - Revision 0

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES (continued)

SURVEILLANCE -SR 3.4.1.1 REQUIREMENTS Since Required Action A.1 allows a Completion Time of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to restore parameters that are not within limits, the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Surveillance Frequency for pressurizer pressure is sufficient to ensure the pressure can be restored to a normal operation, steady state condition following load changes and other expected transient operations. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and to verify operation is within safety analysis assumptions.

SR 3.4.1.2 Since Required Action A.1 allows a Completion Time of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to restore parameters that are not within limits, the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Surveillance Frequency for RCS average temperature is sufficient to ensure the temperature can be restored to a normal operation, steady state condition following load changes and other expected transient operations. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and to verify operation is within safety analysis assumptions.

SR 3.4.1.3 The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Surveillance Frequency for RCS total flow rate is performed using the installed flow instrumentation. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> interval has been shown by operating practice to be sufficient to regularly assess potential degradation and to verify operation within safety analysis assumptions.

SR 3.4.1.4 Measurement of RCS total flow rate by performance of a precision calorimetric heat balance once every 18 months allows the installed RCS flow instrumentation to be normalized and verifies the actual RCS flow rate is greater than or equal to the minimum required RCS flow rate.

When performing a precision heat balance, the instrumentation used for determining steam pressure, feedwater temperature, and feedwater venturi Ap in the calorimetric calculations shall be calibrated within 7 days prior to performing the heat balance.

The Frequency of once after each refueling prior to THERMAL POWER exceeding 75% RTP, and 18 months reflects the importance of verifying (continued)

CALLAWAY PLANT B 3.4.1-4 Revision 3

ý I RCS Loops - MODE 3 B 3.4.5 BASESI LCO Utilization of the Note is permitted provided the following conditions are (continued) met, along with any other conditions imposed by test procedures-

a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1, thereby maintaining the margin to criticality. Introduction of reactor makeup water into the RCS from the Chemical and Volume Control System mixing tee is not permitted when no RCS loop is in operation. Boron dilution with coolant at boon "concentrations less than required to assure "theSDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and Wag b. Core outlet temperature is maintained at least 1OoF below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

An OPERABLE RCS loop consists of one OPERABLE RCP and one OPERABLE SG in accordance with the Steam Generator Tube Surveillance Program, which has the minimum water level specified in SR 3.4.5.2. An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required.

APPLICABILITY In MODE 3, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing.

The most stringent condition of the LCO, that is, two RCS loops OPERABLE and two RCS loops in operation, applies to MODE 3 with the Rod Control System capable of rod withdrawal. The least stringent condition, that is, two RCS loops OPERABLE and one RCS loop in

,operation, applies to MODE 3 with the Rod Control System not capable of rod withdrawal.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops - MODES 1 and 2";

LCO 3.4.6, "RCS Loops - MODE 4";

LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled";

LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled";

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level" (MODE 6); and LCO 3.9.6, "Residual.Heat Removal (RHR) and Coolant Circulation - Low Water Level" (MODE 6).

(continued)

CALLAWAY PLANT *B3.4.5-3 Revision 3

RCS Loops - MODE 3 B 3.4.5 BASES (continued)

ACTIONS A.1 If one required RCS loop is inoperable, redundancy for heat removal is lost. The Required Action is restoration of the required RCS loop to OPERABLE status within the Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This time allowance is a justified period to be without the redundant, nonoperating loop because a single loop in operation has a heat transfer capability greater than that needed to remove the decay heat produced in the reactor core and because of the low probability of a failure in the remaining loop occurring during this period.

B. 1 If restoration is not possible within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the unit must be brought to MODE 4. In MODE 4, the unit may be placed on the Residual Heat Removal System. The additional Completion Time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is compatible with required operations to achieve cooldown and depressurizatiorn from the existing plant conditions in an orderly manner and without-challenging plant systems.

C.1 and C.2 If the required RCS loop is not in operation, and the Rod Control System is capable of rod withdrawal, the Required Action is either to restore the required RCS loop to operation or to place the Rod Control System in a condition incapable of rod withdrawal (e.g., by de-energizing all CRDMs, by opening the RTBs, or de-energizing the motor generator (MG) sets).

When the Rod Control System is capable'of rod withdrawal, it is postulated that a power excursion could occur in the event of an inadvertent control rod withdrawal. This mandates having the heat transfer capacity of two RCS loops in operation. If only one loop is in operation, the Rod Control System must be rendered incapable of rod withdrawal. The Completion Times of I hour to restore the required RCS loop to operation or defeat the Rod Control System is adequate to perform these operations in an orderly manner without exposing the unit to risk for an undue time period.

D.1, D.2, and D.3 If four' RCS loops are inoperable or no RCS loop is in operation, except as during conditions permitted by the Note in the LCO section, place the Rod Control System in a condition incapable of rod withdrawal (e.g., by de energizing all CRDMs, by opening the RTBs, or de-energizing the MG (continued)

CALLAWAY PLANT B 3.4.5-4 Revision 0

RCS Loops - MODE 3 B 3.4.5 BASES ACTIONS D.1, D.2, and D.3 (continued)

,-sets). All operations involving introduction of coolant, into the RCS, with boron concentration less than required to meet the minimum SDM of LCO

-3.1.1 must be suspended, and action to restore one of the RCS loops to OPERABLE status and operation must be initiated. Boron dilution requires forced circulation for proper mixing, and defeating the Rod Control System removes the possibility of an inadvertent rod withdrawal.

Suspending the introduction of coolant, into the RCS, with boron concentration less than required to meet the minimumi SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin tosubcritical operations.

Introduction of reactor makeup water into the RCS from the Chemical and Volume Control System mixing tee is not permitted when no RCS loop is in operation, consistent with Required Action C.1 of LCO 3.3.9,"Boron Dilution Mitigation System (BDMS)." The immediate Completion Time reflects the importance of maintaining operation for heat removal. The action to restore must be continued until one loop is restored to OPERABLE status and operation.

SURVEILLANCE SR 3.4.5.1 REQUIREMENTS This SR requires verification every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> that the required loops are in operation. Verification may include flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal.

The Frequency of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS loop performance.

SR 3.4.5.2 SR 3.4.5.2 requires verification of SG OPERABILITY.SG OPERABILITY is verified by ensuring that the secondaryside narrow range water level is > 4% for required RCS loops. Ifthe SG secondary side narrow range water level is < 4%, the tubes may become uncovered and the associated loop may not be capable of providing the heat sink for removal of the decay heat. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is considered adequate in view of other indications available in the control room to alert the operator to a loss of SG level.

(continued)

CALLAWAY PLANT SB 3.4.5-5 Revision 3

RCS Loops - MODE 3 B 3.4.5 BASES SURVEILLANCE SR 3.4.5.3 REQUIREMENTS (continued) Verification that the required RCPs are OPERABLE ensures that safety analyses limits are met. The requirement also ensures that an additional RCP can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power availability to the required RCPs.

REFERENCES 1. FSAR Section 15.4.6.

CALLAWAY PLANT B 3.4.5-6 Revision 3

RCS Loops - MODE 4 B 3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.6 RCS Loops - MODE 4 BASES BACKGROUND In MODE 4, the primary function of the reactor coolant is the removal of decay heat and the transfer of this heat to either the steam generator (SG) secondary side coolant or the component cooling water via the residual heat removal (RHR) heat exchangers. The secondary function of

- : the reactor coolant is to act as a carrier for soluble neutron poison, boric "acid.

The reactor coolant is circulated through four RCS loops connected in parallel to the reactor vessel, each loop containing an SG, a reactor coolant pump (RCP), and appropriate flow, pressure, level, and .......

temperature instrumentation for control,'protection, and indication. The RCPs circulate the coolant through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and to prevent boric acid stratification.

In MODE 4, either RCPs or RHR loops can be used to provide forced circulation. The intent of this LCO is to provide forced flow from at least one RCP or one RHR loop for decay heat removal and transport. The flow provided by one RCP loop or RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that two paths be available to provide redundancy for decay heat removal.

APPLICABLE In MODE 4, RCS circulation is considered in the determination of SAFETY the time available for mitigation of the accidental boron dilution event.

A IKl Al ~IV~'=

r%114 L-1 0 The operation of one RCP in MODES 3, 4, and 5 provides adequate flow to ensure mixing, prevent stratification, and produce gradual reactivity changes during RCS boron concentration reductions. The reactivity

-change rate associated with boron reduction will, therefore, be within the transient mitigation capability of the Boron Dilution Mitigation System (BDMS). With no reactor coolant loop in operation in either MODES 3, 4, or 5, boron dilutions must be terminated and dilution sources isolated.

The boron dilution analysis in these MODES takes credit for the mixing volume associated with having at least one reactor coolant loop in operation. LCO 3.3.9, "Boron Dilution Mitigation System (BDMS),"

contains the requirements for the BDMS.

RCS Loops -MODE 4 satisfies Criterion 4 of IOCFR50.36(c)(2)(ii).

(continued)

CALLAWAY PLANT ý, B 3.4.6-1 IRevision 0

RCS Loops-MODE 4 B 3.4.6 BASES (continued)

LCO The purpose of this LCO is to require that at least two loops be OPERABLE in MODE 4 and that one of these loops be in operation. The LCO allows the two loops that are required to be OPERABLE to consist of any combination of RCS loops and RHR loops. Any one loop in'operation provides enough flow to remove the decay heat from the core with forced circulation. An additional loop is required to be OPERABLE to provide redundancy for heat removal.

Note 1 permits all RCPs or RHR pumps to be removed from operation for

< 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> per 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> period. The purpose of the Note is to permit tests that are required to be performed without flow or pump noise. The1 hour time period is adequate to perform the necessary testing, and operating experience has shown that boron stratification is not a problem during this short period with no forced flow.

Utilization of Note 1 is permitted provided the following conditions are met along with any other conditions imposed by test procedures:

a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1, thereby maintaining the margin to criticality. Introduction of reactor makeup water into the RCS from the Chemical and Volume Control System mixing tee is not permitted when no RCS loop is in operation. Boron dilution with coolant at boron concentrations less than required to assure the SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and

b. Core outlet temperature is maintained at least 10oF below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulatioriflow obstruction.

Note 2 requires that the secondary side water temperature of each SG be

< 50oF above each of the RCS cold leg temperatures before the start of an RCP with any RCS cold leg temperature < 275oF. This restraint is to prevent a low temperature overpressure event due to a thermal transient when an RCP is started.

An OPERABLE RCS loop is comprised of an OPERABLE RCP and an OPERABLE SG in accordance with the Steam Generator Tube Surveillance Program, which has the minimum water level specified in SR 3.4.6.2.

(continued)

CALLAWAY PLANT B 3.4.6-2 Revision 3

RCS Loops - MODE 4 B 3.4.6 BASES LCO Similarly for the RHR System, an OPERABLE RHR loop comprises an (continued) OPERABLE RHR pump capable of 1providing forced flow to an

- , OPERABLE RHR heat exchanger. RCPs and RHR pumps are OPERABLE if they are capable of being powered and are able to provide forced flow if required.

APPLICABILITY In MODE 4, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing.

One loop of either RCS or RHR provides sufficient circulation for these purposes., However, two loops consisting of any combination of RCS and RHR loops are required to be OPERABLE to meet single failure considerations.

Operation in other MODES is covered by:

, LCO 3.4.4, "RCS Loops - MODES 1 and 2";

LCO 3.4.5, "RCS Loops - MODE 3";

LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled";

LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled";

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level" (MODE 6); and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level" (MODE 6).

ACTIONS A.1 and A.2 If one required loop is inoperable, redundancy for heat removal is lost.

Action must be initiated to restore a second RCS or RHR loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

The unit must be brought to MODE 5 within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if, as indicated in the Note to Required Action A.2, one RHR loop is OPERABLE. Bringing the unit to MODE 5 is a conservative action with regard to decay heat removal. With only one RHR loop-OPERABLE, redundancy for decay heat removal is lost and, in the event of a loss of the remaining RHR loop, it would be safer toinitiate that loss from MODE 5 (* 20GYF) rather than MODE 4 (200 to 350oF). The Completion Time of 24hours is a reasonable time, based on operating experience, to reach MODE 5 from MODE 4 in an orderly manner and without challenging plant systems.

-ed (continu (continued)

CALLAWAY PLANT B 3.4.6-3 Revision 3

RCS Loops- MODE 4 B 3.4.6 BASES ACTIONS B.1 and B.2 (continued)I If no loop is OPERABLE or in operation, except during conditions permitted by Note 1 in the LCO section, all operations involving introduction of coolant, into the RCS, with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore one RCS or RHR loop to OPERABLE status and operation must be initiated. Boron dilution requires forced circulation from at least one RCP for proper mixing so that inadvertent criticality can be prevented.

Suspending the introduction of coolant, into the RCS, with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.

Introduction of reactor makeup water into the RCS from the Chemical and Volume Control System mixing tee is not permitted when no RCS loop is in operation, consistent with Required Action C.1 of LCO 3.3.9,"Boron Dilution' Mitigation System (BDMS)." The immediate Completion Times reflect the importance of maintaining operation for decay heat removal.

The' action to restore must be continued until one loop is restored to OPERABLE status and operation.

SURVEILLANCE SR 3.4.6.1 REQUIREMENTS This SR requires verification every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> that one RCS or RHR loop is in operation. Verification may include flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. The Frequency of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS and RHR loop performance.

SR 3.4.6.2 SR 3.4.6.2 requires verification of SG OPERABILITY. SG OPERABILITY is verified by ensuring that the secondary side narrow range water level is

> 4% for required RCS loops. If the SG secondary side narrow range water level is < 4%, the tubes may become uncovered and the associated loop may not be capable of providing the heat sink necessary for removal of decay heat. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is considered adequate in view of other indications available in the control room to alert the operator to the loss of SG level.

(continued)

CALLAWAY PLANT B 3.4.6-4 Revision 3

RCS Loops-MODE 4 B 3.4.6 BASES SURVEILLANCE SR 3.4.6.3 REQUIREMENTS (continued) Verification that the required pump is OPERABLE ensures that an additional RCS or RHR pump can be placed in operation, if needed, to

- - maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available the required pump.- The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

REFERENCES 1. FSAR Section 15.4.6.

I ý - - -

-'ICALLAWAY PLANT IB 3.4.6-5 Revision 3

RCS Loops - MODE 5, Loops Filled B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.7 RCS Loops - MODE 5, Loops Filled BASES BACKGROUND In MODE 5 with the RCS loops filled, the primary function of the reactor coolant is the removal of decay heat and transfer of this heat either to the steam generator (SG) secondary side coolant via natural circulation (Ref. 1) or the component cooling water via the residual heat removal (RHR) heat exchangers.. While the principal means for decay heat removal is via the RHR System, the SGs via natural circulation are specified as a backup means for redundancy. Even though the SGs cannot produce steam in this MODE, they are capable of being a heat sink due to their large contained volume of secondary water. As long as the SG secondary side water is at a lower temperature than the reactor coolant, heat transfer will occur. The rate of heat transfer is directly proportional to the temperature difference. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.

In MODE 5 with RCS loops filled, the reactor coolant is circulated by means of two RHR loops connected to the RCS, each loop containing an RHR heat exchanger, an RHR pump, and appropriate flow and temperature instrumentation for control, protection, and indication. One RHR pump circulates the water through the RCS at a sufficient rate to prevent boric acid stratification but is not sufficient for the boron dilution analysis discussed below.

The number of loops in operation can vary to suit the operational needs.

The intent of this LCO is to provide forced flow from at least one RHR loop for decay heat removal and transport. The flow provided by one RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that a second path be available to provide redundancy for heat removal. .-.

The LCO provides for redundant paths of decay heat removal capability.

The first path can be an RHR loop that must be OPERABLE and in operation. The second path can be another OPERABLE RHR loop or maintaining two SGs with secondary side wide range water levels above 66% to provide an alternate method for decay heat removal via natural circulation.

(continued)

"I CALLAWAY PLANT B 3.4.7-1 Revision 0

RCS Loops - MODE 5, Loops Filled "B 3.4.7 BASES (continued)

-APPLICABLE In MODE 5, RCS circulation is considered in the determination of the time SAFETY available for mitigation of the accidental boron dilution event.

ANALYSES .

The operation of one RCP in MODES 3, 4, and 5 provides adequate flow "toensure mixing, prevent stratification, and produce gradual reactivity changes during RCS boron concentration reductions. The reactivity change rate associated with boron reduction will, therefore, be within the transient mitigation capability of the Boron Dilution Mitigation System (BDMS). With no reactor coolant loop in operation in either MODES 3, 4, or 5, boron dilutions must be terminated and dilution sources isolated.

The boron dilution analysis in these MODES takes credit for the mixing volume associated with having at least one reactor coolant loop in

- - operation. LCO 3.3.9,,"Boron Dilution Mitigation System (BDMS),"

contains the requirements for the BDMS.

RCS Loops - MODE 5 (Loops Filled) satisfies Criterion 4 of 10CFR50.36(c)(2)(ii).

LCO The purpose of this LCO is to require that at least one of the RHR loops be OPERABLE and in operation with an additional RHR loop OPERABLE or two SGs with secondary side wide range water level > 66%. As shown in Reference 3, any narrow range level indication above 4% will ensure the SG tubes are covered. One RHR loop provides sufficient forced circulation to perform the safety functions of the reactor coolant under these conditions. An additional RHR loop is required to be OPERABLE to meet single failure considerations. However, if the standby RHR loop is not OPERABLE, an acceptable alternate method is two SGs with their secondary side wide range water levels;> 66%. Should the operating RHR loop fail, the SGs could be used to remove the decay heat via natural circulation.

Note 1 permits all RHR pumps to be removed from operation _<1 hour per 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> period. The purpose of the Note is to permit tests that are required to be performed without flow or pump noise. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> time period is adequate to perform the necessary testing, and operating experience has shown that boron stratification is not likely during this short period with no forced flow. .. I Utilizati6n of Note 1 is permitted provided th" following conditions are met, along with any other conditions imposed by test procedures:

(continued)

.CALLAWAY PLANT B 3.4.7-2 Revision 0

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES (continued)

LCO a. No operations are permitted that would dilute the RCS boron (continued), concentration with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1, thereby maintaining the margin to criticality. Introduction of reactor makeup water into the RCS from the Chemical and Volume Control System mixing tee is not permitted when no RCS loop is in operation. Boron dilution with coolant at boron concentrations less than required to assure the SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and

b. Core outlet temperature is maintained at least 10oF below saturation temperature,' so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

Note 2 allows one RHR loop to be inoperable for a period of up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, provided that the other RHR Ioop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when such testing is safe and possible.

Note 3 requires that the secondary side water temperature of each SG be

< 50oF above each of the RCS cold leg temperatures before the start of a reactor coolant pump (RCP) with any RCS cold leg temperature< 275oF.

This restriction is to prevent a low temperature overpressure event due to a thermal transient when an RCP is started.

Note 4 provides for an orderly transition from MODE 5 to MODE 4 during a plarined heatup by permitting removal of RHR loops from operation when at least one RCS loop is in operation. This Note provides for the transition to MODE 4 where an RCS loop is permitted to be in operation and replaces the RCS circulation function provided by the RHR loops.

RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. An OPERABLE SG can perform as a heat sink via natural circulation when it has an adequate water level and is OPERABLE in accordance with the Steam Generator Tube Surveillance Program.

APPLICABILITY In MODE 5 with RCS loops filled, this LCO requires forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. One loop of RHR provides sufficient circulation for these purposes. However, one additional RHR loop is required to be OPERABLE, or the secondary side wide range water level of at least two SGs is required to be > 66%.

(continued)

CALLAWAY PLANT B 3.4.7-3 Revision 3

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES (continued)

APPLICABILITY Operation in other MODES is covered by:

(co ntinu ed ) -a n LCO 3.4.4, "RCS Loops - MODES 1and 2";

LCO 3.4.5, "RCS Loops - MODE 3";

LCO 3.4.6, "RCS Loops - MODE 4";

LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled";

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level" (MODE 6); and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level" (MODE 6).

ACTIONS A.1 and A.2 If one.RHR loop is inoperable and the required SGs have secondary side wide range water levels < 66%, redundancy for heat removal is lost.

Action must be initiated immediately to restore a second RHR loop to OPERABLE status or to restore the required SG secondary side water levels. Either Required Action A.1 or Required Action A.2 will restore redundant heat removal paths. -The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

B.1 and B.2 If no RHR loop is in operation, except during conditions permitted by Notes 1 and 4, or if no loop is OPERABLE, all operations involving introduction of coolant, into the RCS, with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore one RHR loop to OPERABLE status and operation must be initiated. JTo prevent inadvertent criticality during a boron dilution, forced circulation from at least one RCP is required to provide proper mixing. Suspending the introduction of coolant, into the RCS, with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin tosubcritical operations.

Introduction of reactor makeup water into the RCS from the Chemical and

..-Volume Control Systemmixing tee is not permitted when no RCS loop is in operation, consistent with Required Action C.1 of LCO 3.3.9,"Boron Dilution Mitigation System (BDMS)." The immediate Completion Times reflect the importance of maintaining operation for heat removal.

(continued)

CALLAWAY PLANT B 3.4.7-4 Revision 3

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES (continued)

SURVEILLANCE SR 3.4.7.1 REQUIREMENTS This SR requires verification every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> that the required loop is in operation. Verification may include flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal.

The Frequency of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is sufficient considering other indications and alarms available to the operator in the control room to monitor RHR loop performance.

SR 3.4.7.2 Verifying that at least two SGs are OPERABLE by ensuring their secondary side wide range water levels are> 66% ensures an alternate decay heat removal method is available via natural circulation in the event that the second RHR loop is not OPERABLE. As shown in Reference 3, any narrow range level indication above 4% will ensure the SG tubes are covered. If both RHR loops are OPERABLE, this Surveillance is not needed. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is considered adequate in view of other indications available in the control room to alert the operator to the loss of SG level.

SR 3.4.7.3 Verification that a second RHR pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the RHR pump.

If secondary side wide range water level is ->66% in at least two SGs, this Surveillance is not needed. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

REFERENCES 1. NRC Information Notice 95-35, "Degraded Ability of SGs to Remove Decay Heat by Natural Circulation."

2. FSAR Section 15.4.6.

3. TDB-001, "Tank Data Book, Steam Generators EBB01 (A,B,C,D)."

CALLAWAY PLANT B 3.4.7-5 Revision 3

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)

"B3.4.8 RCS Loops - MODE 5, Loops Not Filled BASES "BACKGROUND In MODE 5 with the RCS -loops not filled, the primary function of the reactor coolant is the removal of decay heat generated in the fuel, and the transfer of this heat to the component cooling water via the residual heat removal (RHR) heat exchangers. The steam generators (SGs) are not available as a heat sink when the loops are not filled. The secondary function of the reactor coolant is to act as a carrier for the soluble neutron poison, boric acid. I In MODE 5 with loops not filled, only RHR pumps can be used for coolant circulation. The numberof pumps in operation can vary to suit the operational needs.- -The intent of this LCO is to provide forced flow from at

,least one RHR pump for decay heat removal and transport and to require that two paths be available to provide redundancy for heat removal.

-APPLICABLE -In MODE 5, RCS circulation is considered in the determination of the time SAFETY available for mitigation of the accidental boron dilution event. The flow ANALYSES provided by one RHR loop is adequate for decay heat removal.

The operation of one RCP in MODES 3, 4, and 5 provides adequate flow to ensure mixing, prevent stratification, and produce gradual reactivity changes during RCS boron concentration reductions. The reactivity change rate associated with boron reduction will, therefore, be within the transient mitigation capability of the Boron Dilution Mitigation System (BDMS). With no reactor coolant loop in operation in either MODES 3, 4, or 5, boron dilutions must be terminated and dilution sources isolated.

The boron dilution analysis in these MODES takes credit for the mixing volume associated with having at least one reactor coolant loop in operation.-, LCO 3.3.9, "Boron Dilution Mitigation System (BDMS),"

contains the requirements for~the BDMS.

RCS loops in MODE 5 (loops not filled) satisfies Criterion 4 of 10CFR50.36(c)(2)(ii).

LCO - The purpose of this LCO is to require that at least two RHR loops be OPERABLE and one of these loops be in operation. An OPERABLE loop is one that has the capability of transferring heat from the reactor coolant at a controlled rate. Heat cannot be removed via the RHR System unless forced flow is used. A minimum of one running RHR pump meets the

"(continued)

CALLAWAY PLANT "-,B 3.4.8-11 I.Revision 0

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES LCO LCO requirement for one loop in operation. An additional RHR loop is (continued) required to be OPERABLE to meet single failure considerations.

Note 1 permits all RHR pumps to be removed from operation for< 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

The circumstances for stopping both RHR pumps are to be limited to situations when the outage time is short and core outlet temperature is maintained at least 10oF below saturation temperature. The Note prohibits boron dilution with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1 is maintained or draining operations when RHR forced flow is stopped. Introduction of reactor makeup water into the RCS from the Chemical and Volume Control System mixing tee is not permitted when no RCS loop is in operation.

Note 2 allows one RHR loop to be inoperable for a period of< 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, provided that the other loop is OPERABLEand in-operationr This permits periodic surveillance tests to be performed on the inoperable loop during the only time when these tests are safe and possible.

An OPERABLE RHR loop is comprised of an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger.

RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. '

APPLICABILITY In MODE 5 with loops not filled, this LCO requires core heatremoval and coolant circulation by the RHR System.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops - MODES 1 and 2";

LCO 3.4.5, "RCS Loops - MODE 3";

LCO 3.4.6, "RCS Loops - MODE 4";,

LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled"; ..

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant

. Circulation - High Water Level" (MODE 6); and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level" (MODE 6).

The Applicability is modified by a Note stating that entry into MODE 5 with RCS loops not filled from MODE 5 with RCS loops filled is not permitted while LCO 3.4.8 is not met. This Note specifies an exception to LCO 3.0.4 and would prevent draining the RCS, which would eliminate the possibility of SG heat removal, while the RHR function was degraded.

(continued)

CALLAWAY PLANT B 3.4.8-2 Revision 3

,- RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES (continued)

ACTIONS A.1 If only one RHR loop is OPERABLE and in operation, redundancy for

- RHR is lost. Action must be initiated to restore a second loop to OPERABLE status., The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

B.1 and B.2 If no required RHR loops are OPERABLE or in operation, except during conditions permitted by Note 1, all operations involving introduction of coolant, into the RCS, with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action must be initiated immediately to restore an RHR loop~to OPERABLE status and operation. Boron dilution requires forced circulation from at least one RCP for proper mixing so that inadvertent criticality can be prevented. Suspending the introduction of coolant, into the RCS, with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.

Introduction of reactor makeup water into the RCS from the Chemical and Volume Control System mixing tee is not permittedwhen the RCS loops are not filled or when no RCS loop is in operation, consistent with Required Action C.1 of LCO 3.3.9, "Boron Dilution Mitigation System (BDMS)." The immediate Completion Time reflects the importance of maintaining operation for heat removal. The action to restore must continue until one loop is restored to OPERABLE status and operation.

--SURVEILLANCE SR 3.4.8.1 REQUIREMENTS This SR requires verification every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> that one loop is in operation.

Verification may include flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal.

The Frequency of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is sufficient considering other indications and alarms available to the operator in the control room to monitor RHR loop performance.

SR 3.4.8.2 Verification that a second RHR pump is OPERABLE ensures'that an additional pump can be placed in operation, if needed, to mihntain decay (continued)

CALLAWAY PLANT B 3.4.8-3  ;,Revision 3

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES SURVEILLANCE SR 3.4.8.2 (continued)

REQUIREMENTS heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the RHR pump.

The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

REFERENCES 1. FSAR Section 15.4.6.

CALLAWAY PLANT B 3.4.8-4 Revision 3

Pressurizer B 3.4.9 BASES BACKGROUND- undervoltage signal and manually sequenced back onto the Class 1E (continued) 4.16-kV buses.

APPLICABLE- In MODES 1, 2,"and 3, the' LCO requirement for a steam bubble is SAFETY reflected implicitly in the accident analyses. Safety analyses performed ANALYSES for lower MODES are not limiting. All analyses performed from a critical reactor condition assume the existence of a steam bubble and saturated conditions in the pressurizer.. In making this assumption, the analyses neglect the small fraction of noncondensible gases normally present.

Safety analyses presented in the FSAR (Ref. 1) do not take credit for pressurizer heater operation; howdver, an implicit initial condition assumption of the safety analyses is 'that the RCS is operating at normal Spressure.

The maximum pressurizer water level limit, which ensures that a steam bubble exists in the pressurizer, satisfies Criterion 2 of 10CFR50.36(c)(2)(ii). Although the heaters are not specifically used in accident analysis, the need to maintain subcooling in the long term during loss of offsite power, as indicated in NUREG-0737 (Ref. 2), is the reason for providing an LCO.

LCO The LCO requirement for the pressurizer to be OPERABLE with a water volume _<1657 cubic feet, which is equivalent to 92%, ensures that a steam bubble exists. Limiting the LCO maximum operating water level preserves the steam space for pressure, control. The LCO has been

.established to ensure the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpressure transients. Requiring the presence of a steam bubble is also con'sistent with analytical assumptions.

The LCO requires two groups of OPERABLE backup pressurizer heaters, each with a capacity ;, 150 kW, capable of being powered from either the offsite power source or the emergency power supply. The minimum heater capacity required is sufficient to maintain the RCS near normal operating pressure when accounting for heat losses through the pressurizer insulation. By maintaining the pressure near the operating conditions, a wide margin to subcooling can be obtained in the loops.

The backup pressurizer heaters may be controlled from either the main control board or the auxiliary shutdown panel.

(continued)

SCALLAWAY PLANT B 3.4.9-2 Revision 3

Pressurizer B 3.4.9 BASES (continued)

APPLICABILITY The need for pressure control is most pertinent when core heat'can cause the greatest effect on RCS temperature, resulting in the greatest effect on pressurizer level and RCS pressure control. Thus, applicability has been designated for MODES I and 2. The applicability is also provided for MODE 3. The purpose is to prevent solid water RCS operation'during heatup and cooldown to avoid rapid pressure rises caused by normal operational perturbation, such as reactor coolant pump startup.

In MODES 1, 2, and 3, there is the need to maintain the availability of pressurizer heaters, capable of being powered from either the offsite power source or the emergency power supply. In the event of a loss of offsite power, the initial conditions of these MODES give the greatest demand for maintaining thie RCS in a hot pressurized condition with loop subcooling for an extended period. For MODE 4, 5, or 6, it is not necessary to control pressure (by heaters) to ensure loop subcooling for heat transfer when the Residual Heat Removal (RHR) System is in service, and therefore, the LCO is not applicable.

ACTIONS A. 1 A.2, A.3, and A.4 Pressurizer water level control malfunctions or other plant evolutions may result in a pressurizer water level above the nominal upper limit, even with the plant at steady state conditions. Normally the plant will trip in this event since the upper limit of this LCO is the same as the Pressurizer Water Level - High Trip.

If the pressurizer water level is not within the limit, action must be taken to bring the plant to a MODE in which the LCO does not apply. To achieve this status, within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> the unit must be brought to MODE 3, with all rods fully inserted and incapable of withdrawal (e.g., by de-energizing all CRDMs, by opening the RTBs, or de-energizing the motor generator (MG) sets). Additionally, the unit must be brought to MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. This takes the unit out of the applicable MODES.

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

B.1 If one required group of backup pressurizer heaters is inoperable, restoration is required within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is reasonable considering the anticipation that a demand caused by loss (continued)

CALLAWAY PLANT BJ 3.4.9-3 Revision 0

ECCS - Operating B 3.5.2 BASES I BACKGROUND available, the Engineered Safety Feature (ESF) buses shed selected (continued) loads and are connected to the emergency diesel generators (EDGs).

Safeguard loads are then actuated in the programmed time sequence.

The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required before pumped flow is available to the core following a LOCA.

The active ECCS components, along with the passive accumulators and the RWST covered in LCO 3.5.1, "Accumulators," and LCO 3.5.4, "Refueling Water Storage -Tank (RWST)," provide the cooling water necessary to meet GDC 35 (Ref. 1).

APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY-. ECCS, established by 10 CER 50.46 (Ref. 2), will be met following a ANALYSES LOCA:

a. Maximum fuel element cladding temperature is < 2200°F;

b. Maximum cladding oxidation is <0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding-the plenum volume, were to react;

d. Core is maintained in a coolable geometry; and

e. Adequate long term core cooling capability is maintained.

The LCO also limits the potential for a post trip return to power following an MSLB event and ensures that containment temperature limits are met.

'Each ECCS subsystem is taken credit for in a large break LOCA event at full power (Refs. 3 and 4). This~event establishes the requirement for runout flow for the ECCS pumps, as well as the maximum response time for their actuation. The centrifugal charging pumps and SI pumps are credited in a small break LOCA event. This event establishes the flow and discharge head at the design point for the centrifugal charging pumps. The SGTR and MSLB events also credit the centrifugal charging pumps. The OPERABILITY requirements for the ECCS are based on the following LOCA analysis assumptions:

(continued)

- CALLAWAY PLANT t .13 3.5.2-3 -I! Revision 0

ECCS - Operating B 3.5.2 BASES APPLICABLE a. A large break LOCA event, with a loss of offsite power and a SAFETY single failure disabling one' ECCS train; and ANALYSES (continued) b. A small break LOCA event, with a loss of offsite power and a single failure disabling one ECCS train.

During the blowdown stage of a LOCA, the RCS depressurizes as primary coolant is ejected through the break into the containment. The nuclear reaction is terminated either by moderator voiding during large breaks or control rod insertion for small breaks. Following depressurization, emergency core cooling water is injected into the cold legs, flows into the downcomer, fills the lower plenum, and refloods the core.

The effects on containment mass and energy releases are accounted for in appropriate analyses (Refs. 3 and 4). The LCO ensures that an ECCS train will deliver sufficient water to match boiloff rates soon enough to minimize the consequences of the core being uncovered following a large LOCA. It also ensures that the centrifugal charging and SI pumps will deliver sufficient water and boron during a small LOCA to maintain core subcriticality. For smaller LOCAs, the centrifugal charging pump delivers sufficient fluid to maintain RCS inventory. For a small break LOCA, the steam generators continue to serve as the heat sink, providing part of the required core cooling.

The safety analyses make assumptions with respect to: (1) both the maximum and minimum total system resistance; (2) both the maximum and minimum branch injection line resistance; and (3) the maximum and minimum ranges of potential pump performance. These resistances and ranges of pump performance are used to calculate the maximum and minimum ECCS flows assumed in the safety analyses.

The CCP minimum flow SR in FSAR Section 16.5 provides the absolute minimum injected flow (at zero RCS pressure) assumed in the safety analyses (305.25 gpm). The maximum total system resistance defines the range of minimum flows (including the minimum flow SR), with respect to pump head, that is assumed in the safety analyses. Therefore, the CCP total system resistance ([Pd + (Zd -ZRCS)]/QI) must not be 2

greater than 1.004E-02 ft/gpm , where Pd is pump discharge pressure in feet, Zd is the pump discharge elevation in feet, ZRCS is RCS water level elevation in feet, and Qd is the total pump flow rate in gpm.

The SI pump minimum flow SR in FSAR Section 16.5 provides the absolute minimum injected flow (at zero RCS pressure) assumed in the (continued)

CALLAWAY PLANT B 3.5.2-4 Revision 3

ECCS - Operating B 3.5.2 BASES APPLICABLE- safety analyses (455.6 gpm). The maximum total system resistance SAFETY *. defines the range of minimum flows, with respect to pump head, that is ANALYSES assumed in the safety analyses. Therefore, the safety injection pump (continued) total system resistance ((Pd-PRcs)/Qd 2) must not be greater than 0.423E-02 ft/gpm 2, where Pd is pump discharge pressure in feet, PRCS is RCS pressure in feet, and Qd is the total pump flow rate in gpm.

The CCP maximum total pump flow SR in FSAR Section 16.5 ensures the maximum injection flow limit of 550 gpm is not exceeded. This value of flow is comprised of the total flow to the four branch lines of 461gpm and a seal injection flow of 87 gpm plus 2 gpm for instrument uncertainties. A

-best estimate increase of 17 gpm when aligned in the recirculation phase

• (maximum flow of 567 gpm) is discussed in References 8 and 9.

The SI pump maximum total pump flow SR.in FSAR Section 16.5 ensures the maximum injection flow limit of 675 gpm is not exceeded. This value of flow includes a nominal 30 gpm of mini-flow. A best estimate increase of 16 gpm when aligned in the recirculation phase (maximum flow of 691 gpm) is discussed in References 8 and 9.

The test procedure places requirements on instrument accuracy (20 inches of water column for the charging branch lines and 10 inches of water column for the safety injection branch lines) and setting tolerance (30 inches of water column for both the charging and safety injection branch lines) such that branch line flow imbalance remains within the assumptions of the safety analyses.

The maximum and minimum potential pump performance curves, in conjunction with the maximum and minimum flow SRs, the maximum total system resistance, and the test procedure requirements, ensure that the assumptions of the safety analyses remain valid.

The surveillance flow and differential pressure requirements are the Safety Analysis Limits and do not include instrument uncertainties. These instrument uncertainties will be accounted for in the surveillance test procedure to assure that the Safety Analysis Limits are met.

The ECCS trains satisfy Criterion 3,of 10CFR50.36(c)(2)(ii).

- LC0 ln MODES 1, 2, and 3, two independent (and redundant) ECCS trains are required to ensure that sufficient ECCS flow is available, assuming a single failure affecting either train. Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents.

(continued)

CALLAWAY PLANT ý B 3.5.2-5 Revision 3

ECCS - Operating B 3.5.2 BASES LCO In MODES 1, 2, and 3, an ECCS train consists of a centrifugal charging (continued) subsystem, an SI subsystem, and an RHR subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an SI signal and automatically transferring suction to the containment sump.

During an event requiring ECCS actuation, a flow path is required to provide an'abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the four cold leg injection nozzles., Either of the CCPs may be considered OPERABLE with its associated discharge to RCP seal throttle valve, BGHV8357A or BGHV8357B, inoperable. In the long term,- the injection flow path may be switched to take its supply from the containment sump and to supply its flow to the RCS hot and cold legs.

~.i3 During cold leg recirculation operation, the flow path for each train must maintain its designed independence to ensure that no single failure can disable both ECCS trains.

As indicated in Note 1, the SI flow paths may be isolated for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> in MODE 3, under controlled conditions, to perform pressure isolation valve testing per SR 3.4.14.1. The flow paths are readily restorable from the control room.

As indicated in Note 2, operation in MODE 3 with ECCS pumps made incapable of injecting, pursuant to LCO 3.4.12, "Cold Overpressure Mitigation System (COMS)," is allowed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> or until the temperature of all RCS cold legs exceeds 375 0 F, whichever comes first.

LCO 3.4.12 requires that certain pumps be rendered incapable of injecting at and below the COMS arming temperature and time is needed to restore the pumps to OPERABLE status.

APPLICABILITY In MODES 1, 2, and 3, the ECCS OPERABILITY requirements for the limiting Design Basis Accident, a large break LOCA, are based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirementsý in the lower MODES.' The centrifugal charging pump performance is based on a small break LOCA, which establishes the pump performance curve and has less dependence on power (minimum ECCS large break LOCA assumes the same CCP flow rates as the small break LOCA analysis). The SI pump performance requirements are based on a small break LOCA. MODE 2 and MODE 3 requirements are bounded by the MODE 1 analysis.

This LCO is only applicable in MODE 3 and above. The SI signals on low pressurizer pressure and low steam line pressure may be blocked (continued)

CALLAWAY PLANT B 3.5.2-6 Revision 3

ECCS - Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.5 and SR 3.5.2.6 (continued)

REQUIREMENTS receipt of an actual or simulated RWST Level Low-Low-1 Automatic Transfer signal coincident with an SI signal. In addition to testing that automatic function, SR 3.5.2.5 demonstrates that the RWST to RHR pump suction isolation valves (BNHV8812A/B) are capable of automatic closure after the EJHV8811A/B valves are fully open. The valve interlock functions are depicted in Reference 10. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage and the potential for unplanned plant transients if the Surveillances were performed with the reactor at power.

The 18 month Frequency is also acceptable based on consideration of

-

• thie design reliability (and confirming operating experience) of the ..... -..

• equipment. The actuation logic is tested as part of ESF Actuation System testing, and equipment performance is monitored as part of the Inservice Testing Program.

SR 3.5.2.7 The correct position of throttle valves in the flow path is necessary for proper ECCS performance. These valves have mechanical stops to allow proper positioning for restricted flow to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. The

-18 month Frequency is based on the same reasons as those stated in SR 3.5.2.5 and SR 3.5.2.6. . TheECCS throttle valves are set to ensure proper flow resistance and pressure drop in the piping to each injection point in the event of a LOCA. Once set, these throttle valves are secured with locking devices and mechanical position stops. These devices help "toensure that the following safety analyses assumptions remain valid:

(1) both the maximum and minimum total system resistance; (2) both the maximum and minimum branch injection line resistance; and (3) the maximum and minimum ranges of potential pump performance. These resistances and pump performance ranges are used to calculate the maximum and minimum ECCS flows assumed in the LOCA analyses of Reference 3.

SR 3.5.2.8 Periodic inspections of the containment sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage, on the need to have access to the location, and because of the potential for an unplanned transient if the (continued)

- .. CALLAWAY"PLANT IB 3.5.2-11 -K - Revision 1

ECCS - Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.8 (continued)

REQUIREMENTS Surveillance were performed with the reactor at power. This Frequency has been found to be sufficient to detect abnormal degradation and is confirmed by operating experience.

REFERENCES 1. 10 CFR 50, AppendixA, GDC 35.

2. 10 CFR 50.46.

3. FSAR, Sections 6.3 and 15.6.

4. FSAR, Chapter 15, "Accident Analysis."

5. NRC Memorandum to V. Stello, Jr., from R. L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

6. IE Information Notice No. 87-01.

7. RFR-14801A.

8. ULNRC-2535 dated 12-18-91 (for SI and RHR pumps) and ULNRC-04583 dated 12-13-01 (for CCPs).

9. OLAmendment No. 68 dated 3-24-92 (for SI and RHR pumps and OL Amendment No. 150 dated 5-2-02 (for CCPs).

10. FSAR Figure 7.6-3.

CALLAWAY PLANT B 3.5.2-12 Revision 3

RWST B 3.5.4 BASES SURVEILLANCE SR 3.5.4.2 (continued)

REQUIREMENTS is normally stable and is protected by a low level alarm set above the required water volume, a 7 day Frequency is appropriate and has been shown to be acceptable through operating experience.

SR 3.5.4.3 The boron concentration of the RWST should be verified every 7 days to be within the required limits. This SR ensures that the reactor will remain subcritical following a LOCA. Further, it assures that the resulting sump pH will be maintained in an acceptable range so that boron precipitation in the core will not occur and the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized.

Since the RWST volume is normally stable, a 7 day sampling Frequency to verify boron concentration is appropriate and has been shown to be acceptable through operating experience.

_REFERENCES 1. FSAR, Chapter 6 and Chapter 15.

2. RFR-17070A.

3. . FSAR Section 6.2.1.5 and Table 15.6-11.

CALLAWAY PLANT -B 3.5.4-6 -Revision 0

Seal Injection Flow B 3.5.5 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.5 Seal Injection Flow BASES BACKGROUND This LCO is applicable to Callaway since the plant utilizes the centrifugal charging pumps for safety injection (SI). The function of the seal injection throttle valves during an accident is similar to the function of the ECCS throttle valves in that each restricts flow from the centrifugal charging pump header to the Reactor Coolant System (RCS).

The restriction on reactor coolant pump (RCP) seal injection flow limits the amount of ECCS flow that would be diverted from the injection path following an accident. This limit is based on safety analysis assumptions that are required because RCP seal injection' flow is not isolated during SI.

APPLICABLE All ECCS subsystems are taken credit for in the large break loss of SAFETY coolant accident (LOCA) at full power (Ref. 1). The LOCA analysis ANALYSES establishes the minimum flow for the ECCS pumps. The centrifugal charging pumps are also credited in the small break LOCA analysis. This analysis establishes the flow and discharge head at the design point for the centrifugal charging pumps. The safety analyses make assumptions with respect to: (1) both the maximum and minimum total system resistance; (2) both the maximum and minimum branch injection line resistance; and (3) the maximum and minimum ranges of potential pump performance. These resistances and ranges of pump performance are used to calculate the maximum and minimum ECCS flows assumed in the safety analyses. The CCP maximum total pump flow SR in FSAR Section 16.5 ensures the maximum injection flow limit of 550 gpm is not exceeded. This value of flow is comprised of the total flow to the four branch lines of 461 gpm and a seal injection flow of 87gpm plus 2 gpm I for instrument uncertainties. The Bases for LCO 3.5.2, "ECCS Operating," contain additional discussion on the safety analyses. The steam generator tube rupture and main steam line break event analyses also credit the centrifugal charging pumps, but are not limiting in their design. Reference to these analyses is made in assessing changes to the Seal Injection System for evaluation of their effects in relation to the acceptance limits in these analyses.

This LCO ensures that seal injection flow will be sufficient for RCP seal integrity but limited so that the ECCS trains will be capable of delivering sufficient water to match boiloff rates soon enough to minimize uncovering of the core following a large LOCA. It also ensures that the centrifugal charging pumps will deliver sufficient water for a small break (continued)

CALLAWAY PLANT B 3.5.5-1 Revision 3

Seal Injection Flow B 3.5.5 BASES APPLICABLE LOCA and sufficient boron to maintain the core subcritical. For smaller SAFETY, LOCAs, the centrifugal charging pumps alone deliver sufficient fluid to ANALYSES overcome the loss and maintain RCS inventory. Seal injection flow (continued) satisfies Criterion 2 of 10CFR50.36(c)(2)(ii).

LCO The intent of the LCO limit on seal injection flow is to make sure that flow through the RCP seal water injection line is low enough to ensure that sufficient centrifugal charging pump injection flow is directed to the RCS via the injection points (Ref. 2).

The LCO is not strictly a flow limit, but rather a flow limit based on a flow line resistance. In order to establish the proper flow line resistance, a pressure and flow must be known- The flow line resistanbe is established by adjusting the RCP seal water injection throttle yalves such that the analyzed ECCS flow to the RCP seals is limited to 89 gpm with one centrifugal charging pump (CCP) operating at 550 gpm on its maximum pump curve. ýThis accident analysis limit is met by positioning the valves so that the flow to the RCP seals is within the limits of Technical Specifications Figure 3.5.5-1 for a given differential pressure between the

-charging pump discharge header and the RCS pressurizer steam space pressure. The s'eal injection flow curve is presented with the pressure difference from BGPT0120 to the pressurizer steam space pressure as a function of total seal injection line flow. A flow measurement instrument uncertainty of 0.25 gpm per loop was accounted for in the calculation of the pressure drop from BGPI0120 to the seal injection connection. In addition, 2 psid is added to accommodate instrument uncertainty in the pressure drop measurement. An additional 4 psid has been conservatively added to the required pressure differential to allow for seal injection filter change out. Requiring as an initial condition that the filter used for each surveillance have a differential pressure less than or equal to 4 psid allows for post-surveillance filter change out with no differential pressure restriction.- Once set, these throttle valves are secured with locking devices and mechanical position stops. These devices help to ensure that the following safety analyses assumptions remain valid:

(1) both the maximum and minimum total system resistance; (2) both the maximum and minimum branch injection line resistance; and (3) the maximum and minimum ranges of potential pump performance. These resistances and pump performance ranges are used to calculate the maximum and minimum ECCS flows assumed in the LOCA analyses of Reference 1. The centrifugal charging pump discharge header pressure remains-essentially constant through all the applicable MODES of this LCO. A reduction in RCS pressure would result in more flow being diverted to the RCP seal injection line than at normal operating pressure.

The valve settings established at the prescribed differential pressure

.result in a conservative valve position should RCS pressure decrease.

(continued)

CALLAWAY PLANT "ý B 3.5.5-2 5 Revision 3

Seal Injection Flow B 3.5.5 BASES LCO The limit on seal injection flow must be met to render the ECCS (continued) OPERABLE. If these conditions are not met, the ECCS flow will not be as assumed in the accident analyses.

APPLICABILITY In MODES 1, 2, and 3, the seal injection flow limit is dictated by ECCS flow requirements, which are specified for MODES 1, 2, 3, and 4. The seal injection flow limit is not applicable for MODE 4 and lower, however, because high seal injection flow is less critical as a result of the lower initial RCS pressure and decay heat removal requirements in these MODES. Therefore, RCP seal injection flow must be limited in MODES 1, 2, and 3 to ensure adequate ECCS performance.

ACTIONS A.1 . - I-II- ,m* ,l' With the seal injection flow exceeding its limit, the amount of charging flow available to the RCS may be reduced.' Under this Condition, action must be taken to restore the flow to below its limit. The operator has 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from the time the flow is known to be above the limit to correctly position the manual seal injection throttle valves and thus be in compliance with the accident analysis. The Completion Time minimizes the potential exposure of the' plant to a LOCA with insufficient injection flow and provides a reasonable time to restore seal injection flow within limits. This time is conservative with respect to the Completion Times of other ECCS LCOs; it is based on operating experience and is sufficient for taking corrective actions by operations personnel.

B.1 and B.2 When the Required Action cannot be completed within the required Completion Time, a controlled shutdown must be initiated. The

,Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> for reaching MODE 3 from MODE 1 is a reasonable time for a controlled shutdown, based on operating experience and normal cooldown rates, and does not challenge plant safety systems or operators. Continuing the plant shutdown begun in Required Action B.1, an additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is a reasonable time, based on operating experience and normal cooldown rates, to reach MODE 4 where this LCO is no longer applicable.

SURVEILLANC E SR 3.5.5.1 REQUIREMEN TS Verification every 18 months that the mdnual seal injection throttle valves are adjusted to give a flow within the limit ensures that proper manual*-

seal injection throttle valve position, and hence, proper seal injection flow, CALLAWAY PLANT B 3.5.5-3 -Revision 3

Seal Injection Flow B 3.5.5 BASES SURVEILLANCE SR 3.5.5.1 (continued)

REQUIREMENTS is maintained. The seal water injection throttle valves are set to ensure proper flow resistance and pressure drop in the piping to each injection point in the event of a LOCA. The seal injection flow line resistance is established by adjusting thie RCP seal water injection throttle valves such that the analyzed ECCS flow to the RCP seals is limited to 89 gpm with one centrifugal charging pump (CCP) operating at 550 gpm on its maximum pump curve. This accident analysis limit is met by positioning the valves so that the flow to the RCP seals is within the limits of Technical Specifications Figure 3.5.5-1 for a given differential pressure between the charging pump discharge header and the RCS pressurizer steam space pressure. The seal injection flow curve is presented with the pressure difference from BGTP0120 to the pressurizer steam space

-. ,. - *pressure as a function of total seal injection line flow. A flow - ..

measurement instrument uncertainty of 0.25 gpm per loop was accounted for in the calculation of the pressure drop from BGPT0120 to the seal injection connection. In addition, 2 psid is added to accommodate instrument uncertainty in the pressure drop measurement. An additional 4 psid has been conservatively added to the required pressure differential to allow for seal injection filter change out. Requiring as an initial condition that the filter used for each surveillance have a differential pressure less than or equal to 4 psid allows for post-surveillance filter change out with no differential pressure restriction.

Once set, these throttle valves are secured with locking devices and mechanical position stops. The Frequency of 18 months is based on engineering judgment and the controls placed on the positioning of these valves. The Frequency has proven to be acceptable through operating experience.

As noted, the Surveillance is not required to be performed until 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the RCS pressure has stabilized within a +/-20 psig range of normal -.

operating pressure. The RCS pressure requirement is specified since this configuration will produce the required pressure conditions necessary to assure that the manual seal injection throttle valves are set correctly. The exception is limited to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to ensure that the Surveillance is timely.

REFERENCES 1. FSAR, Sections 6.3 and 15.6.5.

2. 10 CFR 50.46.

CALLAWAY PLANT B 3.5.5-4 Revision 3

AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.1 (continued)

REQUIREMENTS

-mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control.

This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves and relief valves. Additionally, vent and drain valves are not within the scope of this SR.

This SR is modified by a Note indicating that the SR is not required to be performed for the AFW flow control valves until the AFW system is placed in automatic control or when Thermal Power is above 10% RTP.

In order for the TDAFP and MDAFPs to be OPERABLE while the AFW system is in automatic control or above 10% RTP, the discharge flow

.control valves;(ALHV0005, 6, 7, 8, 9, 10, 11, and 12) shall be in the full open position. The TDAFP and MDAFPs remain OPERABLE with the discharge flow control valves throttled to maintain steam generator levels during plant heatup, cooldown, or if started due to an Auxiliary Feedwater Actuation Signal (AFAS) or manually started in anticipation of an AFAS.

The 31 day Frequency, based on engineering judgment, is consistent with procedural controls governing valve operation, and ensures correct valve positions.

SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required'developed head ensures that AFW pump performance has not degraded during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by Section XI of the ASME Code (Ref. 2). Because it is undesirable to introduce cold AFW into the steam generators while they are operating, this testing is performed on recirculation flow. Testing of each MDAFP on a recirculation flow rate greater than or equal to 75 gpm and ensuring a discharge pressure of greater than or equal to 1535 psig verifies the capability of each MDAFP to deliver a total pump flow of 575 gpm at a steam generator pressure of 1221 psig. The capability to deliver 575 gpm includes the 75 gpm recirculation flow plus 250 gpm delivered to two steam generators from one MDAFP. Testing the TDAFP on a recirculation flow greater than or equal to 120 gpm and ensuring a discharge pressure of greater than or equal to 1625 psig verifies the capability of the pump to deliver a total pump flow of 1145 gpm at a steam generator pressure of 1221 psig. The capability to deliver 1145 gpm includes thle 120 gpm recirculation flow, 25 gpm to pump auxiliary loads, and 250 gpm delivered to four steam generators from the TDAFP. Such (continued)

CALLAWAY PLANT - B 3.7.5-8 ,I - -Revision 1

AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.2 (continued)

REQUIREMENTS inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.

Performance of inservice testing discussed in the ASME Code, Section Xl (Ref. 2) satisfies this requirement. The test frequency in accordance with the Inservice Testing Program results in testing each pump once every 3 months, as required by Reference 2.

This SR is modified by a Note indicating that the SR should be deferred until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test.

SR 3.7.5.3 This SR verifies that AFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates an ESFAS, by demonstrating that each automatic valve in the flow path actuates to its correct position on an actual or simulated actuation signal.

This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is acceptable based on operating experience and the design reliability of the equipment This SR includes the requirement to verify that each AFW motor-operated discharge valve, ALHV0005, 7, 9 and 11, limits the flow from the motor-driven pump to each steam generator to< 300 gpm (Reference 6) and that valves ALHV0030, 31, 32, 33, 34, 35 and 36 actuate to the required position upon receipt of an Auxiliary Feedwater Pump suction Pressure-Low signal.

SR 3.7.5.4 This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an AFAS by demonstrating that each AFW pump starts automatically on an actual or simulated auxiliary feedwater actuation signal. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

(continued)

CALLAWAY PLANT B 3.7.5-9 Revision 3

AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.4 (continued)

REQUIREMENTS This SR is modified by a Note. The Note indicates that the SRbe deferred until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test.

SR- 3.7.5.5 This SR verifies that the AFW is properly aligned by verifying the flow paths from the CST to each steam generator prior to entering MODE 2 after more than 30 days in MODE 5 or 6.

OPERABILITY of AFW flow paths must beverified before sufficient core heat is generated that would require the operation of the AFW System during a subsequent shutdown..The Frequency is reasonable, based on engineering judgement and other administrative controls that ensure that

-flow paths remain OPERABLE. To further ensure AFW System alignment, flow path OPERABILITY is verified following extended outages to determine no misalignment of valves has occurred. This SR ensures that the flow path from the CST to the steam generators is properly aligned. .

,-REFERENCES 1. FSAR, Section 10.4.9, Auxiliary Feedwater System.

2. ASME, Boiler and Pressure Vessel Code,Section XI.

3. FSAR, Section 9.3.1, Compressed Air System.

4. Amendment No. 55 to facility Operating License No. NPF-30, dated 7/27/90.

5. FSAR 15.2.8, Feedwater System Ripe Break.

6. Request for Resolution (RFR) 21816A. I CALLAWAY PLANT ,. B 3.7.5-10 -., - , Revision 3

CST B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Condensate Storage Tank (CST)

BASES BACKGROUND The CST provides a nonsafety grade source of water to the steam generators for removing decay and sensible heat from the Reactor Coolant System (RCS). The CST provides a passive flow of water, by gravity, to the Auxiliary Feedwater (AFW) System (LCO 3.7.5). The steam produced is released to the atmosphere by the main steam safety valves or the atmospheric steam dump valves. The AFW pumps operate with a continuous recirculation to the CST.

When the main steam isolation valves are open, the preferred means of heat removal is to discharge steam to the condenser by the nonsafety grade path of the condenser steam dump valves. The condensed steam can be returned to the CST by the condensate pumps. This has the advantage of conserving condensate while minimizing releases to the environment.

The CST capacity allows the plant to remove decay heat from the primary system during a 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Station Blackout event (Ref.3). However, the CST is not the safety-related source of water to the AFW pumps. The safety-related source is provided by the essential service water (ESW) system (LCO 3.7.8).

A description of the CST is found in the FSAR, Section 9.2.6 (Ref. 1).

APPLICABLE The CST is the preferred suction supply to the Auxiliary Feedwater SAFETY Pumps (AFP) due to the quality of the water. However, the CST is a ANALYSES nonseismic structure and thus cannot be relied upon for all accident scenarios. In order to ensure a safety grade supply of water is available to supply the suction of the AFP's for all credible accident conditions, the Essential Service Water System has been designed to provide the backup emergency supply to the AFP's.

The CST is credited as the AFP suction source during a Station Blackout event since automatic swapover to ESW system is not assumed to occur.

Therefore, the CST must have sufficient capacity to remove decay heat during a 4-hour Station Blackout event (Ref. 3). The CST is also the desired AFP suction source for post-trip decay heat removal at hot standby conditions and RCS cooldown to RHR entry conditions. Safe shutdown criteria for extended decay heat removal at hot standby prior to cooldown apply only to safety-related suction sources (ESW) for, the AFW system (Ref. 4). Additional details regarding the design of the AFW system can be found in FSAR 10.4.9.

(continued)

I CALLAWAY PLANT B 3.7.6-1 Revision 3

CST B 3.7.6 BASES APPLICABLE The CST satisfies Criterion 3 and 4 of 10 CFR 50.36 (c)(2)(ii).

SAFETY

- ANALYSES (continued)

LCO To satisfy analysis assumptions, the CST must contain sufficient cooling

. water to remove decay heat and cooldown the RCS during a four-hour Station Blackout event. The water volume needed for this event is 158,000 gallons plus that volume necessary forAFP minimum NPSH.

The basis is established in Reference 3. -This required volume does not include CST water volume for Low Suction Pressure Swapover to the ESW System since it is not expected to occur during a Station Blackout event.

Since the CST is the preferred AFP suction source, the minimum -required CST contained water volume is maintained as > 281,000 gallons to accommodate extended post-trip decay heat removal in hot standby followed by a cooldown to RHR entry conditions. This total volume accounts for AFP minimum NPSH and Low Suction Pressure Swapover water volume allowances within the CST.

The OPERABILITY of the CST is determined by maintaining the tank

. contained water volume at or above the minimum required volume.

APPLICABILITY In MODES 1, 2, and 3, the CST is required to be OPERABLE.

In MODES 4, 5, or 6, the CST is not required because the AFW system is I not required.

ACTIONS A.1 and A.2 If the CST contained water volume is not within limits, the OPERABILITY of the backup ESW supply should be verified by administrative means within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter. OPERABILITY of the backup ESW supply must include verification that the flow paths from the backup water supply (ESW system) to the AFW pumps are OPERABLE, and that the backup supply has the required volume of water available (UHS water level is within limits). The CST must be restored to OPERABLE status within 7 days. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is reasonable, based on operating experience, to verify the OPERABILITY of the backup ESW supply. Additionally, verifying the backup water supply every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is adequate to ensure the backup water supply continues to be available. The 7 day Completion Time is reasonable, based on an OPERABLE backup water supply being available, and the (continued)

,- :* CALLAWAY PLANT B 3.7.6-2 S... . ,Revision 3

I CST B 3.7.6 BASES ACTIONS Al andA.2 (continued) low probability of an event occurring during this time period requiring the CST.

B.1 and B.2 If the CST cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.6.1 REQUIREMENTS" This SR verifies that the CST contains the required volume of cooling water. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is based on operating experience and the need for operator awareness of unit evolutions that may affect the CST inventory between checks.

Also, the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is considered adequate in view of other indications in the control room, including alarms, to alert the operator to abnormal deviations in the CST contained water volume.

REFERENCES 1. FSAR, Section 9.2.6, Condensate Storage and Transfer System.

2. FSAR 10.4.9, Auxiliary Feedwater System.

- 3. -. FSAR 8.3A, Station Blackout.

4. FSAR, Appendix 5.4A, Safe Shutdown I CALLAWAY PLANT B 3.7.6-3 Revision 3

AC Sources - Shutdown B 3.8.2 BASES LCO instrumentation functions is addressed in LCO 3.3.5, "Loss of Power (continued) (LOP) Diesel Generator"(DG) StartIrnstrumentation." Only.the shutdown portion of the associated Load Shedder and Emergency Sequencer is required to be OPERABLE in MODES 5 and 6.

In addition, Load Shedderand Emergency Load Sequencer operation is an integral part of offsite circuit OPERABILITY since its inoperability

.impacts on the ability to start and maintain energized loads required OPERABLE by LC 3.8.10. However, proper sequencer operation shall only be required on the train supported by the OPERABLE DG.

It is acceptable for trains to be cross tied during shutdown conditions, allowing a single offsite power circuit to supply all required trains.

APPLICABILITY The AC sources required to be OPERABLE in MODES 5 and 6 provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core;

b. Systems needed to mitigate a fuel handling accident are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

• The AC power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.1. ,

ACTIONS A.1 An offsite circuit would be considered inoperable if it were not available to one required ESF train. -Theonetrain with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and fuel movement. By the allowance of the

.,option to declare required features inoperable, with no offsite power available, appropriate restrictions will be implemented in accordance with the affected required features LCO's ACTIONS.

(continued)

-CALLAWAY PLANT B 3.8.2-4 CL Y NB4 Revision 0

AC Sources - Shutdown B 3.8.2 BASES ACTIONS A.2.1, A.2.2, A.2.3, A.2.4, B.1, B.2, B.3, and B.4 (continued)

With the offsite circuit not available to one required train, the option would still exist to declare all required features inoperable. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. With the required DG inoperable, the minimum required diversity of AC power sources is not available. It is, therefore; required to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.

Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability or the occurrence of postulated'events. It is further required to immediately initiate action to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the unit safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be cornpleted as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power. -.

Pursuant to LCO 3.0.6, the Distribution System's ACTIONS would not be entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A is entered with no AC power to the required ESF bus, the ACTIONS for LCO 3.8.10 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the.offsite circuit, whether or not a train is de-energized.

LCO 3.8.10 would provide the appropriate restrictions for the situation involving a de-energized train.

(continued)

CALLAWAY PLANT B 3.8.2-5 Revision 3

AC Sources - Shutdown B 3.8.2 BASES ACTIONS C.1 (continued)

Required Action C.1 provides assurance that the appropriate Action is entered for the affected DG and offsite circuit if the shutdown portion of the Load Shedder and Emergency Load Sequencer (LSELS) becomes inoperable. The shutdown portion of the LSELS is an essential support system to both the offsite circuit and the DG associated with a given ESF bus. Furthermore,- the sequencer is on the primary success path for most AC electrically powered safety systems powered from the associated ESF bus. With the required LSELS (shutdown portion) inoperable, immediately declare the affected DG and offsite circuit inoperable and take the Required Actions of Conditions A and B. The Completion Time of immediately is consistent with the required times for actions requiring prompt attention.

SURVEILLANCE SR 3.8.2.1 REQUIREMENTS SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the AC sources in other than MODES 1, 2,

• 3, and 4. SR 3.8.1.12, SR 3.8.1.13, SR 3.8.1.17, SR 3.8.1.18 (LOCA load sequencer only), SR 3.8.1.19, and SR 3.8.1.21 (LOCA load sequencer only) are not required to be met because the capability to respond to a safety injection signal is not required to be demonstrated in MODE 5 or 6.

SR 3.8.1.20 is excepted because starting independence is not required with the DG that is not required to be operable.

This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DG from being paralleled with the offsite power network or otherwise rendered inoperable during performance of SRs, and to preclude deenergizing a required 4160 V ESF bus or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit and the DG. It is the intent that these SRs (SR 3.8.1.3, SR 3.8.1.10, SR 3.8.1.11, SR 3.8.1.14, SR 3.8.1.15, SR 3.8.1.16, and SR 3.8.1.18 (shutdown load sequencer only)) must still be capable of being met, but actual performance is not required during periods when

.the DG and offsite circuit is required to be OPERABLE. Refer to the

.:corresponding Bases for LCO 3.8.1 for a discussion of each SR.

REFERENCES None.

CALLAWAY PLANT .. I- -1 B3.8.2-6 ., Revision 3

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air BASES BACKGROUND Each diesel generator (DG) is provided with a storage tank having a fuel oil capacity sufficient to operate that diesel for a period of 7 days while the DG is supplying maximum post loss of coolant accident load demand discussed in the FSAR, Section 9.5.4.2 (Ref. 1). The maximum load demand is calculated based on the fuel consumption by one DG for operation at continuous rating for 7 days. This onsite fuel oil capacity is sufficient to operate the DGs for longer than the time to replenish the onsite supply from outside sources.

Fuel oil is transferred from storage tank to day tank by a transfer pumps associated with each storage tank. Redundancy of pumps and piping precludes the failure of one pump, or the rupture of any pipe, valve or tank resulting in the loss of more than one DG. All outside tanks, pumps, and piping are located underground.

For proper operation of the standby DGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses

-the recommended fuel oil practices as supplemented by ANSI N195 (Ref. 3). The fuel oil properties governed by these SRs are the water and sediment content, the kinematic viscosity, specific gravity (orAPI gravity),

and impurity level.

The DG lubrication system is designed to provide sufficient lubrication to permit proper operation of its associated DG under all loading conditions.

The system is required to circulate the lube oil to the diesel engine working surfaces and to remove excess heat generated by friction during operation. The contained volume-of lube oil in each diesel engine I-4.-. crankcase is sufficient to allow full load operation for greater than 7 days.

With a contained volume equivalent to the "add oil" mark on the dipstick, a 10 day'supply is available to support full load operation of the engine.

The lube oil system is designed with an automatic makeup supply that begins makeup before the low level alarm is received and before reaching the "add oil" level on the dipstick. The capacity and controls associated with the lube oil system are sufficient to ensure a minimum of 7 days of operation. Refer to the table below:

(continued)

CALLAWAY PLANT B 3.8.3-1 Revision 0

DC Sources - Shutdown B 3.8.5 BASES ,

ACTIONS A.1, A.2.1, A.2.2, A.2.3, and A.2.4 (continued) movement of irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6)). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation.

Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated toensure they do not result in a loss of required SDM.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. .-These actions minimize probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystem and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the unit safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystem should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power.

SURVEILLANCE SR 3.8.5.1 REQUIREMENTS SR 3.8.5.1 requires performance of all Surveillances required by.-.=_

SR 3.8.4.1 through SR 3.8.4.8. Therefore, see the corresponding Bases

,.- for LCO 3.8.4 for a discussion of each SR.

- This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC sources from being discharged below their capability to provide the required. power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that these SRs (SR 3.8.4.6, SR 3.8.4.7, and SR 3:8.4.8) must still be capable of being met, but actual performance is not required.

REFERENCES 1. FSAR, Chapter 6. * -4

2. FSAR, Chapter 15.

2

-CALLAWAY PLANT -"B 3.8.5-5 - Revision 3

Battery Cell Parameters B 3.8.6 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.6 Battery Cell Parameters BASESI BACKGROUND This LCO delineates the limits on electrolyte temperature, level, float voltage, and specific gravity for the DC power source batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC Sources - Operating," and LCO 3.8.5, "DC Sources - Shutdown."

APPLICABLE initial conditions of Design Basis Accident (DBA) and transient SAFETY analyses in the FSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2),

ANALYSES- L-1assume Engineered Safety Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation.

The OPERABILITY of the DC electrical power subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining at least one train of DC sources OPERABLE during accident conditions, in the event of:

a. An assumed loss of all offsite AC power or all onsite AC power, and

b. A worst case single failure.

Battery cell parameters satisfy the Criterion 3 of the 10 CFR 50.36(c)(2)(ii).

LCO Battery cell parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA. Electrolyte limits are conservatively established, allowing continued DC electrical power system function even with Category A and B limits not met.

(continued)

CALLAWAY PLANT B 3.8.6-1 Revision 0

Inverters - Shutdown B 3.8.8 BASES LCO (continued)

TRAIN A TRAIN B Bus NN01 Bus NN3us NN2 Bus NN04 energized from energized from energized from energized from Inverter NN11 Inverter NN13 Inverter NN12 Inverter NN14 connected to connected to ' connected to connected to

`DC bus NK01 DC bus NK03 DC bus NK02 DC bus NK04 APPLICABILITY' The inverters required to be OPERABLE in MODES 5 and 6 provide assurance'that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in'the core;

b. Systems needed to mitigate a fuel handling accident are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

Inverter requirements for MODES 1, 2,'3, and 4 are covered in LCO 3.8.7.

ACTIONS A.1, A.2.1, A.2.2, A.2.3, and A.2.4 By the allowance of thre option todeclare required features inoperable with the associated inverter(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCOs' Required Actions.' In'many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) or

'boron concentration (MODE 6)). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation.

Introduction of coolant inventory must be from sources that have a boron "concentration greater than that required in the RCS for minimum SDM or (continued)

CALLAWAY PLANT B 3.8.8-4 CTRevision 3

Inverters - Shutdown B 3.8.8 BASES ACTIONS A.1, A.2.1, A.2.2, A.2.3, and A.2.4 (continued) refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritica! operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required inverters and to continue this action until restoration is accomplished in order to provide the necessary inverter power to the unit safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required inverters should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power or powered from the inverter internal AC source or the constant voltage transformer.

SURVEILLANCE SR 3.8.8.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and AC vital buses energized from the inverter. The verification of proper voltage output ensures that the required power is readily available for the instrumentation connected to the AC vital buses. The 7 day Frequency takes into account the capability of the inverters and other indications available in the control room that alert the operator to inverter malfunctions.

REFERENCES 1. FSAR, Chapter 6.

2. FSAR, Chapter 15.

CALLAWAY PLANT B 3.8.8-5 Revision 3

Distribution Systems - Shutdown B 3.8.10 BASES LCO The required AC vital bus electrical power distribution subsystem is (continued) supported by one trainbf inverters as required by LCO 3.8.8, "Inverters Shutdown." When the second (subsystem) of AC vital bus electrical

• • power distribution is needed to support redundant required systems, equipment and components, the second train may be energized from any available source. The available source must be Class 1E or another reliable source. The available source must be capable of supplying sufficient AC electrical power such that the redundant components are capable of performing their specified safety function(s) (implicitly required by the definition of OPERABILITY). Otherwise the supported components must be declared inoperable and the appropriate conditions of the LCOs for the redundant components must be entered.

Closure of the tie breaker 52NG0116 between NG01 and NG03 or tie breaker 52NG0216 between N!G02 and NG04 will render all four degraded voltage channels for the associated 4.16 kV bus inoperable.

Refer~to LCO 3.3.5, "LOP DG Start Instrumentation." The 480 V load center transformer load and voltage drop increase when one transformer is supplying both 480 V buses. Since the degraded voltage is sensed on the 4.16 kV bus, the actual 480 V bus voltage will be lower (lower than assumed during a degraded voltage condition) when the protection setpoint is reached. In this case, adequate protection is not provided for the 480 V bus loads.

APPLICABILITY The AC and DC electrical power distribution subsystems required to be OPERABLE in MODES 5 and 6 provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core;

b. Systems needed to mitigate a fuel handling accident are available; S

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition and refueling condition.

The AC, DC, and AC vital bus electrical power distribution subsystems requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.9.

(continued)

CALLAWAY PLANT B 3.8.10-4 0

Distribution Systems - Shutdown B 3.8.10 BASES (continued)

ACTIONS A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5 By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions are implemented in accordance with the affected distribution subsystem LCO's Required Actions. In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i'e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6)). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation.

Introduction of coolant inventory must be from sources that have a boron concentrationgreater than that required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.

Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.

Notwithstanding performance of the above conservative Required Actions, a required residual heat removal (RHR) subsystem may be inoperable. In this case, Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the RHR ACTIONS would not be entered. Therefore, Required Action A.2.5 is provided to direct declaring RHR inoperable and not in operation, which results in taking the appropriate RHR actions. This would assure consideration is given to shutdown cooling systems that are without required power and that appropriate actions are taken to assure operability of these required systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power.

(continued)

CALLAWAY PLANT B 3.8.10-5 Revision 3

Distribution Systems - Shutdown B 3.8.10 BASES (continued)

SURVEILLANCE SR 3.8.10.1 REQUIREMENTS This Surveillance verifies that the required AC, DC, and AC vital bus electrical power distribution subsystems are functioning properly, with all the buses energized. The verification of proper voltage availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. The 7 day Frequency takes into account the capability of the electrical power distribution subsystems, and other indications available in the control room that alert the operator to subsystem malfunctions.

REFERENCES 1. FSAR, Chapter 6.

,1 2. FSAR, Chapter 15. -

I ..

CALLAWAY PLANT B 3.8.10-6 SRevision 3

Boron Concentration B 3.9.1 BASES APPLICABLE 3. After the level has been lowered to below the cavity seal/shield SAFETY ring, further draining of the area enclosed by the inside diameter ANALYSES - of the ring is performed via the RHR connection to the Chemical (continued) and Volume Control letdown line.

The RCS boron concentration satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO . The LCO requires that a minimum boron concentration be maintained in the filled portions of the RCS and the refueling pool, that have direct access to the reactor vessel while in MODE 6. The boron concentration limit ensures that a core kef of _ 0.95 is maintained during fuel handling operations, and shall in all cases be > 2000 ppm. Violation of the LCO could lead to an inadvertent criticalityduring MODE 6.

APPLICABILITY This LCO is applicable in MODE 6 to ensure that the fuel in the reactor vessel will remain subcritical. The required boron concentration ensures a kef

• 0.95. Above MODE 6, LCO 3.1.1, "SHUTDOWN MARGIN (SDM),

LCO 3.1.5, "Shutdown Bank Insertion Limits," and LCO 3.1.6, "Control Bank Insertion Limits," ensure that an adequate amount of negative reactivity is available to shut down the reactor and maintain it subcritical.

The Applicability is modified by a Note stating that transition from MODE 5 to MODE 6 is not permitted while'the LCO is not met. This Note specifies an exception to LCO 3.0.4 and prohibits the transition when boron concentration limits are not met. This Note assures that core reactivity is maintained within limits during fuel handling operations.

ACTIONS A.1 and A.2 Continuation of CORE ALTERATIONS or positive reactivity additions (including actions to reduce boron concentration) is contingent upon maintaining the unit in compliance with the LCO. If the boron concentration of any co6oant Vblime in tlhe-filled portion's of the RCS and the refueling pool that have direct access to the reactor vessel, is less than its limit, all operations involving CORE ALTERATIONS or positive reactivity additions must be suspended immediately.

Suspension of CORE ALTERATIONS and positive reactivity additions shall not preclude moving a component to a safe position. Operations that individually add limited positive reactivity (e.g., temperature fluctuations, inventory addition, or temperature control fluctuations), but when combined with all other operations affecting core reactivity (e.g.,

(continued)

CALLAWAY PLANT B 3.9.1-3 Revision 3

-1 Boron Concentration B 3.9.1 BASES ACTIONS A.1 and A.2 (continued) intentional boration) result in overall net negative reactivity addition, are not precluded by this action.

A.3 In addition to immediately suspending CORE ALTERATIONS and positive I reactivity additions, boration to restore the concentration must be initiated immediately.

In determining the required combination of boration flow rate and concentration, no unique Design Basis Event must be satisfied. The only requirement is to restore the boron concentration to its required value as soon as possible. In order to raise the boron concentration as soon as possible, the operator should begin boration with the best source available for unit conditions.

Once actions have been initiated, they must be continued until the boron concentration is restored. The restoration time depends on the amount of boron that must be injected to reach the required concentration.

SURVEILLANCE SR 3.9.1.1 REQUIREMENTS This SR ensures that the coolant boron concentration in the filled portions of the RCS and the refueling pool that have direct access to the reactor vessel, is within the LCO limits. The boron concentration of the coolant in each required volume is determined periodically by chemical analysis.

A minimum Frequency of once every 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is a reasonable amount of time to verify the boron concentration of representative samples. The Frequency is based on operating experience, which has shown 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to be adequate.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. FSAR, Chapter 15, Section 15.4.

3. Amendment 97 to Facility Operating License No. NPF-30, Callaway Unit 1, dated March 31, 1995.

4. Callaway Plant Request for Resolution 17070.

CALLAWAY PLANT B 3.9.1-4 Revision 3

Nuclear Instrumentation B 3.9.3 BASES LCO Monitor(s) are acceptable equivalent control room indication(s) for (continued) Westinghouse Source Range Neutron Flux Monitor(s) in MODE 6, including CORE ALTERATIONS, with the complete fuel assembly inventory set within the reactor vessel or with the Gamma Metrics Source Range Neutron Flux Monitor(s) coupled to the core. Reactor Engineering shall determine whether each monitor is coupled to the core.

APPLICABILITY In MODE 6, the source range neutron flux monitors must be OPERABLE to determine changes in core reactivity. In other modes, the source range monitors are governed by LCO 3.3.1, LCO 3.3.3, LCO 3.3.4, and LCO 3.3.9.

ACTIONS .. A.1 and A.2 With only one source range neutron flux monitor OPERABLE, redundancy has been lost. 'Since these instruments are the only direct means of monitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1 must be suspended immediately. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum refueling boron concentration.

This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.

Performance of Required Action A.1 shall not preclude completion of movement of a component to a safe position.

- B.1 With no source range neutron flux monitor OPERABLE, action to restore a monitor to OPERABLE status shall be initiated immediately. Once initiated, action shall be continued until a source range neutron flux monitor is restored to OPERABLE status.

• ;~B.2 .

With no source range neutron flux monitor OPERABLE; there are no "directmeans of detecting changes in core reactivity. However, since CORE ALTERATIONS and boron concentration changes inconsistent with Required Action A.2 are not to be made, the core reactivity condition is (continued)

CALLAWAY PLANT B 3.9.3-2 A3 Revision 3

Nuclear Instrumentation B 3.9.3 BASES ACTIONS B.2 (continued) stabilized until the source range neutron flux monitors are OPERABLE.

This stabilized condition is determined by performing SR 3.9.1.1 to ensure that the required boron concentration exists.

The Completion Time of once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is sufficient to obtain and analyze a reactor coolant sample for boron concentration and ensures that unplanned changes in boron concentration would be identified. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is reasonable, considering the low probability of a change in core reactivity during this time period.

SURVEILLANCE SR 3.9.3.1 REQUIREMENTS SR 3.9.3.1 is the performance of a CHANNEL CHECK, which is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that the two indication channels should be consistent with core conditions. Changes in fuel loading'and core geometry can result in significant differences between source range channels, but each channel should be consistent with its local conditions.

The Frequency of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is consistent with the CHANNEL CHECK Frequency specified similarly for the same instruments in LCO 3.3.1.

SR 3.9.3.2 SR 3.9.3.2 is the performance of a CHANNEL CALIBRATION every 18 months. This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION. Neutron detectors are excluded from the CHANNEL CALIBRATION because it is impractical to set up a test that demonstrates and adjusts neutron detector response to known values of the parameter (neutron flux) that the channel monitors.

Depending on which source range channels are used to satisfy the LCO, the Note app!ies to the source range proportional counters in the Westinghouse Nuclear Instrumentation System (NIS) or to the Gamma-Metrics fission chambers, as discussed in the Background and LCO sections above. The CHANNEL CALIBRATION of the Westinghouse NIS source range neutron flux channels consists of obtaining integral bias curves, evaluating those curves, and comparing the curves previous'data. The 18 month Frequency is based on the need to obtain integral bias curves under the conditions that apply during a plant outage. The other remaining portions of the CHANNEL CALIBRATION may be performed either during a plant outage or during (continued)

CALLAWAY PLANT B 3.9.3-3 Revision 3

Nuclear Instrumentation B 3.9.3 BASES SURVEILLANCE SR 3.§.3.2 (continued)

REQUIREMENTS plant operation. Operating experience has shown these components usually pass the Surveillance when performed at the 18 month Frequency.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 13, GDC 26, GDC 28, and GDC 29:

2. FSAR, Section 15.4.6.

CALLAWAY PLANT B 3.9.3-4 Revision 3

Page intentionally blank RHR and Coolant circulation - High Water Level B 3.9.5 BASES LCO a. Removal of decay heat; (continued)

b. Mixing of borated coolant to minimize the possibility of criticality; and

c. Indication of reactor coolant temperature.

An OPERABLE RHR loop includes an RHR pump, a heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path and to determine the RCS temperature. The flow path starts in one of the RCS hot legs and isreturnedto the RCS cold legs.

The LCO is modified by a Note that allows the required operating RHR loop to be removed from service for up to 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> per 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> period, provided no operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to meet the minimum boron concentration of LCO 3.9.1. Boron concentration reduction with coolant at boron concentrations less than required to assure the minimum required RCS boron concentration is maintained is prohibited because uniform concentration distribution cannot be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles and RCS to RHR isolation valve testing. During this 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> period, decay heat is removed by natural convection to the large mass of water in the refueling pool.

APPLICABILITY One RHR loop must be OPERABLE and in operation in MODE 6, with the water level;> 23 ft above the top of the reactor vessel flange, to provide decay heat removal. The 23 ftwater level was selected because it corresponds to the 23 ft requirement established for fuel movement in LCO 3.9.7, "Refueling Pool Water Level." Requirements for the RHR System in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5, Emergency Core Cooling Systems (ECCS). RHR loop requirements in MODE 6 with the water level < 23 ft are located in LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level." Additional RHR loop requirements in MODE 6 with the water level > 23 feet above the top of the reactor vessel flange are located in FSAR 16.1.2.1, uFlow Path Shutdown Limiting Condition For Operation."

ACTIONS" RHR loop requirements are met by having one RHR loop OPERABLE and in operation, except as permitted in the Note to the LCO.

(continued)

CALLAWAY PLANT B 3.9.5-2 Revision 3

RHR and Coolant circulation - High Water Level B 3.9.5 BASES ACTIONS A. 1 (continued)

If RHR loop requirements are not met, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maihtaining subcritical operation. Administrative controls are placed on refueling decontamination activities (See Bases for LCO 3.9.1).

A.2 '

If RHR loop requirements are not met, actions shall be taken immediately to suspend loading of irradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removal from the core occurs by natural convection to the heat sink provided by the water above the core.

A minimum refueling pool water level of 23 ft above the reactor vessel flange provides an adequate available heat sink. Suspending any

-operation that would increase decay heat load, such as loading a fuel assembly, is a prudent action under this condition. Performance of Required Action A.2 shall not preclude completion of movement of a component to a safe condition.

A.3 If RHR loop requirements are not met, actions shall be initiated and continued in order to satisfy RHR loop requirements. With the unit in MODE 6 and the refueling water level >_" 23 ft above the top of the reactor vessel flange, corrective actions shall be initiated immediately.

A.4 If RHR loop requirements are not met, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing containment penetrations that are open to the outside atmosphere ensures dose limits are not exceeded.

(continued)

CALLAWAY PLANT B 3.9.5-3 Revision 3

RHR and Coolant circulation - High Water Level B 3.9.5 BASES ACTIONS A.4-'(continued) "

The Completion Time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is reasonable, based on the low probability of the coolant boiling in that time.

-SURVEILLANCE SR 3.9.5.1 REQUIREMENTS, This Surveillance demonstrates that the RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. The Frequency of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is sufficient, considering the flow,temperature, pump control, and alarm indications available to the operator in the control room for

-.... . monitoring the RHR System.

REFERENCES 1. FSAR, Section 5.4.7.

A, .

"CALLAWAYPLANT B 3.9.5-4 SRevision 3

RHR and Coolant Circulation - Low Water Level B 3.9.6 B 3.9 REFUELING OPERATIONS B 3.9.6 Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level BASES BACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant, and to prevent boron stratification (Ref. 1). Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchangers where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass lines. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System.

APPLICABLE If the reactor coolant temperature is not maintained below 2000 F, boiling SAFETY of the reactor coolant could result. This could lead to a loss of coolant in ANALYSES the reactor vessel. Additionally, boiling of the reactor coolant could lead to boron plating out on components near the areas of the boiling activity.

The loss of reactor coolant and the subsequent plate out of boron will eventually challenge the integrity of the fuel cladding, which is a fission product barrier. Two trains of the RHR System are required to be OPERABLE, and one train in operation, in order to prevent this challenge.

The RHR System is retained as a Specification because it meets Criterion 4 of 10 CFR 50.36(c)(2)(ii).

In MODE 6, with the water level <23 ft above the top of the reactor vessel LCO In MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, both RHR loops must be OPERABLE.

Additionally, one loop of RHR must be in operation in order to provide:

a. Removal of decay heat;

b. Mixing of borated coolant to minimize the possibility of criticality; and

c. Indication of reactor coolant temperature.

(continued)

CALLAWAY PLANT B 3.9.6-1 Revision 0

RHR and Coolant Circulation - Low Water Level B 3.9.6 BASES LCO An OPERABLE RHR loop consists of an RHR pump, a heat exchanger, (continued) valves, piping, instruments and controls to'ensure an OPERABLE flow path and to determine the RCS temperature. The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs. An OPERABLE RHR loop must be capable of being realigned to provide an OPERABLE flow path.

APPLICABILITY Two RHR loops are required to be OPERABLE, and one RHR loop must be in operation in MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, to provide decay heat removal. Requirements for the RHR System in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5, Emergency Core Cooling Systems (ECCS). RHR loop requirements in MODE 6 with the water level Ž: 23 ft are located in LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level." Additional RHR loop requirements in MODE 6 with the water level > 23 feet above the top of the reactor vessel flange are located in FSAR 16.1.2.1, "Flow Path Shutdown Limiting Condition For Operation."

The Applicabiiity is modified by a Note stating that entry into a MODE or other specified condition in the Applicability is not permitted while the LCO is not met.. This note specifies an exception to LCO 3.0.4 and would prevent the transition into MODE 6 with less than 23 feet of water above the top of the vessel flange while the RHR function was degraded.

ACTIONS. A.1 andA.2 If less than the required number of RHR loops are OPERABLE, action shall be immediately initiated and continued until the RHR loop is restored to OPERABLE status and restored to operation in accordance with the LCO or until ;- 23 ft of water level is established above the reactor vessel flange. When the water level is;> 23 ft above the reactor yessel flange, the Applicability changes to that of LCO 3.9.5, and only one RHR loop is required to be OPERABLE and in operation. An immediate Completion Time is necessary for an operator to initiate corrective actions. -

B.1 If no RHR loop is in operation, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that (continued)

CALLAWAY PLANT B 3.9.6-2 Revision 3

RHR and Coolant Circulation - Low Water Level B 3.9.6 BASES ACTIONS B.1 (continued) have a boron concentration greater than that required in the RCS for minimum refueling boron concentration: This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining a subcritical operation. Administrative controls are placed on refueling decontamination activities (See Bases for LCO 3.9.1).

B.2 If no RHR loop is in operation, actions shall be initiated immediately, and continued, to restore one RHR loop to operation. Since the unit is in Conditions A and B concurrently,- the restoration of two OPERABLE RHR loops and one operating RHR loop should be accomplished expeditiously.

B.3 If no RHR loop is in operation, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing containment penetrations that are open to the outside atmosphere ensures that dose limits are not exceeded.

The Completion Time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is reasonable at water levels above reduced inventory, based on the low probability of the coolant boiling in that time. At reduced inventory conditions, additional actions are taken to provide containment closure in a reduced period of time (Reference 2).

Reduced inventory is defined as RCS level lower than 3 feet below the reactor vessel flange.

SURVEILLANCE SR 3.9.6.1 REQUIREMENTS This Surveillance demonstrates that one RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. The Frequency of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is sufficient, considering the flow, temperature, pump control, and alarm indications available to the operator for monitoring the RHR System in the control room.

(continued)

CALLAWAY PLANT B 3.9.6-3 Revision 3

RHR and Coolant Circulation - Low Water Level B 3.9.6 BASES SURVEILLANCE SR 3.9.6.2 REQUIREMENTS (continued) Verification that the required pump is OPERABLE ensures that an additional RHR pump can be placed in operation, if needed,-to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required pump. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

REFERENCES 1. FSAR, Section 5.4.7.

2. Generic Letter No. 88-17, "Loss of Decay Heat Removal."

• 2.

CALLAWAY PLANT B 3.9.6-4 Revision 3

Refueling F0ool'Water Level I B 3.9.7 B 3.9 REFUELING OPERATIONS B 3.9.7 Refueling Pool Water Level BASES BACKGROUND The movement of irradiated fuel assemblies within containment requires a minimum water level of 23 ft above the top of the reactor vessel flange.

During refueling, this maintains sufficient water level in the fuel transfer canal, refueling pool and spent fuel pool. Sufficient water is necessary to retain iodine fission product activity in the water in the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite doses from the accident to < 25% of 10 CFR 100 limits, as provided by the guidance of Reference 3 and acceptance in Reference 6.

APPLICABLE During movement of irradiated fuel assemblies, the water level in the SAFETY refueling pool is an initial condition design parameter in the analysis of a ANALYSES fuel handling accident in containment, as postulated by Regulatory Guide 1.25 (Ref. 1). The reactor is assumed to have been subcritical for 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> prior to movement of irradiated fuel in the reactor vessel. A minimum water level of 23 ft (Regulatory Position C.1 .c of Ref. 1) allows a decontamination factor of 100 (Regulatory Position C. 1.g of Ref. 1) to be used in the accident analysis for iodine. This relates to the assumption that 99% of the total iodine released from the pellet to cladding gap of the damaged rods is retained by the refueling pool water. In addition, for the analyses for the accident in the reactor building, the dropped assembly is assumed to damage 20% of the rods of a different assembly. The fission product release point is assumed to be at the point of impact at the top of the reactor vessel flange. The fuel pellet to cladding gap is assumed to contain 10% of the total fuel rod iodine inventory (Ref. 1).

The fuel handling-accident analysis inside containment is described in Reference 2. With a minimum water level of 23 ft and a minimum decay time of 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> prior to fuel handling, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water and offsite doses are maintained well within the limits of 10 CFR 100 (Refs. 4, 5, and 6).

Refueling pool water level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

(continued)

CALLAWAY PLANT B 3.9.7-1 Revision 0