ML14122A158

From kanterella
Jump to navigation Jump to search
License Amendment Request LAR-14-02392, Request for NRC Approval of Proposed Changes to Emergency Action Levels. EPP-108, Enclosure 1, Revision 01 (Draft E)
ML14122A158
Person / Time
Site: Summer South Carolina Electric & Gas Company icon.png
Issue date: 04/07/2014
From: Gatlin T D
South Carolina Electric & Gas Co
To:
Office of Nuclear Reactor Regulation
Shared Package
ML14122A144 List:
References
RC-14-0032
Download: ML14122A158 (180)
v • d • e


Text

EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

EAL: H -Hazards and Other Conditions Affecting Plant Safety 3 -Natural or Technological Hazard Hazardous event affecting a SAFETY SYSTEM needed for the current operating mode HA3.1 Alert The occurrence of any Table H-1 hazardous event resulting in EITHER of the following: " Event damage has caused indications of degraded performance in at least one train of a SAFETY SYSTEM needed for the current operating mode* The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component or structure needed for the current operating mode Table H-1 Hazardous Events* Internal or external FLOODING event* High winds or tornado strike* Other events with similar hazard characteristics as determined by the Shift Supervisor Mode Applicability:

All Definition(s):

FLOODING -A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area.SAFETY SYSTEM -A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary;Page 177 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E](2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

VISIBLE DAMAGE -Damage to a component or structure that is readily observable without measurements, testing, or analysis.

The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure.

Basis: Plant-Specific

  • Internal FLOODING may be caused by events such as component failures, equipment misalignment, or outage activity mishaps (ref. 1)." Seismic Category I structures are analyzed to withstand a sustained, design wind velocity of at least 100 mph (sustained). (ref. 2).Generic This IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode. This condition significantly reduces the margin to a loss or potential loss of a fission product barrier, and therefore represents an actual or potential substantial degradation of the level of safety of the plant.EAL !.b.!The first conditional addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available.

The indications of degraded performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.EAL 1-t2The second conditional addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent through indications alone, or to a structure containing SAFETY SYSTEM components.

Operators will make this determination based on the totality of available event and damage report information.

This Page 178 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage.Escalation of the emergency cla..ifiat,,, levelE L would be via IC CS1 or AS-I-RS1.VCSNS Basis Reference(s):

1. VCSNS IPE Internal Flooding Analysis Workbook 2. FSAR Section 3.3.1 3. NEI 99-01 CA6 Page 179 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category:

H -Hazards and Other Conditions Affecting Plant Safety Subcategory:

4 -Fire Initiating Condition:

FIRE potentially degrading the level of safety of the plant EAL: HU4.1 Unusual Event A FIRE is NOT extinguished within 15 min. of any of the following FIRE detection indications (Note 1):* Report from the field (i.e., visual observation)" Receipt of multiple (more than 1) fire alarms or indications

  • Field verification of a single fire alarm AND The FIRE is located within any Table H-2 area Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Table H-2 Fire Areas* Reactor Building* Auxiliary Building* Control Building* Fuel Handling Building* Intermediate Building* Diesel Generator Building" Turbine Building* Service water Pumphouse" Safe Shutdown Yard Areas:* RWST* CST* DG Fuel Oil Storage Mode Applicability:

All Definition(s):

Page 180 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]FIRE -Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIRES. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.Basis: Plant-Specific VCSNS Fire Protection Evaluation Report, Section 4.0 "Hazards Analysis" was used to identify areas (Table H-2) containing functions and systems required for safe shutdown of the plant (ref. 1).Generic This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant.EAt-4*T-he-For EAL HU4.1 the intent of the 15-minute duration is to size the FIRE and to discriminate against small FIRES that are readily extinguished (e.g., smoldering waste paper basket). In addition to alarms, other indications of a FIRE could be a drop in fire main pressure, automatic activation of a suppression system, etc.Upon receipt, operators will take prompt actions to confirm the validity of an initial fire alarm, indication, or report. For EAL assessment purposes, the emergency declaration clock starts at the time that the initial alarm, indication, or report was received, and not the time that a subsequent verification action was performed.

Similarly, the fire duration clock also starts at the time of receipt of the initial alarm, indication or report.EAL-#2 This EAL addresses receipt of a single fire alarm, and the existence Of a FIRE is not verified (i.e., proved or disproved) within 30 mninutes of the alarm. Upon receipt, operators will take prompt actioRn the validity of a single fire alarm. For EAL assessment purposes, the 30_minute nlock starts at the t time hat the initial alarm was, reGeived, and not the time that a subsequent verification action was perfeaned.

A single fire alarm, absent other indication(s) of a FIRE, ma" be indicative of equipment failure or asu iou ativation, and not an actual FIRE. For this reason;, addiinalI time.i allowed to vrfthvalidity of the alarm. The 30-minute period is a reasonable amnount of time to determine if an actual FIRE exists; howe ve.r, afterthat time, and absent information to the Gontrarn, it is assumaed that an actual FIRE is in progress.Page 181 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]if an actua! FIRE is verified by a report from the Tfi'eld, ;tihen EAL #1 i me~tl applicablc, and the emergency must be d-l~ared if the FIRE is not extinRguihed within 15 minutes, of the repo.t. if the alarm is.erified to be due to anequipment failu-re Or a prius, o vativation, and this v-ifio Sn ourR, ,,ithin30 m.,int-,es o.f the rFeGeipt of the alarm the this EAL is not applicable and no emnergency declaration is warranted.

In addition to a FIRE addressed by EAL #1 or EAL #2, a FIRE within the plaRn PROT-ECTED AREARnot extinguished Within 60 minutes May also potnial degade the leve! of plant safety. This basis xtend to a FIRE= occURrig within the- PROT-ECTE AREA of an ISF-l lo0ated outside the plant PROTECTE AREA. [Sentence for plants with an.P ISESI outside the Plant PrtecGted Area]EAL-#4 ifaFI RE Aithinthe pilantor IS-SI [for plants Kith an ISQFSI utsi the plant Protected Area] PROTIECTED AREA is of su-fficafient size to require a response by an 9fst fiefighting agency (e.g., a loal town Fire Depament), then the level of plant safety is potentially degraded.

The di ,patch of aR ,ffite firofighting the site an emergency declaration only if it is needed to actively support firefighting effo4t because the fire is beyond the capabii~ty of the Fire Brigade to extinguish.

D~eclarationR i6 Rot.necessary if the agency resources are placed on stand-by, or sUPPE)rting pos extinguishment recover or inetigation actions.Depending upon the plant mode at the time of the event, escalation of the emergeRGY classiofication

'evelEOL would be via IC CA6 or SA9.VCSNS Basis Reference(s):

1. VCSNS Fire Protection Evaluation Report 2. NEI 99-01 HU4 Page 182 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category:

H -Hazards and Other Conditions Affecting Plant Safety Subcategory:

4- Fire Initiating Condition:

FIRE potentially degrading the level of safety of the plant EAL: HU4.2 Unusual Event Receipt of a single fire alarm (i.e., no other indications of a FIRE)AND The fire alarm is indicating a FIRE within any Table H-2 area AND The existence of a FIRE is not verified within 30 min. of alarm receipt (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Table H-2 Fire Areas* Reactor Building* Auxiliary Building* Control Building* Fuel Handling Building* Intermediate Building* Diesel Generator Building" Turbine Building* Service water Pumphouse" Safe Shutdown Yard Areas:* RWST C OST* DG Fuel Oil Storage Mode Applicability:

All Definition(s):

Page 183 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]FIRE -Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.Basis: Plant-Specific VCSNS Fire Protection Evaluation Report, Section 4.0 "Hazards Analysis" was used to identify areas (Table H-2) containing functions and systems required for safe shutdown of the plant (ref. 1).Generic This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant.EAL-#4 The intent of the 15 -Minutc dur~atie;onris to size the FI=RE and to diccrirn~nate against small FIRES that are rcadily extinguished (e.g., smolder~ing waste paper: basket). in addition to, a.a...,, other: ndication of a FIRE .ould be a drop in fire main pre.sure, automati;activation of a suppression system, etc.Upon receipt, operators will take prompt actionn to ccofirm the validity of anr iAL fires alarm, inldication, or report. For E=AL assessment purposes, the mernegency declaration cloesk starts at the time that the initial alarm, indiation, or report was received, and not the time that a subsequent verification action was performed.

Similarly, the fire duration also starts at the time of receipt of the initial alarm, indication or report.EAL-#2 This EAL addresses receipt of a single fire alarm, and the existence of a FIRE is not verified (i.e., proved or disproved) within 30-minutes of the alarm. Upon receipt, operators will take prompt actions to confirm the validity of a single fire alarm. For EAL assessment purposes, the 30-minute clock starts at the time that the initial alarm was received, and not the time that a subsequent verification action was performed.

A single fire alarm, absent other indication(s) of a FIRE, may be indicative of equipment failure or a spurious activation, and not an actual FIRE. For this reason, additional time is allowed to verify the validity of the alarm. The 30-minute period is a reasonable amount of Page 184 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]time to determine if an actual FIRE exists; however, after that time, and absent information to the contrary, it is assumed that an actual FIRE is in progress.If an actual FIRE is verified by a report from the field, then EAL--#4-HU4.1 is immediately applicable, and the emergency must be declared if the FIRE is not extinguished within 15-minutes of the report. If the alarm is verified to be due to an equipment failure or a spurious activation, and this verification occurs within 30-minutes of the receipt of the alarm, then this EAL is not applicable and no emergency declaration is warranted.

In additing to a FIRE addres1cd by EAL #1 of EAL #2, a FIRE Within the plant PRO)TECTED=_

AIREA not eXtinguishcd Within 60 minuters may alrso potentially degrade th!eve ofplat safety. This basis extnd& to a F4RE= occUrring wiithin theA PROTECTE A.REA of an ISE-91 located outside the plant PROTECGTED=_

AREA. [Sentenco for- plants wit an SSIoutside the plant Proteted Area]&AL-#4 Depending upon the plant mode at the time of the event, escalation of the ei~e~geRGY GIa66ificat*9n lcveIECL would be via IC CA6 or SA9.VCSNS Basis Reference(s):

1. VCSNS Fire Protection Evaluation Report 2. NEI 99-01 HU4 Page 185 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category:

H -Hazards and Other Conditions Affecting Plant Safety Subcategory:

4- Fire Initiating Condition:

FIRE potentially degrading the level of safety of the plant EAL: HU4.3 Unusual Event A FIRE within the plant PROTECTED AREA not extinguished within 60 min. of the initial report, alarm or indication (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Mode Applicability:

All Definition(s):

FIRE -Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIRES. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.PROTECTED AREA -An area encompassed by physical barriers and to which access is controlled.

The Protected Area refers to the designated security area around the process buildings and is depicted in Drawing SS-024-019 Site Plan (ref. 1).Basis: Plant-Specific None Generic This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant.The intentSof the ,4n, .... is .. size t PRE and to , ...... 6M FIRES that are readily eXtinguished (e.g., smoldering waste paper basket). In addition to Page 186 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]~~~~Jiiz ~ ~ ~ ~ ~ ~ ~ -M --A FtR Mel Hu MR HM et".itu "tt§ F:, i ~ tui i ALIii I : iviiii:tt.-r S. .. ..activation of a ,upprcssien system, etc.Upon rFceipt, operators will take p.rmpt actioR.o cn the validity of an iRitial fire al~ , ind iiR or Fep.it r ..F AL.. a..s,.6.Me, t pu.."e6 th eInI, A~ de, ai E clock starts at the time that the initial alarm, indicatfion, or report was received, and not the time that a subsequent verification action was, pe~formed.

Similarly, the fire duration Gdock also Mtarts at the time of receipt of the initial alarm, indication or repo.EAL-#2 This EAL addresses-receipt of a single fire alaFrm, and the existence of a FIRE is not verified (i.e., proved or disproved)

Within 30.minutes of the alarm. Upon receipt, operators wiltake prompt actions to confi~rm the v.alidity of a rsnl oeaam. q .l r.eG~~nme.o.e. the Glek at the time that the initial alarm was reGeied and not*kr'.. *;rnr.. ii, .,* ., e., nkr.an, mant * ,nr;4;n..~t;nn n,-4 ,,-~n *An r. nar 4 nrnnI I A single fire alafm, absent other indcation(s) of a FIRE, may be indicative of equipment failure or a Iu acttion, and b ot an actual FIRE. Feo this reason, addithinal time is allowed to vrfthvalidity of the alarm. The 30-minute period is a reasonable am~ount of time to deterMine ifan actual FIRE exists; however, after that time, and absentinomtn to the GOntrar~i, it isassumed that an actual FIRE is in prFogress.

if an actual FIRE isverified by a report from the field, then EAL #1 isimditl applicable, and the emnergency must be decaGredi the FIRE is not extinguished within 1 mninutes, of the report. If the alaarm is verified to be due to an equipment failure or a spurius ativation, andi this verification occrsnF within 30 minutes of tercit of the alar, thn tis EL16 not applicable and no em~ergency declaratioiswratd In addition to a FIRE addressed by EAL #14-HU4.1 or EA1 4#2HU4.2, a FIRE within the plant PROTECTED AREA not extinguished within 60-minutes may also potentially degrade the level of plant safety. This basis extends to a FFE .e.urrg within the PROTECTED A929A nf. an M"!c Loo.-Qtorl uji4 ,bhn nh~ Lant AQC)TQC=Tf AQJrA [I~r onon-- frIn~rnfc IAI.an ISQF.'I n~irJ. thin nlant Pmtrotei~h 4roag]if a FIRE within the plant or: ISESI [for plants Mit an iSF-SI outside the plant P-rotected Area] PROTECTED AREA is Of sufficient size to require a response by an Gfst firefighting agency (e.g., a local town Fire Department), then the level of plant safety is potentially degraded.

The disGpatch of an offsite firefightin agency to) the site requires an em~ergency declaratio~n o~nly if it is needed to activ.ely support firefighting efforts because thin f ire is' hne~nnc the reanahilit" of the Pire nrigaaa tn iztuAin ac~h flo'iaratinn , nnt -U.Ut-.i .4 exhinqufVishment recover; to..i ation actions..Page 187 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Depending upon the plant mode at the time of the event, escalation of the emergeRcy cla6sificGaton levelECL would be via IC CA6 or SA9.VCSNS Basis Reference(s):

1. Drawing SS-024-019 Site Plan 2. NEI 99-01 HU4 Page 188 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El Category:

H -Hazards and Other Conditions Affecting Plant Safety Subcategory:

4- Fire Initiating Condition:

FIRE potentially degrading the level of safety of the plant EAL: HU4.4 Unusual Event A FIRE within the plant PROTECTED AREA that requires firefighting support by an off site fire response agency to extinguish Mode Applicability:

All Definition(s):

FIRE -Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.PROTECTED AREA -An area encompassed by physical barriers and to which access is controlled.

The Protected Area refers to the designated security area around the process buildings and is depicted in Drawing SS-024-019 Site Plan (ref. 1).Basis: Plant-Specific None Generic This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant.EAL-44 The intent of thc 15 _-;nute duratien is to size the FIRE and to disFcirminate against small FIRES that are readily extinguished (e.g., smoldering waste paper basket). in addition to alarms, other ,nd,,ations of a FIRE could be a drop in fire ,main pressure, automatic activation of a suppre~ss on system, etc.Page 189 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Upon roccipt, operators will take prompt actions to confirmn the validity of an initial fireidication, repo,. For E AL, et , the emergency deGlFation clock starts at the time that the initial alarm, indicatiGn, Or report Was rec-eived, and not the time that a s.ubsequent Verificatio-mn acion w~as pe~f)Rmed.

Similarly, the fire duration clock also starts at the time of receipt of the initial alarm, indicatiOn or rcpo.EAL-#2 T-his EAL addresses Feceipt of a single fire alarm, and the eXistence of a FIRE is not vrf 1ed (i.e., proved Or withiln 30minutes of the alarm. Upen receipt, operators will take prompt ac~tion to confirm the validity of a single fire alarm. For E.AL _assessment purposes6, the 30 minute clock starts at the time that the initial alarmA ?a eevd, and not the time that a subsequent verification action was Pe~eom~ed.

A 6inglc fire alarm, absent other indication(s) of a FIRE, ma" be indicativ.e of eqUipMent failure Or a puiusativation, and Rot an actual FIRE. For this reason, additional ti*me is allowed to vrythvalidity of the alarm. The 30- minute period is a reasonRable amount of time. .to UULUirimi;:Ue

.. aan a.. .u.i r-n- .xit., after tI, t time , a U t ...............

to the contrar,', it is assumed that an atual FIRE isi rges if an actual FIRE is verified by a report from the field, then EAL #1 *6imditl applicable, and the emergency mu be declared if the FIRE is nt within 15-m~inutes of the report. if the alarm is erified to be due to anequipmet failure Or a spuriusativation, and- this verification occurs within 30-minutes of the receipt of the a~arm the this E=AL isnot applicable and no emnergency declaratien is warranted.

EAL-43 in addition to a FIRE adderessed by EAL #1 or EAL #2, a FIRE within the plant AR EA R Q TFGno A .R ,.+ .t eXtinguished within 60Dminute

.may also potentially degrade the level of plant rsafety. Thi basis extends to a F4RE occu~rrng withiin the PROTECTE AREA4 of an ISFSI located outside the plant PROTECTED AREA4. [Sentence for- plants wt an ISESI outside the plant Protected Area]E-AL-44 If a FIRE within the plant or ISFS [for ,-,plants .Wth an eutside the plant Protecte Area]-PROTECTED AREA is of sufficient size to require a response by an offsite firefighting agency (e.g., a local town Fire Department), then the level of plant safety is potentially degraded.

The dispatch of an offsite firefighting agency to the site requires an emergency declaration only if it is needed to actively support firefighting efforts because the FIRE is beyond the capability of the Fire Brigade to extinguish.

Declaration is not necessary if the agency resources are placed on stand-by, or supporting post-extinguishment recovery or investigation actions.Page 190 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Depending upon the plant mode at the time of the event, escalation of the eMegeGY classification leve!ECL would be via IC CA6 or SA9.VCSNS Basis Reference(s):

1. Drawing SS-024-019 Site Plan 2. NEI 99-01 HU4 Page 191 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

EAL: H -Hazards and Other Conditions Affecting Plant Safety 4 -FIRE FIRE or EXPLOSION event affecting a SAFETY SYSTEM needed for the current operating mode HA4.1 Alert FIRE or EXPLOSION resulting in EITHER of the following:

  • Event damage has caused indications of degraded performance in at least one train of a SAFETY SYSTEM needed for the current operating mode" The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component or structure needed for the current operating mode Mode Applicability:

All Definition(s):

EXPLOSION

-A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization.

A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an EXPLOSION.

Such events require a post-event inspection to determine if the attributes of an EXPLOSION are present.FIRE -Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.SAFETY SYSTEM -A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: Page 192 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E](1) The integrity of the reactor coolant pressure boundary;(2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

VISIBLE DAMAGE -Damage to a component or structure that is readily observable without measurements, testing, or analysis.

The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure.

Basis: Plant-Specific" Refer to VCSNS Fire Protection Evaluation Report, Section 4.0 "Hazards Analysis" to identify areas containing functions and systems required for safe shutdown of the plant (ref. 4)* An EXPLOSION (including a steam line explosion) that degrades the performance of a SAFETY SYSTEM train or visibly damages a SAFETY SYSTEM component or structure would be classified under this EAL. The need to classify a steam line break not considered an EXPLOSION itself is considered in fission product barrier degradation monitoring (EAL Category F).Generic This IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode. This condition significantly reduces the margin to a loss or potential loss of a fission product barrier, and therefore represents an actual or potential substantial degradation of the level of safety of the plant.EAL14bThe first conditional addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available.

The indications of Page 193 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]degraded performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.I -AL- b2The second conditional addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent through indications alone, or to a structure containing SAFETY SYSTEM components.

Operators will make this determination based on the totality of available event and damage report information.

This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage.Escalation of the emergency classification leve!ECL would be via IC CS1 or AS-I-RS1.VCSNS Basis Reference(s):

1. VCSNS Fire Protection Evaluation Report 2. NEI 99-01 CA6 Page 194 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

H -Hazards and Other Conditions Affecting Plant Safety 5 -Hazardous Gases Gaseous release impeding access to equipment necessary for normal plant operations, cooldown or shutdown EAL: HA5.1 Alert Release of a toxic, corrosive, asphyxiant or flammable gas into any Table H-3 area AND Entry into the area is prohibited or impeded (Note 6)Note 6: If the equipment in the listed area was already inoperable or out-of-service before the event occurred, then no emergency classification is warranted.

Table H-3 Safe Operation

& Shutdown Areas Area Mode Applicability Auxiliary Building 374' 3 Auxiliary Building 388' 3, 4, 5 Auxiliary Building 400' 4, 5 Auxiliary Building 412 3, 4, 5 Auxiliary Building 436' 1, 2, 3, 4, 5 Auxiliary Building 463' 3, 4, 5 Intermediate Building 412' 3 Intermediate Building 436' 4, 5 Intermediate Building 463' 3, 4, 5 Control Building 412' 2, 3 Control Building 436' 3, 4, 5 Turbine Building (All levels) 1,2 Mode Applicability:

All Definition(s):

None Page 195 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Basis: Plant-Specific The Table H-3 safe operation and shutdown areas (with entry-related mode applicability) are those plant areas that contain equipment which require a manual/local action as specified in general operating procedures (and procedures referenced by them) used for normal plant operation, cooldown and shutdown.

The list specifies the plant operating modes during which entry would be required for each area and thus specifying when a loss of access or impeded access is applicable to this EAL (ref. 1).Plant areas where actions of a contingent or emergency nature might be needed to be performed. (e.g., an action to address an off-normal or emergency condition such as emergency repairs, corrective measures or emergency operations) were not considered for inclusion.

Additionally, areas for which entry is required solely to perform actions of an administrative or record keeping nature (e.g., normal rounds or routine inspections) were not considered for inclusion.

Refer to Attachment 4 "Safe Operation

& Shutdown Areas Tables R-2 & H-3 Bases.".If the equipment in the listed room or area was already inoperable, or out-of-service, before the event occurred, then no emergency should be declared since the event will have no adverse impact beyond that already allowed by Technical Specifications at the time of the event.Generic This IC addresses an event involving a release of a hazardous gas that precludes or impedes access to equipment necessary to maintain normal plant operation, or required for a normal plant cooldown and shutdown.

This condition represents an actual or potential substantial degradation of the level of safety of the plant.An Alert declaration is warranted if entry into the affected room/area is, or may be, procedurally required during the plant operating mode in effect at the time of the gaseous release. The emergency classification is not contingent upon whether entry is actually necessary at the time of the release.Page 196 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Evaluation of the IC and EAL do not require atmospheric sampling; it only requires the Emergency Director's judgment that the gas concentration in the affected room/area is sufficient to preclude or significantly impede procedurally required access. This judgment may be based on a variety of factors including an existing job hazard analysis, report of ill effects on personnel, advice from a subject matter expert or operating experience with the same or similar hazards. Access should be considered as impeded if extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed).

An emergency declaration is not warranted if any of the following conditions apply." The plant is in an operating mode different than the mode specified for the affected room/area (i.e., entry is not required during the operating mode in effect at the time of the gaseous release).

For example, the plant is in Mode 1 when the gaseous release occurs, and the procedures used for normal operation, cooldown and shutdown do not require entry into the affected room until Mode 4." The gas release is a planned activity that includes compensatory measures which address the temporary inaccessibility of a room or area (e.g., fire suppression system testing)." The action for which room/area entry is required is of an administrative or record keeping nature (e.g., normal rounds or routine inspections)." The access control measures are of a conservative or precautionary nature, and would not actually prevent or impede a required action." If the equipment in the listed room or area was already inoperable, or out-of-service, before the event occurred, then no emergency should be declared since the event will have no adverse impact beyond that already allowed by Technical Specifications at the time of the event.An asphyxiant is a gas capable of reducing the level of oxygen in the body to dangerous levels. Most commonly, asphyxiants work by merely displacing air in an enclosed Page 197 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]environment.

This reduces the concentration of oxygen below the normal level of around 19%, which can lead to breathing difficulties, unconsciousness or even death.This EAL does not apply to firefighting activities that automatically or manually activate a fire suppression system in an area, Or to intentional ine;-i-g of containmeRt (BWR only).Escalation of the emergency classification levelECL would be via Recognition Category AR, C or F ICs.VCSNS Basis Reference(s):

1. EPP-108 Emergency Action Level Technical Bases Attachment 4 "Safe Operation

&Shutdown Areas Tables R-2 & H-3 Bases." 2. NEI 99-01 HA5 Page 198 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

EAL: H -Hazards and Other Conditions Affecting Plant Safety 6 -Control Room Evacuation Control Room evacuation resulting in transfer of plant control to alternate locations HA6.1 Alert An event has resulted in plant control being transferred from the Control Room to the Control Room Evacuation Panels (CREP)Mode Applicability:

All Definition(s):

None Basis: Plant-Specific Per AOP-600.1 Control Room Evacuation (ref. 1) plant control is established at the CREP when: " Emergency boration capability exists, if required* Charging and letdown flow can be controled to maintain Pressurizer level." EFW flow can be controlled to maintain SG levels.* RCS natural circulation can be established.

Generic This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations outside the Control Room. The loss of the ability to control the plant from the Control Room is considered to be a potential substantial degradation in the level of plant safety.Page 199 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Following a Control Room evacuation, control of the plant will be transferred to alternate shutdown locations.

The necessity to control a plant shutdown from outside the Control Room, in addition to responding to the event that required the evacuation of the Control Room, will present challenges to plant operators and other on-shift personnel.

Activation of the ERO and emergency response facilities will assist in responding to these challenges.

Escalation of the emergency cla6sification 1evelECL would be via IC HS6.VCSNS Basis Reference(s):

1. AOP-600.1 Control Room Evacuation
2. FEP-4.0 Control Room Evacuation Due To Fire.3. FSAR Section 7.4.1.3 4. NEI 99-01 HA6 Page 200 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

H -Hazards and Other Conditions Affecting Plant Safety 6 -Control Room Evacuation Inability to control a key safety function from outside the Control Room EAL: HS6.1 Site Area Emergency An event has resulted in plant control being transferred from the Control Room to the Control Room Evacuation Panels (CREP)AND Control of any of the following key safety functions is not reestablished within 15 min.(Note 1): " Reactivity control* Core cooling" RCS heat removal Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Mode Applicability:

All Definition(s):

None Basis: Plant-Specific Per AOP-600.1 Control Room Evacuation (ref. 1) plant control is established at the CREP when: " Emergency boration capability exists, if required" Charging and letdown flow can be controled to maintain Pressurizer level.* EFW flow can be controlled to maintain SG levels." RCS natural circulation can be established.

Page 201 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Generic This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations, and the control of a key safety function cannot be reestablished in a timely manner. The failure to gain control of a key safety function following a transfer of plant control to alternate locations is a precursor to a challenge to one or more fission product barriers within a relatively short period of time.The determination of whether or not "control" is established at the remote safe shutdown location(s) is based on Emergency Director judgment.

The Emergency Director is expected to make a reasonable, informed judgment within (the Site c" time minutes whether or not the operating staff has control of key safety functions from the remote safe shutdown location(s).

Escalation of the emergenGcy classification le-elECL would be via IC FG1 or CG1 VCSNS Basis Reference(s):

1. AOP-600.1 Control Room Evacuation
2. FEP-4.0 Control Room Evacuation Due To Fire.3. FSAR Section 7.4.1.3 4. NEI 99-01 HS6 Page 202 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: H -Hazards and Other Conditions Affecting Plant Safety Subcategory:

7 -Judgment Initiating Condition:

Other conditions existing that in the judgment of the Emergency Director warrant declaration of a UE EAL: HU7.1 Unusual Event Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated.

No releases of radioactive material requiring off site response or monitoring are expected unless further degradation of SAFETY SYSTEMS occurs.Mode Applicability:

All Definition(s):

None Basis: Plant-Specific None Generic This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the eMorgoncy Gla66ificati..

l-ce!ECL description for a NOW EUnusual Event.VCSNS Basis Reference(s):

1. NEI 99-01 HU7 Page 203 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

EAL: H -Hazards and Other Conditions Affecting Plant Safety 7 -Judgment Other conditions exist that in the judgment of the Emergency Director warrant declaration of an Alert HA7.1 Alert Other conditions exist which, in the judgment of the Emergency Director, indicate that events are in progress or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA Protective Action Guideline exposure levels.Mode Applicability:

All Definition(s):

HOSTILE ACTION- An act toward VCSNS or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on VCSNS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA).Basis: Plant-Specific None Page 204 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El Generic This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the cmenrgccY .la66ification lev,-E" L description for an Alert.VCSNS Basis Reference(s):

1. NEI 99-01 HA7 Page 205 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

EAL: H -Hazards and Other Conditions Affecting Plant Safety 7 -Judgment Other conditions existing that in the judgment of the Emergency Director warrant declaration of a Site Area Emergency HS7.1 Site Area Emergency Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occurred which involve actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that results in intentional damage or malicious acts, (1) toward site personnel or equipment that could lead to the likely failure of or, (2) that prevent effective access to equipment needed for the protection of the public. Any releases are not expected to result in exposure levels which exceed EPA Protective Action Guideline exposure levels beyond the SITE BOUNDARY.Mode Applicability:

All Definition(s):

HOSTILE ACTION -An act toward VCSNS or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on VCSNS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA)Basis: Plant-Specific None Page 206 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Generic This EAL addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the DirectorEmergency Director to fall under the clasification IevelECL description for Site Area Emergency.

VCSNS Basis Reference(s):

1. NEI 99-01 HS7 Page 207 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

EAL: H -Hazards and Other Conditions Affecting Plant Safety 7 -Judgment Other conditions exist which in the judgment of the Emergency Director warrant declaration of a General Emergency HG7.1 General Emergency Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occurred which involve actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility.

Releases can be reasonably expected to exceed EPA Protective Action Guideline exposure levels offsite for more than the immediate site area.Mode Applicability:

All Definition(s):

HOSTILE ACTION -An act toward VCSNS or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on VCSNS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA).IMMINENT-The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.Basis: Plant-Specific None Page 208 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Generic This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification levclECL description for a General Emergency.

VCSNS Basis Reference(s):

1. NEI 99-01 HG7 Page 209 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category S -System Malfunction EAL Group: Hot Conditions (RCS temperature

> 200 0 F);EALs in this category are applicable only in one or more hot operating modes.Numerous system-related equipment failure events that warrant emergency classification have been identified in this category.

They may pose actual or potential threats to plant safety.The events of this category pertain to the following subcategories:

1. Loss of Engineered Safeguards Features (ESF) AC Power Loss of ESF plant electrical power can compromise plant SAFETY SYSTEM operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity.

This category includes loss of onsite and offsite power sources for 7.2 KV safeguards buses 1 DA and 1 DB.2. Loss of Vital DC Power Loss of emergency plant electrical power can compromise plant SAFETY SYSTEM operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity.

This category includes loss of power to or degraded voltage on the 125VDC safeguards buses.3. Loss of Control Room Indications Certain events that degrade plant operator ability to effectively assess plant conditions within the plant warrant emergency classification.

Losses of indicators are in this subcategory.

4. RCS Activity During normal operation, reactor coolant fission product activity is very low. Small concentrations of fission products in the coolant are primarily from the fission of tramp uranium in the fuel clad or minor perforations in the clad itself. Any significant increase from these base-line levels (2% -5% clad failures) is indicative of fuel failures and is Page 210 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]covered under Category F, Fission Product Barrier Degradation.

However, lesser amounts of clad damage may result in coolant activity exceeding Technical Specification limits. These fission products will be circulated with the reactor coolant and can be detected by coolant sampling.5. RCS Leakage The reactor vessel provides a volume for the coolant that covers the reactor core. The reactor vessel and associated pressure piping (reactor coolant system) together provide a barrier to limit the release of radioactive material should the reactor fuel clad integrity fail. Excessive RCS leakage greater than Technical Specification limits indicates potential pipe cracks that may propagate to an extent threatening fuel clad, RCS and Containment integrity.

6. RTS Failure This subcategory includes events related to failure of the Reactor Trip System (RTS) to initiate and complete reactor trips. In the plant licensing basis, postulated failures of the RTS to complete a reactor trip comprise a specific set of analyzed events referred to as Anticipated Transient Without Trip (ATWS) events. For EAL classification however, ATWS is intended to mean any trip failure event that does not achieve reactor shutdown.

If RTS actuation fails to assure reactor shutdown, positive control of reactivity is at risk and could cause a threat to fuel clad, RCS and Containment integrity.

7. Loss of Communications Certain events that degrade plant operator ability to effectively communicate with essential personnel within or external to the plant warrant emergency classification.
8. Containment Isolation Failure Failure of containment isolation capability (under conditions in which the containment is not currently challenged) warrants emergency classification.
9. Hazardous Event Affectinq Safety Systems Page 211 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El Various natural and technological events that result in degraded plant SAFETY SYSTEM performance or significant VISIBLE DAMAGE warrant emergency classification under the sub-category.

Page 212 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category:

S -System Malfunction Subcategory:

1 -Loss of ESF AC Power Initiating Condition:

Loss of all offsite AC power capability to ESF buses for 15 minutes or longer.EAL: SU1.1 Unusual Event Loss of all offsite AC power (Table S-1) capability to 7.2 KV ESF buses 1 DA and 1 DB for 2-15 min. (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Table S-1 AC Power Supplies Offsite:* 115 KV power to XTF-4 and XTF-5* 230 KV power to XTF-31* Parr Hydro Plant 13.8 KV power to ESF bus 1DAor 1DB Onsite:* Diesel Generator A 0 Diesel Generator B Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown, Definition(s):

None Basis: Plant-Specific As used in this EAL the term "capability" means an AC power source is either currently powering essential loads on one or more 7.2 KV ESF buses or is capable of energizing and powering essential loads on at least one 7.2 KV ESF bus within 15 min.Page 213 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Table S-1 lists AC sources capable of powering ESF buses. Safeguards power originates offsite from two independent sources (ref. 1):* The Parr Generating Complex supplies 115 KV power to the two Engineered Safety Feature (ESF) transformers (XTF-4 and XTF-5). The transformer outputs are combined at 7.2 KV bus 1 DX and then supplied to 7.2 KV ESF bus 1 DA (Train A).This is the preferred or normal power source to Train A and the alternate power source for Train B.* 7.2 KV ESF bus 1 DB (Train B) is supplied from the emergency auxiliary transformer (XTF-31).

The emergency auxiliary transformer receives 230 KV power from the Virgil C. Summer substation (switchyard) bus 3. This transformer is the preferred power source for Train B and the alternate power source for Train A.The Parr Hydro Plant provides a 13.8 KV AC line to the 7.2 KV ESF buses. This Alternate AC Power Supply has the capacity to supply only one fully loaded ESF bus (ref. 4).The AAC is designed to provide back-up power to either ESF bus whenever one of the Diesel Generators is out of service, particularly in Modes 1 through 4. The AAC is verified available and an operational readiness status check is performed when it is anticipated that one of the Diesel Generators will be inoperable for longer than the allowed outage time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The design of the AAC is capable of providing the required safety and non-safety related loads in the event of a total loss of offsite power and if both Diesel Generators fail to start and load. During these events it is assumed that there is no seismic event or an event that requires safeguards actuation (e.g., safety injection, containment spray, etc.) Although the AAC is not designed for DBA loads, it is capable of supplying sufficient power to mitigate the effects of an accident.

The AAC is not credited in the safety analysis.

The AAC is, however, capable of mitigating the dominant core damage sequences and provides a significant overall risk reduction for station operation.

The AAC alone is adequate to supply electrical power to affect a safe shutdown of the plant (ref. 7).The two trains of 7.2 KV safeguards power are also provided with an onsite standby source of power for supplying power when the ESF and emergency auxiliary transformers Page 214 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]are not available.

The Diesel Generators A and B are capable of supplying all loads on the distribution network of their respective train (ref. 1, 2, 3, 4, 5).Generic This IC addresses a prolonged loss of offsite power. The loss of offsite power sources renders the plant more vulnerable to a complete loss of power to AC eie~eRY engineered safequard features (ESF) buses. This condition represents a potential reduction in the level of safety of the plant.For emergency classification purposes, "capability" means that an offsite AC power source(s) is available to the emeFqeGy-ESF buses, whether or not the buses are powered from it.Fifteen minutes was selected as a threshold to exclude transient or momentary losses of offsite power.Escalation of the emcrgency classification lcvclECL would be via IC SAI.VCSNS Basis Reference(s):

1. FSAR Section 8 2. EOP-6.0 Loss of All ESF AC Power 3. EOP-1.0 Reactor Trip/Safety Injection Actuation 4. SOP-304 115KV/7.2KV Operations
5. SOP-306 Emergency Diesel Generator 6. AOP-304.1 Loss of Bus 1 DA(1 DB) with the Diesel not Available 7. Technical Specifications Bases 3/4.8 8. NEI 99-01 SU1 Page 215 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

S -System Malfunction 1 -Loss of ESF AC Power Loss of all but one AC power source to ESF buses for 15 minutes or longer.EAL: SA1.1 Alert AC power capability to 7.2 KV ESF buses 1 DA and 1 DB reduced to a single power source (Table S-1) for > 15 min. (Note 1)AND Any additional single power source failure will result in loss of all AC power to SAFETY SYSTEMS Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Table S-1 AC Power Supplies Offsite:* 115 KV power to XTF-4 and XTF-5* 230 KV power to XTF-31 0 Parr Hydro Plant 13.8 KV power to ESF bus 1DA or 1DB Onsite:* Diesel Generator A* Diesel Generator B Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown, Definition(s):

SAFETY SYSTEM -A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: Page 216 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E](1) The integrity of the reactor coolant pressure boundary;(2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

Basis: Plant-Specific As used in this EAL the term "capability" means an AC power source is either currently powering essential loads on one or more 7.2 KV ESF buses or is capable of energizing and powering essential loads on at least one 7.2 KV ESF bus within 15 min.Table S-1 lists AC sources capable of powering ESF buses. Safeguards power originates offsite from two independent sources (ref. 1):* The Parr Generating Complex supplies 115 KV power to the two Engineered Safety Feature (ESF) transformers (XTF-4 and XTF-5). The transformer outputs are combined at 7.2 KV bus 1 DX and then supplied to 7.2 KV ESF bus 1 DA (Train A).This is the preferred or normal power source to Train A and the alternate power source for Train B.* 7.2 KV ESF bus 1 DB (Train B) is supplied from the emergency auxiliary transformer (XTF-31).

The emergency auxiliary transformer receives 230 KV power from the Virgil C. Summer substation (switchyard) bus 3. This transformer is the preferred power source for Train B and the alternate power source for Train A.The Parr Hydro Plant provides a 13.8 KV AC line to the 7.2 KV ESF buses. This Alternate AC Power Supply has the capacity to supply only one fully loaded ESF bus (ref. 4).The AAC is designed to provide back-up power to either ESF bus whenever one of the Diesel Generators is out of service, particularly in Modes 1 through 4. The AAC is verified available and an operational readiness status check is performed when it is anticipated that one of the Diesel Generators will be inoperable for longer than the allowed outage Page 217 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The design of the AAC is capable of providing the required safety and non-safety related loads in the event of a total loss of offsite power and if both Diesel Generators fail to start and load. During these events it is assumed that there is no seismic event or an event that requires safeguards actuation (e.g., safety injection, containment spray, etc.) Although the AAC is not designed for DBA loads, it is capable of supplying sufficient power to mitigate the effects of an accident.

The AAC is not credited in the safety analysis.

The AAC is, however, capable of mitigating the dominant core damage sequences and provides a significant overall risk reduction for station operation.

The AAC alone is adequate to supply electrical power to affect a safe shutdown of the plant (ref. 7).The two trains of 7.2 KV safeguards power are also provided with an onsite standby source of power for supplying power when the ESF and emergency auxiliary transformers are not available.

The Diesel Generators A and B are capable of supplying all loads on the distribution network of their respective train (ref. 1, 2, 3, 4, 5).The 15-minute interval was selected as a threshold to exclude transient or momentary power losses. If the capability of a second source of ESF bus power is not restored within 15 minutes, an Alert is declared under this EAL.Generic This IC describes a significant degradation of offsite and onsite AC power sources such that any additional single failure would result in a loss of all AC power to SAFETY SYSTEMS. In this condition, the sole AC power source may be powering one, or more than one, train of safety-related equipment.

This IC provides an escalation path from IC Sul.An "AC power source" is a source recognized in AOPs and EOPs, and capable of supplying required power to an emergeniy-Engineered Safeguard Features (ESF) bus.Some examples of this condition are presented below.* A loss of all offsite power with a concurrent failure of all but one eMergeRCyESF power source (e.g., an onsite diesel generator).

Page 218 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]" A loss of all offsite power and loss of all power sources (e.g., onsite diesel generators) with a single train of emegeRGY-ESF buses being back-fed from the unit main generator." A loss of emefgeR~yESF power sources (e.g., onsite diesel generators) with a single train of eme Gy.ESF buses being back-fed from an offsite power source.Fifteen minutes was selected as a threshold to exclude transient or momentary losses of power.Escalation of the emergency cl~asification lcveIECL would be via IC SS1.VCSNS Basis Reference(s):

1. FSAR Section 8 2. EOP-6.0 Loss of All ESF AC Power 3. EOP-1.0 Reactor Trip/Safety Injection Actuation 4. SOP-304 115KV/7.2KV Operations
5. SOP-306 Emergency Diesel Generator 6. AOP-304.1 Loss of Bus 1 DA(1 DB) with the Diesel not Available 7. Technical Specifications Bases 3/4.8 8. NEI 99-01 SA1 Page 219 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

S -System Malfunction 1 -Loss of ESF AC Power Loss of all offsite and all onsite AC power to ESF buses for 15 minutes or longer.EAL: SS1.1 Site Area Emergency Loss of all offsite and all onsite AC power (Table S-1) capability to 7.2 KV ESF buses 1 DA and 1DB for > 15 min. (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Table S-1 AC Power Supplies Offsite:* 115 KV power to XTF-4 and XTF-5* 230 KV power to XTF-31* Parr Hydro Plant 13.8 KV power to ESF bus 1DA or 1DB Onsite:* Diesel Generator A* Diesel Generator B Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

None Basis: Plant-Specific As used in this EAL the term "capability" means an AC power source is either currently powering essential loads on one or more 7.2 KV ESF buses or is capable of energizing and powering essential loads on at least one 7.2 KV ESF bus within 15 min.Page 220 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Table S-1 lists AC sources capable of powering ESF buses. Safeguards power originates offsite from two independent sources (ref. 1):* The Parr Generating Complex supplies 115 KV power to the two Engineered Safety Feature (ESF) transformers (XTF-4 and XTF-5). The transformer outputs are combined at 7.2 KV bus 1 DX and then supplied to 7.2 KV ESF bus 1 DA (Train A).This is the preferred or normal power source to Train A and the alternate power source for Train B.* 7.2 KV ESF bus 1 DB (Train B) is supplied from the emergency auxiliary transformer (XTF-31).

The emergency auxiliary transformer receives 230 KV power from the Virgil C. Summer substation (switchyard) bus 3. This transformer is the preferred power source for Train B and the alternate power source for Train A.The Parr Hydro Plant provides a 13.8 KV AC line to the 7.2 KV ESF buses. This Alternate AC Power Supply has the capacity to supply only one fully loaded ESF bus (ref. 4).The AAC is designed to provide back-up power to either ESF bus whenever one of the Diesel Generators is out of service, particularly in Modes 1 through 4. The AAC is verified available and an operational readiness status check is performed when it is anticipated that one of the Diesel Generators will be inoperable for longer than the allowed outage time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The design of the AAC is capable of providing the required safety and non-safety related loads in the event of a total loss of offsite power and if both Diesel Generators fail to start and load. During these events it is assumed that there is no seismic event or an event that requires safeguards actuation (e.g., safety injection, containment spray, etc.) Although the AAC is not designed for DBA loads, it is capable of supplying sufficient power to mitigate the effects of an accident.

The AAC is not credited in the safety analysis.

The AAC is, however, capable of mitigating the dominant core damage sequences and provides a significant overall risk reduction for station operation.

The AAC alone is adequate to supply electrical power to affect a safe shutdown of the plant (ref. 7).The two trains of 7.2 KV safeguards power are also provided with an onsite standby source of power for supplying power when the ESF and emergency auxiliary transformers Page 221 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El are not available.

The Diesel Generators A and B are capable of supplying all loads on the distribution network of their respective train (ref. 1, 2, 3, 4, 5).This EAL is the hot condition equivalent of the cold condition loss of all AC power EAL CA1.1. When in Cold Shutdown, Refueling, or Defueled mode, the event can be classified as an Alert because of the significantly reduced decay heat, lower temperature and pressure, increasing the time to restore one of the ESF buses, relative to that existing when in hot conditions.

Generic This IC addresses a total loss of AC power that compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. In addition, fission product barrier monitoring capabilities may be degraded under these conditions.

This IC represents a condition that involves actual or likely major failures of plant functions needed for the protection of the public.Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.Escalation of the ,mAegrcncy cGlasification lcv.eECL would be via ICs AG-1-RG1, FG1 or SG1.VCSNS Basis Reference(s):

1. FSAR Section 8 2. EOP-6.0 Loss of All ESF AC Power 3. EOP-1.0 Reactor Trip/Safety Injection Actuation 4. SOP-304 115KV/7.2KV Operations
5. SOP-306 Emergency Diesel Generator 6. AOP-304.1 Loss of Bus 1 DA(1 DB) with the Diesel not Available 7. Technical Specifications Bases 3/4.8 8. NEI 99-01 SS1 Page 222 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category:

S -System Malfunction Subcategory:

1 -Loss of ESF AC Power Initiating Condition:

Prolonged loss of all off site and all onsite AC power to ESF buses or loss of all AC and vital DC power sources for 15 minutes or longer.EAL: SG1.1 General Emergency Loss of all offsite and all onsite AC power capability to 7.2 KV ESF buses 1 DA and 1 DB (Table S-1)AND EITHER of the following: " Restoration of at least one ESF bus within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is not likely (Note 1)" CSFST Core Cooling-RED path conditions met Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Table S-1 AC Power Supplies Offsite:* 115 KV power to XTF-4 and XTF-5* 230 KV power to XTF-31* Parr Hydro Plant 13.8 KV power to ESF bus 1DA or 1DB Onsite: " Diesel Generator A" Diesel Generator B Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

None Basis: Page 223 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Plant-Specific As used in this EAL the term "capability" means an AC power source is either currently powering essential loads on one or more 7.2 KV ESF buses or is capable of energizing and powering essential loads on at least one 7.2 KV ESF bus within 15 min.Table S-1 lists AC sources capable of powering ESF buses. Safeguards power originates offsite from two independent sources (ref. 3): 0 The Parr Generating Complex supplies 115 KV power to the two Engineered Safety Feature (ESF) transformers (XTF-4 and XTF-5). The transformer outputs are combined at 7.2 KV bus 1 DX and then supplied to 7.2 KV ESF bus 1 DA (Train A).This is the preferred or normal power source to Train A and the alternate power source for Train B.* 7.2 KV ESF bus 1 DB (Train B) is supplied from the emergency auxiliary transformer (XTF-31).

The emergency auxiliary transformer receives 230 KV power from the Virgil C. Summer substation (switchyard) bus 3. This transformer is the preferred power source for Train B and the alternate power source for Train A.The Parr Hydro Plant provides a 13.8 KV AC line to the 7.2 KV ESF buses. This Alternate AC Power Supply has the capacity to supply only one fully loaded ESF bus (ref. 4).The AAC is designed to provide back-up power to either ESF bus whenever one of the Diesel Generators is out of service, particularly in Modes 1 through 4. The AAC is verified available and an operational readiness status check is performed when it is anticipated that one of the Diesel Generators will be inoperable for longer than the allowed outage time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The design of the AAC is capable of providing the required safety and non-safety related loads in the event of a total loss of offsite power and if both Diesel Generators fail to start and load. During these events it is assumed that there is no seismic event or an event that requires safeguards actuation (e.g., safety injection, containment spray, etc.) Although the AAC is not designed for DBA loads, it is capable of supplying sufficient power to mitigate the effects of an accident.

The AAC is not credited in the safety analysis.

The AAC is, however, capable of mitigating the dominant core damage Page 224 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]sequences and provides a significant overall risk reduction for station operation.

The AAC alone is adequate to supply electrical power to affect a safe shutdown of the plant (ref. 7).The two trains of 7.2 KV safeguards power are also provided with an onsite standby source of power for supplying power when the ESF and emergency auxiliary transformers are not available.

The Diesel Generators A and B are capable of supplying all loads on the distribution network of their respective train (ref. 3, 4, 5, 6, 7).Indication of continuing core cooling degradation is manifested by entry to Critical Safety Function Status Tree (CSFST) Core Cooling-RED or ORANGE path (ref. 8).Critical Safety Function Status Tree (CSFST) Core Cooling-RED or ORANGE path is given in Figure 5 and indicates significant core exit superheating and core uncovery.Generic This IC addresses a prolonged loss of all power sources to AC emergenfy-engineered safeguard (ES) buses. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A prolonged loss of these buses will lead to a loss of one or more fission product barriers.

In addition, fission product barrier monitoring capabilities may be degraded under these conditions.

The EAL should require declaration of a General Emergency prior to meeting the thresholds for IC FG1. This will allow additional time for implementation of offsite protective actions.Escalation of the emergency classification from Site Area Emergency will occur if it is projected that power cannot be restored to at least one A, ermnegenio7.2KV ES bus by the end of the analyzed station blackout coping period. Beyond this time, plant responses and event trajectory are subject to greater uncertainty, and there is an increased likelihood of challenges to multiple fission product barriers.The estimate for restoring at least one ES bus should be based on a realistic appraisal of the situation.

Mitigation actions with a low probability of success Page 225 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]should not be used as a basis for delaying a classification upgrade. The goal is to maximize the time available to prepare for, and implement, protective actions for the public.The EAL will also require a General Emergency declaration if the loss of AC power results in parameters that indicate an inability to adequately remove decay heat from the core.VCSNS Basis Reference(s):

1. FSAR Section 8.3.2.1.2 2. FSAR Section 8.4.1 3. FSAR Section 8 4. EOP-6.0 Loss of All ESF AC Power 5. EOP-1.0 Reactor Trip/Safety Injection Actuation 6. SOP-304 115KV/7.2KV Operations
7. SOP-306 Emergency Diesel Generator 8. EOP-12.0 Monitoring of Critical Safety Functions 9. AOP-304.1 Loss of Bus 1 DA(1 DB) with the Diesel not Available 10. NEI 99-01 SG1 Page 226 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

S -System Malfunction 1 -Loss of ESF AC Power Prolonged loss of all offsite and all onsite AC power to ESF buses or loss of all AC and vital DC power sources for 15 minutes or longer.EAL: SG1.2 General Emergency Loss of all offsite and all onsite AC power (Table S-1) capability to 7.2 KV ESF buses 1 DA and 1DB for ->15 min.AND< 108 VDC on both Train A and Train B vital 125 VDC systems for >- 15 min.(Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Table S-1 AC Power Supplies Offsite:* 115 KV power to XTF-4 and XTF-5 0 230 KV power to XTF-31 0 Parr Hydro Plant 13.8 KV power to ESF bus 1DA or 1DB Onsite: " Diesel Generator A* Diesel Generator B Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

None Basis: Plant-Specific Page 227 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]ESF AC Power As used in this EAL the term "capability" means an AC power source is either currently powering essential loads on one or more 7.2 KV ESF buses or is capable of energizing and powering essential loads on at least one 7.2 KV ESF bus within 15 min.Table S-1 lists AC sources capable of powering ESF buses. Safeguards power originates offsite from two independent sources (ref. 5):* The Parr Generating Complex supplies 115 KV power to the two Engineered Safety Feature (ESF) transformers (XTF-4 and XTF-5). The transformer outputs are combined at 7.2 KV bus 1 DX and then supplied to 7.2 KV ESF bus 1 DA (Train A).This is the preferred or normal power source to Train A and the alternate power source for Train B.* 7.2 KV ESF bus 1 DB (Train B) is supplied from the emergency auxiliary transformer (XTF-31).

The emergency auxiliary transformer receives 230 KV power from the Virgil C. Summer substation (switchyard) bus 3. This transformer is the preferred power source for Train B and the alternate power source for Train A.The Parr Hydro Plant provides a 13.8 KV AC line to the 7.2 KV ESF buses. This Alternate AC Power Supply has the capacity to supply only one fully loaded ESF bus (ref. 4).The AAC is designed to provide back-up power to either ESF bus whenever one of the Diesel Generators is out of service, particularly in Modes 1 through 4. The AAC is verified available and an operational readiness status check is performed when it is anticipated that one of the Diesel Generators will be inoperable for longer than the allowed outage time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The design of the AAC is capable of providing the required safety and non-safety related loads in the event of a total loss of offsite power and if both Diesel Generators fail to start and load. During these events it is assumed that there is no seismic event or an event that requires safeguards actuation (e.g., safety injection, containment spray, etc.) Although the AAC is not designed for DBA loads, it is capable of supplying sufficient power to mitigate the effects of an accident.

The AAC is not credited in the safety analysis.

The AAC is, however, capable of mitigating the dominant core damage Page 228 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]sequences and provides a significant overall risk reduction for station operation.

The AAC alone is adequate to supply electrical power to affect a safe shutdown of the plant (ref. 7).The two trains of 7.2 KV safeguards power are also provided with an onsite standby source of power for supplying power when the ESF and emergency auxiliary transformers are not available.

The Diesel Generators A and B are capable of supplying all loads on the distribution network of their respective train (ref. 1, 2, 3, 4, 5).DC Vital Power Class 1 E 125 VDC power consists of two separate main distribution panels. These panels are DPN-1 HA and DPN-1 HB for the Train A and Train B vital 125 VDC systems (ref. 8).They are both located on the 412' level of the Intermediate Building.

Each main panel is supplied DC power through a battery charger (XBC-1 A and XBC-1 B) and is backed up by a 60 cell, lead-acid storage battery (ref. 9).Minimum DC bus voltage is 108 VDC (ref. 10, 11). MCB annunciators XCP-636 4-6 and XCP-637 4-6 (DC SYS OVRVOLT/UNDRVOLT) signal low Train A and Train B voltage at 126 VDC (ref. 12, 13). Train A and Train B voltage may be monitored on MCB Panel XCP-6116 voltmeters (ref. 14).Generic This IC addresses a concurrent and prolonged loss of both AC and Vital DC power. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A loss of Vital DC power compromises the ability to monitor and control SAFETY SYSTEMS. A sustained loss of both AC and DC power will lead to multiple challenges to fission product barriers.Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. The 15-minute emergency declaration clock begins at the point when both EAL thresholds are met.VCSNS Basis Reference(s):

Page 229 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]1. FSAR Section 8 2. EOP-6.0 Loss of All ESF AC Power 3. EOP-1.0 Reactor Trip/Safety Injection Actuation 4. SOP-304 115KV/7.2KV Operations

5. SOP-306 Emergency Diesel Generator 6. AOP-304.1 Loss of Bus 1 DA(1 DB) with the Diesel not Available 7. Technical Specifications Bases 3/4.8 8. FSAR Figure 8.3-2aa 9. FSAR Section 8.3.2.1 10. EOP-6.0 Loss of All ESF AC Power 11. FSAR Section 8.3.2.1.3 12. ARP-001 -XCP-636 Annunciator Point 4-6 13. ARP-001 -XCP-637 Annunciator Point 4-6 14.201-332 Main Control Board Instrumentation Control Panel XCP-6116 15. NEI 99-01 SG8 Page 230 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El Category:

S -System Malfunction Subcategory:

2 -Loss of Vital DC Power Initiating Condition:

Loss of all vital DC power for 15 minutes or longer.EAL: SS2.1 Site Area Emergency< 108 VDC on both Train A and Train B vital 125 VDC systems for -> 15 min. (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

None Basis: Plant-Specific Class 1 E 125 VDC power consists of two separate main distribution panels. These panels are DPN-1HA and DPN-1HB for the Train A and Train B vital 125 VDC systems (ref. 1).They are both located on the 412' level of the Intermediate Building.

Each main panel is supplied DC power through a battery charger (XBC-1A and XBC-1 B) and is backed up by a 60 cell, lead-acid storage battery (ref. 2).Minimum DC bus voltage is 108 VDC (ref. 3, 4). MCB annunciators XCP-636 4-6 and XCP-637 4-6 (DC SYS OVRVOLT/UNDRVOLT) signal low Train A and Train B voltage at 126 VDC (ref. 5, 6). Train A and Train B voltage may be monitored on MCB Panel XCP-6116 voltmeters (ref. 7).Generic This IC addresses a loss of Vital DC power which compromises the ability to monitor and control SAFETY SYSTEMS. In modes above Cold Shutdown, this condition involves a major failure of plant functions needed for the protection of the public.Page 231 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.Escalation of the emergency classification levelECL would be via ICs AG-1-RG1, FG1 or SG8SG1.VCSNS Basis Reference(s):

1. FSAR Figure 8.3-2aa 2. FSAR Section 8.3.2.1 3. EOP-6.0 Loss of All ESF AC Power 4. FSAR Section 8.3.2.1.3 5. ARP-001 -XCP-636 Annunciator Point 4-6 6. ARP-001 -XCP-637 Annunciator Point 4-6 7. 201-332 Main Control Board Instrumentation Control Panel XCP-6116 8. NEI 99-01 SS8 Page 232 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

S -System Malfunction 3 -Loss of Control Room Indications UNPLANNED loss of Control Room indications for 15 minutes or longer.EAL: SU3.1 Unusual Event An UNPLANNED event results in the inability to monitor one or more Table S-2 parameters from within the Control Room for -> 15 min. (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Table S-2 Safety System Parameters" Reactor power" Reactor vessel/pressurizer level* RCS pressure" Core Exit TCs" Level in at least one SG" EFW/AFW flow Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

UNPLANNED

-A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient.

The cause of the parameter change or event may be known or unknown.Basis: Plant-Specific Display information important in evaluating the performance of a safeguards system during periodic test, continuous normal operation, or post-accident operation is provided on the Main Control Board (MCB) panels XCP-6101 through XCP-6117.

Sufficient process indicators, alarms, and recorders are provided to enable the operator to determine whether Page 233 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El a system is performing normally or if there is some unanticipated failure within a system (ref. 1, 2). The Integrated Plant Computer System (IPCS) monitors selected instrument channels to supplement the display information (ref. 3).CSFST paramters are normally monitored using the SPDS display on the Integrated Plant Computer System (IPCS) (ref. 4).Generic This IC addresses the difficulty associated with monitoring normal plant conditions without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. This condition is a precursor to a more significant event and represents a potential degradation in the level of safety of the plant.As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s).

For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room.An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1 022) to determine if an NRC event report is required.

The event would be reported if it significantly impaired the capability to perform emergency assessments.

In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.

This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, core cooling [PW] / RPV level [Br4] and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition.

In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for reactor vessel level [PWR] ! RPV water Page 234 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]level4WW-cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well.Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation of the emergency classification IcvelECL would be via IC SA2SA3.VCSNS Basis Reference(s):

1. FSAR Section 7.5 2. FSAR Section 7.6 3. OAP-107.1 Control of IPCS Functions 4. EOP-12.0 Monitoring of Critical Safety Functions 5. NEI 99-01 SU2 Page 235 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

S -System Malfunction 3 -Loss of Control Room Indications UNPLANNED loss of Control Room indications for 15 minutes or longer with a significant transient in progress.EAL: SA3.1 Alert An UNPLANNED event results in the inability to monitor one or more Table S-2 parameters from within the Control Room for > 15 min. (Note 1)AND Any of the following transient events in progress: " Automatic or manual runback greater than 25% thermal reactor power" Electrical load rejection greater than 25% full electrical load" Reactor trip* ECCS actuation Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Table S-2 Safety System Parameters" Reactor power* Reactor vessel/pressurizer level" RCS pressure" Core Exit TCs" Level in at least one SG" EFW/AFW flow Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

UNPLANNED

-A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient.

The cause of the parameter change or event may be known or unknown.Basis: Page 236 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El Plant-Specific Display information important in evaluating the performance of a safeguards system during periodic test, continuous normal operation, or post-accident operation is provided on the Main Control Board (MCB) panels XCP-6101 through XCP-6117.

Sufficient process indicators, alarms, and recorders are provided to enable the operator to determine whether a system is performing normally or if there is some unanticipated failure within a system (ref. 1, 2). The Integrated Plant Computer System (IPCS) monitors selected instrument channels to supplement the display information (ref. 3).CSFST paramters are normally monitored using the SPDS display on the Integrated Plant Computer System (IPCS) (ref. 4).Generic This IC addresses the difficulty associated with monitoring rapidly changing plant conditions during a transient without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. During this condition, the margin to a potential fission product barrier challenge is reduced. It thus represents a potential substantial degradation in the level of safety of the plant.As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s).

For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room.An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1 022) to determine if an NRC event report is required.

The event would be reported if it significantly impaired the capability to perform emergency assessments.

In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.

Page 237 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, core cooling [PW.] / RPV level [BWRJ and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition.

In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for reactor vessel level [PWH, / RPV water lveI-[8WRsteam qenerator level cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well.Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation of the mern.gency leveECL would be via ICs FS1 or IC AS4-1RS1.VCSNS Basis Reference(s):

1. FSAR Section 7.5 2. FSAR Section 7.6 3. OAP-107.1 Control of IPCS Functions 4. EOP-1 2.0 Monitoring of Critical Safety Functions 5. NEI 99-01 SA2 Page 238 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category:

S -System Malfunction Subcategory:

4 -RCS Activity Initiating Condition:

Reactor coolant activity greater than Technical Specification allowable limits.EAL: SU4.1 Unusual Event With letdown in service, RM-L1 high range monitor > 39,000 cpm Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

None Basis: Plant-Specific The status of coolant activity and radiation levels is routinely monitored to detect the onset of fuel failure (ref. 1). This EAL addresses reactor coolant letdown line radiation levels sensed by RM-L1 in excess of Technical Specification allowable limits. Primary coolant letdown line radiation monitor RM-L1 provides a means of detecting the presence of failed fuel by indication of an increase in letdown activity which is then verified by analysis of samples. Two detectors with overlapping range are provided.

The low range is designed for the monitor to be on range with the radioactivity resulting from tramp uranium and the corrosion products.

The range of overlap between the low and high range detectors is such that two detectors would be operational in the range of concentrations relating to plant operation with failed fuel (ref. 2). Alarms are received on the MCB panel from the low and high range detectors (ref. 3). The high range alarm is _ 5 X EQUIL, where EQUIL is the normal or expected reading of the monitor when radioactivity is normally present in the sample stream. The low range alarm is _ 2 X EQUIL (ref. 4).Page 239 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]The specified EAL threshold setpoint was calculated using RCS activities given in Table 11.1-2 of the FSAR and included all activities in the table scaled to 1.0 i.Ci/gm dose equivalent iodine (ref. 5, 6).Generic This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications.

This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant.Escalation of the emergen.y leveECL would be via ICs FA1 or the Recognition Category A-R_ICs.VCSNS Basis Reference(s):

1. SAP-154 Failed Fuel Action Plan 2. VCSNS Design Bases Document -Radiation Monitoring System (RM)3. ARP-019-XCP-642
4. HPP-904 Use of the Radiation Monitoring System (RMS)5. TWR 11.0/6.2-07-013 RM-L1 Calculations for New EAL's 6. FSAR Table 11.1-2 7. NEI 99-01 SU3 Page 240 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El Category:

S -System Malfunction Subcategory:

4 -RCS Activity Initiating Condition:

Reactor coolant activity greater than Technical Specification allowable limits.EAL: SU4.2 Unusual Event Sample analysis indicates that a primary coolant activity value is > an allowable limit specified in Technical Specifications 3/4.4.8 Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

None Basis: Plant-Specific This EAL addresses primary coolant samples exceeding Technical Specification LCOs 3/4.4.8, which are applicable in Modes 1, 2 and 3 with RCS average temperature (Tavg)> 500°F (ref. 1). The Technical Specification limits accommodate an iodine spike phenomenon that may occur following changes in thermal power. The Technical Specification LCO limits are established to minimize the offsite radioactivity dose consequences in the event of a steam generator tube rupture (SGTR) accident (ref. 2).Generic This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications.

This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant.Escalation of the emergency classification leveIECL would be via ICs FA1 or the Recognition Category A-R ICs.VCSNS Basis Reference(s):

Page 241 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]1. Technical Specifications 3/4.4.8 2. Technical Specifications Bases 3/4.4.8 3. NEI 99-01 SU3 Page 242 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

EAL: S -System Malfunction 5- RCS Leakage RCS leakage for 15 minutes or longer.SU5.1 Unusual Event RCS unidentified or pressure boundary leakage > 10 gpm for 2 15 min.OR RCS identified leakage > 25 gpm for > 15 min.OR Leakage from the RCS to a location outside containment

> 25 gpm for > 15 min.(Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

None Basis: Plant-Specific Unidentified leakage and identified leakage are determined by performance of the RCS water inventory balance (IPCS CHGNET, LRATE). Pressure boundary leakage would first appear as unidentified leakage and can only be positively identified by inspection (ref. 1).STP-1 14.002 is used to ensure RCS leakage is within Technical Specification limits (ref.2). MCB annunciator XCP-615 3-6 (RCS LEAK DET >1 GPM) signals RCS leakage into the Reactor Building sump that challenges Technical Specifications LCO limits (ref. 1, 4).The rate of primary-to-secondary leakage is determined by comparing the ratio of the activity of a given isotope measured in the secondary plant (i.e., steam generators, condensate or condenser off-gas) to that same isotope in the Reactor Coolant System (ref.5).Page 243 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Technical Specifications (ref. 6) defines RCS leakage as follows: " Controlled Leakage: Seal water flow supplied to the reactor coolant pump seals." Identified Leakage: o Leakage (except Controlled Leakage) into closed systems, such as pump seal or valve packing leaks that are captured and conducted to a sump or collecting tank, or o Leakage into the containment atmosphere from sources that are both specifically located and unknown either not to interfere with the operation of leakage detection systems or not to be Pressure Boundary Leakage, or o Reactor coolant system leakage through a steam generator to the secondary system." Unidentified Leakage: All leakage (except Controlled Leakage) that is not identified leakage." Pressure Boundary Leakage: Leakage (except steam generator tube leakage)through a non-isolable fault in a Reactor Coolant System component body, pipe wall or vessel wall.RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via CVCS/Letdown and interfacing system leakage such as RCS to the Component Cooling Water (CCW system) and RCS sampling system (ref. 7).General symptoms of RCS leakage include the following (ref. 7): " Decreasing Pressurizer level with increased charging flow and normal letdown flow" Increasing radiation level in Containment or the Auxiliary Building indicated by any of the following:

o RM-G5, RB PERSONNEL ACCESS AREA GAMMA o RM-G6, RB REFUEL BRIDGE AREA GAMMA Page 244 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El o RM-A2, RB SAMPLE LINE PARTICULATE (IODINE)(GAS)

ATMOS MONITOR o RM-A3, MAIN PLANT VENT EXH PARTICULATE(IODINE)(GAS)

ATMOS MONITOR o RM-A1 1, AB VENT GAS ATMOS MONITOR" Increasing sump level in Containment or the Auxiliary Building" Increased VCT makeup frequency* Increasing radiation level in the CCW System as indicated on RM-L2A(B), COMPONENT COOLING LIQUID MONITOR" Any of the following Main Control Board annunciators in alarm: o RBCU 1A/2A DRN FLO HI (XCP-606 2-2)o RBCU 1B/2B DRN FLO HI (XCP-607 2-2)o RCS LEAK DET >1GPM (XCP-615 3-6)Generic This IC addresses RCS leakage which may be a precursor to a more significant event. In this case, RCS leakage has been detected and operators, following applicable procedures, have been unable to promptly isolate the leak. This condition is considered to be a potential degradation of the level of safety of the plant.EAL #1 and EAL #2The first and second EAL conditions are focused on a loss of mass from the RCS due to "unidentified leakage", "pressure boundary leakage" or "identified leakage" (as these leakage types are defined in the plant Technical Specifications).

EAL#3The third condition addresses an RCS mass loss caused by an UNISOLABLE leak through an interfacing system. These EALs-conditions thus apply to leakage into the containment, a secondary-side system (e.g., steam generator tube leakage in a PWR) or a location outside of containment.

The leak rate values for each EAL-condition were selected because they are usually observable with normal Control Room indications.

Lesser values typically require time-Page 245 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El consuming calculations to determine (e.g., a mass balance calculation).

E-AL-#-1The first condition uses a lower value that reflects the greater significance of unidentified or pressure boundary leakage.The release of mass from the RCS due to the as-designed/expected operation of a relief valve does not warrant an emergency classification.

Per -PWR&,-aAn emergency classification would be required if a mass loss is caused by a relief valve that is not functioning as designed/expected (e.g., a relief valve sticks open and the line flow cannot be isolated).

For BWE s, a opcn Safety Relief Valve (SRV) or SRV leakage is not considered either identified or unidentified leakage by Technical SpecificatioRs and, therefore, is not applieable to this =AL=.The 15-minute threshold duration allows sufficient time for prompt operator actions to isolate the leakage, if possible.Escalation of the emergeny clas.sification would be via ICs of Recognition Category A-Ror F.VCSNS Basis Reference(s):

1. ARP-001 -XCP-615 Annunciator Point 3-6 2. STP-1 14.002 Operational Leakage Calculation
3. STP-1 14.003 RCS Leak Detection Setpoint Determination
4. Technical Specification 3.4.6.2 5. CP-307 Primary-to-Secondary Leakage Rate Determination
6. Technical Specifications, Definitions
7. AOP-1 01.1 Loss of Reactor Coolant Not Requiring SI 8. ES-1 61 RCS Leakage Management Program 9. FSAR Section 5.2.7 10. FSAR Section 7.6.5 11. NEI 99-01 SU4 Page 246 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category:

S -System Malfunction Subcategory:

6 -RTS Failure Initiating Condition:

Automatic or manual trip fails to shut down the reactor EAL: SU6.1 Unusual Event An automatic trip did not shut down the reactor after any RTS setpoint is exceeded AND A subsequent manual action taken at the reactor control consoles is successful in shutting down the reactor as indicated by reactor power < 5% (Note 8).Note 8: A manual action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 -Power Operation Definition(s):

None Basis: Plant-Specific A reactor trip is automatically initiated by the Reactor Trip System (RTS) when certain continuously monitored parameters exceed predetermined setpoints (ref. 1): Following a successful reactor trip, rapid insertion of the control rods occurs. Nuclear power promptly drops to a few percent of the original power level and then decays to a level some 8 decades less at a startup rate of about -1/3 DPM. The reactor power drop continues until reactor power reaches the point at which the influence of source neutrons on reactor power starts to be observable.

A predictable post-trip response from an automatic reactor trip signal should therefore consist of a prompt drop in reactor power as sensed by the nuclear instrumentation and a negative startup rate as nuclear power drops into the source range (ref. 1).The operator recognizes that the reactor has tripped by observing (ref. 1): Page 247 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]" Any red first-out Reactor Trip annunciator lit* Rapid decrease in neutron flux level as indicated by the NI System" Shutdown and Control Rods fully inserted" Rod Bottom Lights lit If these responses cannot be verified, operators perform contingency actions that manually insert control rods, open the reactor trip and bypass breakers in the Reactor Trip Switchgear (IB-463), and tripping the Rod Drive MG sets in the Rod Drive MG Control Cabinet (IB-463).

Local opening of these breakers requires actions outside of the Control Room; rapid control rod insertion by these methods is therefore not considered a"successful" manual reactor trip. For purposes of emergency classification, a "successful" manual reactor trip, therefore, includes only those immediate actions taken by the reactor operator in the Control Room on the control consoles.

Manual reactor trip switches CS-CR01 and CS-CR01A are located on MCB panels XCP-61 10 and XCP-61114, respectively (ref. 3, 4). These switches and controls can be rapidly manipulated from the specified MCB panels.In the event that the operator identifies a reactor trip is imminent and successfully initiates a manual reactor trip before the automatic trip setpoint is reached, no declaration is required.

The successful manual trip of the reactor before it reaches its automatic trip setpoint or reactor trip signals caused by instrumentation channel failures do not lead to a potential fission product barrier loss. If manual reactor trip actions in the Control Room fail to reduce reactor power below the power associated with the SAFETY SYSTEM design (<5%) (ref. 2), the event escalates to an Alert under EAL SA6.1.Generic This IC addresses a failure of the RP-S-RTS to initiate or complete an automatic or manual reactor (trip [PK] / -cram [BW,,) that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic (trip [PWr-] / scram, is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant.Page 248 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Following the failure on an automatic reactor (trip [PWR1 / scram, operators will promptly initiate manual actions at the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor (tri [PLr] / cram [,.rA/')).

If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.If an initial manual reactor (trip [Pr,- / cram -is unsuccessful, operators will promptly take manual action at another location(s) on the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor (trip [PWR] / ScrFam using a different switch). Depending upon several factors, the initial or subsequent effort to manually (trip [PW'R1] / .cram [BR.]) the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor (trip [PWR] / Sc..ra [B.L] signal. If a subsequent manual or automatic (trip [PWR] /- ,cram ...--R) is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor (trip-[PW,4

/" scram [9144R])).

This action does not include manually driving in control rods or implementation of boron injection strategies.

Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".

Taking the Reactor Mode SWitch to SHUTDOW.AN is considered to bc a mnanual scramn The plant response to the failure of an automatic or manual reactor (trip [PWR34/sGram rBWR]) will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the em.er-gency classification levIe..L will escalate to an Alert via IC SA-SA6. Depending upon the plant response, escalation is also possible via IC FA1. Absent the plant Page 249 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]conditions needed to meet either IC SA5-SA6 or FA1, an Unusual Event declaration is appropriate for this event.A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.Should a reactor (trip [PrD^R] / s.ram signal be generated as a result of plant work (e.g., RPS setpoint testing), the following classification guidance should be applied." If the signal causes a plant transient that should have included an automatic reactor (trip [PWRI / sc-aram [9WR]) and the PPS-RTS fails to automatically shutdown the reactor, then this IC and the EALs are applicable, and should be evaluated." If the signal does not cause a plant transient and the (trip [PWR] / -cram [B. ' RI)failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

VCSNS Basis Reference(s):

1. EOP-1.0 Reactor Trip/Safety Injection Actuation 2. EOP-13.0 Response to Abnormal Nuclear Power Generation
3. 201-326 Main Control Board Instrumentation Control Panel XCP-61 10 4. 201-330 Main Control Board Instrumentation Control Panel XCP-6114 5. NEI 99-01 SU5 Page 250 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category:

S -System Malfunction Subcategory:

6 -RTS Failure Initiating Condition:

Automatic or manual trip fails to shut down the reactor EAL: SU6.2 Unusual Event A manual trip did not shut down the reactor after any manual trip action was initiated AND A subsequent automatic trip or manual trip action taken at the reactor control consoles is successful in shutting down the reactor as indicated by reactor power < 5% (Note 8).Note 8: A manual action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 -Power Operation Definition(s):

None Basis: Plant-Specific This EAL addresses a failure of a manually initiated trip in the absence of having exceeded an automatic RTS trip setpoint and a subsequent automatic or manual trip is successful in shutting down the reactor (reactor power < 5%).A reactor trip is automatically initiated by the Reactor Trip System (RTS) when certain continuously monitored parameters exceed predetermined setpoints (ref. 1): Following a successful reactor trip, rapid insertion of the control rods occurs. Nuclear power promptly drops to a few percent of the original power level and then decays to a level some 8 decades less at a startup rate of about -1/3 DPM. The reactor power drop continues until reactor power reaches the point at which the influence of source neutrons on reactor power starts to be observable.

A predictable post-trip response from an automatic reactor trip signal should therefore consist of a prompt drop in reactor power as Page 251 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]sensed by the nuclear instrumentation and a negative startup rate as nuclear power drops into the source range (ref. 1).The operator recognizes that the reactor has tripped by observing (ref. 1): " Any red first-out Reactor Trip annunciator lit* Rapid decrease in neutron flux level as indicated by the NI System" Shutdown and Control Rods fully inserted* Rod Bottom Lights lit If these responses cannot be verified, operators perform contingency actions that manually insert control rods, open the reactor trip and bypass breakers in the Reactor Trip Switchgear (IB-463), and tripping the Rod Drive MG sets in the Rod Drive MG Control Cabinet (IB-463).

Local opening of these breakers requires actions outside of the Control Room; rapid control rod insertion by these methods is therefore not considered a"successful" manual reactor trip. For purposes of emergency classification, a "successful" manual reactor trip, therefore, includes only those immediate actions taken by the reactor operator in the Control Room on the control consoles.

Manual reactor trip switches CS-CR01 and CS-CR01A are located on MCB panels XCP-61 10 and XCP-6114, respectively (ref. 3, 4). These switches and controls can be rapidly manipulated from the specified MCB panels.Generic This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor (trip [PWRJ / scram [BWRJ) that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic (trip [P,449 / scram, [B. r)A is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant.Following the failure on an automatic reactor (trip [PWRI /.cram .. , operators will promptly initiate manual actions at the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor (trip [PW4R9 /s afir~m [BVWV)). If these manual actions are Page 252 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.If an initial manual reactor (trip [PWRI / scram [BKR,) is unsuccessful, operators will promptly take manual action at another location(s) on the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor (trip [PWA/ / scram [94,4%) using a different switch). Depending upon several factors, the initial or subsequent effort to manually (trip / cram, [B..-.R) the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor (trip oPeW, ] / .cram signal. If a subsequent manual or automatic (trip [P'VW] / [-,r,, is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor (trip [PVWRI / .cram [rR]). This action does not include manually driving in control rods or implementation of boron injection strategies.

Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".

Taking the ReacGto Mode Switch to SHLuTDOW is co.nsidere to be a m.anual ,G.ram aetGR. BW The plant response to the failure of an automatic or manual reactor (trip fPWR]-/-sGraM-BWR]^ will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the em-ergecY leveE. L will escalate to an Alert via IC SA-SA6. Depending upon the plant response, escalation is also possible via IC FAl. Absent the plant conditions needed to meet either IC SA-5-SA6 or FA1, an Unusual Event declaration is appropriate for this event.Page 253 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.Should a reactor (trip [PWR] i/ ..ram [BWR])A signal be generated as a result of plant work (e.g., RPS setpoint testing), the following classification guidance should be applied..If the signal causes a plant transient that should have included an automatic reactor (trip / .cram [B^WR]) and the RPS fails to automatically shutdown the reactor, then this IC and the EALs are applicable, and should be evaluated.

e If the signal does not cause a plant transient and the (trip [PrWRI 6cram failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

VCSNS Basis Reference(s):

1. EOP-1.0 Reactor Trip/Safety Injection Actuation 2. EOP-13.0 Response to Abnormal Nuclear Power Generation
3. 201-326 Main Control Board Instrumentation Control Panel XCP-61 10 4. 201-330 Main Control Board Instrumentation Control Panel XCP-6114 5. NEI 99-01 SU5 Page 254 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

S -System Malfunction 6- RTS Failure Automatic or manual trip fails to shut down the reactor and subsequent manual actions taken at the reactor control consoles are not successful in shutting down the reactor.EAL: SA6.1 Alert An automatic or manual trip fails to shut down the reactor AND Manual actions taken at the reactor control console are not successful in shutting down the reactor as indicated by reactor power -> 5% (Note 8)Note 8: A manual action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 -Power Operation Definition(s):

None Basis: Plant-Specific This EAL addresses any automatic or manual reactor trip signal that fails to shut down the reactor followed by a subsequent manual trip that fails to shut down the reactor to an extent the reactor is producing energy in excess of the heat load for which the SAFETY SYSTEMS were designed (> 5%) (ref. 1). For purposes of emergency classification, a"successful" manual reactor trip, therefore, includes only those immediate actions taken by the reactor operator in the Control Room to actuate manual reactor trip switches CS-CR01 and CS-CR01A (located on MCB panels XCP-61 10 and XCP-6114, respectively) (ref. 2, 3). Although the reactor can be manually tripped using controls on MCB panel XCP-6115 (e.g., depressing MASTER TRIP/EMERGENCY TRIP pushbuttons) (ref. 4), the Page 255 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]turbine/generator trip is not considered a "successful" manual reactor trip when evaluating this EAL.Automatic and manual trips are not considered successful if action away from the Control Room is required to trip the reactor. Local operator actions to open the reactor trip and bypass breakers in the Reactor Trip Switchgear (IB-463), and tripping the Rod Drive MG sets in the Rod Drive MG Control Cabinet (IB-463) are not considered "successful" manual reactor trips. If any of the alternate recovery actions for emergency boration of the RCS listed in EOPs are required to reduce reactor power below the power associated with the SAFETY SYSTEM design (< 5%), the reactor trips have been unsuccessful.

Negative intermediate range startup rate (SUR) is used as an indicator of decreasing power and should be observed following any reactor trip from power (ref. 1).Generic This IC addresses a failure of the RPS-RTS to initiate or complete an automatic or manual reactor (trip-[P14', / Gcram ['WRI) that results in a reactor shutdown, and subsequent operator manual actions taken at the reactor control consoles to shutdown the reactor are also unsuccessful.

This condition represents an actual or potential substantial degradation of the level of safety of the plant. An emergency declaration is required even if the reactor is subsequently shutdown by an action taken away from the reactor control consoles since this event entails a significant failure of the RP-SRTS.A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor (tri [PD4V-] / scram [BW-R),. This action does not include manually driving in control rods or implementation of boron injection strategies.

If this action(s) is unsuccessful, operators would immediately pursue additional manual actions at locations away from the reactor control consoles (e.g., locally opening breakers).

Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".

Taking the Reactor Mode Switch to SHUTDOWN is considered to be a mnanual scramn atin. [BW49 Page 256 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]The plant response to the failure of an automatic or manual reactor (trip f/J-1-sýa6*will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If the failure to shut-down the reactor is prolonged enough to cause a challenge to the core cooling [PWR] / RPV wat/ ..,v, or RCS heat removal safety functions, the eme.gc.. Y classification leve!ECL will escalate to a Site Area Emergency via IC SS6_. Depending upon plant responses and symptoms, escalation is also possible via IC FSl. Absent the plant conditions needed to meet either IC SS65 or FSl, an Alert declaration is appropriate for this event.It is recognized that plant responses or symptoms may also require an Alert declaration in accordance with the Recognition Category F ICs; however, this IC and EAL are included to ensure a timely emergency declaration.

A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.VCSNS Basis Reference(s):

1. EOP-13.0 Response to Abnormal Nuclear Power Generation
2. 201-326 Main Control Board Instrumentation Control Panel XCP-61 10 3. 201-330 Main Control Board Instrumentation Control Panel XCP-6114 4. 201-331 Main Control Board Instrumentation Control Panel XCP-6115 5. NEI 99-01 SA5 Page 257 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Category:

S -System Malfunction Subcategory:

6- RTS Failure Initiating Condition:

Inability to shut down the reactor causing a challenge to core cooling or RCS heat removal.EAL: SS6.1 Site Area Emergency An automatic or manual trip fails to shutdown the reactor AND All manual actions to shut down the reactor are not successful in shutting down the reactor as indicated by reactor power > 5%AND EITHER of the following conditions exist: " CSFST Core Cooling-RED path conditions met" CSFST Heat Sink-RED path conditions met Mode Applicability:

1 -Power Operation Definition(s):

None Basis: Plant-Specific This EAL addresses the following: " Any automatic or manual reactor trip signal followed by a manual trip that fails to shut down the reactor to an extent the reactor is producing energy in excess of the heat load for which the SAFETY SYSTEMS were designed (> 5%, ref. 1) (EAL SA6.1), and* Indications that either core cooling is extremely challenged (CSFST Core Cooling-RED path) or heat removal is extremely challenged (CSFST Heat Sink-Red path)(ref. 2.)Page 258 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Manual reactor trip switches CS-CR01 and CS-CR01A are located on MCB panels XCP-6110 and XCP-6114, respectively (ref. 3, 4). These controls can be rapidly manipulated from the specified MCB panels and constitute the normal methods of initiating a manual trip. These are the only manual trip methods applicable to evaluation of EAL SA6.1.At the Site Area Emergency classification level, however, additional capabilities away from the Control Room may be considered such as opening the reactor trip and bypass breakers in the Reactor Trip Switchgear (IB-463) and tripping the Rod Drive MG sets in the Rod Drive MG Control Cabinet (IB-463).Indication that core cooling is extremely challenged is manifested by entry to Critical Safety Function Status Tree (CSFST) Core Cooling-RED path (Figure 5) (ref. 2). Indication that heat removal is extremely challenged is manifested by entry to CSFST Heat Sink-RED path (Figure 6) (ref. 2).The setpoint values provided in brackets following the normal setpoint values in the CSFSTs are used under adverse containment conditions.

Adverse containment conditions are defined as either (ref. 6): " Hi-1 RB pressure (> 3.6 psig), or" Containment Hi-radiation

(> 100,000 Rads integrated dose)The IPCS monitors these parameters and indicates when adverse containment values should be used. The instruments available to monitor these containment parameters are Containment pressure on PI-950, PI-951, PI-952 or PI-953, and Containment radiation on RM-G7 or RM-G18. When no adverse values are provided, the given setpoint is used for any containment condition, as the parameter measurement is independent of containment atmosphere.

If containment pressure decreases below the adverse pressure setpoint after it has been exceeded, the normal values are again used. Once the adverse radiation level setpoint is exceeded, the adverse containment values must be utilized through event recovery and establishment of normal operating procedures.

Engineering should then be requested to evaluate instrumentation inaccuracies.

Generic Page 259 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor (trip [PW14 / ..ram [VVR) that results in a reactor shutdown, all subsequent operator actions to manually shutdown the reactor are unsuccessful, and continued power generation is challenging the capability to adequately remove heat from the core and/or the RCS. This condition will lead to fuel damage if additional mitigation actions are unsuccessful and thus warrants the declaration of a Site Area Emergency.

In some instances, the emergency classification resulting from this IC/EAL may be higher than that resulting from an assessment of the plant responses and symptoms against the Recognition Category F ICs/EALs.

This is appropriate in that the Recognition Category F ICs/EALs do not address the additional threat posed by a failure to shut-down the reactor.The inclusion of this IC and EAL ensures the timely declaration of a Site Area Emergency in response to prolonged failure to shutdown the reactor.A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.Escalation of the emergency classification

!evc!ECL would be via IC AG-1-RG1 or FGI.VCSNS Basis Reference(s):

1. EOP-13.0 Response to Abnormal Nuclear Power Generation
2. EOP-12.0 Monitoring of Critical Safety Functions 3. 201-326 Main Control Board Instrumentation Control Panel XCP-61 10 4. 201-330 Main Control Board Instrumentation Control Panel XCP-6114 5. 201-331 Main Control Board Instrumentation Control Panel XCP-6115 6. OAP-103.4 EOP/AOP User's Guide 7. NEI 99-01 SS5 Page 260 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

EAL: S -System Malfunction 7 -Loss of Communications Loss of all onsite or offsite communications capabilities.

SU7.1 Unusual Event Loss of all Table S-3 onsite communication methods OR Loss of all Table S-3 ORO/NRC communication methods Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

None Basis: Plant-Specific Page 261 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]The Table S-3 list for onsite communications loss encompasses the loss of all means of routine communications (e.g., commercial and intemal telephones, page party system (Gai-Tronics) and radios) (ref. 1, 2, 3).The Table S-3 list for offsite (ORO/NRC) communications loss encompasses the loss of all means of communications with offsite authorities.

This includes the FTS (ENS), commercial telephone lines and dedicated phone systems (fiberoptic and satellite) (ref. 1, 2,3).This EAL is the hot condition equivalent of the cold condition EAL CU5.1.Generic This IC addresses a significant loss of on-site or offsite communications capabilities.

While not a direct challenge to plant or personnel safety, this event warrants prompt notifications to OROs and the NRC.This IC should be assessed only when extraordinary means are being utilized to make communications possible (e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points, individuals being sent to offsite locations, etc.).EWAL-#The first EAL condition addresses a total loss of the communications methods used in support of routine plant operations.

EAL-#2The second EAL condition addresses a total loss of the communications methods used to notify all OROs or NRC of an emergency declaration.

The OROs referred to here are (see Dev.lope.

Notes) the State, Fairfield, Newberry, Lexington and Richland County EOCs as well as the NRC.EAL #3 add rcsses a total loss of the communications methods used to notify the NR of an emergency decl-aration.

VCSNS Basis Reference(s):

1. FSAR 9.5.2 2. EP-100 Radiation Emergency Plan, Section 7.5 3. EP-100 Radiation Emergency Plan, Figure 7-2 Page 262 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El 4. NEI 99-01 SU6 Page 263 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category:

S -System Malfunction Subcategory:

8 -Containment Isolation Failure Initiating Condition:

Failure to isolate containment or loss of containment pressure control EAL: SU8.1 Unusual Event Containment isolation actuated AND At least one isolation valve in each penetration is not closed within 15 min. of the actuation (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

None Basis: Plant-Specific None Generic This IC addresses a failure of one or mor ontainment penetrations to automatically isolate (close) when required by an actuation signal. it also addresse.

an event that reul~ts in high ,ontainment pressure with a failure Of containment pressure."ntrol systems. Absent challenges to another fission product barrier, eite-r-this condition represents potential degradation of the level of safety of the plant.Fer EAL #-,4ltThe containment isolation signal must be generated as the result on an off-normal/accident condition (e.g., a safety injection or high containment pressure);

a failure resulting from testing or maintenance does not warrant classification.

The determination of Page 264 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]containment and penetration status -isolated or not isolated -should be made in accordance with the appropriate criteria contained in the plant AOPs and EOPs. The 15-minute criterion is included to allow operators time to manually isolate the required penetrations, if possible.E1t7=AL#2 addrcsscs a GcGond*ito where cRontaiRmet pre-6ure i6 greator than the6netp-ont at Which containment energy (heat) removal systems6 are designed to autematically actuate., and less than one full train of equipment i6 capable of operating per design. The 15-minute criterion is included to allow operators, time to m~anually Start equipment that Ma" not have automatically started, if possible.

The inability to satal the required equipment indicates thatGcontainment heat removal/depressurizatiOn systems (e.g., containmen~t sprys r ie condenser fans) are either lost or perforFming in a degraded mannr.This event would escalate to a Site Area Emergency in accordance with IC FS1 if there were a concurrent loss or potential loss of either the Fuel Clad or RCS fission product barriers and a direct release pathway to the environment as a result of the failed isolation.

VCSNS Basis Reference(s):

1. EOP-2.5 LOCA Outside Containment
2. EOP-1.0 Attachment 3 SI Equipment Verification
2. NEI 99-01 SU7 Page 265 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

S -System Malfunction 8 -Containment Isolation Failure Failure to isolate containment or loss of containment pressure control.EAL: SU8.2 Unusual Event Containment pressure > 12 psig AND< one full train of depressurization equipment (Table S-4) is operating per designfor> 15 min.(Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Table S-4 Full Train Depressurization Equipment RBCU Groups Containment Sprays Operating Operating 2 0 1 1 0 2 Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

None Basis: Plant-Specific The Containment pressure setpoint (12 psig, ref. 2, 3) is the pressure at which the Containment Spray System should actuate and begin performing its function.

The design Page 266 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT El basis accident analyses and evaluations assume the loss of one Containment Spray System train (ref. 2, 3).Each spray subsystem is started by separate ESF containment isolation Phase A and spray actuation signals. Normally, both subsystems operate; however, they are independent and can operate individually.

Although the design basis for Reactor Building heat removal is one spray subsystem operating in conjunction with one Reactor Building Cooling Unit (with one RHR pump and one charging pump providing emergency core cooling water), two Reactor Building Cooling Units (RBCUs) with no spray pumps or two spray pumps with no RBCUs can handle all required heat loads Technical Specifications defined equipment that comprises one full train of depressurization equipment is given in the note (ref. 1, 2, 4, 5).RBCU operation verification is performed in accordance with EOP-1.0 Attachment 3 SI Equipment Verification.

In order to take credit for a RBCU operating per design, each RBCU must meet minimum Service Water flow requirements (ref. 6).Generic This IC addr.ssc.

a failure Of one Or more containm.ent penetration-to automatically iso-late (cIoe) when required by an actuatin signal. it also addresses an event that results in high containment pressure with a concurrent failure of containment pressure control systems. Absent challenges to another fission product barrier, either-this condition represents potential degradation of the level of safety of the plant.For EAL #1, the containment isolation signal must be generated as the result On an offýnormnal/accident conditionR (e.g., a safety injectionR or high GGntainment pressure);

a fai!ur resulting frM testing or m.aintenance does not warrant classification.

The d-tef ,,iat, , of containment anld penetration status6 isolated or not isolated should be madei accordance with the appropriate Griteria contained in the plant AQPs and F=01s. The 15 penetratiGRG-it pessible-EAL-#2This EAL addresses a condition where containment pressure is greater than the setpoint at which containment energy (heat) removal systems are designed to automatically actuate, and less than one full train of equipment is capable of operating per design. The 15-minute criterion is included to allow operators time to manually start Page 267 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]equipment that may not have automatically started, if possible.

The inability to start the required equipment indicates that containment heat removal/depressurization systems (e.g., containment sprays Or ice condenser fans) are either lost or performing in a degraded manner.This event would escalate to a Site Area Emergency in accordance with IC FS1 if there were a concurrent loss or potential loss of either the Fuel Clad or RCS fission product barriers.VCSNS Basis Reference(s):

1. FSAR Section 6.2.2.2.1.2
2. OAP-103.2 Emergency Operating Procedure Setpoint Document 3. EOP-12.0 Monitoring of Critical Safety Functions 4. Technical Specifications 3/4-6.2.1 5. Technical Specifications 3/4-6.2.3 6. EOP-1.0 Reactor Trip/Safety Injection Actuation Attachmen 3 SI Equipment Verification
7. NEI 99-01 SU7 Page 268 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

EAL: S -System Malfunction 9 -Hazardous Event Affecting Safety System Hazardous event affecting a SAFETY SYSTEM needed for the current operating mode.SA9.1 Alert The occurrence of any Table S-5 hazardous event AND EITHER of the following: " Event damage has caused indications of degraded performance in at least one train of a SAFETY SYSTEM needed for the current operating mode" The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component or structure needed for the current operating mode Table S-5 Hazardous Events* Seismic event (earthquake)

  • Internal or external FLOODING event* High winds or tornado strike* FIRE* EXPLOSION* Other events with similar hazard characteristics as determined by the Shift Supervisor Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

EXPLOSION

-A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization.

A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an EXPLOSION.

Such Page 269 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]events require a post-event inspection to determine if the attributes of an EXPLOSION are present.FIRE- Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIRES. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.FLOODING -A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area.SAFETY SYSTEM -A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary;(2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

VISIBLE DAMAGE -Damage to a component or structure that is readily observable without measurements, testing, or analysis.

The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure.

Basis: Plant-Specific

  • The significance of seismic events are discussed under EAL HU2.1 (ref. 1).* Internal FLOODING may be caused by events such as component failures, equipment misalignment, or outage activity mishaps (ref. 2).Page 270 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El* Seismic Category I structures are analyzed to withstand a sustained, design wind velocity of at least 100 mph (sustained). (ref. 3).* Refer to VCSNS Fire Protection Evaluation Report, Section 4.0 "Hazards Analysis" to identify areas containing functions and systems required for safe shutdown of the plant (ref. 4)" An EXPLOSION (including a steam line explosion) that degrades the performance of a SAFETY SYSTEM train or visibly damages a SAFETY SYSTEM component or structure would be classified under this EAL. The need to classify a steam line break not considered an explosion itself is considered in fission product barrier degradation monitoring (EAL Category F).Generic This IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode. This condition significantly reduces the margin to a loss or potential loss of a fission product barrier, and therefore represents an actual or potential substantial degradation of the level of safety of the plant.EAL !.b.!The first condition addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available.

The indications of degraded performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.EAL-1-.b2The second condition addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent through indications alone, or to a structure containing SAFETY SYSTEM components.

Operators will make this determination based on the totality of available event and damage report information.

This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage.Escalation of the emergency classification 1evelECL would be via IC FS1 or AS1-RS1.VCSNS Basis Reference(s):

Page 271 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]1. ES-426 Earthquake Response Procedure 2. VCSNS IPE Internal Flooding Analysis Workbook 3. FSAR Section 3.3.1 4. VCSNS Fire Protection Evaluation Report 5. NEI 99-01 SA9 Page 272 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category F -Fission Product Barrier Degradation EAL Group: Hot Conditions (RCS temperature

> 200'F);EALs in this category are applicable only in one or more hot operating modes.EALs in this category represent threats to the defense in depth design concept that precludes the release of highly radioactive fission products to the environment.

This concept relies on multiple physical barriers any one of which, if maintained intact, precludes the release of significant amounts of radioactive fission products to the environment.

The primary fission product barriers are: A. Fuel Clad (FC): The Fuel Clad Barrier consists of the cladding material that contains the fuel pellets.B. Reactor Coolant System (RCS): The RCS Barrier includes the RCS primary side and its connections up to and including the pressurizer safety and relief valves, and other connections up to and including the primary isolation valves.C. Containment (CMT): The Containment Barrier includes the containment building and connections up to and including the outermost containment isolation valves.This barrier also includes the main steam, feedwater, and blowdown line extensions outside the containment building up to and including the outermost secondary side isolation valve. Containment Barrier thresholds are used as criteria for escalation of the ECL from Alert to a Site Area Emergency or a General Emergency.

The EALs in this category require evaluation of the loss and potential loss thresholds listed in the fission product barrier matrix of Table F-1 (Attachment 2). "Loss" and "Potential Loss" signify the relative damage and threat of damage to the barrier. "Loss" means the barrier no longer assures containment of radioactive materials. "Potential Loss" means integrity of the barrier is threatened and could be lost if conditions continue to degrade.The number of barriers that are lost or potentially lost and the following criteria determine the appropriate emeregncy classification 1eveECL: Alert: Any loss or any potential loss of either Fuel Clad or RCS Page 273 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Site Area Emergency:

Loss or potential loss of any two barriers General Emergency:

Loss of any two barriers and loss or potential loss of the third barrier The logic used for Category F EALs reflects the following considerations: " The Fuel Clad Barrier and the RCS Barrier are weighted more heavily than the Containment Barrier." Unusual Event ICs associated with fission product barriers are addressed in Recognition Category S.For accident conditions involving a radiological release, evaluation of the fission product barrier thresholds will need to be performed in conjunction with dose assessments to ensure correct and timely escalation of the emergency classification.

For example, an evaluation of the fission product barrier thresholds may result in a Site Area Emergency classification while a dose assessment may indicate that an EAL for General Emergency IC RG1 has been exceeded.The fission product barrier thresholds specified within a scheme reflect plant-specific VCSNS Unit 1 design and operating characteristics.

As used in this category, the term RCS leakage encompasses not just those types defined in Technical Specifications but also includes the loss of RCS mass to any location-inside the containment, a secondary-side system (i.e., steam generator tube leakage), an interfacing system, or outside of the containment building.

The release of liquid or steam mass from the RCS due to the as-designed/expected operation of a relief valve is not considered to be RCS leakage.At the Site Area Emergency level, classification decision-makers should maintain cognizance of how far present conditions are from meeting a threshold that would require a General Emergency declaration.

For example, if the Fuel Clad and RCS fission product barriers were both lost, then there should be frequent assessments of containment Page 274 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]radioactive inventory and integrity.

Alternatively, if both the Fuel Clad and RCS fission product barriers were potentially lost, the Emergency Director would have more assurance that there was no immediate need to escalate to a General Emergency.

Page 275 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category:

Fission Product Barrier Degradation Subcategory:

N/A Initiating Condition:

Any loss or any potential loss of either Fuel Clad or RCS EAL: FAI.1 Alert Any loss or any potential loss of either Fuel Clad or RCS (Table F-i)Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

None Basis: Plant-Specific Fuel Clad, RCS and Containment comprise the fission product barriers.

Table F-1 (Attachment

2) lists the fission product barrier thresholds, bases and references.

At the Alert classification level, Fuel Clad and RCS barriers are weighted more heavily than the Containment barrier. Unlike the Containment barrier, loss or potential loss of either the Fuel Clad or RCS barrier may result in the relocation of radioactive materials or degradation of core cooling capability.

Note that the loss or potential loss of Containment barrier in combination with loss or potential loss of either Fuel Clad or RCS barrier results in declaration of a Site Area Emergency under EAL FS1.1.Generic None VCSNS Basis Reference(s):

1. NEI 99-01 FA1 Page 276 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category:

Fission Product Barrier Degradation Subcategory:

N/A Initiating Condition:

Loss or potential loss of any two barriers EAL: FS1.1 Site Area Emergency Loss or potential loss of any two barriers (Table F-i)Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Standby, 4 -Hot Shutdown Definition(s):

None Basis: Plant-Specific Fuel Clad, RCS and Containment comprise the fission product barriers.

Table F-1 (Attachment

2) lists the fission product barrier thresholds, bases and references.

At the Site Area Emergency classification level, each barrier is weighted equally. A Site Area Emergency is therefore appropriate for any combination of the following conditions: " One barrier loss and a second barrier loss (i.e., loss -loss)" One barrier loss and a second barrier potential loss (i.e., loss -potential loss)" One barrier potential loss and a second barrier potential loss (i.e., potential loss -potential loss)At the Site Area Emergency classification level, the ability to dynamically assess the proximity of present conditions with respect to the threshold for a General Emergency is important.

For example, the existence of Fuel Clad and RCS Barrier loss thresholds in addition to offsite dose assessments would require continual assessments of radioactive inventory and Containment integrity in anticipation of reaching a General Emergency classification.

Alternatively, if both Fuel Clad and RCS potential loss thresholds existed, Page 277 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]the Emergency Director would have greater assurance that escalation to a General Emergency is less imminent.Generic None VCSNS Basis Reference(s):

1. NEI 99-01 FS1 Page 278 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

EAL: Fission Product Barrier Degradation N/A Loss of any two barriers and loss or potential loss of the third barrier FG1.1 General Emergency Loss of any two barriers AND Loss or potential loss of the third barrier (Table F-i)Mode Applicability:

1 -Power Operation, 2 -Startup, 3 -Hot Shutdown, 4 -Hot Standby Definition(s):

None Basis: Plant-Specific Fuel Clad, RCS and Containment comprise the fission product barriers.

Table F-1 (Attachment

2) lists the fission product barrier thresholds, bases and references.

At the General Emergency classification level each barrier is weighted equally. A General Emergency is therefore appropriate for any combination of the following conditions: " Loss of Fuel Clad, RCS and Containment barriers" Loss of Fuel Clad and RCS barriers with potential loss of Containment barrier" Loss of RCS and Containment barriers with potential loss of Fuel Clad barrier" Loss of Fuel Clad and Containment barriers with potential loss of RCS barrier Generic None VCSNS Basis Reference(s):

1. NEI 99-01 FG1 Page 279 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category I -Independent Spent Fuel Storage Installation (ISFSI)EAL Group: ANY (EALs in this category are applicable to any plant condition, hot or cold.)An independent spent fuel storage installation (ISFSI) is a complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage. A significant amount of the radioactive material contained within a canister must escape its packaging and enter the biosphere for there to be a significant environmental effect resulting from an accident involving the dry storage of spent nuclear fuel. Formal offsite planning is not required because the postulated worst-case accident involving an ISFSI has insignificant consequences to the public health and safety.A Notification of Unusual Event is declared on the basis of the occurrence of an event of sufficient magnitude that a loaded cask confinement boundary is damaged or violated.Page 280 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Category: Subcategory:

Initiating Condition:

EAL: ISFSI Confinement Boundary Damage to a loaded cask CONFINEMENT BOUNDARY IU1.1 Unusual Event Damage to a loaded cask CONFINEMENT BOUNDARY as indicated by an on-contact radiation reading greater than the following on the surface of the spent fuel cask (overpack):

  • 60 mrem/hr (T + rn) on the top of the overpack* 600 mrem/hr (T + rn) on the side of the overpack Mode Applicability:

All Definition(s):

CONFINEMENT BOUNDARY-.

The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As applied to the VCS ISFSI, the CONFINEMENT BOUNDARY is defined to be the HI-STORM Multi-Purpose Canister (MPC).Basis: Plant-Specific Overpacks are the casks which receive and contain the sealed MPCs for interim storage on the ISFSI. They provide gamma and neutron shielding, and provide for ventilated air flow to promote heat transfer from the MPC to the environs.

The term overpack does not include the transfer cask (ref. 1).The values shown represent 2 times the limits specified in the ISFSI Certificate of Compliance Technical Specification section 5.3.4 for radiation external to a loaded MPC overpack (ref. 1).Generic Page 281 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]This IC addresses an event that results in damage to the CONFINEMENT BOUNDARY of a sterage Ga MPC containing spent fuel. It applies to irradiated fuel that is licensed for dry storage beginning at the point that the sealed MPC is loaded into the storage cask (overpack)-i4 sealed. The issues of concern are the creation of a potential or actual release path to the environment, degradation of one or more fuel assemblies due to environmental factors, and configuration changes which could cause challenges in removing the cask or fuel from storage.The existence of "damage" is determined by radiological survey. The technical specification multiple of "2 times", which is also used in Recognition Category A-R IC RAU1, is used here to distinguish between non-emergency and emergency conditions.

The emphasis for this classification is the degradation in the level of safety of the spent fuel cask and not the magnitude of the associated dose or dose rate. It is recognized that in the case of extreme damage to a loaded cask, the fact that the "on-contact" dose rate limit is exceeded may be determined based on measurement of a dose rate at some distance from the cask.Security-related events for ISFSIs are covered under ICs HU1 and HAl.VCSNS Basis Reference(s):

1. Certificate of Compliance No. 1032 Appendix A Technical Specifications for the HI-STORM FW MPC Storage System 2. NEI 99-01 E-HU1 Page 282 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]ATTACHMENT 2 FISSION PRODUCT BARRIER MATRIX AND BASES Page 283 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Introduction Table F-1 lists the threshold conditions that define the Loss and Potential Loss of the three fission product barriers (Fuel Clad, Reactor Coolant System, and Containment).

The table is structured so that the three barriers occupy adjacent columns. Each fission product barrier column is further divided into two columns; one for Loss thresholds and one for Potential Loss thresholds.

The first column of the table (to the left of the Fuel Clad Barrier Loss column) lists the categories (types) of fission product barrier thresholds.

The fission product barrier categories are: 1. RCS or SG Tube Leakage 2. Inadequate Heat Removal 3. CMT Radiation

/ RCS Activity 4. CMT Integrity or Bypass 5. Emergency Director Judgment Each category occupies a row in Table F-1 thus forming a matrix defined by the category rows and the Loss/Potential Loss columns. The intersection of each category row with each Loss/Potential Loss column forms a cell in which one or more fission product barrier thresholds appear. If NEI 99-01 does not define a threshold for a barrier Loss/Potential Loss, the word "None" is entered in the cell.Thresholds are assigned letters within each Loss and Potential Loss column beginning with "A." In this manner, a threshold can be identified by its category number and threshold letter. For example, the first Fuel Clad barrier Loss in Category 2 is "FC Loss 2.A," the third Containment barrier Potential Loss in Category 4 is "CMT P-Loss 4.C," etc.If a cell in Table F-1 contains more than one threshold, each of the thresholds, if exceeded, signifies a Loss or Potential Loss of the barrier. It is not necessary to exceed all of the thresholds in a category before declaring a barrier Loss/Potential Loss.Page 284 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Subdivision of Table F-1 by category facilitates association of plant conditions to the applicable fission product barrier Loss and Potential Loss thresholds.

This structure promotes a systematic approach to assessing the classification status of the fission product barriers.When equipped with knowledge of plant conditions related to the fission product barriers, the EAL-user first scans down the category column of Table F-1, locates the likely category and then reads across the row of fission product barrier Loss and Potential Loss thresholds in that category to determine if any threshold has been exceeded.

If a threshold has not been exceeded in that category row, the EAL-user proceeds to the next likely category and continues review of the row of thresholds in the new category The EAL-user must examine each of the three fission product barriers to determine if other barrier thresholds in the category are lost or potentially lost. For example, if Reactor Building radiation is sufficiently high (i.e., > 20,000 R/hr), a Loss of the Fuel Clad and RCS barriers and a Potential Loss of the Containment barrier exist. Barrier Losses and Potential Losses are then applied to the algorithms given in EALs FG1.1, FS1.1 and FA1.1 to determine the appropriate emergency classification.

In the remainder of this Attachment, the Fuel Clad barrier threshold bases appear first, followed by the RCS barrier and finally the Containment barrier threshold bases. In each barrier, the bases are given according to category Loss followed by category Potential Loss beginning with Category 1, then 2.. .5.Page 285 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Table F-1 Fission Product Barrier Threshold Matrix Fuel Clad Barrier Reactor Coolant System Barrier Containment Barrier Category Loss Potential Loss Loss Potential Loss Loss Potential Loss A. An automatic or manual ECCS A. Operation of a standby charging 1 (SI) actuation required by pump is required by EITHER.RCS or None None EITHER: -UNISOLABLE RCS leakage A. A leaking or RUPTURED SG is None RCS Tue Ne- UNISOLABLE RCS

  • SG tube RUPTURE FAULTED outside of containment LoeasG leakage B. CSFST Integrity-RED path go -SG tube RUPTURE conditions met A. CSFST Core Cooling- RANGF A. CSFST Core Cooling-RED path 2 path conditions met A. CSFST Heat Sink-RED path conditions met condndiionssmet Inadequate A. CSFST Core Cooling-RED B. CSFST Heat Sink-RED path conditions met Heat path conditions met conditions met None AND None AND Restoration procedures not Removal AND Heat sink is required effective within 15 mi. (Note 1)Heat sink is required 3 A 3A. RM-G7orRM-G18 CNTMT HI CMT RNG Gamma > 2,000 R/hr None A. RM-G7 or RM-G18 CNTMT HI None None A. RM-G7 or RM-G18 CNTMT HI RNG Radiation B. Dose equivalent 1-131 coolant nRNG Gamma > 100 R/hr Gamma > 20,000 R/hr/ RCS activity > 300 pCigm Activity A. Containment isolation is required A. CSFST Containment-RED path AND EITHER: conditions met 4 .Containment integrity has B. Containment hydrogen concentratior been lost based on ED > 4%CMT None None None None judgment C. Containment pressure > 12 psig Integrity
  • UNISOLABLE pathway from AND or Bypass containment to the environment

< one full train of depressurization exists equipment (Table F-2) is operating B. Indications of RCS leakage per design for a 15 min. (Note 1)outside of containment 5 A. Any condition in the opinion of A. Any condition in the opinion of A. Any condition in the opinion of A. Any condition in the opinion of the A. Any condition in the opinion of A. Any condition in the opinion of the the ED that indicates loss of the the ED that indicates potential the ED that indicates loss of the ED that indicates potential loss of the ED that indicates loss of the ED that indicates potential loss of ED fuel clad barrier loss of the fuel clad barrier RCS barrier the RCS barrier containment barrier the containment barrier Judgment Table F-2 Full Train Deprsaaurizmtion Equipment RBCU Groups Containment Sprays Operng Operating 2 0 1 1 0 2 Page 286 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Category: Degradation Threat: Threshold:

Fuel Clad 1. RCS or SG Tube Leakage Loss None Definition(s):

N/A Basis: Plant-Specific N/A Generic N/A VCSNS Basis Reference(s):

N/A Page 287 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Category: Degradation Threat: Threshold:

Fuel Clad 1. RCS or SG Tube Leakage Potential Loss None Definition(s):

N/A Basis: Plant-Specific N/A Generic N/A VCSNS Basis Reference(s):

N/A Page 288 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT El Barrier: Fuel Clad Category:

2. Inadequate Heat Removal Degradation Threat: Loss Threshold:

A. CSFST Core Cooling-RED path conditions met Definition(s):

None Basis: Plant-Specific Critical Safety Function Status Tree (CSFST) Core Cooling-RED path is given in Figure 5 and indicates significant core exit superheating and core uncovery.

The CSFSTs are normally monitored using the SPDS display on the Integrated Plant Computer System (IPCS). (ref. 1)The setpoint values provided in brackets following the normal setpoint values in the CSFSTs are used under adverse containment conditions.

Adverse containment conditions are defined as either (ref. 4): " Hi-1 RB pressure (_> 3.6 psig), or" Containment Hi-radiation

(> 100,000 Rads integrated dose)The IPCS monitors these parameters and indicates when adverse containment values should be used. The instruments available to monitor these containment parameters are Containment pressure on PI-950, PI-951, PI-952 or PI-953, and Containment radiation on RM-G7 or RM-G18. When no adverse values are provided, the given setpoint is used for any containment condition, as the parameter measurement is independent of containment atmosphere.

If containment pressure decreases below the adverse pressure setpoint after it has been exceeded, the normal values are again used. Once the adverse radiation level setpoint is exceeded, the adverse containment values must be utilized through event Page 289 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT El recovery and establishment of normal operating procedures.

Engineering should then be requested to evaluate instrumentation inaccuracies (ref. 3).Generic This reading indicates temperatures within the core are sufficient to cause significant superheating of reactor coolant.VCSNS Basis Reference(s):

1. EOP-12.0 Monitoring of Critical Safety Functions 2. EOP-14.0 Response to Inadequate Core Cooling 3. EOP-14.1 Response to Degraded Core Cooling 4. OAP-103.4 EOP/AOP User's Guide 5. NEI 99-01 Inadequate Heat Removal Fuel Clad Loss 2.A Page 290 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Fuel Clad Category:
2. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

A. CSFST Core Cooling-ORANGE path conditions met Definition(s):

None Basis: Plant-Specific Critical Safety Function Status Tree (CSFST) Core Cooling-ORANGE path is given in Figure 5 and indicates subcooling has been lost and that some fuel clad damage may potentially occur (ref. 1).The CSFSTs are normally monitored using the SPDS display on the Integrated Plant Computer System (IPCS) (ref. 1).The setpoint values provided in brackets following the normal setpoint values in the CSFSTs are used under adverse containment conditions.

Adverse containment conditions are defined as either (ref. 4): " Hi-1 RB pressure (> 3.6 psig), or" Containment Hi-radiation

(> 100,000 Rads integrated dose)The IPCS monitors these parameters and indicates when adverse containment values should be used. The instruments available to monitor these containment parameters are Containment pressure on PI-950, PI-951, PI-952 or PI-953, and Containment radiation on RM-G7 or RM-G18. When no adverse values are provided, the given setpoint is used for any containment condition, as the parameter measurement is independent of containment atmosphere.

If containment pressure decreases below the adverse pressure setpoint after it has been exceeded, the normal values are again used. Once the adverse radiation level setpoint is exceeded, the adverse containment values must be utilized through event Page 291 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]recovery and establishment of normal operating procedures.

Engineering should then be requested to evaluate instrumentation inaccuracies (ref. 3).Generic This reading indicates a reduction in reactor vessel water level sufficient to allow the onset of heat-induced cladding damage.VCSNS Basis Reference(s):

1. EOP-12.0 Monitoring of Critical Safety Functions 2. EOP-14.0 Response to Inadequate Core Cooling 3. EOP-14.1 Response to Degraded Core Cooling 4. OAP-103.4 EOP/AOP User's Guide 5. NEI 99-01 RCS or SG Tube Leakage Potential Loss 1.A Page 292 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Fuel Clad Category:
2. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

B. CSFST Heat Sink-RED path conditions met AND Heat sink is required Definition(s):

None Basis: Plant-Specific In combination with RCS Potential Loss 2.A, meeting this threshold results in a Site Area Emergency.

Critical Safety Function Status Tree (CSFST) Heat Sink-RED path is given in Figure 6 and indicates the ultimate heat sink function is under extreme challenge and that some fuel clad damage may potentially occur (ref. 1).The CSFSTs are normally monitored using the SPDS display on the Integrated Plant Computer System (IPCS) (ref. 1).The phrase "and heat sink required" precludes the need for classification for conditions in which RCS pressure is less than SG pressure or Heat Sink-RED path entry was created through operator action directed by an EOP. For example, EOP-1 5.0 is entered from CSFST Heat Sink-Red.

Step 1 tells the operator to determine if heat sink is required by checking that RCS pressure is greater than any non-faulted SG pressure and RCS Thot is greater than 350 0 F. If these conditions exist, Heat Sink is required.

Otherwise, the operator is to either return to the procedure and step in effect or place RHR in service for heat removal. For large LOCA events inside the Containment, the SGs are moot because heat removal through the containment heat removal systems takes place. Therefore, Heat Sink Page 293 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Red should not be required and, should not be assessed for EAL classification because a LOCA event alone should not require higher than an Alert classification. (ref. 2)The setpoint values provided in brackets following the normal setpoint values in the CSFSTs are used under adverse containment conditions.

Adverse containment conditions are defined as either (ref. 3): " Hi-1 RB pressure (> 3.6 psig), or" Containment Hi-radiation

(> 100,000 Rads integrated dose)The IPCS monitors these parameters and indicates when adverse containment values should be used. The instruments available to monitor these containment parameters are Containment pressure on PI-950, PI-951, PI-952 or PI-953, and Containment radiation on RM-G7 or RM-G 18. When no adverse values are provided, the given setpoint is used for any containment condition, as the parameter measurement is independent of containment atmosphere.

If containment pressure decreases below the adverse pressure setpoint after it has been exceeded, the normal values are again used. Once the adverse radiation level setpoint is exceeded, the adverse containment values must be utilized through event recovery and establishment of normal operating procedures.

Engineering should then be requested to evaluate instrumentation inaccuracies.

Generic This condition indicates an extreme challenge to the ability to remove RCS heat using the steam generators (i.e., loss of an effective secondary-side heat sink). This condition represents a potential loss of the Fuel Clad Barrier. In accordance with EOPs, there may be unusual accident conditions during which operators intentionally reduce the heat removal capability of the steam generators; during these conditions, classification using threshold is not warranted.

VCSNS Basis Reference(s):

1. EOP-12.0 Monitoring of Critical Safety Functions 2. EOP-15.0 Response to Loss of Secondary Heat Sink 3. OAP-103.4 EOP/AOP User's Guide 4. NEI 99-01 Inadequate Heat Removal Fuel Clad Potential Loss 2.B Page 294 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Fuel Clad Category:
3. CMT Radiation

/ RCS Activity Degradation Threat: Loss Threshold:

A. RM-G7 or RM-G18 CNTMT HI RNG Gamma > 2,000 R/hr Definition(s):

None Basis: Plant-Specific The gamma dose rate resulting from a postulated loss of coolant accident (LOCA) is monitored by the high range Reactor Building monitors, RM-G7 and -G18. RM-G18 and RM-G7 are located inside containment outside the A and B Steam Generator cubicles, respectively, on the 469' elevation.

The detector range is approximately 1 to 1 E7 R/hr (logarithmic scale). Radiation Monitors RM-G18 and RM-G7 provide a diverse means of measuring the containment for high level gamma radiation.

The detectors for RM-G18 and RM-G7 are a stainless steel gamma sensitive ion-chambers (ref. 1).The value specified represents, based on Microshield calculations, the expected containment high range radiation monitor (RM-G7 and RM-G18) response (2.1E3 R/hr rounded down to nearest whole number for readability) based on a LOCA (Reg. Guide 1.4 Case LOCA with fuel failure), one hour after shutdown with -2% fuel failure (ref. 2).Generic The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the containment, assuming that reactor coolant activity equals 300 pCi/gm dose equivalent 1-131. Reactor coolant activity above this level is greater than that expected for iodine spikes and corresponds to an approximate range of 2% to 5% fuel clad damage. Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.Page 295 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]The radiation monitor reading in this threshold is higher than that specified for RCS Barrier Loss threshold 3.A since it indicates a loss of both the Fuel Clad Barrier and the RCS Barrier. Note that a combination of the two monitor readings appropriately escalates the.mergency classification

!eveoECL to a Site Area Emergency.

VCSNS Basis Reference(s):

1. VCSNS Design Bases Document -Radiation Monitoring System (RM)2. TWR 11.5-91-027 Accident Severity Estimates from RM-G7 and G18 Response 3. NEI 99-01 CMT Radiation

/ RCS Activity Fuel Clad Loss 3.A Page 296 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Fuel Clad Category:

3. CMT Radiation

/ RCS Activity Degradation Threat: Loss Threshold:

B. Dose equivalent 1-131 coolant activity > 300 pCi/gm Definition(s):

None Basis: Plant-Specific Elevated reactor coolant activity represents a potential degradation in the level of safety of the plant and a potential precursor of more serious problems.

The threshold dose equivalent 1-131 concentration is well above that expected for iodine spikes and corresponds to about 5% fuel clad damage. When reactor coolant activity reaches this level the Fuel Clad barrier is considered lost. (ref. 1)Generic This threshold indicates that RCS radioactivity concentration is greater than 300 PCi/gm dose equivalent 1-131. Reactor coolant activity above this level is greater than that expected for iodine spikes and corresponds to an approximate range of 2% to 5% fuel clad damage. Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.There is no Potential Loss threshold associated with RCS Activity / Containment Radiation.

VCSNS Basis Reference(s):

1. NEI 99-01 CMT Radiation

/ RCS Activity Fuel Clad Loss 3.B Page 297 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Category: Degradation Threat: Threshold:

Fuel Clad 3. CMT Radiation

/ RCS Activity Potential Loss None Definition(s):

N/A Basis: Plant-Specific N/A Generic N/A VCSNS Basis Reference(s):

N/A Page 298 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Category: Degradation Threat: Threshold:

Fuel Clad 4. CMT Integrity or Bypass Loss None Definition(s):

N/A Basis: Plant-Specific N/A Generic N/A VCSNS Basis Reference(s):

N/A Page 299 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Category: Degradation Threat: Threshold:

Fuel Clad 4. CMT Integrity or Bypass Potential Loss None Definition(s):

N/A Basis: Plant-Specific N/A Generic N/A VCSNS Basis Reference(s):

N/A Page 300 of 359

.EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Fuel Clad Category:

5. ED Judgment Degradation Threat: Loss Threshold:

A. Any condition in the opinion of the ED that indicates loss of the fuel clad barrier Definition(s):

None Basis: Plant-Specific None Generic This threshold addresses any other factors that may be used by the Emergency Director in determining whether the Fuel Clad Barrier is lost.VCSNS Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Fuel Clad Loss 6.A Page 301 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Fuel Clad Category:
5. ED Judgment Degradation Threat: Potential Loss Threshold:

A. Any condition in the opinion of the ED that indicates potential loss of the fuel clad barrier Definition(s):

None Basis: Plant-Specific None Generic This threshold addresses any other factors that may be used by the Emergency Director in determining whether the Fuel Clad Barrier is potentially lost. The Emergency Director should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

VCSNS Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Potential Fuel Clad Loss 6.A Page 302 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Reactor Coolant System Category:
1. RCS or SG Tube Leakage Degradation Threat: Loss Threshold:

A. An automatic or manual ECCS (SI) actuation required by EITHER:* UNISOLABLE RCS leakage" SGtube RUPTURE Definition(s):

UNISOLABLE

-An open or breached system line that cannot be isolated, remotely or locally.RUPTURE -The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection.

Basis: Plant-Specific ECCS (SI) actuation is caused by (ref. 1): " Pressurizer pressure < 1850 psig" Steamline pressure < 675 psig" Steamline differential pressure __ 97 psid" Reactor Building (Containment) pressure _> 3.6 psig Generic This threshold is based on an UNISOLABLE RCS leak of sufficient size to require an automatic or manual actuation of the Emergency Core Cooling System (ECCS). This condition clearly represents a loss of the RCS Barrier.This threshold is applicable to unidentified and pressure boundary leakage, as well as identified leakage. It is also applicable to UNISOLABLE RCS leakage through an Page 303 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]interfacing system. The mass loss may be into any location -inside containment, to the secondary-side (i.e., steam generator tube leakage) or outside of containment.

A steam generator with primary-to-secondary leakage of sufficient magnitude to require an safety injection is considered to be RUPTURED.

If a RUPTURED steam generator is also FAULTED outside of containment, the declaration escalates to a Site Area Emergency since the Containment Barrier Loss threshold 1 .A will also be met.VCSNS Basis Reference(s):

1. EOP-1.0 Reactor Trip/Safety Injection Actuation 2. EOP-4.0 Steam Generator Tube Rupture 3. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Loss 1.A Page 304 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Reactor Coolant System Category:
1. RCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold:

A. Operation of a standby charging pump is required by EITHER:* UNISOLABLE RCS leakage" SG tube RUPTURE Definition(s):

UNISOLABLE

-An open or breached system line that cannot be isolated, remotely or locally.RUPTURE -The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection.

Basis: Plant-Specific The Chemical and Volume Control System (CVCS) includes three charging pumps which take suction from the Volume Control Tank and return cooled, purified reactor coolant to the RCS. Normal charging flow is handled by one of the three charging pumps. Each charging pump is designed for a flow rate of 150 gpm at 2520 psid and a maximum flow rate of 650 gpm at 1040 psid. A second charging pump being required is indicative of a substantial RCS leak. (ref. 1, 2, 3, 4)Generic This threshold is based on an UNISOLABLE RCS leak that results in the inability to maintain pressurizer level within specified limits by operation of a normally used charging (makeup) pump, but an ECCS (SI) actuation has not occurred.

The threshold is met when an operating procedure, or operating crew supervision, directs that a standby charging (makeup) pump be placed in service to restore and maintain pressurizer level.Page 305 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]This threshold is applicable to unidentified and pressure boundary leakage, as well as identified leakage. It is also applicable to UNISOLABLE RCS leakage through an interfacing system. The mass loss may be into any location -inside containment, to the secondary-side (i.e., steam generator tube leakage) or outside of containment.

If a leaking steam generator is also FAULTED outside of containment, the declaration escalates to a Site Area Emergency since the Containment Barrier Loss threshold 1 .A will also be met.VCSNS Basis Reference(s):

1. SOP-1 02 Chemical and Volume Control System 2. FSAR Section 9.3.4.1.6 3. FSAR Section 9.3.4.2.1 4. FSAR Table 9.3-4 5. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Potential Loss 1.A Page 306 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Reactor Coolant System Category:
1. RCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold:

B. CSFST Integrity-RED path conditions met Definition(s):

None Basis: Plant-Specific The "Potential Loss" threshold is defined by the CSFST RCS Integrity

-RED path (Figure 7). The values in this EAL are consistent with the CSFST value (ref. 1). CSFST RCS Integrity

-Red Path plant and associated Operational Curve Limit A is given in Figures 7 and 8 and indicates an extreme challenge to the safety function when plant parameters are to the right of the limit curve following excessive RCS cooldown under pressure (ref. 1).The CSFSTs are normally monitored using the SPDS display on the Integrated Plant Computer System (IPCS) (ref. 1).Generic This condition indicates an extreme challenge to the integrity of the RCS pressure boundary due to pressurized thermal shock -a transient that causes rapid RCS cooldown while the RCS is in Mode 3 or higher (i.e., hot and pressurized).

VCSNS Basis Reference(s):

1. EOP-12.0 Monitoring of Critical Safety Functions 2. OAP-103.4 EOP/AOP User's Guide 3. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Potential Loss 1..B Page 307 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Category: Degradation Threat: Threshold:

Reactor Coolant System 2. Inadequate Heat Removal Loss None Definition(s):

N/A Basis: Plant-Specific N/A Generic N/A VCSNS Basis Reference(s):

N/A Page 308 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Reactor Coolant System Category:

2. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

A. CSFST Heat Sink-RED path conditions met AND Heat sink is required Definition(s):

None Basis: Plant-Specific In combination with Fuel Clad Potential Loss 2.B, meeting this threshold results in a Site Area Emergency.

Critical Safety Function Status Tree (CSFST) Heat Sink-RED path is given in Figure 6 and indicates the ultimate heat sink function is under extreme challenge and that some fuel clad damage may potentially occur (ref. 1).The CSFSTs are normally monitored using the SPDS display on the Integrated Plant Computer System (IPCS) (ref. 1).The phrase "and heat sink required" precludes the need for classification for conditions in which RCS pressure is less-than SG pressure or Heat Sink-RED path entry was created through operator action directed by an EOP. For example, EOP-1 5.0 is entered from CSFST Heat Sink-Red.

Step 1 tells the operator to determine if heat sink is required by checking that RCS pressure is greater than any non-faulted SG pressure and RCS Thot is greater than 350 0 F. If these conditions exist, Heat Sink is required.

Otherwise, the operator is to either return to the procedure and step in effect or place RHR in service for heat removal. For large LOCA events inside the Containment, the SGs are moot because heat removal through the containment heat removal systems takes place. Therefore, Heat Sink Page 309 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Red should not be required and, should not be assessed for EAL classification because a LOCA event alone should not require higher than an Alert classification. (ref. 2)The setpoint values provided in brackets following the normal setpoint values in the CSFSTs are used under adverse containment conditions.

Adverse containment conditions are defined as either (ref. 3): " Hi-1 RB pressure (> 3.6 psig), or* Containment Hi-radiation

(> 100,000 Rads integrated dose)The IPCS monitors these parameters and indicates when adverse containment values should be used. The instruments available to monitor these containment parameters are Containment pressure on PI-950, PI-951, PI-952 or PI-953, and Containment radiation on RM-G7 or RM-G18. When no adverse values are provided, the given setpoint is used for any containment condition, as the parameter measurement is independent of containment atmosphere.

If containment pressure decreases below the adverse pressure setpoint after it has been exceeded, the normal values are again used. Once the adverse radiation level setpoint is exceeded, the adverse containment values must be utilized through event recovery and establishment of normal operating procedures.

Engineering should then be requested to evaluate instrumentation inaccuracies.

Generic This condition indicates an extreme challenge to the ability to remove RCS heat using the steam generators (i.e., loss of an effective secondary-side heat sink). This condition represents a potential loss of the RCS Barrier. In accordance with EOPs, there may be unusual accident conditions during which operators intentionally reduce the heat removal capability of the steam generators; during these conditions, classification using threshold is not warranted.

Meeting this threshold results in a Site Area Emergency because this threshold is identical to Fuel Clad Barrier Potential Loss threshold 2.B; both will be met. This condition warrants a Site Area Emergency declaration because inadequate RCS heat removal may result in fuel heat-up sufficient to damage the cladding and increase RCS pressure to the point where mass will be lost from the system.Page 310 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]VCSNS Basis Reference(s):

1. EOP-12.0 Monitoring of Critical Safety Functions 2. EOP-15.0 Response to Loss of Secondary Heat Sink 3. OAP-103.4 EOP/AOP User's Guide 4. NEI 99-01 Inadequate Heat Removal Potential Reactor Coolant System Loss 2.A Page 311 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Reactor Coolant System Category:
3. CMT Radiation

/ RCS Activity Degradation Threat: Loss Threshold:

A. RM-G7 or RM-G18 CNTMT HI RNG Gamma > 100 R/hr Definition(s):

None Basis: Plant-Specific The gamma dose rate resulting from a postulated loss of coolant accident (LOCA) is monitored by the high range Reactor Building monitors, RM-G7 and -G18. RM-G18 and RM-G7 are located inside containment outside the A and B Steam Generator cubicles, respectively, on the 469' elevation.

The detector range is approximately 1 to 1 E7 R/hr (logarithmic scale). Radiation Monitors RM-G18 and RM-G7 provide a diverse means of measuring the containment for high level gamma radiation.

The detectors for RM-G18 and RM-G7 are a stainless steel gamma sensitive ion-chambers (ref. 1).The value specified represents, based on Microshield calculations, the expected containment high range radiation monitor (RM-G7 and RM-G18) response (Reg. Guide 1.4 Case LOCA with fuel failure) (1.05E2 R/hr rounded down to nearest whole number for readability) based on a LOCA, one hour after shutdown with -0.1% fuel failure (ref. 2).Generic The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the containment, assuming that reactor coolant activity equals Technical Specification allowable limits. This value is lower than that specified for Fuel Clad Barrier Loss threshold 3.A since it indicates a loss of the RCS Barrier only.There is no Potential Loss threshold associated with RCS Activity / Containment Radiation.

Page 312 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]VCSNS Basis Reference(s):

1. VCSNS Design Bases Document -Radiation Monitoring System (RM)2. TWR 11.5-91-027 Accident Severity Estimates from RM-G7 and G18 Response 3. NEI 99-01 CMT Radiation

/ RCS Activity Reactor Coolant System Loss 2.A Page 313 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Category: Degradation Threat: Threshold:

Reactor Coolant System 3. CMT Radiation

/ RCS Activity Potential Loss None Definition(s):

N/A Basis: Plant-Specific N/A Generic N/A VCSNS Basis Reference(s):

N/A Page 314 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Category: Degradation Threat: Threshold:

Reactor Coolant System 4. CMT Integrity or Bypass Loss None Definition(s):

N/A Basis: Plant-Specific N/A Generic N/A VCSNS Basis Reference(s):

N/A Page 315 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Category: Degradation Threat: Threshold:

Reactor Coolant System 4. CMT Integrity or Bypass Potential Loss None Definition(s):

N/A Basis: Plant-Specific N/A Generic N/A VCSNS Basis Reference(s):

N/A Page 316 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Reactor Coolant System Category:

5. ED Judgment Degradation Threat: Loss Threshold:

A. Any condition in the opinion of the ED that indicates loss of the RCS barrier Definition(s):

None Basis: Plant-Specific None Generic This threshold addresses any other factors that may be used by the Emergency Director in determining whether the RCS Barrier is lost.VCSNS Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Reactor Coolant System Loss 6.A Page 317 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Reactor Coolant System Category:
5. ED Judgment Degradation Threat: Potential Loss Threshold:

A. Any condition in the opinion of the ED that indicates potential loss of the RCS barrier Definition(s):

None Basis: Plant-Specific None Generic This threshold addresses any other factors that may be used by the Emergency Director in determining whether the RCS Barrier is potentially lost. The Emergency Director should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

VCSNS Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Reactor Coolant System Potential Loss 6.A Page 318 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Containment Category:
1. RCS or SG Tube Leakage Degradation Threat: Loss Threshold:

A. A leaking or RUPTURED SG is FAULTED outside of containment Definition(s):

FAULTED -The term applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressurized.

RUPTURED -The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection.

Basis: Plant-Specific None Generic This threshold addresses a leaking or RUPTURED Steam Generator (SG) that is also FAULTED outside of containment.

The condition of the SG, whether leaking or RUPTURED, is determined in accordance with the thresholds for RCS Barrier Potential Loss 1 .A and Loss 1 .A, respectively.

This condition represents a bypass of the containment barrier.FAULTED is a defined term within the NEI 99-01 methodology; this determination is not necessarily dependent upon entry into, or diagnostic steps within, an EOP. For example, if the pressure in a steam generator is decreasing uncontrollably

.(part of the FAULTED definition)]

and the FAULTED steam generator isolation procedure is not entered because EOP user rules are dictating implementation of another procedure to address a higher Page 319 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]priority condition, the steam generator is still considered FAULTED for emergency classification purposes.The FAULTED criterion establishes an appropriate lower bound on the size of a steam release that may require an emergency classification.

Steam releases of this size are readily observable with normal Control Room indications.

The lower bound for this aspect of the containment barrier is analogous to the lower bound criteria specified in IC SU4 for the fuel clad barrier (i.e., RCS activity values) and IC SU5 for the RCS barrier (i.e., RCS leak rate values).This threshold also applies to prolonged steam releases necessitated by operational considerations such as the forced steaming of a leaking or RUPTURED steam generator directly to atmosphere to cooldown the plant, or to drive an auxiliary (emergency) feed water pump. These types of conditions will result in a significant and sustained release of radioactive steam to the environment (and are thus similar to a FAULTED condition).

The inability to isolate the steam flow without an adverse effect on plant cooldown meets the intent of a loss of containment.

Steam releases associated with the expected operation of a SG power operated relief valve or safety relief valve do not meet the intent of this threshold.

Such releases may occur intermittently for a short period of time following a reactor trip as operators process through emergency operating procedures to bring the plant to a stable condition and prepare to initiate a plant cooldown.

Steam releases associated with the unexpected operation of a valve (e.g., a stuck-open safety valve) do meet this threshold.

Following an SG tube leak or rupture, there may be minor radiological releases through a secondary-side system component (e.g., air ejectors, glad seal exhausters, valve packing, etc.). These types of releases do not constitute a loss or potential loss of containment but should be evaluated using the Recognition Category A-RICs.The ermergencY

-lasifiation ,eveECLs resulting from primary-to-secondary leakage, with or without a steam release from the FAULTED SG, are summarized below.Page 320 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Affected SG is FAULTED Outside of Containment?

P-to-S Leak Rate Yes No I Less than or equal to 25 gpm Greater than 25 gpm Requires operation of a standby charging (makeup) pump (RCS Barrier Potential Loss)Requires an automatic or manual ECCS (SI) actuation (RCS Barrier Loss)No classification Unusual Event per SU4SU5 Site Area Emergency per FS1 Site Area Emergency per FS1 No classification Unusual Event per SU4SU5 Alert per FA1 Alert per FA1 There is no Potential Loss threshold associated with RCS or SG Tube Leakage.VCSNS Basis Reference(s):

1. EOP-3.0 Faulted Steam Generator Isolation 2. EOP-4.0 Steam Generator Tube Rupture 3. NEI 99-01 RCS or SG Tube Leakage Containment Loss 1.A Page 321 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Category: Degradation Threat: Threshold:

Containment

1. RCS or SG Tube Leakage Potential Loss None Definition(s):

N/A Basis: Plant-Specific N/A Generic N/A VCSNS Basis Reference(s):

N/A Page 322 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Category: Degradation Threat: Threshold:

Containment

2. Inadequate Heat Removal Loss None Definition(s):

N/A Basis: Plant-Specific N/A Generic N/A VCSNS Basis Reference(s):

N/A Page 323 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Containment Category:

2. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

A. CSFST Core Cooling-RED path conditions met AND Restoration procedures not effective within 15 min. (Note 1)Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Definition(s):

None Basis: Plant-Specific Critical Safety Function Status Tree (CSFST) Core Cooling-RED path is given in Figure 5 and indicates significant core exit superheating and core uncovery.

The CSFSTs are normally monitored using the SPDS display on the Integrated Plant Computer System (IPCS). (ref. 1)The function restoration procedures are those emergency operating procedures that address the recovery of the core cooling critical safety functions.

The procedure is considered effective if the temperature is decreasing or if the vessel water level is increasing (ref. 1, 2, 3).A direct correlation to status trees can be made if the effectiveness of the restoration procedures is also evaluated.

The setpoint values provided in brackets following the normal setpoint values in the CSFSTs are used under adverse containment conditions.

Adverse containment conditions are defined as either (ref. 4): 0 Hi-1 RB pressure (> 3.6 psig), or Page 324 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]a Containment Hi-radiation

(> 100,000 Rads integrated dose)The IPCS monitors these parameters and indicates when adverse containment values should be used. The instruments available to monitor these containment parameters are Containment pressure on PI-950, PI-951, PI-952 or PI-953, and Containment radiation on RM-G7 or RM-G18. When no adverse values are provided, the given setpoint is used for any containment condition, as the parameter measurement is independent of containment atmosphere.

If containment pressure decreases below the adverse pressure setpoint after it has been exceeded, the normal values are again used. Once the adverse radiation level setpoint is exceeded, the adverse containment values must be utilized through event recovery and establishment of normal operating procedures.

Engineering should then be requested to evaluate instrumentation inaccuracies (ref. 3, 4).This threshold indicates significant core exit superheating and core uncovery.

If core exit thermocouple (TC) readings are greater than 1,200°F (ref. 1), Fuel Clad barrier is also lost.Generic This condition represents an IMMINENT core melt sequence which, if not corrected, could lead to vessel failure and an increased potential for containment failure. For this condition to occur, there must already have been a loss of the RCS Barrier and the Fuel Clad Barrier. If implementation of a procedure(s) to restore adequate core cooling is not effective (successful) within 15 minutes, it is assumed that the event trajectory will likely lead to core melting and a subsequent challenge of the Containment Barrier.The restoration procedure is considered "effective" if core exit thermocouple readings are decreasing and/or if reactor vessel level is increasing.

Whether or not the procedure(s) will be effective should be apparent within 15 minutes. The Emergency Director should escalate the .m.rg.ncy .lasifiation l.ve..CL as soon as it is determined that the procedure(s) will not be effective.

Severe accident analyses (e.g., NUREG-1 150) have concluded that function restoration procedures can arrest core degradation in a significant fraction of core damage scenarios, and that the likelihood of containment failure is very small in these events. Given this, it is Page 325 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]appropriate to provide 15 minutes beyond the required entry point to determine if procedural actions can reverse the core melt sequence.VCSNS Basis Reference(s):

1. EOP-12.0 Monitoring of Critical Safety Functions 2. EOP-14.0 Response to Inadequate Core Cooling 3. EOP-14.1 Response to Degraded Core Cooling 4. OAP-103.4 EOP/AOP User's Guide 54. NEI 99-01 Inadequate Heat Removal Containment Potential Loss 2.A Page 326 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Category: Degradation Threat: Threshold:

Containment

3. CMT Radiation

/ RCS Activity Loss None Definition(s):

N/A Basis: Plant-Specific N/A Generic N/A VCSNS Basis Reference(s):

N/A Page 327 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Containment Category:

3. CMT Radiation

/ RCS Activity Degradation Threat: Potential Loss Threshold:

A. RM-G7 or RM-G18 CNTMT HI RNG Gamma > 20,000 R/hr Definition(s):

None Basis: Plant-Specific The gamma dose rate resulting from a postulated loss of coolant accident (LOCA) is monitored by the high range Reactor Building monitors, RM-G7 and -G18. RM-G18 and RM-G7 are located inside containment outside the A and B Steam Generator cubicles, respectively, on the 469' elevation.

The detector range is approximately 1 to 1 E7 R/hr (logarithmic scale). Radiation Monitors RM-G18 and RM-G7 provide a diverse means of measuring the containment for high level gamma radiation.

The detectors for RM-G18 and RM-G7 are a stainless steel gamma sensitive ion-chambers (ref. 1).The value specified represents, based on Microshield calculations, the expected containment high range radiation monitor (RM-G7 and RM-G18) response (Reg. Guide 1.4 Case LOCA with fuel failure) based on a LOCA, one hour after shutdown with -20% fuel failure (ref. 2).2.1 x 10 4 R/hr (rounded down the the nearest whole number) is a value which indicates significant fuel damage well in excess of the thresholds associated with both loss of Fuel Clad and loss of RCS barriers.

A major release of radioactivity requiring off-site protective actions from core damage is not possible unless a major failure of fuel cladding allows radioactive material to be released from the core into the reactor coolant (ref. 1, 2).Generic Page 328 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the containment, assuming that 20% of the fuel cladding has failed. This level of fuel clad failure is well above that used to determine the analogous Fuel Clad Barrier Loss and RCS Barrier Loss thresholds.

NUREG-1228, Source Estimations During Incident Response to Severe Nuclear Power Plant Accidents, indicates the fuel clad failure must be greater than approximately 20% in order for there to be a major release of radioactivity requiring offsite protective actions. For this condition to exist, there must already have been a loss of the RCS Barrier and the Fuel Clad Barrier. It is therefore prudent to treat this condition as a potential loss of containment which would then escalate the emergency classification le-eIECL to a General Emergency.

VCSNS Basis Reference(s):

1. VCSNS Design Bases Document -Radiation Monitoring System (RM)2. TWR 11.5-91-027 Accident Severity Estimates from RM-G7 and G18 Response 3. NEI 99-01 CMT Radiation

/ RCS Activity Containment Potential Loss 3.A Page 329 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El Barrier: Containment Category:

4. CMT Integrity or Bypass Degradation Threat: Loss Threshold:

A. Containment isolation is required AND EITHER: " Containment integrity has been lost based on ED judgment* UNISOLABLE pathway from containment to the environment exists Definition(s):

UNISOLABLE

-An open or breached system line that cannot be isolated, remotely or locally.Basis: Plant-Specific None Generic These thresholds address a situation where containment isolation is required and one of two conditions exists as discussed below. Users are reminded that there may be accident and release conditions that simultaneously meet both bulleted thresholds 4.A.1 and 4.A.2.47A.4First Threshold

-Containment integrity has been lost, i.e., the actual containment atmospheric leak rate likely exceeds that associated with allowable leakage (or sometimes referred to as design leakage).

Following the release of RCS mass into containment, containment pressure will fluctuate based on a variety of factors; a loss of containment integrity condition may (or may not) be accompanied by a noticeable drop in containment pressure.

Recognizing the inherent difficulties in determining a containment leak rate during accident conditions, it is expected that the Emergency Director will assess this threshold using judgment, and with due consideration given to current plant conditions, and available operational and radiological data (e.g., containment pressure, readings on Page 330 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]radiation monitors outside containment, operating status of containment pressure control equipment, etc.).Refer to the middle piping run of Figure 9-F--1 04. Two simplified examples are provided.One is leakage from a penetration and the other is leakage from an in-service system valve. Depending upon radiation monitor locations and sensitivities, the leakage could be detected by any of the four monitors depicted in the figure.Another example would be a loss or potential loss of the RCS barrier, and the simultaneous occurrence of two FAULTED locations on a steam generator where one fault is located inside containment (e.g., on a steam or feedwater line) and the other outside of containment.

In this case, the associated steam line provides a pathway for the containment atmosphere to escape to an area outside the containment.

Following the leakage of RCS mass into containment and a rise in containment pressure, there may be minor radiological releases associated with allowable (design) containment leakage through various penetrations or system components.

These releases do not constitute a loss or potential loss of containment but should be evaluated using the Recognition Category A-R lCs.4,A-2Second Threshold

-Conditions are such that there is an UNISOLABLE pathway for the migration of radioactive material from the containment atmosphere to the environment.

As used here, the term "environment" includes the atmosphere of a room or area, outside the containment, that may, in tum, communicate with the outside-the-plant atmosphere (e.g., through discharge of a ventilation system or atmospheric leakage).

Depending upon a variety of factors, this condition may or may not be accompanied by a noticeable drop in containment pressure.Refer to the top piping run of Figure 9-F--1 04. In this simplified example, the inboard and outboard isolation valves remained open after a containment isolation was required (i.e., containment isolation was not successful).

There is now an UNISOLABLE pathway from the containment to the environment.

The existence of a filter is not considered in the threshold assessment.

Filters do not remove fission product noble gases. In addition, a filter could become ineffective due to Page 331 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]iodine and/or particulate loading beyond design limits (i.e., retention ability has been exceeded) or water saturation from steam/high humidity in the release stream.Leakage between two interfacing liquid systems, by itself, does not meet this threshold.

Refer to the bottom piping run of Figure 9-F-10_ 04. In this simplified example, leakage in an RCP seal cooler is allowing radioactive material to enter the Auxiliary Building.

The radioactivity would be detected by the Process Monitor. If there is no leakage from the closed water cooling system to the Auxiliary Building, then no threshold has been met. If the pump developed a leak that allowed steam/water to enter the Auxiliary Building, then second threshold-489 would be met. Depending upon radiation monitor locations and sensitivities, this leakage could be detected by any of the four monitors depicted in the figure and cause the first threshold 4.A.1to be met as well.Following the leakage of RCS mass into containment and a rise in containment pressure, there may be minor radiological releases associated with allowable containment leakage through various penetrations or system components.

Minor releases may also occur if a containment isolation valve(s) fails to close but the containment atmosphere escapes to an enclosed system. These releases do not constitute a loss or potential loss of containment but should be evaluated using the Recognition Category A-R__ICs.The status of the containment barrier during an event involving steam generator tube leakage is assessed using Loss Threshold 1.A.VCSNS Basis Reference(s):

1. EOP-2.5 LOCA Outside Containment
2. NEI 99-01 CMT Integrity or Bypass Containment Loss 4.A Page 332 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Containment Category:
4. CMT Integrity or Bypass Degradation Threat: Loss Threshold:

B. Indications of RCS leakage outside of containment Definition(s):

None Basis: Plant-Specific EOP-2.5 LOCA Outside Containment (ref. 1) provides instructions to identify and isolate a LOCA outside of the containment.

Potential RCS leak pathways outside containment include: " RHR" CVCS/Letdown" RCP seals" PZR/RCS Loop sample lines Generic Containment sump, temperature, pressure and/or radiation levels will increase if reactor coolant mass is leaking into the containment.

If these parameters have not increased, then the reactor coolant mass may be leaking outside of containment (i.e., a containment bypass sequence).

Increases in sump, temperature, pressure, flow and/or radiation level readings outside of the containment may indicate that the RCS mass is being lost outside of containment.

Unexpected elevated readings and alarms on radiation monitors with detectors outside containment should be corroborated with other available indications to confirm that the source is a loss of RCS mass outside of containment.

If the fuel clad barrier has not been Page 333 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]lost, radiation monitor readings outside of containment may not increase significantly; however, other unexpected changes in sump levels, area temperatures or pressures, flow rates, etc. should be sufficient to determine if RCS mass is being lost outside of the containment.

Refer to the middle piping run of Figure 9- Y-1 04. In this simplified example, a leak has occurred at a reducer on a pipe carrying reactor coolant in the Auxiliary Building.Depending upon radiation monitor locations and sensitivities, the leakage could be detected by any of the four monitors depicted in the figure and cause threshold 4.A. to be met as well.To ensure proper escalation of the emergency classification, the RCS leakage outside of containment must be related to the mass loss that is causing the RCS Loss and/or Potential Loss threshold 1 .A to be met.VCSNS Basis Reference(s):

1. EOP-2.5 LOCA Outside Containment
2. NEI 99-01 CMT Integrity or Bypass Containment Loss 4.B Page 334 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Containment Category:
4. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

A. CSFST Containment-RED path conditions met Definition(s):

None Basis: Plant-Specific Critical Safety Function Status Tree (CSFST) Containment-RED path (Figure 9) is entered if Containment pressure is greater than or equal to 55 psig and represents an extreme challenge to safety function (ref. 1).55 psig is based on the containment design pressure (ref. 2).Generic If containment pressure exceeds the design pressure, there exists a potential to lose the Containment Barrier. To reach this level, there must be an inadequate core cooling condition for an extended period of time; therefore, the RCS and Fuel Clad barriers would already be lost. Thus, this threshold is a discriminator between a Site Area Emergency and General Emergency since there is now a potential to lose the third barrier.VCSNS Basis Reference(s):

1. EOP-12.0 Monitoring of Critical Safety Functions 2. OAP-103.2 Emergency Operating Procedure Setpoint Document 3. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.A Page 335 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Containment Category:
4. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

B. Containment hydrogen concentration

> 4%Definition(s):

None Basis: Plant-Specific The lower limit of flammability of hydrogen in air is approximately 4% (ref. 1).In the early stages of a core uncovery event, it is unlikely that hydrogen buildup due to a core uncovery could result in an explosive mixture of dissolved gases in Containment.

However, Containment monitoring and/or sampling should be performed to verify this assumption and a General Emergency declared if it is determined that an explosive mixture exists. A combustible mixture can be formed when hydrogen gas concentration in the Containment atmosphere is greater than 4% by volume (ref. 1, 2). All hydrogen measurements are referenced to concentrations in dry air even though the actual Containment environment may contain significant steam concentrations.

The plant has two hydrogen monitoring systems. Sample points are located near each recombiner and near the RBCUs on the 530' Level. Manual action is required to start the redundant hydrogen analyzers.

The analyzers

[CI-8257 (8258)] have a range of 0-10% and 0-20% of H 2 in air (by volume) and an accuracy of +/- 2% of range. Hydrogen concentration in the Reactor Building is indicated in the control room (ref. 3, 4).To generate such levels of combustible gas, loss of the Fuel Clad and RCS barriers must have occurred.

With the Potential Loss of the Containment barrier, the threshold hydrogen concentration, therefore, will likely warrant declaration of a General Emergency.

Generic Page 336 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]The existence of an explosive mixture means, at a minimum, that the containment atmospheric hydrogen concentration is sufficient to support a hydrogen burn (i.e., at the lower deflagration limit). A hydrogen burn will raise containment pressure and could result in collateral equipment damage leading to a loss of containment integrity.

It therefore represents a potential loss of the Containment Barrier.VCSNS Basis Reference(s):

1. FSAR Section 6.2.3.5.1 2. SOP-1 22 Post Accident Hydrogen Removal System 3. FSAR Section 6.2.5.5.3 4. SOP-122 Post Accident Hydrogen Removal System 5. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.B Page 337 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT El Barrier: Containment Category: 4. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

C. Containment pressure > 12 psig AND< one full train of depressurization equipment (Table F-2) operating per design for > 15 min. (Note 1 Note 1: The Emergency Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.Table F-2 Full Train Depressurization Equipment RBCU Groups Containment Sprays Operating Operating 2 0 1 1 0 2 Definition(s):

None Basis: Plant-Specific The Containment pressure setpoint (12 psig, ref. 2, 3) is the pressure at which the Containment Spray System should actuate and begin performing its function.

The design basis accident analyses and evaluations assume the loss of one Containment Spray System train (ref. 2, 3).Each spray subsystem is started by separate ESF containment isolation Phase A and spray actuation signals. Normally, both subsystems operate; however, they are independent and can operate individually.

Although the design basis for Reactor Building Page 338 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]heat removal is one spray subsystem operating in conjunction with one Reactor Building Cooling Unit (with one RHR pump and one charging pump providing emergency core cooling water), two Reactor Building Cooling Units (RBCUs) with no spray pumps or two spray pumps with no RBCUs can handle all required heat loads Technical Specifications defined equipment that comprises one full train of depressurization equipment is given in Table F-3 (ref. 1, 2, 4, 5).RBCU operation verification is performed in accordance with EOP-1.0 Attachment 3 SI Equipment Verification.

In order to take credit for a RBCU operating per design, each RBCU must meet minimum Service Water flow requirements (ref. 6).Generic This threshold describes a condition where containment pressure is greater than the setpoint at which containment energy (heat) removal systems are designed to automatically actuate, and less than one full train of equipment is capable of operating per design. The 15-minute criterion is included to allow operators time to manually start equipment that may not have automatically started, if possible.

This threshold represents a potential loss of containment in that containment heat removal/depressurization systems (e.g., containment sprays, ice condenser etc., but not including containment venting strategies) are either lost or performing in a degraded manner.VCSNS Basis Reference(s):

1. FSAR Section 6.2.2.2.1.2
2. OAP-1 03.2 Emergency Operating Procedure Setpoint Document 3. EOP-12.0 Monitoring of Critical Safety Functions 4. Technical Specifications 3/4-6.2.1 5. Technical Specifications 3/4-6.2.3 6. EOP-1.0 Reactor Trip/Safety Injection Actuation Attachmen 3 SI Equipment Verification
7. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.C Page 339 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Containment Category:
5. ED Judgment Degradation Threat: Loss Threshold:

A. Any condition in the opinion of the ED that indicates loss of the containment barrier Definition(s):

None Basis: Plant-Specific None Generic This threshold addresses any other factors that may be used by the Emergency Director in determining whether the Containment Barrier is lost.VCSNS Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Containment Loss 6.A Page 340 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Barrier: Containment Category:
5. ED Judgment Degradation Threat: Potential Loss Threshold:

A. Any condition in the opinion of the ED that indicates potential loss of the containment barrier Definition(s):

None Basis: Plant-Specific None Generic This threshold addresses any other factors that may be used by the Emergency Director in determining whether the Containment Barrier is potentially lost. The Emergency Director should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

VCSNS Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Containment Potential Loss 6.A Page 341 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]ATTACHMENT 3 Figures Page 342 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Figure 1: Fuel Assembly Uncovery Elevations Transfer slot ty-' -"-461'-6" Normal WL ityI SFPJ 439' top of fuel in SFP-' and upenders-431'Transfer tube-- * ' L 427' TOAF Page 343 of 359 (D to (0 0 m z 0 2 m z 0 t-C m m-D-u 0 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Figure 3: RCS Elevations MANSELUMIDLOOP MONITOR RVLIS NARROW ELEVATION RANGE (FT) (%)Top of Active Fuel 427' 57.9 Bottom of Hot Leg 429' 6" 64.2 RV FLANGE 437' 7.4" 84.3 Page 345 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Figure 4: Response of the TMI-2 Source Range Measurement During the First Six Hours of the Accident w\0 C'j I)-0.I--c~) I-(0 Lfl (sapeoap 6ol) puooaS jed slunoo Page 346 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Figure 5: CSFST Core Cooling GOTO EOP-14.0 GOTO EOP-14-0 mmmm Comn~m NO YESTO EOP-14.1 YES GO TO EOP-14.1 0 NOo GO TO AT LO UKI 000 r",'.,,,.,, EOP-14-2 ,,,,am,, cps,00M 'r ,o& EOP-14.1WTIMt 711,l awv s.* YES~fGO TO goo EOP-14-2 CSF SAT Page 347 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Figure 6: CSFST Heat Sink Sf GOTO EOP-15.0 L~NOTO 0000000000000000000000000 GO TO 0 ~EOP-15-1 0 T 0 NO YE, S 8000000GO TO 0,Soo EOP-15.4 o 0 0 o LEM I AU a GO TO UMHoo0000 EOP-15.4 CSF SAT Page 348 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Figure 7: CSFST RCS Integrity ,IOGOTO EOP-16.0 ALmAMsomsuws NO I1°-OF U GO TO EOP-16.0" CSF SAT No SGOTO In , EOP-16.1 P" FM NO1=0 CSF SAT cSF SAT Page 349 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Figure 8: Plant Operational Limits Curve PLANT OPERATIONAL LIMITS CURVE RCS PRESSURE (PSIG)3000 -rI 2500 2000 1500 1000 100 150 200 250 300 350 400 RCS Tcold (-F)Page 350 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Figure 9: CSFST Containment O GOTO EOP-17.0 GO TO MMMM*OWANW MEM NOEOP-17-0P O TO Lin1mw4 p" YES coomfsawr SPRAY U2pin 4 ATLEAlWr 0 0000000000000 GO TO EOP-17.1 I II NOO Umn"a p"GO TO o EOP-17.2 CSF SAT Page 351 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Figure 10: Containment Integrity or Bypass Examples RCP Seal Coolinq Page 352 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]ATTACHMENT 4 Safe Operation

& Shutdown Areas Tables R-2 & H-3 Bases Page 353 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]Background NEI 99-01 Revision 6 ICs AA3 and HA5 prescribe declaration of an Alert based on impeded access to rooms or areas (due to either area radiation levels or hazardous gas concentrations) where equipment necessary for normal plant operations, cooldown or shutdown is located. These areas are intended to be plant operating mode dependent.

Specifically the Developers Notes For AA3 and HA5 states: The "site-specific list of plant rooms or areas with entry-related mode applicability identified" should specify those rooms or areas that contain equipment which require a manual/local action as specified in operating procedures used for normal plant operation, cooldown and shutdown.

Do not include rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, corrective measures or emergency operations).

In addition, the list should specify the plant mode(s) during which entry would be required for each room or area.The list should not include rooms or areas for which entry is required solely to perform actions of an administrative or record keeping nature (e.g., normal rounds or routine inspections).

Further, as specified in IC HA5: The list need not include the Control Room if adequate engineered safety/design features are in place to preclude a Control Room evacuation due to the release of a hazardous gas. Such features may include, but are not limited to, capability to draw air from multiple air intakes at different and separate locations, inner and outer atmospheric boundaries, or the capability to acquire and maintain positive pressure within the Control Room envelope.VCS1 Table R-2 and H-3 Bases A review of station operating procedures identified the following mode dependent in-plant actions and associated areas that are required for normal plant operation, cooldown or shutdown: MODE 1 (Power Operation)" FWP and FWBP's per SOP-210 (TB all levels)" PTP-1 02.001 Extraction System check valves (TB-436)" XVG02074 &2075 (TB-412)" XVG02210 (TB-463)" XVT02072A/B (TB-412)* 3062's Blow down temperature control (AB-436)MODE 2 (Startup)" FWP and FWBP's per SOP-210 (TB all levels)" XVT01663 (TB-412)* Primary Chemistry Lab (CB-412)Page 354 of 359 EPP-1 08 ENCLOSURE I REVISION 01 [DRAFT E]MODE 3 (Hot Standby)" Primary Chemistry Lab (CB-412)" PZR heater disconnects (AB-436)" RCP seal injection adjustments (AB-412 west pen/IB-412 east pen)* SI Accumulator isolation valves (IB-463/AB-463)" P-12 interlocks (CB-436 relay room)" RHR samples (AB-374)" CCW pump start (IB-412)* CHG/Sl pump cycle (AB-388/IB-436/IB-463)

MODE 4 (Hot Shutdown)/Mode 5 (Cold Shutdown" CHG/SI Bkr alignment (IB-436/IB463)" RHR bkr alignment (AB-412/AB-463/IB-463)

  • ASI disable (AB-388/AB-400/AB-436)
  • P-12 interlocks (CB-436 relay room)" Steam Generator Shell Temp monitoring for MODE 5 (RB-412/RB-436)

Table R-2 & H-3 Results Table R-2 & H-3 Safe Operation

& Shutdown Areas Area Mode Applicability Auxiliary Building 374' 3 Auxiliary Building 388' 3, 4, 5 Auxiliary Building 400' 4, 5 Auxiliary Building 412 3, 4, 5 Auxiliary Building 436' 1,2, 3, 4, 5 Auxiliary Building 463' 3, 4, 5 Intermediate Building 412' 3 Intermediate Building 436' 4, 5 Intermediate Building 463' 3, 4, 5 Control Building 412' 2, 3 Control Building 436' 3, 4, 5 Turbine Building (All levels) 1,2 Plant Operating Procedures Reviewed 1. GOP-4B Power Operation Mode 1 Descending

2. GOP-5 Reactor Shutdown From Startup to Hot Standby Mode 2 to Mode 3 Page 355 of 359 EPP-108 ENCLOSURE I REVISION 01 [DRAFT E]3. GOP-6 Plant Shutdown From Hot Standby to Cold Shutdown Mode 3 to Mode 5 4. SOP-210 Feedwater System 5. PTP-102.001 Main Turbine Tests 6. "Rooms Needed for Normal Plant Shutdown from Mode 1 to Mode 5" An Assessment performed by Doug Edwards 5/24/13 Page 356 of 359
Retrieved from "https://kanterella.com/w/index.php?title=ML14122A158&oldid=1359110"