Text

Technical Specifications Bases
	ML15133A500
Person / Time
Site:	Peach Bottom
Issue date:	04/14/2015
From:	Jim Barstow; Exelon Generation Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML15133A504	List: ML15133A499; ML15133A500; ML15133A503;
References
	Download: ML15133A500 (382)
	v • d • e

PBAPS UNIT 3 - LICENSE NO. DPR 56 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B TABLE OF CONTENTS page(s) i ................................................. Rev 28 ii ......... ............................................ Rev 106 iii .................................................................................................................... Rev 3 B 2.0 SAFETY LIMITS (SLs) page(s) 2.0-1 ............................................................................................................. Rev 98 2.0-3 ............................................................................................................. Rev 48 2.0-4 ............................................................................................................. Rev 48 2.0-5 ............................................................................................................. Rev 76 2.0-6 ............................................................................................................. Rev 76 2.0-7 ............................................................................................................. Rev 76 2.0-8 ............................................................................................................. Rev 58 2.0-9 ............................................................................................................. Rev 76 2.0-10 ........................................................................................................... Rev 76 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY page(s) 3.0-1 ........................................................................................................... Rev 100 3.0-5 ............................................................................................................. Rev 53 3.0-5a ........................................................................................................... Rev 53 3.0-6 ............................................................................................................. Rev 53 3.0-9 ........................................................................................................... Rev 100 3.0-9a ......................................................................................................... Rev 100 3.0-9b ......................................................................................................... Rev 107 3.0-12 ............................................................................................................. Rev 6 3.0-13 ............................................................................................................. Rev 1 3.0-14 ........................................................................................................... Rev 53 3.0-15 ........................................................................................................... Rev 53 B 3.1 REACTIVITY CONTROL SYSTEMS page(s) 3.1-5 ............................................................................................................. Rev 73 3.1-6 ............................................................................................................. Rev 73 3.1-7 ............................................................................................................. Rev 73 3.1-8 ........................................................................................................... Rev 113 3.1-9 ........................................................................................................... Rev 113 3.1-10 ........................................................................................................... Rev 94 3.1-11 ......................................................................................................... Rev 113 3.1-14 ........................................................................................................... Rev 50 3.1-15 ............................................................................................................. Rev 2 3.1-16 ........................................................................................................... Rev 80 3.1-17 ........................................................................................................... Rev 64 3.1-18 ........................................................................................................... Rev 64 3.1-19 ........................................................................................................... Rev 87 3.1-20 ........................................................................................................... Rev 80 3.1-21 ........................................................................................................... Rev 64 3.1-23 ........................................................................................................... Rev 50 PBAPS UNIT 3 I Revision No. 114

PBAPS UNIT 3 - LICENSE NO. DPR 56 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B 3.1 REACTIVITY CONTROL SYSTEMS (continued) page(s) 3.1-25 ........................................................................................................... Rev 58 3.1-26 ........................................................................................................... Rev 87 3.1-27 ........................................................................................................... Rev 58 3.1-28 ........................................................................................................... Rev 73 3.1-29 ........................................................................................................... Rev 50 3.1-31 ............................................................................................................. Rev 2 3.1-32 ............................................................................................................. Rev 2 3.1-33 ........................................................................................................... Rev 87 3.1-34 ........................................................................................................... Rev 76 3.1-35 ........................................................................................................... Rev 64 3.1-35a ......................................................................................................... Rev 64 3.1-36 ........................................................................................................... Rev 64 3.1-37 ........................................................................................................... Rev 87 3.1-38 ........................................................................................................... Rev 62 3.1-39 ........................................................................................................... Rev 76 3.1-40 ......................................................................................................... Rev 103 3.1-41 ........................................................................................................... Rev 76 3.1-42 ........................................................................................................... Rev 86 3.1-43 ........................................................................................................... Rev 86 3.1-44 ........................................................................................................... Rev 87 3.1-45 ........................................................................................................... Rev 87 3.1-46 ......................................................................................................... Rev 110 3.1-47 ........................................................................................................... Rev 87 3.1-48 ........................................................................................................... Rev 76 3.1-49 ........................................................................................................... Rev 58 3.1-50 ........................................................................................................... Rev 58 3.1-51 ........................................................................................................... Rev 87 3.1-52 ........................................................................................................... Rev 87 B 3.2 POWER DISTRIBUTION LIMITS page(s) 3.2-1 ............................................................................................................. Rev 50 3.2-2 ............................................................................................................. Rev 50 3.2-3 ............................................................................................................. Rev 50 3.2-4 ............................................................................................................. Rev 87 3.2-5 ............................................................................................................. Rev 50 3.2-7 ............................................................................................................. Rev 98 3.2-8 ............................................................................................................. Rev 87 3.2-9 ............................................................................................................. Rev 87 3.2-10 ........................................................................................................... Rev 48 3.2-11 ......................................................................................................... Rev 101 3.2-12 ........................................................................................................... Rev 50 3.2-12a ......................................................................................................... Rev 50 3.2-13 ......................................................................................................... Rev 101 PBAPS UNIT 3 ii Revision No. 114

PBAPS UNIT 3 - LICENSE NO. DPR 56 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B 3.3 INSTRUMENTATION page(s) 3.3 6 (inclusive) ..................................................................................... Rev 17 3.3-7 ............................................................................................................. Rev 55 3.3-8 ............................................................................................................. Rev 51 3.3-9 ............................................................................................................. Rev 51 3.3-10 ........................................................................................................... Rev 30 3.3-11 ........................................................................................................... Rev 30 3.3-12 ........................................................................................................... Rev 51 3.3-12a ......................................................................................................... Rev 51 3.3-12b ......................................................................................................... Rev 51 3.3-18 ........................................................................................................... Rev 45 3.3-19 ........................................................................................................... Rev 45 3.3-23 ........................................................................................................... Rev 30 3.3-24 ........................................................................................................... Rev 51 3.3-25 ........................................................................................................... Rev 51 3.3-26 ........................................................................................................... Rev 30 3.3-27 ........................................................................................................... Rev 55 3.3-27a ......................................................................................................... Rev 55 3.3-28 ........................................................................................................... Rev 87 3.3-29 .......................................................................................................... Rev 87 3.3-30 ........................................................................................................... Rev 87 3.3-31 ........................................................................................................... Rev 87 3.3-32 ........................................................................................................... Rev 87 3.3-33 ........................................................................................................... Rev 87 3.3-34 ........................................................................................................... Rev 87 3.3-35 ........................................................................................................... Rev 87 3.3-36 ........................................................................................................... Rev 87 3.3-36a ......................................................................................................... Rev 51 3.3 41 (inclusive) ................................................................................. Rev 17 3.3-42 ........................................................................................................... Rev 87 3.3-43 ........................................................................................................... Rev 87 3.3-44

. .......................................................................................................... Rev 87 3.3-45 ........................................................................................................... Rev 87 3.3-46 ........................................................................................................... Rev 30 3.3-47 ........................................................................................................... Rev 31 3.3-48 ............................................................................................................. Rev 3 3.3-49 ........................................................................................................... Rev 64 3.3-50 ......................................................................... I................................. Rev 64 3.3-51 ............................................................................................................. Rev 3 3.3-52 ............................................................................................................. Rev 3 3.3-53 ........................................................................................................... Rev 87 3.3-54 ........................................................................................................... Rev 87 3.3-55 ........................................................................................................... Rev 87 3.3-56 ........................................................................................................... Rev 87 3.3-57 ........................................................................................................... Rev 87 3.3-58 ........................................................................................................... Rev 62 3.3-59 ............................................................................................................. Rev 3 3.3-60 ........................................................................................................... Rev 45 3.3-61 ........................................................................................................... Rev 50 3.3-62 ............................................................................................................. Rev 3 PBAPS UNIT 3 iii Revision No. 114

PBAPS UNIT 3 - LICENSE NO. DPR 56 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B 3.3 INSTRUMENTATION (continued) page(s) 3.3-63 ........................................................................................................... Rev 58 3.3-64 ........................................................................................................... Rev 87 3.3-65 ........................................................................................................... Rev 87 3.3-66 ............................................................................................................. Rev 3 3.3-67 ............................................................................................................. Rev 3 3.3-68 ............................................................................................................. Rev 7 3.3-69 ............................................................................................................. Rev 3 3.3-70 ........................................................................................................... Rev 58 3.3-71 ........................................................................................................... Rev 56 3.3-72 ........................................................................................................... Rev 53 3.3-73 ............................................................................................................. Rev 3 3.3-74 ............................................................................................................. Rev 3 3.3-75 ........................................................................................................... Rev 87 3.3-76 ........................................................................................................... Rev 87 3.3-77 .............................................................................................................. Rev 3 3.3-78 ............................................................................................................. Rev 3 3.3-79 ........................................................................................................... Rev 53 3.3-80 ........................................................................................................... Rev 87 3.3 89 (inclusive) .................................................................................. Rev 3 3.3-90 ........................................................................................................... Rev 87 3.3-91 ........................................................................................................... Rev 87 3.3-92 ........................................................................................................... Rev 87 3.3-92a ......................................................................................................... Rev 28 3.3-92b ......................................................................................................... Rev 50 3.3-92c ......................................................................................................... Rev 50 3.3-92d ............................................... Rev 45 3.3-92e ......................................................................................................... Rev 45 3.3-92f .......................................................................................................... Rev 58 3.3-92g ......................................................................................................... Rev 58 3.3-92h ......................................................................................................... Rev 87 3.3-92i .......................................................................................................... Rev 87 3.3-92j .......................................................................................................... Rev 87 3.3 98 (inclusive) ................................................................................... Rev 3 3.3-99 ........................................................................................................... Rev 23 3.3-100 ......................................................................................................... Rev 58 3.3-101 ......................................................................................................... Rev 58 3.3-102 ......................................................................................................... Rev 58 3.3-103 ......................................................................................................... Rev 58 3.3-104 ......................................................................................................... Rev 58 3.3-105 ......................................................................................................... Rev 58 3.3-106 ........................................................................................................... Rev 3 3.3-107 ......................................................................................................... Rev 58 3.3-108 - 111 (inclusive) ............................................................................... Rev 3 3.3-112 ......................................................................................................... Rev 79 3.3-113 - 124 (inclusive) ............................................................................... Rev 3 3.3-125 ......................................................................................................... Rev 59 3.3-126 ......................................................................................................... Rev 84 PBAPS UNIT 3 iv Revision No. 114

PBAPS UNIT 3 - LICENSE NO. DPR 56 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B 3.3 INSTRUMENTATION (continued) page(s) 3.3-127 ........................................................................................................... Rev 3 3.3-128 ......................................................................................................... Rev 87 3.3-129 ......................................................................................................... Rev 87 3.3-130 ......................................................................................................... Rev 87 3.3-131 - 138 (inclusive) ............................................................................... Rev 3 3.3-139 ........................................................................................................ Rev 87 3.3-140 ......................................................................................................... Rev 87 3.3-141 ......................................................................................................... Rev 87 3.3-142 ........................................................................................................... Rev 3 3.3-143 ........................................................................................................... Rev 3 3.3-144 ........................................................................................................... Rev 3 3.3-145 ......................................................................................................... Rev 58 3.3-146 ......................................................................................................... Rev 58 3.3-147 ........................................................................................................... Rev 3 3.3-148 ......................................................................................................... Rev 76 3.3-149 ......................................................................................................... Rev 76 3.3-150 ........................................................................................................ Rev 76 3.3-151 ......................................................................................................... Rev 76 3.3-152 ......................................................................................................... Rev 22 3.3-153 - 155 (inclusive) ............................................................................... Rev 3 3.3-156 ......................................................................................................... Rev 34 3.3-157 ......................................................................................................... Rev 76 3.3-158 ........................................................................................................... Rev 3 3.3-159 ........................................................................................................... Rev 3 3.3-160 .......................................................................................................... Rev 58 3.3-160a ....................................................................................................... Rev 58 3.3-161 ......................................................................................................... Rev 58 3.3-162 ........................................................................................................... Rev 3 3.3-163 ......................................................................................................... Rev 46 3.3-1 64 ........................................................................................................... Rev 3 3.3-165 ........................................................................................................... Rev 3 3.3-166 ......................................................................................................... Rev 87 3.3-167 ......................................................................................................... Rev 87 3.3-168 ......................................................................................................... Rev 87 3.3-169 - 173 (inclusive) ............................................................................... Rev 3 3.3-174 ......................................................................................................... Rev 76 3.3-175 ........................................................................................................... Rev 3 3.3-176 ........................................................................................................... Rev 3 3.3-177 ......................................................................................................... Rev 87 3.3-178 ......................................................................................................... Rev 87 3.3-179 ........................................................................................................... Rev 3 3.3-180 ........................................................................................................... Rev 3 3.3-181 ........................................................................................................... Rev 3 3.3-182 ........................................................................................................... Rev 3 3.3-183 ........................................................................................................... Rev 3 3.3-184 ......................................................................................................... Rev 87 3.3-185 ......................................................................................................... Rev 87 3.3-186 ......................................................................................................... Rev 87 PBAPS UNIT 3 v Revision No. 114

PBAPS UNIT 3 - LICENSE NO. DPR 56 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B 3.3 INSTRUMENTATION (continued) page(s) 3.3-187 ........................................................................................................... Rev 5 3.3-188 ......................................................................................................... Rev 88 3.3-189 ......................................................................................................... Rev 88 3.3-190 ......................................................................................................... Rev 88 3.3-191 - 194 (inclusive) ............................................................................... Rev 5 3.3-195 ......................................................................................................... Rev 78 3.3-196 ........................................................................................................... Rev 5 3.3-197 ......................................................................................................... Rev 87 3.3-198 ........................................................................................................ Rev 87 3.3-199 .......................................................................................................... Rev 3 3.3-200 ........................................................................................................... Rev 3 3.3-201 ........................................................................................................... Rev 3 3.3-202 ........................................................................................................... Rev 3 3.3-203 ......................................................................................................... Rev 67 3.3-204 ......................................................................................................... Rev 87 3.3-205 ......................................................................................................... Rev 87 B 3.4 REACTOR COOLANT SYSTEM (RCS) page(s) 3.4-3 ........................................................................................................... Rev 101 3.4-4 ............................................................................................................. Rev 51 3.4-5 ............................................................................................................. Rev 51 3.4-6 ............................................................................................................. Rev 51 3.4-7 ............................................................................................................. Rev 51 3.4-8 ............................................................................................................. Rev 51 3.4-9 ............................................................................................................. Rev 87 3.4-10 ......................................................................................................... Rev 101 3.4-14 ........................................................................................................... Rev 87 3.4-15 ........................................................................................................... Rev 75 3.4-16 ......................................................................................................... Rev 110 3.4-17 ......................................................................................................... Rev 110 3.4-18 ........................................................................................................... Rev 87 3.4-23 ........................................................................................................... Rev 87 3.4-24 ........................................................................................................... Rev 93 3.4-25 ........................................................................................................... Rev 93 3.4-26 ........................................................................................................... Rev 93 3.4-26a ......................................................................................................... Rev 93 3.4-27 ........................................................................................................... Rev 87 3.4-28 ........................................................................................................... Rev 93 3.4-29 ........................................................................................................... Rev 76 3.4-30 ........................................................................................................... Rev 76 3.4-31 ........................................................................................................... Rev 76 3.4-32 ........................................................................................................... Rev 87 3.4-35 ........................................................................................................... Rev 53 3.4-37 ........................................................................................................... Rev 87 3.4-39 ............................................................................................................. Rev 1 3.4-42 ........................................................................................................... Rev 87 3.4-43 ......................................................................................................... Rev 102 3.4-44 ......................................................................................................... Rev 102 PBAPS UNIT 3 vi Revision No. 114

PBAPS UNIT 3 - LICENSE NO. DPR 56 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B 3.4 REACTOR COOLANT SYSTEM (RCS) (continued) page(s) 3.4-45 ......................................................................................................... Rev 102 3.4-46 ......................................................................................................... Rev 102 3.4-47 ......................................................................................................... Rev 102 3.4-48 ......................................................................................................... Rev 102 3.4-49 ......................................................................................................... Rev 102 3.4-50 ......................................................................................................... Rev 102 3.4-51 ......................................................................................................... Rev 102 3.4-52 ........................................................................................................... Rev 50 3.4-53 ........................................................................................................... Rev 87 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM page(s) 3.5-3 ........................................................................................................... Rev 110 3.5-4 ........................................................................................................... Rev 101 3.5-5 ........................................................................................................... Rev 112 3.5-6 ........................................................................................................... Rev 112 3.5-6a ........................................................................................................... Rev 96 3.5-7 ............................................................................................................. Rev 89 3.5-8 ........................................................................................................... Rev 101 3.5-9 ............................................................................................................. Rev 67 3.5-10 ........................................................................................................... Rev 87 3.5-11 ........................................................................................................... Rev 87 3.5-12 ........................................................................................................... Rev 87 3.5-13 ........................................................................................................... Rev 99 3.5-14 ........................................................................................................... Rev 87 3.5-15 ........................................................................................................... Rev 87 3.5-16 ........................................................................................................... Rev 87 3.5-17 ......................................................................................................... Rev 101 3.5-19 ........................................................................................................... Rev 96 3.5-1ga ......................................................................................................... Rev 96 3.5-1 9b ......................................................................................................... Rev 96 3.5-22 ........................................................................................................... .Rev 87 3.5-23 .......................................................................................................... .Rev 58 3.5-24 ........................................................................................................ .Rev 110 3.5-26 .......................................................................................................... .Rev 67 3.5-27 .......................................................................................................... .Rev 87 3.5-28 .......................................................................................................... .Rev 87 3.5-29 .......................................................................................................... .Rev 87 3.5-30 .......................................................................................................... .Rev 67 B 3.6 CONTAINMENT SYSTEMS page(s) 3.6-1 ............................................................................................................. Rev 27 3.6-2 ............................................................................................................. Rev 76 3.6-3 ............................................................................................................. Rev 67 3.6-4 ............................................................................................................. Rev 87 3.6-5 ............................................................................................................. Rev 67 PBAPS UNIT 3 vii Revision No. 114

PBAPS UNIT 3 - LICENSE NO. DPR 56 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B 3.6 CONTAINMENT SYSTEMS (continued) page(s) 3.6-7 ............................................................................................................. Rev 76 3.6-11 ............................................................................................................. Rev 6 3.6-12 ........................................................................................................... Rev 87 3.6-13 ........................................................................................................... Rev 21 3.6-16 ........................................................................................................... Rev 91 3.6 18 (inclusive) ................................................................................... Rev 2 3.6-20 ........................................................................................................... Rev 58 3.6-21 ......................... .................................................................................. Rev 58 3.6-22 ........................................................................................................... Rev 58 3.6-23 ........................................................................................................... Rev 76 3.6-24 ........................................................................................................... Rev 91 3.6-25 ........................................................................................................... Rev 87 3.6-26 ........................................................................................................... Rev 87 3.6-27 ........................................................................................................... Rev 87 3.6-28 ........................................................................................................... Rev 87 3.6-29 ........................................................................................................... Rev 87 3.6-30 ........................................................................................................... Rev 87 3.6-31 ........................................................................................................... Rev 20 3.6-33 ........................................................................................................... Rev 87 3.6-35 ........................................................................................................... Rev 91 3.6-38 ........................................................................................................... Rev 67 3.6-39 ........................................................................................................... Rev 91 3.6-40 ........................................................................................................... Rev 87 3.6-41 ........................................................................................................... Rev 87 3.6-43 ........................................................................................................... Rev 44 3.6-45 ........................................................................................................... Rev 67 3.6-46 ........................................................................................................... Rev 87 3.6-47 ........................................................................................................... Rev 87 3.6-49 ........................................................................................................... Rev 17 3.6-50 ........................................................................................................... Rev 17 3.6-51 ........................................................................................................... Rev 17 3.6-52 ........................................................................................................... Rev 87 3.6-55 ........................................................................................................... Rev 87 3.6-58 ........................................................................................................... Rev 67 3.6-59 ........................................................................................................... Rev 87 3.6-62 ........................................................................................................... Rev 67 3.6-63 ........................................................................................................... Rev 87 3.6-63a ....................................................................................................... Rev 106 3.6-63b ....................................................................................................... Rev 106 3.6-63c ....................................................................................................... Rev 106 3.6-63d ....................................................................................................... Rev 106 3.6-64 ........................................................................................................... Rev 81 3.6-70 ........................................................................................................... Rev 81 3.6-72 ........................................................................................................... Rev 87 3.6-73 ........................................................................................................... Rev 76 3.6-74 ........................................................................................................... Rev 76 3.6-75 ........................................................................................................... Rev 76 PBAPS UNIT 3 viii Revision No. 114

PBAPS UNIT 3 - LICENSE NO. DPR 56 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B 3.6 CONTAINMENT SYSTEMS (continued) page(s) 3.6-76 ........................................................................................................... Rev 87 3.6-77 ........................................................................................................... Rev 97 3.6-78 ........................................................................................................... Rev 76 3.6-79 ........................................................................................................... Rev 76 3.6-81 ........................................................................................................... Rev 58 3.6-82 ........................................................................................................... Rev 76 3.6-83 ........................................................................................................... Rev 87 3.6-84 ........................................................................................................... Rev 87 3.6-87 ........................................................................................................... Rev 76 3.6-88 ........................................................................................................... Rev 76 3.6-89 ........................................................................................................... Rev 87 3.6-90 .......................................................................................................... Rev 87 B 3.7 PLANT SYSTEMS page(s) 3.7-1 ............................................................................................................. Rev 89 3.7-3 ............................................................................................................. Rev 89 3.7-4 ............................................................................................................. Rev 67 3.7-5 ............................................................................................................. Rev 87 3.7-6 ............................................................................................................... Rev 4 3.7-7 ........................................................................................................... Rev 109 3.7-8 ........................................................................................................... Rev 109 3.7-9 ................................................ Rev 109 3.7-10 ........................................................................................................... Rev 87 3.7-11 ........................................................................................................... Rev 68 3.7-12 ........................................................................................................... Rev 92 3.7-13 ............................................................................................................. Rev I 3.7-14 .......................................................................................................... Rev 87 3.7-15 ......................................................................................................... Rev 114 3.7-16 ........................................................................................................ Rev 114 3.7-16a ....................................................................................................... Rev 114 3.7-16b ....................................................................................................... Rev 114 3.7-17 ......................................................................................................... Rev 114 3.7-18 ......................................................................................................... Rev 114 3.7-19 ........................................................................................................... Rev 69 3.7-20 ........................................................................................................... Rev 87 3.7-20a ....................................................................................................... Rev 114 3.7-21 ......................................................................................................... Rev 114 3.7-23 ........................................................................................................... Rev 67 3.7-24 ........................................................................................................... Rev 87 3.7-26 ........................................................................................................... Rev 50 3.7-27 ........................................................................................................... Rev 87 3.7-28 ......................................................................................................... Rev 111 3.7-29 ........................................................................................................... Rev 76 3.7-30 ........................................................................................................... Rev 87 PBAPS UNIT 3 ix Revision No. 114

PBAPS UNIT 3 - LICENSE NO. DPR 56 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B 3.8 ELECTRICAL POWER SYSTEMS page(s) 3.8-1 ............................................................................................................. Rev 83 3.8-2 ............................................................................................................. Rev 90 3.8-2a ........................................................................................................... Rev 90 3.8-3 ............................................................................................................. Rev 95 3.8-5 ............................................................................................................. Rev 74 3.8-6 ............................................................................................................. Rev 53 3.8-7 ............................................................................................................... Rev 5 3.8-8 ............................................................................................................. Rev 86 3.8-9 ............................................................................................................. Rev 86 3.8-10 ............................................................................................................. Rev 5 3.8-11 ........................................................................................................... Rev 61 3.8-12 ............................................................................................................ Rev 1 3.8-17 ........................................................................................................... Rev 67 3.8-18 ........................................................................................................... Rev 72 3.8-19 ........................................................................................................... Rev 87 3.8-20 .......................................................................................................... Rev 87 3.8-21 ........................................................................................................... Rev 87 3.8-22 ........................................................................................................... Rev 87 3.8-23 ........................................................................................................... Rev 87 3.8-24 ......................................................................................................... Rev 104 3.8-25 ............................................................................................................. Rev 1 3.8-26 ........................................................................................................... Rev 87 3.8-27 ........................................................................................................... Rev 87 3.8-27a ......................................................................................................... Rev 58 3.8-28 ........................................................................................................... Rev 87 3.8-29 ........................................................................................................... Rev 72 3.8-30 ........................................................................................................... Rev 87 3.8-31 ........................................................................................................... Rev 58 3.8-32 ........................................................................................................... Rev 87 3.8-33 ........................................................................................................... Rev 87 3.8-34 ........................................................................................................... Rev 87 3.8-35 ........................................................................................................... Rev 87 3.8-36 ........................................................................................................... Rev 87 3.8-37 ........................................................................................................... Rev 72 3.8-38 ........................................................................................................... Rev 87 3.8-39 ........................................................................................................... Rev 95 3.8-42 ........................................................................................................... Rev 58 3.8 47 (inclusive) ................................................................................ Rev 18 3.8-48 ......................................................................................................... Rev 105 3.8-51 ......................................................................................................... Rev 105 3.8-53 ........................................................................................................... Rev 87 3.8-54 ........................................................................................................... Rev 87 3.8-55 ......................................................................................................... Rev 108 3.8-56 ........................................................................................................... Rev 87 3.8-57 ........................................................................................................... Rev 87 3.8-64 ........................................................................................................... Rev 67 3.8-65 ........................................................................................................... Rev 87 3.8-66 ........................................................................................................... Rev 87 3.8-67 ........................................................................................................... Rev 87 3.8-69 ........................................................................................................... Rev 87 PBAPS UNIT 3 x Revision No. 114

PBAPS UNIT 3 - LICENSE NO. DPR 56 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B 3.8 ELECTRICAL POWER SYSTEMS (continued) page(s) 3.8-71 ........................................................................................................... Rev 67 3.8-79 ........................................................................................................... Rev 87 3.8-80 ........................................................................................................... Rev 87 3.8-89 ........................................................................................................... Rev 86 3.8-90 ........................................................................................................... Rev 86 3.8-91 ........................................................................................................... Rev 86 3.8-92 ........................................................................................................... Rev 87 3.8-97 ........................................................................................................... Rev 87 B 3.9 REFUELING OPERATIONS page(s) 3.9-1 ............................................................................................................. Rev 29 3.9-3 ............................................................................................................. Rev 29 3.9-4 ............................................................................................................. Rev 87 3.9-7 ............................................................................................................. Rev 87 3.9-8 ............................................................................................................. Rev 17 3.9-9 ............................................................................................................. Rev 87 3.9-10 ........................................................................................................... Rev 17 3.9-14 ........................................................................................................... Rev 17 3.9-15 ........................................................................................................... Rev 87 3.9-17 ........................................................................................................... Rev 76 3.9-19 ........................................................................................................... Rev 87 3.9-23 ........................................................................................................... Rev 87 3.9-27 ........................................................................................................... Rev 87 B 3.10 SPECIAL OPERATIONS page(s) 3.10-1 ............................................................................................................. Rev 1 3.10-5 ........................................................................................................... Rev 17 3.10-8 ........................................................................................................... Rev 87 3.10-9 ........................................................................................................... Rev 87 3.10-13 ......................................................................................................... Rev 87 3.10-18 ......................................................................................................... Rev 87 3.10-22 ......................................................................................................... Rev 87 3.10-26 ......................................................................................................... Rev 87 3.10-30 ......................................................................................................... Rev 73 3.10-31 ......................................................................................................... Rev 17 3.10-32 ......................................................................................................... Rev 30 3.10-33 ......................................................................................................... Rev 64 3.10-35 ......................................................................................................... Rev 87 3.10-36 ......................................................................................................... Rev 87 All remaining pages are Rev 0 dated 1/18196.

PBAPS UNIT 3 xi Revision No. 114

Recirculation Loops Operating B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.1 Recirculation Loops Operating BASES BACKGROUND The Reactor Coolant Recirculation System is designed.,to provide a forced coolant flow through the core.to.remove heat from the fuel. The forced coolant flow removes'more heat from the fuel than would be possible with just- natural circulation. The forced flow, therefore, allows operation.

at significantly higher power than would otherwise be possible. The recirculation system also controls reactivity over a wide span of reactor power by varying the recirculation flow rate to control the void content of the moderator. The Reactor Coolant Recirculation System consists of two recirculation pump loops external to the.

reactor vessel. These loops provide the piping.path for the driving flow of water to the reactor vessel jet pumps.. Each external loop contains one variable speed motor driven.

recirculation pump, a motor generator (MG) set to control pump speed and associated piping, jet pumps, valves.;-.and instrumentation. The recirculation loops are part.of the reactor coolant pressure boundary and are located inside'the drywell structure. The jet pumps are reactor vessel internals.

The recirculated coolant consists of saturated water from the steam separators and dryers that has been subcooled by incoming feedwater. This water passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold, from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the suction flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the driving flow. The drive flow and suction flow are mixed in the jet pump throat section. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core. The subcooled water enters the bottom of the fuel channels and contacts the fuel cladding, where heat is transferred to'the coolant. As it rises, the coolant (continued)

PBAPS UNIT 3 B 3.4-1 Revision No. 0

Recirculation Loops Operating B 3.4.1 BASES BACKGROUND begins to boil, creating steam voids within the fuel channel (continued) that continue until the coolant exits the-core. Because of reduced moderation, the steam voiding introduces negative reactivity that must be compensated for to maintain or to increase reactor power. The recirculation flow control allows operators to increase recirculation flow and sweep some of the voids from the fuel channel, overcoming the negative reactivity void effect. Thus, the reason for having variable recirculation flow is to compensate for reactivity effects of boiling over a wide range of power generation (i.e., 65 to 100% of RTP) without having to move control rods and disturb desirable flux patterns.

Each recirculation loop is manually started from the control room. The MG set provides regulation of individual recirculation loop drive flows. The flow in each loop is manually controlled.

APPLICABLE The operation of the Reactor Coolant Recirculation System is SAFETY ANALYSES an initial condition assumed in the design basis loss of coolant accident (LOCA) (Ref. 1). During a LOCA caused by a recirculation loop pipe break, the intact loop is assumed to provide coolant flow during the first few seconds of the accident. The initial core flow decrease is rapid because the recirculation pump in the broken loop ceases to pump reactor coolant to the vessel almost immediately. The pump in the intact loop coasts down relatively slowly. This pump coastdown governs the core flow response for the next several seconds until the jet pump suction is uncovered.

The analyses assume that both loops are operating at the same flow prior to the accident. However, the LOCA analysis was reviewed for the case with a flow mismatch between the two loops, with the pipe break assumed to be in the loop with the higher flow. While the flow coastdown and core response are potentially more severe in this assumed case (since the intact loop starts at a lower flow rate and the core response is the same as if both loops were operating at a lower flow rate), a small mismatch has been determined to be acceptable based on engineering judgement. The recirculation system is also assumed to have sufficient flow coastdown characteristics to maintain fuel thermal margins during abnormal operational transients, which are analyzed in Chapter 14 of the UFSAR.

(continued)

PBAPS UNIT 3 B 3.4-2 Revision No. 0

Recirculation Loops Operating B 3.4.1 BASES APPLICABLE Plant specific LOCA and average power range monitor/rod SAFETY ANALYSES block monitor Technical Specification/maximum extended load (continued) line limit analyses have been performed assuming only one operating recirculation loop. These analyses demonstrate that, in the event of a LOCA caused by a pipe break in the operating recirculation loop, the Emergency Core Cooling System response will provide adequate core cooling (Refs. 2, 3, 4, 7, and 8). I The transient analyses of Chapter 14 of the UFSAR have also been performed for single recirculation loop operation (Ref. 5) and demonstrate sufficient flow coastdown characteristics to maintain fuel thermal margins during the abnormal operational transients analyzed provided the MCPR requirements are modified. During single recirculation loop operation, modification to the Reactor Protection System (RPS) average power range monitor (APRM) instrument setpoints is also required to account for the different relationships between recirculation drive flow and reactor core flow. The MCPR limits and APLHGR limits (power-dependent APLHGR multipliers, MAPFACp, and flow-dependent APLHGR multipliers, MAPFACf) for single loop operation are specified in the COLR. The APRM Simulated Thermal Power-High Allowable Value is in LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation."

(continued)

PBAPS UNIT 3 B 3.4-3 Revision No. 101

Recirculation Loops Operating B 3.4.1 BASES APPLICABLE SAFETY ANALYSES (continued)

Recirculation loops operating satisfies Criterion 2 of the NRC Policy Statement.

LCO Two recirculation loops are normally required to be in operation with their flows matched within the limi.ts specified in SR 3.4.1.1 to ensure that during a LOCA caused by a break of the piping of one recirculation loop the (continued)

PBAPS UNIT 3 B 3.4-4 Revision No. 51

Recirculation Loops Operating B 3.4.1 BASES LCO assumptions of the LOCA analysis are satisfied.

Alternatively, with only one recirculation loop in operation, modifications to the required APLHGR limits (power- and flow-dependent APLHGR multipliers, MAPFACP and MAPFACf, respectively of LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)"), MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and APRM Simulated Thermal Power-High Allowable Value (LCO 3.3.1.1) must be applied to allow continued operation consistent with the assumptions of Reference 5.

The LCO is modified by a Note which allows up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months before having to put in effect the required modifications to required limits after a change in the reactor operating conditions from two recirculation loops operating to single recirculation loop operation. If the required limits are not in compliance with the applicable requirements at the end of this period, the associated equipment must be declared inoperable or the limits "not satisfied," and the ACTIONS required by nonconformance with the applicable specifications implemented. This time is provided due to the need to stabilize operation with one recirculation loop, including the procedural steps necessary to limit flow in the operating loop, and the complexity and detail required to fully implement and confirm the required limit modifications.

APPLICABILITY In MODES 1 and 2, requirements for operation of the Reactor Coolant Recirculation System are necessary since there is considerable energy in the reactor core and the limiting design basis transients and accidents are assumed to occur.

In MODES 3, 4, and 5, the consequences of an accident are reduced and the coastdown characteristics of the recirculation loops are not important.

(continued)

PBAPS UNIT 3 B 3.4-5 Revision No. 51

Recirculation Loops Operating B 3.4.1 BASES THIS PAGE LEFT BLANK INTENTIONALLY (The contents of this page have been deleted)

PBAPS UNIT 3 B 3.4-6 Revision No. 51

Recirculation Loops Operating B 3.4.1 BASES ACTIONS (continued)

A.1 With the requirements of the LCO not met, the recirculation loops must be restored to operation with matched flows within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . A recirculation loop is considered not in operation when the pump in that loop is idle or when the mismatch between total jet pump flows of the two loops is greater than required limits. The loop with the lower flow must be considered not in operation. Should a LOCA occur with one recirculation loop not in operation, the core flow coastdown and resultant core response may not be bounded by the LOCA analyses. Therefore, only a limited time is allowed to restore the inoperable loop to operating status.

Alternatively, if the single loop requirements of the LCO are applied to operating limits and RPS setpoints, operation with only one recirculation loop would satisfy the requirements of the LCO and the initial conditions of the accident sequence.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is based on the low probability of an accident occurring during this time period, on a reasonable time to complete the Required Action, and on frequent core monitoring by operators allowing abrupt changes in core flow conditions to be quickly detected.

(continued)

PBAPS UNIT 3 B 3.4-7 Revision No. 51

Recirculation Loops Operating B 3.4.1 BASES ACTIONS A.1 (continued)

This Required Action does not require tripping the recirculation pump in the lowest flow loop when the mismatch between total jet pump flows of the two loops is greater than the required limits. However, in cases where large flow mismatches occur, low flow or reverse flow can occur in the low flow loop jet pumps, causing vibration of the jet pumps. If zero or reverse flow is detected, the condition should be alleviated by changing pump speeds to re-establish forward flow or by tripping the pump.

B.1 With no recirculation loops in operation or the Required Action and associated Completion Time of Condition A not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In this condition, the recirculation loops are not required to be operating because of the reduced severity of DBAs and minimal dependence on the recirculation loop coastdown characteristics. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PBAPS UNIT 3 B 3.4-8 Revision No. 51

Recirculation Loops Operating B 3.4.1 BASES SURVEILLANCE SR 3.4.1.1 REQUIREMENTS This SR ensures the recirculation loops are within the allowable limits for mismatch. At low core flow (i.e.,

< 71.75 X 106 lbm/hr), the MCPR requirements provide larger margins to the fuel cladding integrity Safety Limit such that the potential adverse effect of early boiling transition during a LOCA is reduced. A larger flow mismatch can therefore be allowed when core flow is < 71.75 X 106 lbm/hr. The recirculation loop jet pump flow, as used in this Surveillance, is the summation of the flows from all of the jet pumps associated with a single recirculation loop.

The mismatch is measured in terms of core flow. (Rated core flow is 102.5 X 106 lbm/hr. The first limit is based on mismatch

10% of rated core flow when operating at < 70% of rated core flow. The second limit is based on mismatch 5 5%

of rated core flow when operating at Ž 70% of rated core flow.) If the flow mismatch exceeds the specified limits, the loop with the lower flow is considered not in operation.

The SR is not required when both loops are not in operation since the mismatch limits are meaningless during single loop or natural circulation operation. The Surveillance must be performed within the specified Frequency after both loops are in operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.4-9 Revision No. 87

Recirculation Loops Operating B 3.4.1 BASES REFERENCES 1. UFSAR, Section 14.6.3.

2. NEDC-32163P, "PBAPS Units 2 and 3 SAFER/GESTR-LOCA Loss-of-Coolant Accident Analysis," January 1993.

3. NEDC-32162P, "Maximum Extended Load Line Limit and ARTS Improvement Program Analyses for Peach Bottom Atomic Power Station Unit 2 and 3," Revision 1, February 1993.

4. NEDC-32427P, "Peach Bottom Atomic Power Station Unit 3 Cycle 10 ARTS Thermal Limits Analyses," December 1994.

5. NEDO-24229-1, "PBAPS Units 2 and 3 Single-Loop Operation," May 1980.

6. NEDC-33064P, "Safety Analysis Report for Peach Bottom Atomic Power Station Units 2 & 3 Thermal Power Optimization," May 2002.

7. G-080-VC-400, "Peach Bottom Atomic Power Station Units 2 & 3 GNF2 ECCS-LOCA Evaluation," GE Hitachi Nuclear Energy, 0000-0100-8531-RI, March 2011.

8. G-080-VC-272, "Peach Bottom Atomic Power Station ECCS-LOCA Evaluation for GE14," General Electric Company, GENE-J11-03716-09-02P, July 2000.

PBAPS UNIT 3 B 3.4-10 Revision No. 101

Jet Pumps B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.2 Jet Pumps BASES BACKGROUND The Reactor Coolant Recirculation System is described in the Background section of the Bases for LCO 3.4.1, "Recirculation Loops Operating," which discusses the operating characteristics of the system and how these characteristics affect the Design Basis Accident (DBA) analyses.

The jet pumps are reactor vessel internals and in conjunction with the Reactor Coolant Recirculation System are designed to provide forced circulation through the core to remove heat from the fuel. The jet pumps are located in the annular region between the core shroud and the vessel inner wall. Because the jet pump suction elevation is at two-thirds core height, the vessel can be reflooded and coolant level maintained at two-thirds core height even with the complete break of the recirculation loop pipe that is located below the jet pump suction elevation.

Each reactor coolant recirculation loop contains ten jet pumps. Recirculated coolant passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the suction flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the drive flow.

The drive flow and suction flow are mixed in the jet pump throat section. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core.

APPLICABLE Jet pump OPERABILITY is an implicit assumption in the design SAFETY ANALYSES basis loss of coolant accident (LOCA) analysis evaluated in Reference 1.

(continued)

PBAPS UNIT 3 B 3.4-11 Revision No. 0 I

Jet Pumps B 3.4.2 BASES APPLICABLE The capability of reflooding the core to two-thirds core SAFETY ANALYSES height is dependent upon the structural integrity of the jet (continued) pumps. If the structural system, including the beam holding a jet pump in place, fails, jet pump displacement and performance degradation could occur, resulting in an increased flow area through the jet pump and a lower core flooding elevation. This could adversely affect the water level in the core during the reflood phase of a LOCA as well as the assumed blowdown flow during a LOCA.

Jet pumps satisfy Criterion 2 of the NRC Policy Statement.

LCO The structural failure of any of the jet pumps could cause significant degradation in the ability of the jet pumps to allow reflooding to two-thirds core height during a LOCA.

OPERABILITY of all jet pumps is required to ensure that operation of the Reactor Coolant Recirculation System will be consistent with the assumptions used in the licensing basis analysis (Ref. 1).

APPLICABILITY In MODES I and 2, the jet pumps are required to be OPERABLE since there is a large amount of energy in the reactor core and since the limiting DBAs are assumed to occur in these MODES. This is consistent with the requirements for operation of the Reactor Coolant Recirculation System (LCO 3.4.1).

In MODES 3, 4, and 5, the Reactor Coolant Recirculation System is not required to be in operation, and when not in operation, sufficient flow is not available to evaluate jet pump OPERABILITY.

ACTIONS A.1 An inoperable jet pump can increase the blowdown area and reduce the capability of reflooding during a design basis LOCA. If one or more of the jet pumps are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PBAPS UNIT 3 B 3.4-12 Revision No. 0

Jet Pumps B 3.4.2 BASES (continued)

SURVEILLANCE SR 3.4.2.1 REQUIREMENTS This SR is designed to detect significant degradation in jet pump performance that precedes jet pump failure (Ref. 2).

This SR is required to be performed only when the loop has

forced recirculation flow since surveillance checks and measurements can only be performed during jet pump operation. The jet pump failure of concern is a complete mixer displacement due to jet pump beam failure. Jet pump plugging is also of concern since it adds flow resistance to the recirculation loop. Significant degradation is indicated if the specified criteria confirm unacceptable deviations from established patterns or relationships. The allowable deviations from the established patterns have been developed based on the variations experienced at plants during normal operation and with jet pump assembly failures (Refs. 2 and 3). Each recirculation loop must satisfy one of the performance criteria provided. Since refueling activities (fuel assembly replacement or shuffle, as well as any modifications to fuel support orifice size or core plate bypass flow) can affect the relationship between core flow, jet pump flow, and recirculation loop flow, these relationships may need to be re-established each cycle.

Similarly, initial entry into extended single loop operation may also require establishment of these relationships.

During the initial weeks of operation under such conditions, while baselining new "established patterns," engineering judgement of the daily surveillance results is used to detect significant abnormalities which could indicate a jet pump failure.

The recirculation pump speed operating characteristics (pump flow and loop flow versus pump speed) are determined by the flow resistance from the loop suction through the jet pump nozzles. A change in the relationship indicates a plug, flow restriction, loss in pump hydraulic performance, leakage, or new flow path between the recirculation pump discharge and jet pump nozzle. For this criterion, the pump flow and loop flow versus pump speed relationship must be verified.

Individual jet pumps in a recirculation loop normally do not have the same flow. The unequal flow is due to the drive flow manifold, which does not distribute flow equally to all risers. The flow (or jet pump diffuser to lower plenum differential pressure) pattern or relationship of one jet (continued)

PBAPS UNIT 3 B 3.4-13 Revision No. 0

Jet Pumps B 3.4.2 BASES SURVEILLANCE SR 3.4.2.1 (continued)

REQUIREMENTS pump to the loop average is repeatable. An appreciable change in this relationship is an indication that increased (or reduced) resistance has occurred in one of the jet pumps. This may be indicated by an increase in the relative flow for a jet pump that has experienced beam cracks.

The deviations from normal are considered indicative of a potential problem in the recirculation drive flow or jet pump system (Ref. 2). Normal flow ranges and established jet pump flow and differential pressure patterns are established by plotting historical data as discussed in Reference 2.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. Note 1 allows this Surveillance not to be performed until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the associated recirculation loop is in operation, since these checks can only be performed during jet pump operation. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is an acceptable time to establish conditions appropriate for data collection and evaluation.

Note 2 allows this SR not to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after THERMAL POWER exceeds 25% of RTP. During low flow conditions, jet pump noise approaches the threshold response of the associated flow instrumentation and precludes the collection of repeatable and meaningful data. The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is an acceptable time to establish conditions appropriate to perform this SR.

REFERENCES 1. UFSAR, Section 14.6.3.

2. GE Service Information Letter No. 330, "Jet Pump Beam Cracks," June 9, 1980.

3. NUREG/CR-3052, "Closeout of IE Bulletin 80-07: BWR Jet Pump Assembly Failure," November 1984.

PBAPS UNIT 3 B 3.4-14 Revision No. 87

SRVs and SVs B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.3 Safety Relief Valves (SRVs) and Safety Valves (SVs)

BASES I BACKGROUND The ASME Code requires the reactor pressure vessel be protected from overpressure during upset conditions by self-actuated safety valves. As part of the nuclear pressure relief system, the size and number of SRVs and SVs are selected such that peak pressure in the nuclear system will not exceed the ASME Code limits for the reactor coolant pressure boundary (RCPB).

The SRVs and SVs are located on the main steam lines between the reactor vessel and the first isolation valve within the drywell. The SRVs can actuate by either of two modes: the safety mode or the depressurization mode. In the safety mode, the pilot disc opens when steam pressure at the valve inlet expands the bellows to the extent that the hydraulic seating force on the pilot disc is reduced to zero. Opening of the pilot stage allows a pressure differential to develop across the second stage disc which opens the second stage disc, thus venting the chamber over the main valve piston.

This causes a pressure differential across the main valve piston which opens the main valve. The SVs are spring loaded valves that actuate when steam pressure at the inlet overcomes the spring force holding the valve disc closed.

This satisfies the Code requirement.

Each of the 11 SRVs discharge steam through a discharge line to a point below the minimum water level in the suppression pool. The two SVs discharge steam directly to the drywell.

In the depressurization mode, the SRV is opened by a pneumatic actuator which opens the second stage disc. The main valve then opens as described above for the safety mode. The depressurization mode provides controlled depressurization of the reactor coolant pressure boundary.

All 11 of the SRVs function in the safety mode and have the capability to operate in the depressurization mode via manual actuation from the control room. Five of the SRVs are allocated to the Automatic Depressurization System (ADS). The ADS requirements are specified in LCO 3.5.1, "ECCS-Operati ng."

(continued)

PBAPS UNIT 3 B 3.4-15 Revision No. 75

SRVs and SVs B 3.4.3 BASES (continued)

APPLICABLE The overpressure protection system must accommodate the most SAFETY ANALYSES severe pressurization transient. Evaluations have determined that the most severe transient is the closure of all main steam isolation valves (MSIVs), followed by reactor scram on high neutron flux (i.e., failure of the direct scram associated with MSIV position) (Ref. 1). For the purpose of the analyses, 12 SRVs and SVs are assumed to operate in the safety mode. The analysis results demonstrate that the design SRV and SV capacity is capable of maintaining reactor pressure below the ASME Code limit of 110% of vessel design pressure (110% x 1250 psig =

1375 psig). This LCO helps to ensure that the acceptance limit of 1375 psig is met during the Design Basis Event.

From an overpressure standpoint, the design basis events are bounded by the MSIV closure with flux scram event described above. Reference 2 discusses additional events that are expected to actuate the SRVs and SVs.

SRVs and SVs satisfy Criterion 3 of the NRC Policy Statement.

LCO The safety function of any combination of 12 SRVs and SVs are required to be OPERABLE to satisfy the assumptions of the safety analysis (Refs. 1 and 2). Regarding the SRVs, the requirements of this LCO are applicable only to their capability to mechanically open to relieve excess pressure when the lift setpoint is exceeded (safety mode).

The SRV and SV setpoints are established to ensure that the ASME Code limit on peak reactor pressure is satisfied. The ASME Code specifications require the lowest safety valve setpoint to be at or below vessel design pressure (1250 psig) and the highest safety valve to be set so that the total accumulated pressure does not exceed 110% of the design pressure for overpressurization conditions. The transient evaluations in the UFSAR are based on these setpoints, but also include the additional uncertainties of

+ 3% of the nominal setpoint to provide an added degree of I conservatism.

Operation with fewer valves OPERABLE than specified, or with setpoints outside the ASME limits, could result in a more severe reactor response to a transient than predicted, possibly resulting in the ASME Code limit on reactor pressure being exceeded.

(continued)

PBAPS UNIT 3 B 3.4-16 Revision No. 110

SRVs and SVs B 3.4.3 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, all required SRVs and SVs must be OPERABLE, since considerable energy may be in the reactor core and the limiting design basis transients are assumed to occur in these MODES. The SRVs and SVs may be required to provide pressure relief to discharge energy from the core until such time that the Residual Heat Removal (RHR) System is capable of dissipating the core heat.

In MODE 4, decay heat is low enough for the RHR System to provide adequate cooling, and reactor pressure is low enough that the overpressure limit is unlikely to be approached by assumed operational transients or accidents. In MODE 5, the reactor vessel head is unbolted or removed and the reactor is at atmospheric pressure. The SRV and SV function is not needed during these conditions.

ACTIONS A.1 and A.2 With less than the minimum number of required SRVs or SVs OPERABLE, a transient may result in the violation of the ASME Code limit on reactor pressure. If the safety function of one or more required SRVs or SVs is inoperable, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.3.1 REQUIREMENTS This Surveillance requires that the required SRVs and SVs will open at the pressures assumed in the safety analyses of References 1 and 2. The demonstration of the SRV and SV safety lift settings must be performed during shutdown, since this is a bench test, to be done in accordance with the Inservice Testing Program. The lift setting pressure shall correspond to ambient conditions of the valves at nominal operating temperatures and pressures and be verified with insulation installed simulating the in-plant condition.

The SRV and SV setpoint is +/- 3% for OPERABILITY. Prior to placing new or refurbished valves into service, the valve openings setpoints must be adjusted to be within +/- 1% of their nominal setting.

(continued)

PBAPS UNIT 3 B 3.4-17 Revision No. 110

SRVs and SVs B 3.4.3 BASES SURVEILLANCE SR 3.4.3.2 REQUIREMENTS (continued) The pneumatic actuator of each SRV valve is stroked to verify that the second stage pilot disc rod is mechanically displaced when the actuator strokes. Second stage pilot rod movement is determined by the measurement of actuator rod travel. The total amount of movement of the second stage pilot rod from the valve closed position to the open position shall meet criteria established by the SRV supplier. If the valve fails to actuate due only to the failure of the solenoid, but is capable of opening on overpressure, the safety function of the SRV is considered OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. NEDC-32183P, "Power Rerate Safety Analysis Report for Peach Bottom 2 & 3," May 1993.

2. UFSAR, Chapter 14.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.4-18 Revision No. 87 i

RCS Operational LEAKAGE B 3.4.4 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.4 RCS Operational LEAKAGE BASES BACKGROUND The RCS includes systems and components that contain or transport the coolant to or from the reactor core. The pressure containing components of the RCS and the portions of connecting systems out to and including the isolation valves define the reactor coolant pressure boundary (RCPB).

The joints of the RCPB components are welded or bolted.

During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration.

Limits on RCS operational LEAKAGE are required to ensure appropriate action is taken before the integrity of the RCPB is impaired. This LCO specifies the types and limits of LEAKAGE. This protects the RCS pressure boundary described in 10 CFR 50.2, 10 CFR 50.55a(c), and the UFSAR (Refs. 1, 2, and 3).

The safety significance of RCS LEAKAGE from the RCPB varies widely depending on the source, rate, and duration.

Therefore, detection of LEAKAGE in the primary containment is necessary. Methods for quickly separating the identified LEAKAGE from the unidentified LEAKAGE are necessary to provide the operators quantitative information to permit them to take corrective action should a leak occur that is detrimental to the safety of the facility or the public.

A limited amount of leakage inside primary containment is expected from auxiliary systems that cannot be made 100%

leaktight. Leakage from these systems should be detected and isolated from the primary containment atmosphere, if possible, so as not to mask RCS operational LEAKAGE detection.

This LCO deals with protection of the RCPB from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident.

(continued)

PBAPS UNIT 3 B 3.4-19 Revision No. 0

RCS Operational LEAKAGE B 3.4.4 BASES (continued)

APPLICABLE The allowable RCS operational LEAKAGE limits are based on SAFETY ANALYSES the predicted and experimentally observed behavior of pipe cracks. The normally expected background LEAKAGE due to equipment design and the detection capability of the instrumentation for determining system LEAKAGE were also considered. The evidence from experiments suggests that, for LEAKAGE even greater than the specified unidentified LEAKAGE limits, the probability is small that the imperfection or crack associated with such LEAKAGE would grow rapidly.

The unidentified LEAKAGE flow limit allows time for corrective action before the RCPB could be significantly compromised. The 5 gpm limit is a small fraction of the calculated flow from a critical crack in the primary system piping. Crack behavior from experimental programs (Refs. 4 and 5) shows that leakage rates of hundreds of gallons per minute will precede crack instability.

The low limit on increase in unidentified LEAKAGE assumes a failure mechanism of intergranular stress corrosion cracking (IGSCC) in service sensitive type 304 and type 316 austenitic stainless steel that produces tight cracks. This flow increase limit is capable of providing an early warning of such deterioration.

No applicable safety analysis assumes the total LEAKAGE limit. The total LEAKAGE limit considers RCS inventory makeup capability and drywell floor sump capacity.

RCS operational LEAKAGE satisfies Criterion 2 of the NRC Policy Statement.

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, since it is indicative of material degradation. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE.

Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

(continued)

PBAPS UNIT 3 B 3.4-20 Revision No. 0

RCS Operational LEAKAGE B 3.4.4 BASES LCO b. Unidentified LEAKAGE (continued)

The 5 gpm of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and drywell sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO could result in continued degradation of the RCPB.

c. Total LEAKAGE The total LEAKAGE limit is based on a reasonable minimum detectable amount. The limit also accounts for LEAKAGE from known sources (identified LEAKAGE).

Violation of this LCO indicates an unexpected amount of LEAKAGE and, therefore, could indicate new or additional degradation in an RCPB component or system.

d. Unidentified LEAKAGE Increase An unidentified LEAKAGE increase of > 2 gpm within the previous 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period indicates a potential flaw in the RCPB and must be quickly evaluated to determine the source and extent of the LEAKAGE. The increase is measured relative to the steady state value; temporary changes in LEAKAGE rate as a result of transient conditions (e.g., startup) are not considered. As such, the 2 gpm increase limit is only applicable in MODE 1 when operating pressures and temperatures are established. Violation of this LCO could result in continued degradation of the RCPB.

APPLICABILITY In MODES 1, 2, and 3, the RCS operational LEAKAGE LCO applies, because the potential for RCPB LEAKAGE is greatest when the reactor is pressurized.

In MODES 4 and 5, RCS operational LEAKAGE limits are not required since the reactor is not pressurized and stresses in the RCPB materials and potential for LEAKAGE are reduced.

(continued)

PBAPS UNIT 3 B 3.4-21 Revision No. 0

RCS Operational LEAKAGE B 3.4.4 BASES (continued)

ACTIONS A.1 With RCS unidentified or total LEAKAGE greater than the limits, actions must be taken to reduce the leak. Because the LEAKAGE limits are conservatively below the LEAKAGE that would constitute a critical crack size, 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is allowed to reduce the LEAKAGE rates before the reactor must be shut down. If an unidentified LEAKAGE has been identified and quantified, it may be reclassified and considered as identified LEAKAGE; however, the total LEAKAGE limit would remain unchanged.

B.1 and B.2 An unidentified LEAKAGE increase of > 2 gpm within a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period is an indication of a potential flaw in the RCPB and must be quickly evaluated. Although the increase does not necessarily violate the absolute unidentified LEAKAGE limit, certain susceptible components must be determined not to be the source of the LEAKAGE increase within the required Completion Time. For an unidentified LEAKAGE increase greater than required limits, an alternative to reducing LEAKAGE increase to within limits (i.e., reducing the leakage rate such that the current rate is less than the "2 gpm increase in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months " limit; either by isolating the source or other possible methods) is to evaluate service sensitive type 304 and type 316 austenitic stainless steel piping that is subject to high stress or that contains relatively stagnant or intermittent flow fluids and determine it is not the source of the increased LEAKAGE. This type piping is very susceptible to IGSCC.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable to properly reduce the LEAKAGE increase or verify the source before the reactor must be shut down without unduly jeopardizing plant safety.

C.1 and C.2 If any Required Action and associated Completion Time of Condition A or B is not met or if pressure boundary LEAKAGE exists, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within (continued)

PBP NT .- 2 eiio o PBAPS UNIT 3 B 3.4-22 Revision No. 0

RCS Operational LEAKAGE B 3.4.4 BASES ACTIONS C.1 and C.2 (continued) 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant safety systems.

SURVEILLANCE SR 3.4.4.1 REQUIREMENTS The RCS LEAKAGE is monitored by a variety of instruments designed to provide alarms when LEAKAGE is indicated and to quantify the various types of LEAKAGE. Leakage detection instrumentation is discussed in more detail in the Bases for LCO 3.4.5, "RCS Leakage Detection Instrumentation." Sump level and flow rate are typically monitored to determine actual LEAKAGE rates; however, any method may be used to quantify LEAKAGE within the guidelines of Reference 6. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50.2.

2. 10 CFR 50.55a(c).

3. UFSAR,. Section 4.10.4.

4. GEAP-5620, "Failure Behavior in ASTM A1O6B Pipes Containing Axial Through-Wall Flaws," April 1968.

5. NUREG-75/067, "Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactors," October 1975.

6. Regulatory Guide 1.45, May 1973.

7. Generic Letter 88-01, "NRC Position on IGSCC in BWR Austenitic Stainless Steel Piping," January 1988.

PBAPS UNIT 3 B 3.4-23 Revision No. 87

.. RCS LeakagenDetection .InSt.rumentation "B 3.4.5 B 3.4 REACTOR COOLANT SYSTEM. (RCS)

B 3.4.5 RCS Leakage Detection Instrumentation BASES BACKGROUND UFSAR.Safety Design Basis (Ref. 1) requires means for detecting and, to the extenit practical, identifying the location of the source of RCS LEAKAGE. Regu.latory Guide 1.45, Revision 0, (Ref. 2) describes acceptable metholds for selecting leakage detection systems.

Limits on LEAKAGE from the reactor coolant pressure boundary (RCPB) are required so that appropriate acti~o'n can be taken before the integrity of the RCPB is* impaired (Reff. 2).

Leakage detection systems for the RCS are provided to alert the operators when leakage rates above normal background levels are detected and also to supply quantitative measurement of leakage rates. In addition to meeting the OPERABILITY requirements, the monitors are typically set to provide the most sensitive response without causing an excessive numiiber of spurious alarms. The Bases for LCO 3.4.4, "RCS

. Operational LEAKAGE," discuss the limits on-RCS LEAKAGE rates.

Systems fo* separating the LEAKAGE of an identified source from an- unidentified source are necessary to provide prompt and quantitative information to the operators to permit them to take immediate corrective action.

LEAKAGE from the RCPB inside the drywell is detected by at least one of two independently monitored variables, such as sump level changes and drywell-ga eous radioactivity levels.

The primary means of quantifying.LEAKAGE in the drywell is the drywell floor drain sump monitoring system.

The drywell floor drain sump monitoring system monitors the LEAKAGE collected in the floor drain sump. This-unidentifiediLEAKAGE. consistsof LEAKAGE from. control,-rod drives: valve flanges orpackings, floor drains, th* Reactor

.Buidin ,Cl6sed Cooling Water System,.and drywell air cooling unit condensatedrains, and any LEAKAGE not collected-in the drywell equipment drain sump.

An alternate to the drywell floor drain sump monitoring system is the drywell equipment drain sump monitoring system, but only if the drywell- floor drain sump is overflowing. The drywell equipment.drain sump. collects not only all leakage not collected in the drywell floor drain sump," but also any overflow from the drywell floor drain sump. Therefore, if" the drywell floor drain sump is (continued)-

PBAPS UNIT 3 B1.3.4-124 Be .Rev~ision No. 93

RCS Leakage Detection Instrumentation B 3.4.5

-I BASES BACKGROUND-.. overflowing to the drywell equipment drain sump, the drywell (continued) equipment drain sump monitoring System can be used to

.quantify:JLEAKAGE. In thisrcondition:, all*LEAKAGE measured by the drywell equipment drain sump monitoring system is assumed to be unidentified LEAKAGE.

The floor drain sump level indicators *have switches that start' and stop the sump pumps when required. If-the sump fills to the high high level setpoint, an alarm sounds in the control room, indicating a LEAKAGE rate into the sump in excess of 50 gpm.

A flow, transmitter in the discharge line of the drywell floor drain sump pumps provides flow indication in the control room. The pumps can also be started from the control room.

The primary containment air monitoring system continuously monitors the primary, containment atmosphere for ai.rborne gaseous radioactivity. A sudden significant increase of radioactivity, which may be attributed to RCPB steam or water LEAKAGE, is annunciated in the control room.

I APPLICABLE A threat of significant compromise to the RCPB exists if the SAFETY ANALYSES barrier contains a crack that is large enough to propagate rapidly. LEAKAGE rate limits are set low enough to detect the LEAKAGE emitted from a single crack in the RCPB (Refs. 3 and 4). The allowed LEAKAGE rates are well below the'rates ,1 predicted for critical crack sizes (Ref. 6). Therefore, these actions provide adequate response before a significant break in the RCPB can occur.

RCS leakage detection instrumentation satisfies Criterion 1 of the NRC Policy Statement.

LCO This LCO -requires instruments of diverse monitoring principles to be OPERABLE to provide confidence that small amounts of unidentified LEAKAGE are detected in time to allow actions to place-the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.

The LCO requires two instruments-.to be OPERABLE.

The drywell sump monitoring system is required to quantify the unidentified LEAKAGE from the RCS. Thus, for the system to be considered OPERABLE, the-system must be capable of (rnnti nuir1d)

PBAPS UNIT-3 B 3.4-25 Revision No.. 93

RCS Leakage Detection Instrumentation 8 3.4.5 BASES LCO measuring reactor-coolant leakage. This may be accomplished

. (conti nued) by use of the associ'ated drywell sumpflow integrator, flow recorder,-or the'.pump curves an d drywelI sump". pump out ti`me.

The system iconisists of a) the drywel-l floor drailn sump

monitoring-system; or b) the drywell equipment drain sump monitoring system, but oniy. when the drywell floor drain sump is"overflowing. The identification of an increase in unidentified LEAKAGE will be delayed by-the time required for the unident iflied LEAKAGE to travel to the drywell- sumpand Iit may take longer than one hour to detect a I gpm increase-in unidentified LEAKAGE, depending oh the origin and magnitude of the- LEAKAGE. This sensitivity is acceptable, for containment sump monitor OPERABILITY.

The 'reactor coolant contains radioactivity that, when released to- the primarY' conta.inment, can be detected by the gaseous primary cOntainment atmospheric radioactivity monitor. Only one of the. two detectors is required. to. be OPERABLE. A radioactivity, detection system is included for monitoring -

gaseous activities because of its sensitivities and rapid responses to RCS .LEAKAGE, but it has recognized -limitations.

Reactor.coolant radioactivity levels.will be low during initial reactorstartup. and-for a few weeks thereafter, until activated corrosion products -have been formed. and. f-ission products appear from fuel element cladding contamination or cladding defects.;

If there are few fuel element.claddingdefects and 1Ow levels of activation products, it may not be possible for the gaseous, primary containment atmospheric radioactivity monitor to detect a 1 g*mn increase within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months during normal operation.

However, the gaseous,.primary containment atmospheric radioactivity monitor is OPERABLE when it is capable of detecting a 1 gpmn increase in unidentified LEAKAGEwithin 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months given an RCS activity equivalent to that assumed in the design calculations for the monitors (Reference 6)..

- The LCO is satisfied when monitors of di-verse measurement, means

are available. Thus, the drywell, sump monitoring -system,. in-combination with a gaseous° p6rimary. containment atmospheric radioactivity monitor provides an acceptable minimum.

APPLICABILITY In MODES,1, 2, and 3, leakage detection systems are required

.. to be OPERABLE to support LCO 3.4.4.. This Applicability is consistent with that for LCO 3.4*.4.

(continued)

PBARS,-UNIT 3 ;B 3_4726 Revision No. 93

RCS Leakage Detection Instrumentatiol B 3.4.5 BASES (continued)

ACTIONS A.1. A.2. and A.3 Width the drywell sump monitoring system inoperable, the only; means of detecting LEAKAGE is the primary containment atmospheric gaseous radiation monitor. The primary containment atmospheric gaseous radiation monitor typically cannot detect a 1 gpm leak within one hour when RCS activity is low. In addition, this-configuration doestnot provide the required diverse means of leakage detection. ,Indirect methods of monitoring RCS leakage must be implemented. Grab samples of the primary containment atmosphere must be taken and analyzed and monitoring of RCS leakage by administrative means must be performed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to provide alternate periodic information.

Administrative means of monitoring RCS leakage include monitoring. and trending parameters that may indicate an increase in RCS leakage.. There are diverse alternative mechanisms from which',appropri~ate Jindicators may be. selected based. on. plant conditions. It is not necessary to utilize all of these methods, but a method-or methods should be selected considering the current plant conditions and historical or expected .sources of unidentified leakage. The administrative metfhods are drywel.l pressure and temperature, Reactor Recirculation System pump seal pressure and temperature and motor cooler temperature indications, and Safety Relief Valves tailpipe-temperature.

These indications, coupled with the atmospheric grab samples, are sufficient to alert the operating staff to an unexpected increase in unidentified LEAKAGE.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval is sufficient to detect increasinig RCS leakage. The Required Action provides 7 days to restore another RCS leakage monitor to OPERABLE status to regain the intended.,

leakage detection diversity. The 7 day Completion-Time ensures that the plant will not be operated in a degraded configuration -

for a lengthy time.period.

B.1 and B.2-With the gaseous primary containment atmospheric monitoring channel inoperable, grab samples of the prima.ry containment -

atmosphere-must be taken and analyzed for gaseous radioactivity to provide periodic leakage :information.

Provided a sample is obtained and analyzed once every 12'hours, the plant may be operated for up to 3.0-da.ys.to allow restoration of the required monitor.

(continued)

PBAPS UNIT 3 B 3.4-26a Revision No. 93 I

RCS Leakage Detection Instrumentation B 3.4.5 BASES ACTIONS B.1 and B.2 (continued)

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval provides periodic information that is adequate to detect LEAKAGE. The 30 day Completion Time for restoration recognizes that at least one other form of leakage detection is available.

C.1 and C.2 If any Required Action and associated Completion Time of Condition A or B cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to perform the actions in an orderly manner and without challenging plant systems.

D.1 With all required monitors inoperable, no required automatic means of monitoring LEAKAGE are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE SR 3.4.5.1 REQUIREMENTS This SR is for the performance of a CHANNEL CHECK of the required primary containment atmospheric monitoring system.

The check gives reasonable confidence that the channel is operating properly. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.4-27 Revision No. 87

RCS.Leakage Detection Instrumentation B 3.4.5 BASES

-SURVEI LLANCE SR 3.4.5.2 REQUIREMENTS (conti nued) This SR is for the performance of a CHANNEL FUNCTIONAL TEST of the :requi red. RCS leakage detection instrumentation. The test ensures that the monitors can perform their function in the *desired manner. The test also verifies the alar m setpoint and relative accuracy of the instrument string.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.5.3 This SR is,for the performance of a CHANNEL CALIBRATION of required leakage detection instrumentation" channels. The calibration verifies the accuracy of the instrument string.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1.- UFSAR, Section 4.10.2.

2. RegulatoryGuide 1.45, Revision 0, "Reactor Coolant

-Pressure Boundary Leakage Detection Systems.,." May 1973. II

3. GEAP-5620, "Failure Behavior in ASTM A1O6B Pipes Containing.Axial Through-Wall Flaws," April 1968.

4. NUREG-75/067, "Investigation and Evaluation of ;

Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactors," October 1975.

I

5. UFSAR, Section 4.10.4.

-6. UFSAR, Section 4.10.3.2. I PBAPS UNIT 3 B' 3.,4"-28 Reyision No. 93

RCS Specific Activity B 3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.6 RCS Specific Activity BASES BACKGROUND During circulation, the reactor coolant acquires radioactive materials due to release of fission products from fuel leaks into the reactor coolant and activation of corrosion products in the reactor coolant. These radioactive materials in the reactor coolant can plate out in the RCS, and, at times, an accumulation will break away to spike the normal level of radioactivity. The release of coolant during a Design Basis Accident (DBA) could send radioactive materials into the environment.

Limits on the maximum allowable level of radioactivity in the reactor coolant are established to ensure that in the event of a release of any radioactive material to the environment during a DBA, radiation doses are maintained within the limits of 10 CFR 50.67 (Ref. 1).

This LCO contains the iodine specific activity limits. The iodine isotopic activities per gram of reactor coolant are expressed in terms of a DOSE EQUIVALENT 1-131. The allowable level is intended to limit the maximum 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months radiation dose to an individual at the site boundary to well within the 10 CFR 50.67 limit as modified in Regulatory Guide 1.183, Table 6.

APPLICABLE Analytical methods and assumptions involving radioactive SAFETY ANALYSES material in the primary coolant are presented in the UFSAR (Ref. 2). The specific activity in the reactor coolant (the source term) is an initial condition for evaluation of the consequences of an accident due to a main steam line break (MSLB) outside containment. No fuel damage is postulated in the MSLB accident, and the release of radioactive material to the environment is assumed to end when the main steam isolation valves (MSIVs) close completely.

This MSLB release forms the basis for determining offsite doses (Ref. 2). The limits on the specific activity of the primary coolant ensure that the maximum 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months TEDE doses at the site boundary, resulting from an MSLB outside containment during steady state operation, will not exceed the dose guidelines of 10 CFR 50.67 as modified in Regulatory Guide 1.183, Table 6.

(continued)

PBAPS UNIT 3 B 3.4-29 Revision No. 76

RCS Specific Activity B 3.4.6 BASES APPLICABLE The limits on specific activity are values from a parametric SAFETY ANALYSES evaluation of typical site locations. These limits are (continued) conservative because the evaluation considered more restrictive parameters than for a specific site, such as the location of the site boundary and the meteorological conditions of the site.

RCS specific activity satisfies Criterion 2 of the NRC Policy Statement.

LCO The specific iodine activity is limited to

0.2 iCi/gm DOSE EQUIVALENT 1-131. This limit ensures the source term assumed in the safety analysis for the MSLB is not exceeded, so any release of radioactivity to the environment during an MSLB is well within the 10 CFR 50.67 limits as modified in Regulatory Guide 1.183, Table 6.

APPLICABILITY In MODE 1, and MODES 2 and 3 with any main steam line not isolated, limits on the primary coolant radioactivity are applicable since there is an escape path for release of radioactive material from the primary coolant to the environment in the event of an MSLB outside of primary containment.

In MODES 2 and 3 with the main steam lines isolated, such limits do not apply since an escape path does not exist. In MODES 4 and 5, no limits are required since the reactor is not pressurized and the potential for leakage is reduced.

ACTIONS A.1 and A.2 When the reactor coolant specific activity exceeds the LCO DOSE EQUIVALENT 1-131 limit, but is

4.0 4Ci/gm, samples must be analyzed for DOSE EQUIVALENT 1-131 at least once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . In addition, the specific activity must be restored to the LCO limit within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The Completion Time of once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is based on the time needed to take and analyze a sample. The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time to restore the activity level provides a reasonable time for temporary coolant activity increases (iodine spikes) to be cleaned up with the normal processing systems.

(continued)

PBAPS UNIT 3 B 3.4-30 Revision No. 76

RCS Specific Activity B 3.4.6 BASES ACTIONS A.1 and A.2 (continued)

A Note permits the use of the provisions of LCO 3.0.4.c.

This allowance permits entry into the applicable MODE(S) while relying on the ACTIONS. This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to, power operation.

B.1, B.2.1, B.2.2.1, and B.2.2.2 If the DOSE EQUIVALENT 1-131 cannot be restored to < 0.2

ýCi/gm within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , or if at any time it is > 4.0

ýiCi/gm, it must be determined at least once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and all the main steam lines must be isolated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Isolating the main steam lines precludes the possibility of releasing radioactive material to the environment in an amount that is more than a small fraction of the requirements of 10 CFR 50.67 as modified in Regulatory Guide 1.183, Table 6, during a postulated MSLB accident.

Alternatively, the plant can be placed in MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This option is provided for those instances when isolation of main steam lines is not desired (e.g., due to the decay heat loads).

In MODE 4, the requirements of the LCO are no longer applicable.

The Completion Time of once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is the time needed to take and analyze a sample. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to isolate the main steam lines in an orderly manner and without challenging plant systems. Also, the allowed Completion Times for Required Actions B.2.2.1 and B.2.2.2 for placing the unit in MODES 3 and 4 are reasonable, based on operating experience, to achieve the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PBAPS UNIT 3 B 3.4-31 Revision No. 76

RCS Specific Activity B 3.4.6 BASES (continued)

SURVEI LLANCE SR 3.4.6.1 REQUIREMENTS This Surveillance is performed to ensure iodine remains within limit during normal operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that requires this Surveillance to be performed only in MODE 1 because the level of fission products generated in other MODES is much less.

REFERENCES 1. 10 CFR 50.67.

2. UFSAR, Section 14.6.5.

PBAPS UNIT 3 B 3.4-32 Revision No. 87

RHR Shutdown Cooling System-Hot Shutdown B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.7 Residual Heat Removal (RHR) Shutdown Cooling System-Hot Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to reduce the temperature of the reactor coolant to

2120F. This decay heat removal is in preparation for performing refueling or maintenance operations, or for keeping the reactor in the Hot Shutdown condition.

The RHR System has two loops with each loop consisting of two motor driven pumps, two heat exchangers, and associated piping and valves. There are two RHR shutdown cooling subsystems per RHR System loop. Both loops have a common suction from the same recirculation loop. The four redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal. Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the High Pressure Service Water (HPSW)

System. Any one of the four RHR shutdown cooling subsystems can provide the required decay heat removal function.

APPLICABLE Decay heat removal by operation of the RHR System in the SAFETY ANALYSES shutdown cooling mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result. The RHR Shutdown Cooling System meets Criterion 4 of the NRC Policy Statement.

LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and when no recirculation pump is in operation, one shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one OPERABLE RHR pump, one heat exchanger, a HPSW pump capable of providing cooling to the heat exchanger, and the associated piping and valves. The two subsystems have a common suction source and are allowed to have common discharge piping. Since piping is a passive component that (continued)

PBAPS UNIT 3 B 3.4-33 Revision No. 0

RHR Shutdown Cooling System-Hot Shutdown B 3.4.7 BASES LCO is assumed not to fail, it is allowed to be common to both (continued) subsystems. Each shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. In MODE 3, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain or reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required.

Note 1 permits both required RHR shutdown cooling subsystems and recirculation pumps to be shut down for a period of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. Note 2 allows one required RHR shutdown cooling subsystem to be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for performance of Surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy.

APPLICABILITY In MODE 3 with reactor steam dome pressure below the RHR shutdown cooling isolation pressure (i.e., the actual pressure at which the RHR shutdown cooling isolation pressure setpoint clears) the RHR Shutdown Cooling System must be OPERABLE and shall be operated in the shutdown cooling mode to remove decay heat to reduce or maintain coolant temperature. Otherwise, a recirculation pump is required to be in operation.

In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR shutdown cooling isolation pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the shutdown cooling piping.

Decay heat removal at reactor pressures greater than or equal to the RHR shutdown cooling isolation pressure is typically accomplished by condensing the steam in the main condenser.

(continued)

PBAPS UNIT 3 B 3.4-34 Revision No. 0

RHR Shutdown Cooling System-Hot Shutdown B 3.4.7 BASES APPLICABILITY Additionally, in MODE 2 below this pressure, the OPERABILITY (continued) requirements for the Emergency Core Cooling Systems (ECCS)

(LCO 3.5.1, "ECCS-Operating") do not allow placing the RHR shutdown cooling subsystem into operation.

The requirements for decay heat removal in MODES 4 and 5 are discussed in LCO 3.4.8, "Residual Heat Removal (RHR)

Shutdown Cooling System-Cold Shutdown"; LCO 3.9.7, "Residual Heat Removal (RHR)-High Water Level"; and LCO 3.9.8, "Residual Heat Removal (RHR)-Low Water Level."

ACTIONS A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.

A.1, A.2, and A.3 With one required RHR shutdown cooling subsystem inoperable for decay heat removal, except as permitted by LCO Note 2, the inoperable subsystem must be restored to OPERABLE status without delay. In this condition, the remaining OPERABLE subsystem can provide the necessary decay heat removal. The (continued)

PBAPS UNIT 3 B 3.4-35 Revision No. 53

RHR Shutdown Cooling System-Hot Shutdown B 3.4.7 BASES ACTIONS A.1, A.2, and A.3 (continued) overall reliability is reduced, however, because a single failure in the OPERABLE subsystem could result in reduced RHR shutdown cooling capability. Therefore, an alternate method of decay heat removal must be provided.

With both required RHR shutdown cooling.subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability. This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities.

The required cooling capacity of the alternate method should be ensured by verifying (by calculation or demonstration) its capability to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability. Alternate methods that can be used include (but are not limited to) the Condensate/Main Steam Systems and the Reactor Water Cleanup System.

However, due to the potentially reduced reliability of the alternate methods of decay heat removal, it is also required to reduce the reactor coolant temperature to the point where MODE 4 is entered.

B.I. B.2, and B.3 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as permitted by LCO Note 1, reactor coolant circulation by the RHR shutdown cooling subsystem or recirculation pump must be restored without delay.

Until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant temperature. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the coolant circulation function and is modified such that the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable separately for each occurrence involving a loss of coolant (continued)

PBAPS UNIT 3 B 3.4-36 Revision No. 0

RHR Shutdown Cooling System-Hot Shutdown B 3.4.7 BASES ACTIONS B.1, B.2, and B.3 (continued) circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. This will provide assurance of continued temperature monitoring capability.

During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate.

SURVEILLANCE SR 3.4.7.1 REQUIREMENTS This Surveillance verifies that one required RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This Surveillance is modified by a Note allowing sufficient time to align the RHR System for shutdown cooling operation after clearing the pressure setpoint that isolates the system, or for placing a recirculation pump in operation.

The Note takes exception to the requirements of the Surveillance being met (i.e., forced coolant circulation is not required for this initial 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months period), which also allows entry into the Applicability of this Specification in accordance with SR 3.0.4 since the Surveillance will not be

'not met" at the time of entry into the Applicability.

REFERENCES None.

PBAPS UNIT 3 B 3.4-37 Revision No. 87

RHR Shutdown Cooling System-Cold Shutdown B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.8 Residual Heat Removal (RHR) Shutdown Cooling System-Cold Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to maintain the temperature of the reactor coolant

212°F. This decay heat removal is in preparation for performing refueling or maintenance operations, or for keeping the reactor in the Cold Shutdown condition.

The RHR System has two loops with each loop consisting of two motor driven pumps, two heat exchangers, and associated piping and valves. There are two RHR shutdown cooling subsystems per RHR System loop. Both loops have a common suction from the same recirculation loop. The four redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal. Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the High Pressure Service Water (HPSW)

System. Any one of the four RHR shutdown cooling subsystems can provide the requested decay heat removal function.

APPLICABLE Decay heat removal by operation of the RHR System in the SAFETY ANALYSES shutdown cooling mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result. The RHR Shutdown Cooling System meets Criterion 4 of the NRC Policy Statement.

LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and when no recirculation pump is in operation, one RHR shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one OPERABLE RHR pump, one heat exchanger, a HPSW pump capable of providing cooling to the heat exchanger, and the associated piping and valves. The two subsystems have a common suction source and are allowed to have common discharge piping. Since piping is a passive component that is assumed not to fail, it is allowed to be common to both (continued)

PBAPS UNIT 3 B 3.4-38 Revision No. 0

RHR Shutdown Cooling System-Cold Shutdown B 3.4.8 BASES I LCO subsystems. In MODE 4, the RHR cross tie valve (continued) (MO-3-10-020) may be opened (per LCO 3.5.2) to allow pumps in one loop to discharge through the opposite recircul.ation loop to make a complete subsystem. In addition, the HPSW cross-tie valve may be opened to allow an HPSW pump in one loop to provide cooling to a heat exchanger in the opposite loop to make a complete subsystem. Additionally, each shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. In MODE 4, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain or reduce the reactor coolant temperature as required.

However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required.

Note 1 permits both required RHR shutdown cooling subsystems to be shut down for a period of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period.

Note 2 allows one required RHR shutdown cooling subsystem to be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for performance of Surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy.

APPLICABILITY In MODE 4, the RHR Shutdown Cooling System must be OPERABLE and shall be operated in the shutdown cooling mode to remove decay heat to maintain coolant temperature below 2121F.

Otherwise, a recirculation pump is required to be in operation.

In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR shutdown cooling isolation pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the shutdown cooling piping.

Decay heat removal at reactor pressures above the RHR shutdown cooling isolation pressure is typically accomplished by condensing the steam in the main condenser.

I. ýWtflu

I. **M~

PBAPS UNIT 3 B 3.4-39 Revision No. I

RHR Shutdown Cooling System-Cold Shutdown B 3.4.8 BASES APPLICABILITY Additionally, in MODE 2 below this pressure, the OPERABILITY (continued) requirements for the Emergency Core Cooling Systems (ECCS)

(LCO 3.5.1, "ECCS-Operating") do not allow placing the RHR shutdown cooling subsystem into operation.

The requirements for decay heat removal in MODE 3 below the RHR shutdown cooling isolation pressure and in MODE 5 are discussed in LCO 3.4.7, "Residual Heat Removal (RHR)

Shutdown Cooling System-Hot Shutdown"; LCO 3.9.7, "Residual Heat Removal (RHR)--High Water Level"; and LCO 3.9.8, "Residual Heat Removal (RHR)-Low Water Level."

ACTIONS A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions ofithe Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.

A.1 With one of the two required RHR shutdown cooling subsystems inoperable, except as permitted by LCO Note 2, the remaining subsystem is capable of providing the required decay heat removal. However, the overall reliability is reduced.

Therefore, an alternate method of decay heat removal must be provided. With both required RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability.

This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat (continued)

PBP NT3B34-0Rvso o PBAPS UNIT 3 B 3.4-40 Revision No. 0

RHR Shutdown Cooling System--Cold Shutdown B 3.4.8 BASES ACTIONS A.1 (continued) removal capabilities. Furthermore, verification of the functional availability of these alternate method(s) must be reconfirmed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. This will provide assurance of continued heat removal capability.

The required cooling capacity of the alternate method should be ensured by verifying (by calculation or demonstration) its capability to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability. Alternate methods that can be used include (but are not limited to) the Condensate/Main Steam Systems (feed and bleed) and the Reactor Water Cleanup System.

B.1 and B.2 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as permitted by LCO Note 1, and until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant temperature. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the coolant circulation function and is modified such that the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. This will provide assurance of continued temperature monitoring capability.

During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate.

(continued)

PBAPS UNIT 3 B 3.4-41 Revision No. 0

RHR Shutdown Cooling System-Cold Shutdown B 3.4.8 BASES (continued)

SURVEILLANCE SR 3.4.8.1 REQUIREMENTS This Surveillance verifies that one required RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES None.

PBAPS UNIT 3 B 3.4-42 Revision No. 87

RCS P/T Limits B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.9 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.

The PRESSURE AND TEMPERATURE LIMITS REPORT (PTLR) (Ref. 9) contains P/T limit curves for heatup, cooldown, and inservice leakage and hydrostatic testing, and also limits the maximum rate of change of reactor coolant temperature.

The criticality curve provides limits for both heatup and criticality.

Each P/T limit curve defines an acceptable region for normal operation. The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.

The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component' most subject to brittle failure. Therefore, the LCO limits apply to the vessel.

10 CFR 50, Appendix G (Ref. 1), requires the establishment of P/T limits for material fracture toughness requirements of the RCPB materials. Reference 1 requires an adequate margin to brittle failure during normal operation, abnormal operational transients, and system hydrostatic tests. It mandates the use of the ASME Code, Section III, Appendix G (Ref. 2).

The actual shift in the RTNOT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with the UFSAR (Ref. 3) and Appendix H of 10 CFR 50 (Ref. 4). The operating P/T limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of Reference 5.

(continued)

PBAPS UNIT 3 B 3.4-43 Revision No. 102

RCS P/T Limits B 3.4.9 BASES BACKGROUND The P/T limit curves are composite curves established by (continued) superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.

The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.

The criticality limits include the Reference 1 requirement that they be at least 40°F above the heatup curve or the cooldown curve and not lower than 60'F above the adjusted reference temperature of the reactor vessel material in the region that is controlling (reactor vessel flange region).

The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the reactor pressure vessel, possibly leading to a nonisolable leak or loss of coolant accident.

In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components. ASME Code, Section XI, Appendix E (Ref. 6), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.

APPLICABLE The P/T limits are not derived from Design Basis Accident SAPETY ANALYSES (DBA) analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the reactor pressure vessel, a condition that is unanalyzed. Since the P/T limits are not derived from any DBA, there are no acceptance limits related to the P/T limits. Rather, the P/T limits are acceptance limits themselves since they preclude operation in an unanalyzed condition.

(conti nued)

PBAPS UNIT 3 B 3.4-44 Revision No. 102

RCS P/T Limits B 3.4.9 BASES APPLICABLE RCS P/T limits satisfy Criterion 2 of the NRC Policy SAFETY ANALYSES Statement.

(continued)

LCO The elements of this LCO are:

a. RCS pressure and temperature are within the limits specified in the PTLR and heatup and cooldown rates are within the limits specified in the PTLR;

b. The temperature difference between the reactor vessel bottom head coolant and the reactor pressure vessel (RPV) coolant is within the limits specified in the PTLR during recirculation pump startup;

c. The temperature difference between the reactor coolant in the respective recirculation loop and in the reactor vessel is within the limits specified in the PTLR during recirculation pump startup;

d. RCS pressure and temperature are within the criticality limits specified in the PTLR, prior to achieving criticality; and

e. The reactor vessel flange and the head flange temperatures are within the limits specified in the PTLR when tensioning the reactor vessel head bolting studs.

These limits define allowable operating regions and permit a large number of operating cycles while also providing a wide margin to nonductile failure.

The rate of change of temperature limits controls the thermal gradient through the vessel wall and is used as input for calculating the heatup, cooldown, and inservice leakage and hydrostatic testing P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.

(continued)

PBAPS UNIT 3 B 3.4-45 Revision No. 102

RCS P/T Limits B 3.4.9 BASES LCO Violation of the limits places the reactor vessel outside of (continued) the bounds of the stress analyses and can increase stresses in other RCS components. The consequences depend on several factors, as follows:

a. The severity of the departure from the allowable operating pressure temperature regime or the severity of the rate of change of temperature;

b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and

c. The existences, sizes, and orientations of flaws in the vessel material.

APPLICABILITY The potential for violating a P/T limit exists at all times.

For example, P/T limit violations could result from ambient temperature conditions that result in the reactor vessel metal temperature being less than the minimum allowed temperature for boltup. Therefore, this LCO is applicable even when fuel is not loaded in the core.

ACTIONS A.1 and A.2 Operation outside the P/T limits in the PTLR while in MODES 1, 2, and 3 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.

The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.

Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed if continued operation is desired.

Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.

ASME Code, Section XI, Appendix E (Ref. 6), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.

(continued)

PBAPS UNIT 3 B 3.4-46 Revision No. 102

RCS P/T Limits B 3.4.9 BASES ACTIONS A.1 and A.2 (continued)

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable to accomplish the evaluation of a mild violation. More severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed if continued operation is desired.

Condition A is modified by a Note requiring Required Action A.2 be completed whenever the Condition is entered.

The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits.

Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.

B.1 and B.2 If a Required Action and associated Completion Time of Condition A are not met, the plant must be placed in a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of increased stress, or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. With the reduced pressure and temperature conditions, the possibility of propagation of undetected flaws is decreased.

Pressure and temperature are reduced by placing the plant in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 Operation outside the P/T limits in the PTLR in other than MODES 1, 2, and 3 (including defueled conditions) must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses. The Required Action must be initiated without delay and continued until the limits are restored.

(continued)

PBAPS UNIT 3 B 3.4-47 Revision No. 102

RCS P/T Limits B 3.4.9 BASES ACTIONS C.1 and C.2 (continued)

Besides restoring the P/T limit parameters to within limits, an evaluation is required to determine if RCS operation is allowed. This evaluation must verify that the RCPB integrity is acceptable and must be completed before approaching criticality or heating up to > 212'F. Several methods may be used, including comparison with pre-analyzed transients, new analyses, or inspection of the components.

ASME Code, Section XI, Appendix E (Ref. 6), may be used to support the evaluation; however, its use is restricted to evaluation of the beltline.

SURVEILLANCE SR 3.4.9.1 REQUIREMENTS Verification that operation is within the PTLR limits is required when RCS pressure and temperature conditions are undergoing planned changes. Plant procedures specify the pressure and temperature monitoring points to be used during the performance of this Surveillance. The Surveillance Frequency *iscontrolled under the Surveillance Frequency Control Program.

Surveillance for heatup, cooldown, or inservice leakage and hydrostatic testing may be discontinued when the criteria given in the relevant plant procedure for ending the activity are satisfied.

This SR has been modified with a Note that requires this Surveillance to be performed only during system heatup and cooldown operations and inservice leakage and hydrostatic testing.

SR 3.4.9.2 A separate limit in the PTLR is used when the reactor is approaching criticality. Consequently, the RCS pressure and temperature must be verified within the appropriate limits before withdrawing control rods that will make the reactor critical.

(continued)

PBAPS UNIT 3 B 3.4-48 Revision No. 102

RCS P/T Limits B 3.4.9 BASES SURVEILLANCE SR 3.4.9.2 (continued)

REQUIREMENTS Performing the Surveillance within 15 minutes before control rod withdrawal for the purpose of achieving criticality provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the control rod withdrawal.

SR 3.4.9.3 and SR 3.4.9.4 Differential temperatures within the applicable limits in the PTLR ensure that thermal stresses resulting from the startup of an idle recirculation pump will not exceed design allowances. In addition, compliance with these limits ensures that the assumptions of the analysis for the startup of an idle recirculation loop (Ref. 8) are satisfied.

Performing the Surveillance within 15 minutes before starting the idle recirculation pump provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the idle pump start.

An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.9.4 is to compare the temperatures of the operating recirculation loop and the idle loop.

SR 3.4.9.3 and SR 3.4.9.4 have been modified by a Note that requires the Surveillance to be met only in MODES 1, 2, 3, and 4. In MODE 5, the overall stress on limiting components is lower. Therefore, AT limits are not required. The Note also states the SR is only required to be met during a recirculation pump startup, since this is when the stresses occur.

SR 3.4.9.5. SR 3.4.9.6. and SR 3.4.9.7 Limits in the PTLR on the reactor vessel flange and head flange temperatures are generally bounded by the other P/T limits during system heatup and cooldown. However, operations approaching MODE 4 from MODE 5 and in MODE 4 with RCS temperature less than or equal to certain specified values require assurance that these temperatures meet the LCO limits.

(continued)

PBAPS UNIT 3 B 3.4-49 Revision No. 102

RCS P/T Limits B 3.4.9 BASES SURVEILLANCE SR 3.4.9.5. SR 3.4.9.6. and SR 3.4.9.7 (continued)

REQUIREMENTS The flange temperatures must be verified to be above the limits in the PTLR before and while tensioning the vessel head bolting studs to ensure that once the head is tensioned the limits are satisfied. When in MODE 4 with RCS temperature

80 0 F, checks of the flange temperatures are required because of the reduced margin to the limits. When in MODE 4 with RCS temperature ! 100 0 F, monitoring of the flange temperature is required to ensure the temperature is within the limits specified in the PTLR.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.9.5 is modified by a Note that requires the Surveillance to be performed only when tensioning the reactor vessel head bolting studs. SR 3.4.9.6 is modified by a Note that requires the Surveillance to be initiated after RCS temperature

80'F in MODE 4. SR 3.4.9.7 is modified by a Note that requires the Surveillance to be initiated after RCS temperature

100°F in MODE 4. The Notes contained in these SRs are necessary to specify when the reactor vessel flange and head flange temperatures are required to be verified to be within the limits specified.

REFERENCES 1. 10 CFR 50, Appendix G.

2. ASME, Boiler and Pressure Vessel Code, Section III, Appendix G.

3. UFSAR, Section 4.2.6 and Appendix K.

4. 10 CFR 50, Appendix H.

5. Regulatory Guide 1.99, Revision 2, May 1988.

(continued)

PBAPS UNIT 3 B 3.4-50 Revision No. 102

RCS P/T Limits B 3.4.9 BASES REFERENCES 6. ASME, Boiler and Pressure Vessel Code, Section XI, (continued) Appendix E.

7. DELETED

8. UFSAR, Section 14.5.6.2.

9. PRESSURE AND TEMPERATURE LIMITS REPORT.

PBAPS UNIT 3 R 3.4-51 Revision No. 102

Reactor Steam Dome Pressure B 3.4.10 I. B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.10 Reactor Steam Dome Pressure BASES BACKGROUND The reactor steam dome pressure is an assumed value in the determination of compliance with reactor pressure vessel overpressure protection criteria and is also an assumed initial condition of design basis accidents and transients.

APPLICABLE The reactor steam dome pressure of

1053 psig 1s an SAFETY ANALYSES initial condition of the vessel overpressure protection analysis of Reference 1. This analysis assumes an initial maximum reactor steam dome pressure and evaluates the response of the pressure relief system. primarily the safety/relief valves, during the limiting pressurization transient. The determination of compliance wiLh the overpressure criteria is dependent on the initial reactor steam dome pressure; therefore, the limit on this pressure ensures that the assumptions of the overpressure protection analysis are conserved. Reference 2 along with Reference I assumes an initial reactor steam dome pressure for the analysis of design basis accidents and transients used te determine the limits for fuel cladding integrity (see Bases for LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") an(d 1%

cladding plastic strain (see Bases for LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)").

Reactor steam dome pressure satisfies the requirements oý Criterion 2 of the NRC Policy Statement.

LCO The specified reactor steam dome pressure limit of

1053 psig ensures the plant is operated within the assumptions of the reactor overpressure protection analysis.

Operation above the limit may result in a transient response more severe than analyzed.

APPLICABILITY In MODES 1 and 2, the reactor steam dome pressure is required to be less than or equal to the limit. In these MODES, the reactor may be generating significant steam and the events which may challenge the ov.erpressure limits are possible.

(continued)

PBAPS UNIT 3 B 3.4-52 Revision No. 50

Reactor Steam Dome Pressure B 3.4.10 BASES APPLICABILITY In MODES 3, 4, and 5, the limit is not applicable because (continued) the reactor is shut down. In these MODES, the reactor pressure is well below the required limit, and no anticipated events will challenge the overpressure limits.

ACTIONS A.1 With the reactor steam dome pressure greater than the limit, prompt action should be taken to reduce pressure to below the limit and return the reactor to operation within the bounds of the analyses. The 15 minute Completion Time is reasonable considering the importance of maintaining the pressure within limits. This Completion Time also ensures that the probability of an accident occurring while pressure is greater than the limit is minimized.

B.1 If the reactor steam dome pressure cannot be restored to within the limit within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.10.1 REQUIREMENTS Verification that reactor steam dome pressure is

1053 psig ensures that the initial conditions of the reactor overpressure protection analysis and design basis accidents are met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. I REFERENCES 1. Letter G94-PEPR-002A, Peach Bottom Rerate Project Overpressure Analysis at LCO Dome Pressure, from G.V.

Kumar (GE) to T.E. Shannon (PECo), January 18, 1994.

2. UFSAR, Chapter 14.

PBAPS UNIT 3 B 3.4-53 Revision No. 87

ECCS-Operating B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.1 ECCS-Operating BASES BACKGROUND The ECCS are designed, in conjunction with the primary and secondary containment, to limit the release of radioactive materials to the environment following a loss of coolant accident (LOCA). The ECCS uses two independent methods (flooding and spraying) to cool the core during a LOCA. The ECCS network consists of the High Pressure Coolant Injection (HPCI) System, the Core Spray (CS) System, the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System, and the Automatic Depressurization System (ADS). The suppression pool provides the required source of water for the ECCS. Although no credit is taken in the safety analyses for the condensate storage tank (CST), it is capable of providing a source of water for the HPCI and CS systems.

On receipt of an initiation signal, ECCS pumps automatically start; simultaneously, the system aligns and the pumps inject water, taken either from the CST or suppression pool, into the Reactor Coolant System (RCS) as RCS pressure is overcome by the discharge pressure of the ECCS pumps.

Although the system is initiated, ADS action is delayed, allowing the operator to interrupt the timed sequence if the system is not needed. The HPCI pump discharge pressure almost immediately exceeds that of the RCS, and the pump injects coolant into the vessel to cool the core. If the break is small, the HPCI System will maintain coolant inventory as well as vessel level while the RCS is still pressurized. If HPCI fails, it is backed up by ADS in combination with LPCI and CS.. In this event, the ADS timed sequence would be allowed to time out and open the selected safety/relief valves (S/RVs) depressurizing the RCS, thus allowing the LPCI and CS to overcome RCS pressure and inject coolant into the vessel. If the break is large, RCS pressure initially drops rapidly and the LPCI and CS cool the core.

Water from the break returns to the suppression pool where it is used again and again. Water in the suppression pool is circulated through an RHR.System heat exchanger cooled by the High Pressure Service Water System. Depending on the location and size of the break, portions of the ECCS may be (continued)

PBAPS UNIT 3 .B 3.5-1 Revision No. 0

ECCS-Operating B 3.5.1 BASES BACKGROUND ineffective; however,the overall design is effective in (continued) cooling the core regardless of the size or location of the piping break.

All ECCS subsystems are designed to ensure that no single active component failure will prevent automatic initiation and successful operation of the minimum required ECCS equipment.

The CS System (Ref. 1) is composed of two independent subsystems. Each subsystem consists of two 50% capacity motor driven pumps, a spray sparger above the core, and piping and valves to transfer water from the suppression pool to the sparger. The CS System is designed to provide cooling to the reactor core when reactor pressure is low.

Upon receipt of an initiation signal, the CS pumps in both subsystems are automatically started (if offsite power is available, A and C pumps in approximately 13 seconds, and B and D pumps in approximately 23 seconds, and if offsite power is not available, all pumps 6 seconds after AC power is available). When the RPV pressure drops sufficiently, CS System flow to the RPV begins. A full flow test line is provided to route water from and to the suppression pool to allow testing of the CS System without spraying water in the RPV.

LPCI is an independent operating mode of the RHR System.

There are two LPCI subsystems (Ref. 2), each consisting of two motor driven pumps and piping and valves to transfer water from the suppression pool to the RPV via the corresponding recirculation loop. The two LPCI pumps and associated motor operated valves in each LPCI subsystem are powered from separate 4 kV emergency buses. Both pumps in a LPCI subsystem inject water into the reactor vessel through a common inboard injection valve and depend on the closure of the recirculation pump discharge valve following a LPCI injection signal. Therefore, each LPCI subsystems' common inboard injection valve and recirculation pump discharge valve is powered from one of the two 4 kV emergency buses associated with that subsystem (normal source) and has the capability for automatic transfer to the second 4 kV emergency bus associated with that LPCI subsystem. The ability to provide power to the inboard injection valve and the recirculation pump discharge valve from either 4 kV emergency bus associated with the LPCI subsystem ensures that the single failure of a diesel generator (DG) will not result in the failure of both LPCI pumps in one subsystem.

(continued)

PBAPS UNIT 3 B 3.5-2 Revision No. 0

ECCS-Operating B 3.5.1 BASES BACKGROUND The two LPCI subsystems can be interconnected via the LPCI (continued) cross tie valve; however, the cross tie valve is maintained closed with its power removed to prevent loss of both LPCI subsystems during a LOCA. The LPCI subsystems are designed to provide core cooling at low RPV pressure. Upon receipt of an initiation signal, all four LPCI pumps are automatically started (if offsite power is available, A and B pumps in approximately 2 seconds and C and D pumps in approximately 8 seconds, and, if offsite power is not available, all pumps immediately after AC power is available). Since one DG supplies power to an RHR pump in both units, the RHR pump breakers are interlocked between units to prevent operation of an RHR pump from both units on one DG and potentially overloading the affected DG. RHR System valves in the LPCI flow path are automatically positioned to ensure the proper flow path for water from the suppression pool to inject into the recirculation loops.

When the RPV pressure drops sufficiently, the LPCI flow to the RPV, via the corresponding recirculation loop, begins.

The water then enters the reactor through the jet pumps.

Full flow test lines are provided for the four LPCI pumps to route water to the suppression pool, to allow testing of the LPCI pumps without injecting water into the RPV. These test lines also provide suppression pool cooling capability, as described in LCO 3.6.2.3, "RHR Suppression Pool Cooling."

The HPCI System (Ref. 3) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the feedwater system line, where the coolant is distributed within the RPV through the feedwater sparger. Suction piping for the system is provided from the CST and the suppression pool.

Pump suction for HPCI is normally aligned to the CST source to minimize injection of suppression pool water into the RPV. However, if the CST water supply is low, or if the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the HPCI System. The steam supply to the HPCI turbine is piped from a main steam line upstream of the associated inboard main steam isolation valve.

The HPCI System is designed to provide core cooling for a wide range of reactor pressures (150 psig to 1170 psig).

Upon receipt of an initiation signal, the HPCI turbine stop valve and turbine control valve open and the turbine accelerates to a specified speed. As the HPCI flow (continued)

PBAPS UNIT 3 B 3.5-3 Revision No. 110

ECCS-Operating B 3.5.1 BASES BACKGROUND increases, the turbine governor valve is automatically (continued) adjusted to maintain design flow. Exhaust steam from the HPCI turbine is discharged to the suppression pool. A full flow test line is provided to route water back to the CST to allow testing of the HPCI System during normal operation without injecting water into the RPV.

The ECCS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open to prevent pump damage due to overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, all ECCS pump discharge lines are filled with water. The LPCI and CS System discharge lines are kept full of water using a "keep fill" system. The HPCI System is normally aligned to the CST. The height of water in the CST is sufficient to maintain the piping full of water up to the first isolation valve. The relative height of the feedwater line connection for HPCI is such that the water in the feedwater lines keeps the remaining portion of the HPCI discharge line full of water. Therefore, HPCI does not require a "keep fill" system.

The Nuclear System Pressure Relief System consists of 2 safety valves (SVs) and 11 safety/relief valves (S/RVs).

The ADS (Ref. 4) consists of 5 of the 11 S/RVs. It is designed to provide depressurization of the RCS during a small break LOCA if HPCI fails or is unable to maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating pressure range of the low pressure ECCS subsystems (CS and LPCI), so that these subsystems can provide coolant inventory makeup. Each of the S/RVs used for automatic depressurization is equipped with onenitrogen accumulator and associated inlet check valves. The accumulator provides the pneumatic power to actuate the valves.

APPLICABLE The ECCS performance is evaluated for the entire spectrum of SAFETY ANALYSES break sizes for a postulated LOCA. The accidents for which ECCS operation is required are presented in Reference 5.

The required analyses and assumptions are defined in Reference 6. The results of these analyses are described in References 7, 14 and 15.

(continued)

PBAPS UNIT 3 B 3.5-4 Revision No. 101 i

ECCS-Operating B 3.5.1 BASES APPLICABLE This LCO helps to ensure that the following acceptance SAFETY ANALYSES criteria for the ECCS, established by 10 CFR 50.46 (Ref. 8),

(continued) will be met following a LOCA, assuming the worst case single active component failure in the ECCS:

a. Maximum fuel element cladding temperature is

2200'F;

b. Maximum cladding oxidation is

0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is < 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. The core is maintained in a coolable geometry; and

e. Adequate long term cooling capability is maintained.

The limiting single failures are discussed in References 7, 14, and 15. The remaining OPERABLE ECCS subsystems provide the capability to adequately cool the core and prevent excessive fuel damage.

The ECCS satisfy Criterion 3 of the NRC Policy Statement.

LCO Each ECCS injection/spray subsystem and five ADS valves are required to be OPERABLE. The ECCS injection/spray subsystems are defined as the two CS subsystems, the two LPCI subsystems, and one HPCI System. The low pressure ECCS injection/spray subsystems are defined as the two CS subsystems and the two LPCI subsystems.

With less than the required number of ECCS subsystems OPERABLE, the potential exists that during a limiting design basis LOCA concurrent with the worst case single failure, the limits specified in Reference 8 could be exceeded. All ECCS subsystems must therefore be OPERABLE to satisfy the single failure criterion required by Reference 8.

A LPCI subsystem is considered inoperable during alignment and operation for decay heat removal when below the actual RHR shutdown cooling isolation pressure in MODE 3, since transferring from the shutdown cooling mode to the LPCI mode could result in pump cavitation and voiding in the suction (continued)

PBAPS UNIT 3 B 3.5-5 Revision No. 112

ECCS-Operating B 3.5.1 BASES LCO piping, resulting in the potential to damage the RHR System, (continued) including water hammer. This is necessary since the RHR System is required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling when necessary. One LPCI subsystem shall be declared inoperable when MO-34A(B) and MO-39A(B) are simultaneously open in the same subsystem (one or both subsystems) with no Emergency Diesel Generators (EDGs) declared inoperable to ensure compliance to References 7, 14, and 15 single failure analyses (Ref. 11).

If the MO-34A and MO-39A are simultaneously open, the 'A' subsystem of LPCI shall. be declared inoperable unless the E-1, E-2, or E-4 EDG is declared inoperable. If the MO-34B and MO-39B are simultaneously open, the 'B' subsystem of LPCI shall be declared inoperable unless the E-1, E-2, or E-3 EDG is declared inoperable.

APPLICABILITY All ECCS subsystems are required to be OPERABLE during MODES 1, 2, and 3, when there is considerable energy in the reactor core and core cooling would be required to prevent fuel damage in the event of a break in the primary system piping. In MODES 2 and 3, when reactor steam dome pressure is

150 psig, HPCI is not required to be OPERABLE because the low pressure ECCS subsystems can provide sufficient flow below this pressure. In MODES 2 and 3, when reactor steam dome pressure is

100 psig, ADS is not required to be OPERABLE because the low pressure ECCS subsystems can provide sufficient flow below this pressure. ECCS requirements for MODES 4 and 5 are specified in LCO 3.5.2, "ECCS-Shutdown."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable HPCI subsystem. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable HPCI subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

(continued)

PBAPS UNIT 3 B 3.5-6 Revision No. 112

ECCS-Operating B 3.5.1 BASES ACTIONS A.1 (continued)

If any one low pressure ECCS injection/spray subsystem is inoperable, or if one LPCI pump in each subsystem is inoperable, all inoperable subsystems must be restored to OPERABLE status within 7 days (e.g., if one LPCI pump in each subsystem is inoperable, both must be restored within 7 days). In this Condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA.

However, overall ECCS reliability is reduced, because a single failure in one of the remaining OPERABLE subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 9) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service.

The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

(continued)

PBAPS UNIT 3 B 3.5-6a Revision No. 96 I

ECCS-Operating B 3.5.1 BASES ACTIONS B.1 (continued)

If the inoperable low pressure ECCS subsystem cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 12) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 If the HPCI System is inoperable and the RClC System is immediately verified to be OPERABLE, the HPCI System must be restored to OPERABLE status within 14 days. In this Condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with ADS. Also, the RCIC System will automatically provide makeup water at most reactor operating pressures. Immediate verification of RCIC OPERABILITY is therefore required when HPCI is inoperable. This may be performed as an administrative check by examining logs or other information to determine if RCIC is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. If the OPERABILITY of the RCIC System cannot be verified immediately, however, Condition G must be immediately entered. If a single active component fails concurrent with a design basis LOCA, there is a potential, depending on the specific failure, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on a reliability study cited in Reference 9 and has been found to be acceptable through operating experience.

D.1 and D.2 If any one low pressure ECCS injection/spray subsystem is inoperable in addition to an inoperable HPCI System, the inoperable low pressure ECCS injection/-spray subsystem or the HPCI System must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, adequate core cooling is (continued)

PBAPS UNIT 3 B 3.5-7 Revision No. 89

ECCS-Operating B 3.5.1 BASES ACTIONS D.1 and D.2 (continued) ensured by the OPERABILITY of the ADS and the remaining low pressure ECCS subsystems. However, the overall ECCS reliability is significantly reduced because a single failure in one of the remaining OPERABLE subsystems concurrent with a design basis LOCA may result in the ECCS not being able to perform its intended safety function.

Since both a high pressure system (HPCI) and a low pressure subsystem are inoperable, a more restrictive Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is required to restore either the HPCI System or the low pressure ECCS injection/spray subsystem to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 9 and has been found to be acceptable through operating experience.

E.1 The LCO requires five ADS valves to be OPERABLE in order provide the ADS function (Refs. 7, 14, and 15). A single failure in the OPERABLE ADS valves results in a reduction in depressurization capability. The 14 day Completion Time is based on a reliability study cited in Reference 9 and has been found to be acceptable through operating experience.

F. 1 and F. 2 If any one low pressure ECCS injection/spray subsystem is inoperable in addition to one inoperable ADS valve, adequate core cooling is ensured by the OPERABILITY of HPCI and the remaining low pressure ECCS injection/spray subsystem.

However, overall ECCS reliability is reduced because a single active component failure concurrent with a design basis LOCA could result in the minimum required ECCS equipment not being available. Since both a high pressure system (ADS) and a low pressure subsystem are inoperable, a more restrictive Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is required to restore either the low pressure ECCS subsystem or the ADS valve to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 9 and has been found to be acceptable through operating experience.

(continued)

PBAPS UNIT 3 B 3.5-8 Revision No. 101

ECCS-Operating B 3.5.1 BASES ACTIONS G.I (continued)

If any Required Action and associated Completion Time of Condition C, D, E, or F is not met, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 12) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

H.1 and H.2 If two or more ADS valves are inoperable, there is a reduction in the depressurization capability. The plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reactor steam dome pressure reduced to = 100 psig within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

1.1 When multiple ECCS subsystems are inoperable (for reasons other than the second Condition of Condition A), as stated in Condition I, the plant is in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.5.1.1 REQUIREMENTS The flow path piping has the potential to develop voids and pockets of entrained air. Maintaining the pump discharge lines of the HPCI System, CS System, and LPCI subsystems full of water ensures that the ECCS will perform properly, (continued)

PBAPS UNIT 3 B 3.5-9 Revision No. 67

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.1 (continued)

REQUIREMENTS injecting its full capacity into the RCS upon demand. This will also prevent a water hammer following an ECCS initiation signal. An acceptable method of ensuring that the lines are full is to vent at the high points. An acceptable method of ensuring the LPCI and CS System discharge lines are full is to verify the absence of the associated "keep fill" system accumulator alarms. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.1.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the HPCI System, this SR also includes the steam flow path for the turbine and the flow controller position.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.5-10 Revision No. 87

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.3 REQUIREMENTS (continued) Verification that ADS nitrogen supply header pressure is

>_ 85 psig ensures adequate air pressure for reliable ADS operation. The accumulator on each ADS valve provides pneumatic pressure for valve actuation. The design pneumatic supply pressure requirements for the accumulator are such that, following a failure of the pneumatic supply to the accumulator, at least two valve actuations can occur with the drywell at 70% of design pressure (Ref. 10). The ECCS safety analysis assumes only one actuation to achieve the depressurization required for operation of the low pressure ECCS. This minimum required pressure of > 85 psig is provided by the ADS instrument air supply. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.1.4 Verification that the LPCI cross tie valve is closed and power to its operator is disconnected ensures that each LPCI subsystem remains independent and a failure of the flow path in one subsystem will not affect the flow path of the other LPCI subsystem. Acceptable methods of removing power to the operator include de-energizing breaker control power or racking out or removing the breaker. If the LPCI cross tie valve is open or power has not been removed from the valve operator, both LPCI subsystems must be considered inoperable. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.5-11 Revision No. 87

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.5 REQUIREMENTS (continued) Cycling the recirculation pump discharge valves through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and will close when required.

Upon initiation of an automatic LPCI subsystem injection signal, these valves are required to be closed to ensure full LPCI subsystem flow injection in the reactor via the recirculation jet pumps. De-energizing the valve in the closed position will also ensure the proper flow path for the LPCI subsystem. Acceptable methods of de-energizing the valve include de-energizing breaker control power, racking out the breaker or removing the breaker.

The specified Frequency is once during reactor startup before THERMAL POWER is > 25% RTP. However, this SR is modified by a Note that states the Surveillance is only required to be performed if the last performance was more than 31 days ago. Verification during reactor startup prior to reaching > 25% RTP is an exception to the normal Inservice Testing Program generic valve cycling Frequency, but is considered acceptable due to the demonstrated reliability of these valves. If the valve is inoperable and in the open position, the associated LPCI subsystem must be declared inoperable.

SR 3.5.1.6 Verification of the automatic transfer between the normal and the alternate power source (4 kV emergency bus) for each LPCI subsystem inboard injection valve and each recirculation pump discharge valve demonstrates that AC electrical power will be available to operate these valves following loss of power to one of the 4 kV emergency buses.

The ability to provide power to the inboard injection valve and the recirculation pump discharge valve from either 4 kV emergency bus associated with the LPCI subsystem ensures that the single failure of an DG will not result in the (rnntinuoid PBAPS UNIT 3 B 3.5-12 Revision No. 87

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.6 (continued)

REQUIREMENTS failure of both LPCI pumps in one subsystem. Therefore, failure of the automatic transfer capability will result in the inoperability of the affected LPCI subsystem. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.1.7. SR 3.5.1.8. and SR 3.5.1.9 The performance requirements of the low pressure ECCS pumps are determined through application of the 10 CFR 50, Appendix K criteria (Ref. 6). This periodic Surveillance is performed to verify that the ECCS pumps will develop the flow rates required by the respective analyses. The low pressure ECCS pump flow rates ensure that adequate core cooling is provided to satisfy the acceptance criteria of Reference 8. The pump flow rates are verified against a system head equivalent to the RPV pressure expected during a LOCA. The total system pump outlet pressure is adequate to overcome the elevation head pressure between the pump suction and the vessel discharge, the piping friction losses, and RPV pressure present during a LOCA. These values may be established by testing or analysis or during preoperational testing. Core spray pump flow surveillance requirements ensure that the flow rates of Reference 7 are met. Long term core spray flow requirements (Ref. 13) are assured by the existence of high pump run out flow capability. SR 3.5.1.7 also accounts for any piping leakage in the system.

To avoid damaging CS System valves during testing, throttling is not normally performed to obtain a system head corresponding to a reactor pressure of Ž 105 psig. As such, SR 3.5.1.7 is modified by a Note to allow use of pump curves to determine equivalent values for flow rate and test pressure for the CS pumps in order to meet the Surveillance Requirement. The Note allows baseline testing at a system head corresponding to a reactor pressure of Ž 105 psig to be used to determine an equivalent flow value at the normal test pressure. This baseline testing is performed after any modification or repair that could affect system flow characteristics.

The flow tests for the HPCI System are performed at two different pressure ranges such that system capability to provide rated flow is tested at both the higher and lower operating ranges of the system. Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor (continued)

PBAPS UNIT 3 B 3.5-13 Revision No. 99

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.7. SR 3.5.1.8. and SR 3.5.1.9 (continued)

REQUIREMENTS pressure when the HPCI System diverts steam flow. Reactor steam pressure must be

1053 and Ž 940 psig to perform SR 3.5.1.8 and greater than or equal to the Electro-Hydraulic Control (EHC) System minimum pressure set with the EHC System controlling pressure (EHC System begins controlling pressure at a nominal 150 psig) and

175 psig to perform SR 3.5.1.9. Adequate steam flow is represented by at least 2 turbine bypass valves open. Therefore, sufficient time is allowed after adequate pressure and flow are achieved to perform these tests. Reactor startup is allowed prior to performing the low pressure Surveillance test because the reactor pressure is low and the time allowed to satisfactorily perform the Surveillance test is short. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure test has been satisfactorily completed and there is no indication or reason to believe that HPCI is inoperable.

Therefore, SR 3.5.1.8 and SR 3.5.1.9 are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the reactor steam pressure and flow are adequate to perform the test.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.1.10 The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCI, CS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup and actuation of all automatic valves to their required positions. This SR also ensures that either the HPCI System (continued)

PBAPS UNIT 3 B 3.5-14 Revision No. 87

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.10 (continued)

REQUIREMENTS will automatically restart on an RPV low water level (Level

2) signal received subsequent to an RPV high water level (Level 8) trip or, if the initial RPV low water level (Level

2) signal was not manually reset, then the HPCI System will restart when the RPV high water level (Level 8) trip automatically clears, and that the suction is automatically transferred from the CST to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

SR 3.5.1.11 The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals.

A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,

solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.12 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.5-15 Revision No. 87

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.11 (continued)

REQUIREMENTS This SR is modified by a Note that excludes valve actuation.

This prevents an RPV pressure blowdown.

SR 3.5.1.12 The pneumatic actuator of each ADS valve is stroked to verify that the second stage pilot disc rod is mechanically displaced when the actuator strokes. Second stage pilot rod movement is determined by the measurement of actuator rod travel. The total amount of movement of the second stage pilot rod from the valve closed position to the open position shall meet criteria established by the S/RV supplier. SRs 3.3.5.1.5 and 3.5.1.11 overlap this Surveillance to provide testing of the SRV depressurization mode function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.5-16 Revision No. 87

ECCS-Operating B 3.5.1 BASES (continued)

REFERENCES 1. UFSAR, Section 6.4.3.

2. UFSAR, Section 6.4.4.

3. UFSAR, Section 6.4.1.

4. UFSAR, Sections 4.4.5 and 6.4.2.

5. UFSAR, Section 14.6.

6. 10 CFR 50, Appendix K.

7. NEDC-32163P, "Peach Bottom Atomic Power Station Units 2 and 3 SAFER/GESTR-LOCA Loss of Coolant Accident Analysis," January 1993.

8. 10 CFR 50.46.

9. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.

(NRC), "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

10. UFSAR, Section 10.17.6.

11. Issue Report 189167, Operability of RHR while in Test Modes/Torus Cooling.

12. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

13. GE Position Summary - Long-Term Post-LOCA Adequate Core Cooling Requirements (DRF-E22-00135-01, Revision 0, November 2000).

14. G-080-VC-400, "Peach Bottom Atomic Power Station Units 2 & 3 GNF2 ECCS-LOCA Evaluation," GE Hitachi Nuclear Energy, 0000-0100-8531-RI, March 2011.

15. G-080-VC-272, "Peach Bottom Atomic Power Station ECCS-LOCA Evaluation for GE14," General Electric Company, GENE-JI1-03716-09-02P, July 2000.

PBAPS UNIT 3 B 3.5-17 Revision No. 101

ECCS-Shutdown B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.2 ECCS-Shutdown BASES BACKGROUND A description of the Core Spray (CS) System and the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System is provided in the Bases for LCO 3.5.1, "ECCS-Operating."

APPLICABLE The ECCS performance is evaluated for the entire spectrum SAFETY ANALYSES of break sizes for a postulated loss of coolant accident (LOCA). The long term cooling analysis following a design basis LOCA (Ref. 1) demonstrates that only one low pressure ECCS injection/spray subsystem is required, post LOCA, to maintain adequate reactor vessel water level in the event of an inadvertent vessel draindown. It is reasonable to assume, based on engineering judgement, that while in MODES 4 and 5 one low pressure ECCS injection/spray subsystem can maintain adequate reactor vessel water level. To provide redundancy, a minimum of two low pressure ECCS injection/

spray subsystems are required to be OPERABLE in MODES 4 and 5.

The low pressure ECCS subsystems satisfy Criterion 3 of the NRC Policy Statement.

LCO Two low pressure ECCS injection/spray subsystems are required to be OPERABLE. A low pressure ECCS injection/

spray subsystem consists of a CS subsystem or a LPCI subsystem. Each CS subsystem consists of two motor driven pumps, piping, and valves to transfer water from the suppression pool or condensate storage tank (CST) to the reactor pressure vessel (RPV). Each LPCI subsystem consists of one motor driven pump, piping, and valves to transfer water from the suppression pool to the RPV. Only a single LPCI pump is required per subsystem because of the larger injection capacity in relation to a CS subsystem. In MODES 4 and 5, the LPCI cross tie valve is not required to be closed. The necessary portions of the Emergency Service Water System are also required to provide appropriate cooling to each required ECCS subsystem.

(continuedl PBAPS UNIT 3 B 3.5-18 Revision No. 0

ECCS-Shutdown B 3.5.2 BASES LCO As noted, one LPCI subsystem may be considered OPERABLE (continued) during alignment and operation for decay heat removal if capable of being manually realigned (remote or local) to the LPCI mode and is not otherwise inoperable. Alignment and operation for decay heat removal includes when the required RHR pump is not operating or when the system is realigned from or to the RHR shutdown cooling mode. This allowance is necessary since the RHR System may be required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. Because of low pressure and low temperature conditions in MODES 4 and 5, sufficient time will be available to manually align and initiate LPCI subsystem operation to provide core cooling prior to postulated fuel uncovery.

The following discussion applies when the LPCI cross tie valve (MO-20) is closed:

One LPCI subsystem shall not be considered one of the required ECCS injection/spray subsystems when MO-34A(B) and MO-39A(B) are simultaneously open in the same subsystem with no Emergency Diesel Generators (EDGs) declared inoperable. As discussed below, an exception to this may be taken if an EDG is declared inoperable.

If the MO-34A and MO-39A are simultaneously open, the

'A' subsystem of LPCI shall not be considered as one of the required ECCS injection/spray subsystems unless the E-1, E-2, or E-4 EDG is declared inoperable. If the MO-34B and MO-39B are simultaneously open, the 'B' subsystem of LPCI shall not be considered as one of the required ECCS injection/spray subsystems unless the E-1, E-2, or E-3 EDG is declared inoperable.

The following discussion applies when the LPCI cross tie valve (MO-20) is open:

The LPCI cross tie valve (MO-20) cannot be credited for closing during an event to isolate both LPCI subsystems. A pipe break within Primary Containment is assumed when the Reactor Coolant System (RCS) is pressurized. Conversely, a pipe break within Primary Containment is not assumed when the RCS is depressurized.

Mode 4 with RCS pressurized:

When the Unit is in Mode 4 with reactor steam dome pressure indicating that the RCS is pressurized, then both subsystems of LPCI are inoperable.

(continued)

PBAPS UNIT 3 B 3.5-19 Revision No. 96

ECCS-Shutdown B 3.5.2 BASES LCO Mode 4 with RCS depressurized or Mode 5:

(continued)

MO-34A(B) and MO-39A(B) Closed:

When the Unit is in Mode 4 with reactor steam dome pressure indicating that the RCS is depressurized or in Mode 5 AND there are no flow paths that could divert LPCI flow going to the reactor vessel (i.e., MO-34/39 closed), then both subsystems of LPCI can be considered operable as the required ECCS injection/spray subsystems.

MO-34A(B) and MO-39A(B) Open:

When MO-20, MO-34A, and MO-39A are simultaneously open, the 'A' subsystem of Core Spray and both subsystems of LPCI cannot be considered as separate ECCS injection/spray subsystems because a single failure (failure of the E-3 EDG) exists that causes the 'A' subsystem of Core Spray and both subsystems of LPCI to be unable to perform their design functions. As a result, the 'A' subsystem of Core Spray and both subsystems of LPCI can only be considered as one of the two required ECCS injection/spray subsystems when aligned in this configuration.

When MO-20, MO-34A, and MO-39A are simultaneously open with either the E-1, E-2, or E-4 EDG declared inoperable, then the 'A' and

'B' subsystems of LPCI may be credited as being operable, separate subsystems, since a failure of the E-3 EDG is not postulated.

When MO-20, MO-34B, and MO-39B are simultaneously open, the 'B' subsystem of Core Spray and both subsystems of LPCI cannot be considered as separate ECCS injection/spray subsystems because a single failure (failure of E-4 EDG) exists that causes the 'B' subsystem of Core Spray and both subsystems of LPCI to be unable to perform their design functions. As a result, the 'B' subsystem of Core Spray and both subsystems of LPCI can only be considered as one of the two required ECCS injection/spray subsystems when aligned in this configuration.

(continued)

PBAPS UNIT 3 B 3.5-19a Revision No. 96 I

ECCS- Shutdown B 3.5.2 BASES LCO When MO-20, MO-34B, and MO-39B are (continued) simultaneously open with either the E-1, E-2, or E-3 EDG declared inoperable, then the 'A' and

'B' subsystems of LPCI may be credited as being operable, separate subsystems, since a failure of the E-4 EDG is not postulated.

APPLICABILITY OPERABILITY of the low pressure ECCS injection/spray subsystems is required in MODES 4 and 5 to ensure adequate coolant inventory and sufficient heat removal capability for the irradiated fuel in the core in case of an inadvertent draindown of the vessel. Requirements for ECCS OPERABILITY during MODES 1, 2, and 3 are discussed in the Applicability section of the Bases for LCO 3.5.1. ECCS subsystems are not required to be OPERABLE during MODE 5 with the spent fuel storage pool gates removed, the water level maintained at

Ž 458 inches above reactor pressure vessel instrument zero (20 ft 11 inches above the RPV flange), and no operations with a potential for draining the reactor vessel (OPDRVs) in progress. This provides sufficient coolant inventory to allow operator action to terminate the inventory loss prior to fuel uncovery in case of an inadvertent draindown.

The Automatic Depressurization System is not required to be OPERABLE during MODES 4 and 5 because the RPV pressure is 100 psig, and the CS System and the LPCI subsystems can provide core cooling without any depressurization of the primary system.

The High Pressure Coolant Injection System is not required to be OPERABLE during MODES 4 and 5 since the low pressure ECCS injection/spray subsystems can provide sufficient flow to the vessel.

ACTIONS A.1 and B.1 If any one required low pressure ECCS injection/spray subsystem is inoperable, an inoperable subsystem must be restored to OPERABLE status in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . In this Condition, the remaining OPERABLE subsystem can provide sufficient vessel flooding capability to recover from an inadvertent vessel draindown. However, overall system reliability is reduced because a single failure in the remaining OPERABLE (continued)

PBAPS UNIT 3 B 3.5-19b Revision No. 96 1

ECCS-Shutdown B 3.5.2 BASES ACTIONS A.1 and B.1 (continued) subsystem concurrent with a vessel draindown could result in the ECCS not being able to perform its intended function.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time for restoring the required low pressure ECCS injection/spray subsystem to OPERABLE status is based on engineering judgment that considered the remaining available subsystem and the low probability of a vessel draindown event.

With the inoperable subsystem not restored to OPERABLE status in the required Completion Time, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

C.1, C.2. D.I. D.2. and D.3 With both of the required ECCS injection/spray subsystems inoperable, all coolant inventory makeup capability may be unavailable. Therefore, actions must immediately be initiated to suspend OPDRVs to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until OPDRVs are suspended. One ECCS injection/spray subsystem must also be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

If at least one low pressure ECCS injection/spray subsystem is not restored to OPERABLE status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time, additional actions are required to minimize any potential fission product release to the environment.

This includes ensuring secondary containment is OPERABLE; one standby gas treatment subsystem for Unit 3 is OPERABLE; and secondary containment isolation capability (i.e., one isolation valve and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability) in each associated secondary containment penetration flow path not isolated that is assumed to be isolated to mitigate radioactivity releases.

OPERABILITY may be verified by an administrative check, or by examining logs or other information, to determine whether the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components.

(continued)

PBAPS UNIT 3 B 3.5-20 Revision No. 0

ECCS-Shutdown B 3.5.2 BASES ACTIONS C.1. C.2, D.1, D.2. and D.3 (continued)

If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the Surveillance may need to be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time to restore at least one low pressure ECCS injection/spray subsystem to OPERABLE status ensures that prompt action will be taken to provide the required cooling capacity or to initiate actions to place the plant in a condition that minimizes any potential fission product release to the environment.

SURVEILLANCE SR 3.5.2.1 and SR 3.5.2.2 REQUIREMENTS The minimum water level of 11.0 feet required for the suppression pool is periodically verified to ensure that the suppression pool will provide adequate net positive suction head (NPSH) for the CS System and LPCI subsystem pumps, recirculation volume, and vortex prevention. With the suppression pool water level less than the required limit, all ECCS injection/spray subsystems are inoperable unless they are aligned to an OPERABLE CST.

When suppression pool level is < 11.0 feet, the CS System is considered OPERABLE only if it can take suction from the CST, and the CST water level is sufficient to provide the required NPSH for the CS pump. Therefore, a verification that either the suppression pool water level is ý 11.0 feet or that CS is aligned to take suction from the CST and the CST contains a 17.3 feet of water, equivalent to

> 90,976 gallons of water, ensures that the CS System can supply at least 50,000 gallons of makeup water to the RPV.

The unavailable volume of the CST for CS is at the 40,976 gallon level. However, as noted, only one required CS subsystem may take credit for the CST option during OPDRVs.

During OPDRVs, the volume in the CST may not provide adequate makeup if the RPV were completely drained.

Therefore, only one CS subsystem is allowed to use the CST.

This ensures the other required ECCS subsystem has adequate makeup volume.

(continued)

PBAPS UNIT 3 B 3.5-21 Revision No. 0

ECCS-Shutdown B 3.5.2 BASES SURVEILLANCE SR 3.5.2.1 and SR 3.5.2.2 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.3. SR 3.5.2.5. and SR 3.5.2.6 The Bases provided for SR 3.5.1.1, SR 3.5.1.7, and SR 3.5.1.10 are applicable to SR 3.5.2.3, SR 3.5.2.5, and SR 3.5.2.6, respectively.

SR 3.5.2.4 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position.

This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.5-22 Revision No. 87

ECCS-Shutdown B 3.5.2 BASES REFERENCES 1. NEDO-20566A, "General Electric Company Analytical Model for Loss-of-Coolant Accident Analysis in Accordance with 10 CFR 50 Appendix K," September 1986.

PBAPS UNIT 3 B 3.5-23 Revision No. 58

RCIC System B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.3 RCIC System BASES BACKGROUND The RCIC System is not part of the ECCS; however, the RCIC System is included with the ECCS section because of their similar functions.

The RCIC System is designed to operate either automatically or manually following reactor pressure vessel (RPV) isolation accompanied by a loss of coolant flow from the feedwater system to provide adequate core cooling and control of the RPV water level. Under these conditions, the High Pressure Coolant Injection (HPCI) and RCIC systems perform similar functions. The RCIC System design requirements ensure that the criteria of Reference 1 are satisfied.

The RCIC System (Ref. 2) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the feedwater system line, where the coolant is distributed within the RPV through the feedwater sparger. Suction piping is provided from the condensate storage tank (CST) and the suppression pool. Pump suction is normally aligned to the CST to minimize injection of suppression pool water into the RPV.

However, if the CST water supply is low, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the RCIC System.

The steam supply to the turbine is piped from a main steam line upstream of the associated inboard main steam line isolation valve.

The RCIC System is designed to provide core cooling for a wide range of reactor pressures (150 psig to 1170 psig).

Upon receipt of an initiation signal, the RCIC turbine accelerates to a specified speed. As the RCIC flow increases, the turbine governor valve is automatically adjusted to maintain design flow. Exhaust steam from the RCIC turbine is discharged to the suppression pool. A full flow test line is provided to route water back to the CST to allow testing of the RCIC System during normal operation without injecting water into the RPV.

(continued)

PBAPS UNIT 3 B 3.5-24 Revision No. 110

RCIC System B 3.5.3 BASES BACKGROUND The RCIC pump is provided with a minimum flow bypass line, (continued) which discharges to the suppression pool. The valve in this line automatically opens when the discharge line valves -are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the RCIC System discharge piping is kept full of water. The RCIC System is normally aligned to the CST. The height of water in the CST is sufficient to maintain the piping full of water up to the first isolation valve. The relative height of the feedwater line connection for RCIC is such that the water in the feedwater lines keeps the remaining portion of the RCIC discharge line full of water. Therefore, RCIC does not require a "keep fill" system.

APPLICABLE The function of the RCIC System is to respond to transient SAFETY ANALYSES events by providing makeup coolant to the reactor. The RCIC System is not an Engineered Safeguard System and no credit is taken in the safety analyses for RCIC System operation.

Based on its contribution to the reduction of overall plant risk, however, the system satisfies Criterion 4 of the NRC Policy Statement.

LCO The OPERABILITY of the RCIC System provides adequate core cooling such that actuation of any of the low pressure ECCS subsystems is not required in the event of RPV isolation accompanied by a loss of feedwater flow. The RCIC System has sufficient capacity for maintaining RPV inventory during an isolation event.

APPLICABILITY The RCIC System is required to be OPERABLE during MODE 1, and MODES 2 and 3 with reactor steam dome pressure

> 150 psig, since RCIC is the primary non-ECCS water source for core cooling when the reactor is isolated and pressurized. In MODES 2 and 3 with reactor steam dome pressure : 150 psig, and in MODES 4 and 5, RCIC is not required to be OPERABLE since the low pressure ECCS injection/spray subsystems can provide sufficient flow to the RPV.

(continued)

PBAPS UNIT 3 B 3.5-25 Revision No. 0

RCIC System B 3.5.3 BASES (continued)

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable RCIC system. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable RCIC system and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 and A.2 If the RCIC System is inoperable during MODE 1, or MODE 2 or 3 with reactor steam dome pressure > 150 psig, and the HPCI System is immediately verified to be OPERABLE, the RCIC System must be restored to OPERABLE status within 14 days.

In this Condition, loss of the RCIC System will not affect the overall plant capability to provide makeup inventory at high reactor pressure since the HPCI System is the only high pressure system assumed to function during a loss of coolant accident (LOCA). OPERABILITY of HPCI is therefore immediately verified when the RCIC System is inoperable.

This may be performed as an administrative check, by examining logs or other information, to determine if HPCI is out of service for maintenance or other reasons. It does not mean it is necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the HPCI System. If the OPERABILITY of the HPCI System cannot be verified immediately, however, Condition B must be immediately entered. For certain transients and abnormal events with no LOCA, RCIC (as opposed to HPCI) is the preferred source of makeup coolant because of its relatively small capacity, which allows easier control of the RPV water level.

Therefore, a limited time is allowed to restore the inoperable RCIC to OPERABLE status.

The 14 day Completion Time is based on a reliability study (Ref. 3) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (AOTs). Because of similar functions of HPCI and RCIC, the AOTs (i.e., Completion Times) determined for HPCI are also applied to RCIC.

B.1 If the RCIC System cannot be restored to OPERABLE status within the associated Completion Time, or if the HPCI System is simultaneously inoperable, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of (continued)

PBAPS UNIT 3 B 3.5-26 Revision No. 67

RCIC System B 3.5.3 4*BASES ACTIONS B.1 (continued) the LCO is acceptable because the plant risk in MODE 3 is.

similar to or lower than the risk in MODE 4 (Ref. 4) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The flow path piping has the potential to develop voids and pockets of entrained air. Maintaining the pump discharge line of the RCIC System full of water ensures that the system will perform properly, injecting its full capacity into the Reactor Coolant System upon demand. This will also prevent a water hammer following an initiation signal. An acceptable method of ensuring the line is full is to vent at 4I i the high points. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.3.2 Verifying the correct alignment for manual, power operated, and automatic valves in the RCIC flow path provides assurance that the proper flow path will exist for RCIC operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the RCIC System, this SR also includes the steam flow path for the turbine and the flow controller position.

(continued)

PBAPS UNIT 3 B 3.5-27 Revision No. 87

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.2 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.3.3 and SR 3.5.3.4 The RCIC pump flow rates ensure that the system can maintain reactor coolant inventory during pressurized conditions with the RPV isolated. The flow tests for the RCIC System are performed at two different pressure ranges such that system capability to provide rated flow is tested both at the higher and lower operating ranges of the system.

Additionally, adeq.uate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the RCIC System diverts steam flow. Reactor steam pressure must be

1053 and Ž 940 psig to perform SR 3.5.3.3 and greater than or equal to the Electro-Hydraulic Control (EHC) System minimum pressure set with the EHC System controlling pressure (the EHC System begins controlling pressure at a nominal 150 psig) and

175 psig to perform SR 3.5.3.4. Alternately, auxiliary steam can be used to perform SR 3.5.3.4. Adequate steam flow is represented by at least 2 turbine bypass valves open. Therefore, sufficient time is allowed after adequate pressure and flow are achieved to perform these SRs.

Reactor startup is allowed prior to performing the low pressure Surveillance because the reactor pressure is low and the time allowed to satisfactorily perform the Surveillance is short. Alternately, the low pressure Surveillance test may be performed prior to startup using an auxiliary steam supply. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure Surveillance has been satisfactorily completed and there is no indication or reason to believe that RCIC is inoperable. Therefore, these SRs are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the reactor steam pressure and flow are adequate to perform the test.

(continued)

PBAPS UNIT 3 B 3.5-28 Revision No. 87

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.3 and SR 3.5.3.4 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.3.5 The RCIC System is required to actuate automatically in order to verify its design function satisfactorily. This Surveillance verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of the RCIC System will cause the system to operate as designed, including actuation of the system throughout its emergency operating sequence; that is, automatic pump startup and actuation of all automatic valves to their required positions. This test also ensures the RCIC System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the CST to the suppression pool on low CST level. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.2 overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes vessel injection during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

(continued)

PBAPS UNIT 3 B 3.5-29 Revision No. 87

RCIC System B 3.5.3 BASES (continued)

REFERENCES 1. UFSAR, Section 1.5.

2. UFSAR, Section 4.7.

3. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.

(NRC), "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

4. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.5-30 Revision No. 67

Primary Containment B 3.6.1.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.1 Primary Containment BASES BACKGROUND The function of the primary containment is to isolate and contain fission products released from the Reactor Primary System following a Design Basis Accident (DBA) and to confine the postulated release of radioactive material. The primary containment consists of a steel vessel, which surrounds the Reactor Primary System and provides an essentially leak tight barrier against an uncontrolled release of radioactive material to the environment.

Portions of the steel vessel are surrounded by reinforced concrete for shielding purposes.

The isolation devices for the penetrations in the primary containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier:

a. All penetrations required to be closed during accident conditions are either:

1. capable of being closed by an OPERABLE automatic Containment Isolation System, or

2. closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)";

b. The primary containment air lock is OPERABLE, except as provided in LCO 3.6.1.2, "Primary Containment Air Lock"; and

c. All equipment hatches are closed.

This Specification ensures that the performance of the primary containment, in the event of a DBA, meets the assumptions used in the safety analyses of Reference 1.

SR 3.6.1.1.1 leakage rate requirements are in conformance with 10 CFR 50, Appendix J Option B (Ref. 3), as modified by approved exemptions.

(continued)

PBAPS UNIT 3 B 3.6-1 Revision No. 27

Primary Containment B 3.6.1.1 BASES (continued)

APPLICABLE The safety design basis for the primary containment is that SAFETY ANALYSES it must withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate.

The DBA that postulates the maximum release of radioactive material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE such that release of fission products to the environment is controlled by the rate of primary containment leakage.

Analytical methods and assumptions involving the primary containment are presented in Reference 1. The safety analyses assume a nonmechanistic fission product release following a DBA, which forms the basis for determination of offsite doses. The fission product release is, in turn, based on an assumed leakage rate from the primary containment. OPERABILITY of the primary containment ensures that the leakage rate assumed in the safety analyses is not exceeded.

The maximum allowable leakage rate for the primary containment (La) is 0.7% by weight of the containment air per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at the design basis LOCA maximum peak containment pressure (Pa) of 49.1 psig. The value of Pa (49.1 psig) is conservative with respect to the current calculated peak drywell pressure of 47.2 psig (Ref. 2).

This value is 47.8 psig for operation with 90'F Final Feedwater Temperature Reduction (Ref. 7).

Primary containment satisfies Criterion 3 of the NRC Policy Statement.

LCO Primary containment OPERABILITY is maintained by limiting leakage to

1.0 La, except prior to the first startup after performing a required Primary Containment Leakage Rate Testing Program leakage test. At this time, applicable leakage limits must be met. In addition, the leakage from the drywell to the suppression chamber must be limited to ensure the pressure suppression function is accomplished and the suppression chamber pressure does not exceed design limits. Compliance with this LCO will ensure a primary containment configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analyses.

(continued)

PBAPS UNIT 3 B 3.6-2 Revision No. 76

Primary Containment B 3.6.1.1 BASES LCO Individual leakage rates specified for the primary (continued) containment air lock are addressed in LCO 3.6.1.2.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, primary containment is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment.

ACTIONS A.1 In the event primary containment is inoperable, primary containment must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining primary containment OPERABILITY during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring primary containment OPERABILITY) occurring during periods where primary containment is inoperable is minimal.

B.1 If primary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 8) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.1.1 REQUIREMENTS Maintaining the primary containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Primary Containment Leakage Rate Testing Program. Failure to meet air lock leakage testing (SR 3.6.1.2.1), or main steam isolation (continued)

PBAPS UNIT 3 B 3.6-3 Revision No. 67

Primary Containment B 3.6.1.1 BASES SURVEILLANCE SR 3.6.1.1.1 (continued)

REQUIREMENTS valve leakage (SR 3.6.1.3.14), does not necessarily result in a failure of this SR. The impact of the failure to meet these SRs must be evaluated against the Type A, B, and C acceptance criteria of the Primary Containment Leakage Rate Testing Program. At

1.0 L, the offsite dose consequences are bounded by the assumptions of the safety analysis. The Frequency is required by the Primary Containment Leakage Rate Testing Program.

SR 3.6.1.1.2 Maintaining the pressure suppression function of primary containment requires limiting the leakage from the drywell to the suppression chamber. Thus, if an event were to occur that pressurized the drywell, the steam would be directed through the downcomers into the suppression pool. This SR is a leak test that confirms that the bypass area between the drywell and the suppression chamber is less than or equivalent to a one-inch diameter hole (Ref. 4). This ensures that the leakage paths that would bypass the suppression pool are within allowable limits.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Two consecutive test failures, however, would indicate unexpected primary containment degradation; in this event, as the Note indicates, a test shall be performed at a Frequency of once every 12 months until two consecutive tests pass.

(continued)

PBAPS UNIT 3 B 3.6-4 Revision No. 87

Primary Containment B 3.6.1.1 BASES (continued)

REFERENCES 1. UFSAR, Section 14.9.

2. Letter G94-PEPR-183, Peach Bottom Improved Technical Specification Project Increased Drywell and Suppression Chamber Pressure Analytical Limits, from G.V. Kumar (GE) to A.A. Winter (PECO), August 23, 1994.

3. 10 CFR 50, Appendix J, Option B.

4. Safety Evaluation by the Office of Nuclear Reactor Regulation Supporting Amendment Nos. 127 and 130 to Facility Operating License Nos. DPR-44 and DPR-56, dated February 18, 1988.

5. NEI 94-01, Revision 0, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J."

6. ANSI/ANS-56.8-1994, "Containment System Leakage Testing Requirements."

7. Peach Bottom Atomic Power Station Evaluation for Extended Final Feedwater Reduction, NEDC-32707P, Supplement 1, Revision 0, May, 1998.

8. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.6-5 Revision No. 67

Primary Containment Air Lock B 3.6.1.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.2 Primary Containment Air Lock BASES BACKGROUND One double door primary containment air lock has been built into the primary containment to provide personnel access to the drywell and to provide primary containment isolation during the process of personnel entering and exiting the drywell. The air lock is designed to withstand the same loads, temperatures, and peak design internal and external pressures as the primary containment (Ref. 1). As part of the primary containment, the air lock limits the release of radioactive material to the environment during normal unit operation and through a range of transients and accidents up to and including postulated Design Basis Accidents (DBAs).

Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a DBA in primary containment.

Each of the doors contains a gasket seal to ensure pressure integrity. To effect a leak tight seal, the air lock design uses pressure seated doors (i.e., an increase in primary containment internal pressure results in increased sealing force on each door).

Each air lock is nominally a right circular cylinder, 12 ft in diameter, with doors at each end that are interlocked to prevent simultaneous opening. During periods when primary containment is not required to be OPERABLE, the air lock interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent primary containment entry is necessary. Under some conditions as allowed by this LCO, the primary containment may be accessed through the air lock, when the interlock mechanism has failed, by manually performing the interlock function.

The primary containment air lock forms part of the primary containment pressure boundary. As such, air lock integrity and leak tightness are essential for maintaining primary containment leakage rate to within limits in the event of a DBA. Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the unit safety analysis.

(continued)

PBAPS UNIT 3 B 3.6-6 Revision No. 0

Primary Containment Air Lock B 3.6.1.2 BASES (continued)

APPLICABLE The DBA that postulates the maximum release of radioactive SAFETY ANALYSES material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE, such that release of fission products to the environment is controlled by the rate of primary containment leakage. The primary containment is designed with a maximum allowable leakage rate (La) of 0.7%

by weight of the containment air per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at the maximum peak containment pressure (Pa) of 49.1 psig. The value of Pa (49.1 psig) is conservative with respect to the current calculated peak drywell pressure of 47.2 psig (Ref. 3).

This value is 47.8 psig for operation with 90'F Final Feedwater Temperature Reduction (Ref. 4). This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air lock.

Primary containment air lock OPERABILITY is also required to minimize the amount of fission product gases that may escape primary containment through the air lock and contaminate and pressurize the secondary containment.

The primary containment air lock satisfies Criterion 3 of the NRC Policy Statement.

LCO As part of primary containment, the air lock's safety function is related to control of containment leakage rates following a DBA. Thus, the air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

The primary containment air lock is required to be OPERABLE.

For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door to be opened at a time. This provision ensures that a gross breach of primary containment does not exist when primary containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry and exit from primary containment.

(continued)

PBAPS UNIT 3 B 3.6-7 Revision No. 76

Primary Containment Air Lock B 3.6.1.2 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the primary containment air lock is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment.

ACTIONS The ACTIONS are modified by Note 1, which allows entry and exit to perform repairs of the affected air lock component.

If the outer door is inoperable, then it may be easily accessed to repair. If the inner door is the one that is inoperable, however, then a short time exists when the containment boundary is not intact (during access through the outer door). The ability to open the OPERABLE door, even if it means the primary containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the primary containment during the short time in which the OPERABLE door is expected to be open. The OPERABLE door must be immediately closed after each entry and exit.

The ACTIONS are modified by a second Note, which ensures appropriate remedial measures are taken when necessary.

Pursuant to LCO 3.0.6, actions are not required, even if primary containment leakage is exceeding La. Therefore, the Note is added to require ACTIONS for LCO 3.6.1.1, "Primary Containment," to be taken in this event.

A.1, A.2, and A.3 With one primary containment air lock door inoperable, the OPERABLE door must be verified closed (Required Action A.1) in the air lock. This ensures that a leak tight primary containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, which requires that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

In addition, the air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is considered (continued)

PBAPS UNIT 3 B 3.6-8 Revision No. 0

Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS A.I. A.2. and A.3 (continued) reasonable for locking the OPERABLE air lock door, considering that the OPERABLE door is being maintained closed.

Required Action A.3 ensures that the air lock with an inoperable door has been isolated by the use of a locked closed OPERABLE air lock door. This ensures that an acceptable primary containment leakage boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls. Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas or areas with limited access due to inerting and allows these doors to be verified locked closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.

The Required Actions have been modified by two Notes.

Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. With both doors in the air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls.

Primary containment entry may be required to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on TS-required equipment or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e., non-TS-related activities) if the primary containment was entered, using the inoperable air lock, to perform an allowed activity listed above. The administrative controls required consist of the stationing of a dedicated individual to assure closure of the OPERABLE door except during the entry and exit, and assuring the OPERABLE door is relocked after (continued)

PBAPS UNIT 3 B 3.6-9 Revision No. 0

Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS A.I. A.2. and A.3 (continued) completion of the containment entry and exit. This allowance is acceptable due to the low probability of an event that could pressurize the primary containment during the short time that the OPERABLE door is expected to be open.

B.1, B.2. and B.3 With an air lock interlock mechanism inoperable, the Required Actions and associated Completion Times are consistent with those specified in Condition A.

The Required Actions have been modified by two Notes.

Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. With both doors in the air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from the primary containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock).

Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas or areas with limited access due to inerting and that allows these doors to be verified locked closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.

C.1. C.2. and C.3 If the air lock is inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be immediately initiated to evaluate containment overall leakage rates using current air lock leakage test results. An evaluation is acceptable since it is overly conservative to immediately declare the primary containment inoperable if the overall air lock leakage is not within (continued)

PBAPS UNIT 3 B 3.6-10 Revision No. 0

Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS C.I, C.2, and C.3 (continued) limits. In many instances (e.g., only one seal per door has failed), primary containment remains OPERABLE, yet only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (according to LCO 3.6.1.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with the overall air lock leakage not within limits, the overall containment leakage rate can still be within limits.

Required Action C.2 requires that one door in the primary containment air lock must be verified closed. This action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1.1, which require that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, the air lock must be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable for restoring an inoperable air lock to OPERABLE status considering that at least one door is maintained closed in the air lock.

D.1 and D.2 If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.2.1 REQUIREMENTS Maintaining primary containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Primary Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with respect to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and primary containment OPERABILITY (continued)

. PBAPS UNIT 3 B 3.6-11 Revision No. 6

Primary Containment Air Lock B 3.6.1.2 BASES SURVEILLANCE SR 3.6.1.2.1 (continued)

REQUIREMENTS testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall primary containment leakage rate. The Frequency is required by the Primary Containment Leakage Rate Testing Program.

The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test.

This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 requires the results of air lock leakage tests to be evaluated against the acceptance criteria of the Primary Containment Leakage Rate Testing Program, 5.5.12.

This ensures that the air lock leakage is properly accounted for in determining the combined Type B and C primary containment leakage.

SR 3.6.1.2.2 The air lock interlock mechanism is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident primary containment pressure, closure of either door will support primary containment OPERABILITY. Thus, the interlock feature supports primary containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.6-12 Revision No. 87

Primary Containment Air Lock B 3.6.1.2 D BASES (continued)

REFERENCES 1. UFSAR, Section 5.2.3.4.5.

2. 10 CFR 50, Appendix J, Option B.

3. Letter G94-PEPR-183, Peach Bottom Improved Technical Specification Project Increased Drywell and Suppression Chamber Pressure Analytical Limits, from G.V. Kumar (GE) to A.A. Winter (PECo), August 23, 1994.

4. Peach Bottom Atomic Power Station Evaluation for Extended Final Feedwater Reduction, NEDC-32707P, Supplement 1, Revision 0, May, 1998.

PBAPS UNIT 3 B 3.6-13 Revision No. 21

PCIVs B 3.6.1.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.3 Primary Containment Isolation Valves (PCIVs)

BASES BACKGROUND The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) to within limits. Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA.

The OPERABILITY requirements for PCIVs help ensure that an adequate primary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. Therefore, the OPERABILITY requirements provide assurance that primary containment function assumed in the safety analyses will be maintained. These isolation devices are either passive or active (automatic). Closed manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), blind flanges, and closed systems are considered passive devices. Check valves and other automatic valves designed to close without operator action following an accident, are considered active devices.

Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in thesafety analyses. One of these barriers may be a closed system.

The reactor building-to-suppression chamber vacuum breakers and the scram discharge volume vent and drain valves each serve a dual function, one of which is primary containment isolation. However, since the other safety functions of the vacuum breakers and the scram discharge volume vent and drain valves would not be available if the normal PCIV actions were taken, the PCIV OPERABILITY requirements are not applicable to the reactor building-to-suppression chamber vacuum breaker valves and the scram discharge volume vent and drain valves. Similar Surveillance Requirements in the LCO for the reactor building-to-suppression chamber vacuum breakers and the LCO for the scram discharge volume (continued)

PBAPS UNIT 3 B 3.6-14 Revision No. 0

PCIVs B 3.6.1.3 BASES BACKGROUND vent and drain valves provide assurance that the isolation (continued) capability is available without conflicting with the vacuum relief or scram discharge volume vent and drain functions.

The primary containment purge lines are 18 inches in diameter; exhaust lines are 18 inches in diameter. In addition, a 6 inch line from the Containment Atmospheric Control (CAC) System is also provided to purge primary containment. The 6 and 18 inch primary containment purge valves and the 18 inch primary containment exhaust valves are normally maintained closed in MODES 1, 2, and 3 to ensure the primary containment boundary is maintained.

However, containment purging with the 18 inch purge and exhaust valves is permitted for inerting, de-inerting, and pressure control. Included in the scope of the de-inerting is the need to purge containment to ensure personnel safety during the performance of inspections beneficial to nuclear safety; e.g., inspection of primary coolant integrity during plant startups and shutdowns. Adjustments in primary containment pressure to perform tests such as the drywell-to-suppression chamber bypass leakage test are included within the scope of pressure control purging. Purging for humidity and temperature control using the 18 inch valves is excluded. The isolation valves on the 18 inch vent lines have 2 inch bypass lines around them for use during normal reactor operation when the 18 inch valves cannot be opened.

Two additional redundant Standby Gas Treatment (SGT) isolation valves are provided on the vent line upstream of the SGT System filter trains. These isolation valves, together with the PCIVs, will prevent high pressure from reaching the SGT System filter trains in the unlikely event of ;a loss of coolant accident (LOCA) during venting.

The Safety Grade Instrument Gas (SGIG) System supplies pressurized nitrogen gas (from the Containment Atmospheric Dilution (CAD) System liquid nitrogen storage tank) as a safety grade pneumatic source to the CAC System purge and exhaust isolation valve inflatable seals, the reactor building-to-suppression chamber vacuum breaker air operated isolation valves and inflatable seal, and the CAC and CAD Systems vent control air operated valves. The SGIG System thus performs two distinct post-LOCA functions: (1) supports containment isolation and (2) supports CAD System vent operation. SGIG System requirements are addressed for (continued)

PBAPS UNIT 3 B 3.6-15 Revision No. 0

PCIVs B 3.6.1.3 BASES BACKGROUND each of the supported system and components in LCO 3.6.1.3, (continued) "Primary Containment Isolation Valves (PCIVs)," and LCO 3.6.1.5, "Reactor Building-to-Suppression Chamber Vacuum Breakers." For the SGIG System, liquid nitrogen from the liquid nitrogen storage tank passes through the liquid nitrogen vaporizer where it is converted to a gas. The gas then flows into a Unit 2 header and a Unit 3 header separated by two manual globe valves. From each header, the gas then branches to each valve operator or valve seal supplied by the SGIG System. Each branch is separated from the header by a manual globe valve and a check valve.

To support SGIG System functions, the nitrogen inventory is equivalent to a storage tank minimum required level of Ž 22 inches water column, or a technically justified source of equivalent inventory Ž 124,000 scf at 250 psig, and a minimum required SGIG System header pressure of 80 psig.

APPLICABLE The PCIVs LCO was derived from the assumptions related to SAFETY ANALYSES minimizing the loss of reactor coolant inventory, and establishing the primary containment boundary during major accidents. As part of the primary containment boundary, PCIV OPERABILITY supports leak tightness of primary containment. Therefore, the safety analysis of any event requiring isolation of primary containment is applicable to this LCO.

The DBAs that result in a release of radioactive material and are mitigated by PCIVs are a LOCA and a main steam line break (MSLB). In the analysis for each of these accidents, it is assumed that PCIVs are either closed or close within the required isolation times following event initiation.

This ensures that potential paths to the environment through PCIVs (including primary containment purge valves) are minimized. Of the events analyzed in Reference 1, the LOCA is a limiting event due to radiological consequences. The closure time of the main steam isolation valves (MSIVs) is the most significant variable from a radiological standpoint. The MSIVs are required to close within 3 to 5 seconds after signal generation. Likewise, it is assumed that the primary containment is isolated such that release of fission products to the environment is controlled.

(continued)

PBAPS UNIT 3 B 3.6-16 Revision No. 91

PCIVs B 3.6.1.3 BASES APPLICABLE The DBA analysis assumes that within 60 -seconds of the SAFETY ANALYSES accident, isolation of the primary containment is complete (continued) and leakage is terminated, except for the maximum allowable leakage rate, L . The primary containment isolation total response time of 60 seconds includes signal delay, diesel generator startup (for loss of offsite power), and PCIV stroke times.

The single failure criterion required to be imposed in the conduct of unit safety analyses was considered in the original design of the primary containment purge and exhaust valves. Two valves in series on each purge and exhaust line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred.

PCIVs satisfy Criterion 3 of the NRC Policy Statement.

LCO PCIVs form a part of the primary containment boundary. The PCIV safety function is related to minimizing the loss of the reactor coolant inventory and establishing the primary containment boundary during a DBA.

The power operated, automatic isolation valves are required to have isolation times within limits and actuate on an automatic isolation signal. In addition, for the CAC System purge and exhaust isolation valves to be considered OPERABLE, the SGIG System supplying nitrogen gas to the inflatable seals of the valves must be OPERABLE. While the reactor building-to-suppression chamber vacuum breakers and the scram discharge volume vent and drain valves isolate primary containment penetrations, they are excluded from this Specification. Controls on their isolation function are adequately addressed in LCO 3.1.8, "Scram Discharge Volume (SDV) Vent and Drain Valves," and LCO 3.6.1.5, "Reactor Building-to-Suppression Chamber Vacuum Breakers."

The valves covered by this LCO are listed with their associated stroke times in Reference 2. The required stroke time is the stroke time listed in Reference 2, or the Inservice Testing Program which ever is more conservative.

The normally closed PCIVs are considered OPERABLE when manual valves are closed or open in accordance with appropriate administrative controls, automatic valves are (continued)

PBAPS UNIT 3 B 3.6-17 Revision No. 2

PCIVs B 3.6.1.3 BASES LCO de-activated and secured in their closed position, blind (continued) flanges are in place, and closed systems are intact. These passive isolation valves and devices are those listed in I Reference 2 and Reference 5.

MSIVs must meet additional leakage rate requirements. Other PCIV leakage rates are addressed by LCO 3.6.1.1, "Primary Containment," as Type B or C testing.

This LCO provides assurance that the PCIVs will perform their designed safety functions to minimize the loss of reactor coolant inventory and establish the primary containment boundary during accidents.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, most PCIVs are not required to be OPERABLE and the primary containment purge and exhaust valves are not required to be normally closed in MODES 4 and 5. Certain valves, however, are required to be OPERABLE

-lei to prevent inadvertent reactor vessel draindown. These valves are those whose associated instrumentation is required to be OPERABLE per LCO 3.3.6.1, "Primary Containment Isolation Instrumentation." (This does not include the valves that isolate the associated instrumentation.)

ACTIONS The ACTIONS are modified by a Note allowing penetration flow path(s) except for purge or exhaust valve flow path(s) to be unisolated intermittently under administrative controls.

These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated. Due to the size of the primary containment purge line penetration and the fact that those penetrations exhaust directly from the containment atmosphere to the environment, the penetration flow path containing these valves is not allowed to be operated under administrative controls.

(continued)

PBAPS UNIT 3 B 3.6-18 Revision No. 2

PCIVs B 3.6.1.3 BASES ACTIONS A second Note has been added to provide clarification that, (continued) for the purpose of this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable PCIV.

Complying with the Required Actions may allow for continued operation, and subsequent inoperable PCIVs are governed by subsequent Condition entry and application of associated Required Actions.

The ACTIONS are modified by Notes 3 and 4. Note 3 ensures that appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable PCIV (e.g., an Emergency Core Cooling Systems subsystem is inoperable due to a failed open test return valve). Note 4 ensures appropriate remedial actions are taken when the primary containment leakage limits are exceeded. Pursuant to LCO 3.0.6, these actions would not be required even when the associated LCO is not met.

Therefore, Notes 3 and 4 are added to require the proper actions be taken.

A.1 and A.2 With one or more penetration flow paths with one PCIV inoperable except for MSIV leakage not within limit, the affected penetration flow paths must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For a penetration isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available valve to the primary containment. The Required Action must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time (8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for main steam lines). The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable considering the time required to isolate the penetration and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3.

For main steam lines, an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is allowed.

The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for the main steam lines (continued)

PBAPS UNIT 3 B 3.6-19 Revision No. 0

PCIVs B 3.6.1.3 BASES ACTIONS A.1 and A.2 (continued) allows a period of time to restore the MSIVs to OPERABLE status given the fact that MSIV closure will result in isolation of the main steam line(s) and a potential for plant shutdown.

For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration flow path(s) must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident, and no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those devices outside containment and capable of potentially being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside primary containment" is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low. For the devices inside primary containment, the time period specified "prior to entering MODE 2 or 3 from MODE 4, if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the devices and other administrative controls ensuring that device misalignment is an unlikely possibility.

Condition A is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two PCIVs. For penetration flow paths with one PCIV, Condition C provides the appropriate Required Actions.

Required Action A.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas, and allows them to be verified by use of administrative means.

Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.

(continued)

PBAPS UNIT 3 B 3.6-20 Revision No. 58

PCIVs B 3.6.1.3 BASES ACTIONS B.1 (continued)

With one or more penetration flow paths with two PCIVs inoperable except due to MSIV leakage not within limit, either the inoperable PCIVs must be restored to OPERABLE status or the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.1.

Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two PCIVs.

For penetration flow paths with one PCIV, Condition C provides the appropriate Required Actions.

C.1 and C.2 With one or more penetration flow paths with one PCIV inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange.

A check valve may not be used to isolate the affected penetration. The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable considering the time required to isolate the penetration and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months for penetrations with a closed system is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3.

The closed system must also meet the requirements of Reference 6. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is also reasonable considering the instrument and the small pipe diameter of penetration (hence, reliability) to act as a penetration isolation boundary and the small pipe diameter of the affected penetrations.

For affected penetrations that have been isolated in accordance with Required Action C.1, the affected penetration flow path(s) must be verified to be isolated on (continued)

PBAPS UNIT 3 B 3.6-21 Revision No. 58

PCIVs B 3.6.1.3 BASES ACTIONS C.1 and C.2 (continued) a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident, and no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those valves outside containment and capable of potentially being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside primary containment" is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low. For the valves inside primary containment, the time period specified "prior to entering MODE 2 or 3 from MODE 4, if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the valves and other administrative controls ensuring that valve misalignment is an unlikely possibility.

Condition C is modified by a Note indicating that this Condition is only applicable to penetration flow paths with only one PCIV. For penetration flow paths with two PCIVs, Conditions A and B provide the appropriate Required Actions.

Required Action C.2 is modified by two Notes. Note 1 applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned.

Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is low.

D.1 With any MSIV leakage rate not within limit, the assumptions of the safety analysis are not met. Therefore, the leakage must be restored to within limit within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

Restoration can be accomplished by isolating the penetration that caused the limit to be exceeded by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. When a penetration is isolated, the leakage (continued)

PBAPS UNIT 3 B 3.6-22 Revision No. 58

PCIVs B 3.6.1.3 BASES ACTIONS D.1 (continued) rate for the isolated penetration is assumed to be the actual pathway leakage through the isolation device. If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the lesser actual pathway leakage of the two devices. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable considering the time required to restore the leakage by isolating the penetration, the fact that MSIV closure will result in isolation of the main steam line and a potential for plant shutdown, and the relative importance of MSIV leakage to the overall containment function.

E.:_.2. and E.2.2 The accumulated time that the large containment urge and/or vent valves (6" and 18" vent valves) are open, when reactor pressure is greater than 100 psig and the reactor is in MODES 1 or 2, is limited to 90 hours0.00104 days 0.025 hours 1.488095e-4 weeks 3.4245e-5 months per calendar year. This will limit the total time that a flow path exists through certain containment penetrations and ensures that there is no significant threat to the design analysis for crediting containment overpressure for EGGS NPSH. Consequently, there exists minimal impact on plant risk resulting from challenges to ECCS NPSH during a LOCA while purging. The 4-hour Completion Time to isolate the penetration is considered a reasonable amount of time to ensure compliance with the design analysis for containment overpressure. If the penetration is not isolated within the specified 4-hour time period, then the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

F.1 and F.2 If any Required Action and associated Completion Time cannot be met in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

G.1 and G.2 If any Required Action and associated Completion Time cannot be met for PCIV(s) required to be OPERABLE during MODE 4 or 5, the unit must be placed in a condition in which the LCO does not apply. Action must be immediately initiated to suspend operations with a potential for draining the reactor vessel (OPDRVs) to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended and valve(s) are restored to OPERABLE status. If suspending an OPDRV would result in closing the residual heat removal RHR) shutdown cooling isolation valves, an alternative equired Action is provided to immediately initiate action to restore the valve(s) to OPERABLE status. This allows RHR to remain in service wile actions are being taken to restore the valve.

(continued)

PBAPS UNIT 3 B 3.6-23 Revision No. 76

PCIVs B 3.6.1.3 BASES (continued)

SURVEILLANCE SR 3.6.1.3.1 REQUIREMENTS Verifying that the nitrogen inventory is equivalent to a level in the liquid nitrogen tank of Ž 22 inches water column (Ž 124,000 scf at 250 psig) will ensure at least 7 days of post-LOCA SGIG System operation. This minimum volume of nitrogen allows sufficient time after an accident to replenish the nitrogen supply in order to maintain the containment isolation function. The inventory is verified to ensure that the system is capable of performing its intended isolation function when required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.2 This SR ensures that the pressure in the SGIG System header is Ž 80 psig. This ensures that the post-LOCA nitrogen pressure provided to the valve operators and valve seals is adequate for the SGIG System to perform its design function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.3 This SR ensures that the primary containment purge and exhaust valves are closed as required or, if open, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable (Condition A applies). The SR is modified by a Note stating that the SR is not required to be met when the purge and exhaust valves are open for the stated reasons. The Note states that these valves may be opened for inerting, de-inerting, pressure control, ALARA or air quality considerations for personnel entry, or Surveillances that require the valves to be open.

The 6 inch and 18 inch purge valves and 18 inch exhaust (continued)

PBAPS UNIT 3 B 3.6-24 Revision No. 91

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.3 (continued)

REQUIREMENTS valves are capable of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time.

SR 3.6.1.3.4 This SR verifies that each primary containment isolation manual valve and blind flange that is located outside primary containment and is not locked, sealed, or otherwise secured and is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits.

This SR does not require any testing or valve manipulation.

Rather, it involves verification that those PCIVs outside primary containment, and capable of being mispositioned, are in the correct position. Since verification of valve position for PCIVs outside primary containment is relatively easy, the Frequency was chosen to provide added assurance that the PCIVs are in the correct positions. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these valves were verified to be in the correct position upon locking, sealing, or securing.

Three Notes have been added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls.

Allowing verification by administrative controls is considered acceptable since the primary containment is inerted and access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these PCIVs, once they have been verified to be in the proper position, is low. A second Note has been included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open. A third Note states that performance of the SR is not required for test taps with a diameter

1 inch. It is the intent that this SR must still be met, but actual performance is not required for test taps with a diameter

1 inch. The Note 3 allowance is consistent with the original plant licensing basis.

(continued)

PBAPS UNIT 3 B 3.6-25 Revision No. 87

PCIVs B 3.6.1.3 BASES SURVEI LLANCE SR 3.6.1.3.5 REQUIREMENTS (continued) This SR verifies that each primary containment manual isolation valve and blind flange that is located inside primary containment and not locked, sealed, or otherwise secured and is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits. For PCIVs inside primary containment, the Frequency defined as "prior to entering MODE 2 or 3 from MODE 4 if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is appropriate since these PCIVs are operated under administrative controls and the probability of their misalignment is low. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these valves were verified to be in the correct position upon locking, sealing, or securing.

Two Notes have been added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since the primary containment is inerted and access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these PCIVs,. once they have been verified to be in their proper position, is low. A second Note has been included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open.

SR 3.6.1.3.6 The traversing incore probe (TIP) shear isolation valves are actuated by explosive charges. Surveillance of explosive charge continuity provides assurance that TIP valves will actuate when required. Other administrative controls, such as those that limit the shelf life of the explosive charges, must be followed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.7 Verifying the correct alignment for each manual valve in the SGIG System required flow paths provides assurance that the proper flow paths exist for system operation. This SR does not apply to valves that are locked or otherwise secured in (continued)

PBAPS UNIT 3 B 3.6-26 Revision No. 87

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.7 (continued)

REQUIREMENTS position, since these valves were verified to be in the correct position prior to locking or securing. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.8 Verifying the isolation time of each power operated automatic PCIV is within limits is required to demonstrate OPERABILITY. MSIVs may be excluded from this SR since MSIV full closure isolation time is demonstrated by SR 3.6.1.3.9.

The isolation time test ensures that the valve will isolate in a time period less than or equal to that assumed in the safety analyses. The isolation time is in accordance with Reference 2 or the requirements of the Inservice Testing Program which ever is more conservative. The Frequency of this SR is in accordance with the requirements of the Inservice Testing Program.

SR 3.6.1.3.9 Verifying that the isolation time of each MSIV is within the specified limits is required to demonstrate OPERABILITY.

The isolation time test ensures that the MSIV will isolate in a time period that does not exceed the times assumed in the DBA analyses. This ensures that the calculated radiological consequences of these events remain within 10 CFR 50.67 limits as modified in Regulatory Guide 1.183, Table 6. The Frequency of this SR is in accordance with the requirements of the Inservice Testing Program.

SR 3.6.1.3.10 Automatic PCIVs close on a primary containment isolation signal to prevent leakage of radioactive material from primary containment following a DBA. This SR ensures that each automatic PCIV will actuate to its isolation position on a primary containment isolation signal. The LOGIC SYSTEM (continued)

PBAPS UNIT 3 B 3.6-27 Revision No. 87

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.10 (continued)

REQUIREMENTS FUNCTIONAL TEST in LCO 3.3.6.1 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.11 This SR requires a demonstration that a representative sample of reactor instrumentation line excess flow check valve (EFCVs) is OPERABLE by verifying that the valve actuates to the isolation position on a simulated instrument line break signal. The representative sample consists of an approximately equal number of EFCVs, such that each EFCV is tested at least once every 10 years (Nominal). In addition, the EFCVs in the sample are representative of the various plant configurations, models, sizes and operating environments. This ensures that any potentially common problem with a specific type of application of EFCV is detected at the earliest possible time. This SR provides assurance that the instrumentation line EFCVs will perform so that predicted radiological consequences will not be exceeded during a postulated instrument line break event.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.12 The TIP shear isolation valves are actuated by explosive charges. An in place functional test is not possible with this design. The explosive squib is removed and tested to provide assurance that the valves will actuate when required. The replacement charge for the explosive squib shall be from the same manufactured batch as the one fired or from another batch that has been certified by having one of the batch successfully fired. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.6-28 Revision No. 87

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.13 REQUIREMENTS (continued) This SR ensures that in case the non-safety grade instrument air system is unavailable, the SGIG System will perform its design function to supply nitrogen gas at the required pressure for valve operators and valve seals supported by the SGIG System. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.14 Total leakage through all four main steam lines must be

204 scfh, and

116 scfh for any one steam line, when tested at

> 25 psig. The analysis in Reference 1 is based on treatment of MSIV leakage as secondary containment bypass leakage, independent of the primary to secondary containment leakage analyzed at La. The Frequency is in accordance with the Primary Containment Leakage Rate Testing Program.

SR 3.6.1.3.15 Verifying the opening of each 6 inch and 18 inch primary containment purge valve and each 18 inch primary containment exhaust valve is restricted by a blocking device to less than or equal to the required maximum opening angle specified in the UFSAR (Ref. 4) is required to ensure that the valves can close under DBA conditions within the times in the analysis of Reference 1. If a LOCA occurs, the purge and exhaust valves must close to maintain primary containment leakage within the values assumed in the accident analysis. At other times pressurization concerns are not present, thus the purge and exhaust valves can be fully open. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.6-29 Revision No. 87

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.16 REQUIREMENTS (continued) The inflatable seal of each 6 inch and 18 inch primary containment purge valve and each 18 inch primary containment exhaust valve must be replaced periodically. This will allow the opportunity for replacement before gross leakage failure occurs.

REFERENCES 1. UFSAR, Chapter 14.

2. UFSAR, Table 7.3.1.

3. 10 CFR 50, Appendix J, Option B.

4. UFSAR, Table 7.3.1, Note 17.

5. UFSAR, Table 5.2.2.

6. UFSAR, Table 7.3.1, Note 14.

PBAPS UNIT 3 B 3.6-30 Revision No. 87

Drywell Air Temperature B 3.6.1.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.4 Drywell Air Temperature BASES BACKGROUND The drywell contains the reactor vessel and piping, which add heat to the airspace. Drywell coolers remove heat and maintain a suitable environment. The average airspace temperature affects the calculated response to postulated Design Basis Accidents (DBAs). The limitation on the drywell average air temperature was developed as reasonable, based on operating experience. The limitation on drywell air temperature is used in the Reference 1 safety analyses.

APPLICABLE Primary containment performance is evaluated for a SAFETY ANALYSES spectrum of break sizes for postulated loss of coolant accidents (LOCAs) (Ref. 1). Among the inputs to the design basis analysis is the initial drywell average air temperature (Ref. 1). Analyses assume an initial average drywell air temperature of 145°F. This limitation ensures that the safety analysis remains valid by maintaining the expected initial conditions and ensures that the peak LOCA drywell temperature does not exceed the maximum allowable temperature of 281'F (Ref. 2) except for a brief period of less than 20 seconds which was determined to be acceptable in References 1 and 3. Exceeding this design temperature may result in the degradation of the primary containment structure under accident loads. Equipment inside primary containment required to mitigate the effects of a DBA is.

designed to operate and be capable of operating under environmental conditions expected for the accident.

Drywell air temperature satisfies Criterion 2 of the NRC Policy Statement.

LCO In the event of a DBA, with an initial drywell average air temperature less than or equal to the LCO temperature limit, the resultant peak accident temperature is maintained within acceptable limits for the drywell. As a result, the ability of primary containment to perform its design function is ensured.

(continued)

PBAPS UNIT 3 B 3.6-31 Revision No. 20

Drywell Air Temperature B 3.6.1.4 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining drywell average air temperature within the limit is not required in MODE 4 or 5.

ACTIONS A.I With drywell average air temperature not within the limit of the LCO, drywell average air temperature must be restored within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The Required Action is necessary to return operation to within the bounds of the primary containment analysis. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is acceptable,.

considering the sensitivity of the analysis to variations in this parameter, and provides sufficient time to correct minor problems.

B.1 and B.2 If the drywell average air temperature cannot be restored to within the limit within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.4.1 REQUIREMENTS Verifying that the drywell average air temperature is within the LCO limit ensures that operation remains within the limits assumed for the primary containment analyses.

Drywell air temperature is monitored in various quadrants and at various elevations. Due to the shape of the drywell, a volumetric average is used to determine an accurate representation of the actual average temperature.

(continued)

PBAPS UNIT 3 B 3.6-32 Revision No. 0

Drywell Air Temperature B 3.6.1.4 BASES SURVEILLANCE SR 3.6.1.4.1 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Letter G94-PEPR-183, Peach Bottom Improved Technical Specification Project Increased Drywell and Suppression Chamber Pressure Analytical Limits, from G.V. Kumar (GE) to A.A. Winter (PECO), August 23, 1994.

2. UFSAR, Section 5.2.3.1.

3. Peach Bottom Atomic Power Station Evaluation for Extended Final Feedwater Reduction, NEDC-32707P, Supplement 1, Revision 0, May, 1998.

PBAPS UNIT 3 B 3.6-33 Revision No. 87

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.5 Reactor Building-to-Suppression Chamber Vacuum Breakers BASES BACKGROUND The function of the reactor building-to-suppression chamber vacuum breakers is to relieve vacuum when primary containment depressurizes below reactor building pressure.

If the drywell depressurizes below reactor building pressure, the negative differential pressure is mitigated by flow through the reactor building-to-suppression chamber vacuum breakers and through the suppression-chamber-to-drywell vacuum breakers. The design of the external (reactor building-to-suppression chamber) vacuum relief provisions consists of two vacuum breakers (a check valve and an air operated butterfly valve), located in series in each of two lines from the reactor building to the suppression chamber airspace. The butterfly valve is actuated by a differential pressure signal. The check valve is self actuating and can be manually operated for testing purposes. The two vacuum breakers in series must be closed to maintain a leak tight primary containment boundary.

A negative differential pressure across the drywell wall is caused by rapid depressurization of the drywell. Events that cause this rapid depressurization are cooling cycles, primary containment spray actuation, and steam condensation in the event of a primary system rupture. Reactor building-to-suppression chamber vacuum breakers prevent an excessive negative differential pressure across the primary containment boundary. Cooling cycles result in minor pressure transients in the drywell, which occur slowly and are normally controlled by heating and ventilation equipment. Inadvertent spray actuation results in a significant negative pressure transient and is the design basis event postulated in sizing the external (reactor building-to-suppression chamber) vacuum breakers.

The external vacuum breakers are sized on the basis of the air flow from the secondary containment that is required to mitigate the depressurization transient and limit the maximum negative containment (suppression chamber) pressure to within design limits. The maximum depressurization rate is a function of the primary containment spray flow rate and temperature and the assumed initial conditions of the (continued)

PBAPS UNIT 3 B 3.6-34 Revision No. 0

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES BACKGROUND suppression chamber atmosphere. Low spray temperatures and (continued) atmospheric conditions that yield the minimum amount of contained noncondensible gases are assumed for conservatism.

The Safety Grade Instrument Gas (SGIG) System supplies pressurized nitrogen gas (from the Containment Atmospheric Dilution (CAD) System liquid nitrogen storage tank) as a safety grade pneumatic source to the CAC System purge and exhaust isolation valve inflatable seals, the reactor building-to-suppression chamber vacuum breaker air operated isolation butterfly valves and inflatable seal, and the CAC and CAD Systems vent control air operated valves. The SGIG System thus performs two distinct post-LOCA functions: (1) supports containment isolation and (2) supports CAD System vent operation. SGIG System requirements are addressed for each of the supported system and components in LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)," LCO 3.6.1.5, and "Reactor Building-to-Suppression Chamber Vacuum Breakers." For the SGIG System, liquid nitrogen from the liquid nitrogen storage tank passes through the liquid nitrogen vaporizer where it is converted to a gas. The gas then flows into a Unit 2 header and a Unit 3 header separated by two manual globe valves. From each header, the gas then branches to each valve operator or valve seal supplied by the SGIG System. Each branch is separated from the header by a manual globe valve and a check valve.

To support SGIG System functions, the nitrogen inventory is equivalent to a storage tank minimum required level of Ž 22 inches water column, or a technically justified source of equivalent inventory Ž 124,000 scf at 250 psig, and a minimum required SGIG System header pressure of 80 psig.

APPLICABLE Analytical methods and assumptions involving the reactor SAFETY ANALYSES building-to-suppression chamber vacuum breakers are used as part of the accident response of the containment systems.

Internal (suppression-chamber-to-drywell) and external (reactor building-to-suppression chamber) vacuum breakers (continued)

PBAPS UNIT 3 B 3.6-35 Revision No. 91

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES APPLICABLE are provided as part of the primary containment to limit the SAFETY ANALYSES negative differential pressure across the drywell and (continued) suppression chamber walls, which form part of the primary containment boundary.

The safety analyses assume the external vacuum breakers to be closed initially and to be fully open at 0.75 psid.

Additionally, of the four reactor building-to-suppression chamber vacuum breakers (two in each of the two lines from the reactor building-to-suppression chamber airspace), one is assumed to fail in a closed position to satisfy the single active failure criterion. Design Basis Accident (DBA) analyses require the vacuum breakers to be closed initially and to remain closed and leak tight with positive primary containment pressure.

Three cases were considered in the safety analyses to determine the adequacy of the external vacuum breakers:

a. A small break loss of coolant accident followed by actuation of both drywell spray loops;

b. Inadvertent actuation of one drywell spray loop during normal operation; and

c. A postulated DBA assuming low pressure coolant injection flow out the loss of coolant accident break, which condenses the drywell steam.

The results of these three cases show that the external vacuum breakers, with an opening setpoint of 0.75 psid, are capable of maintaining the differential pressure within design limits.

The reactor building-to-suppression chamber vacuum breakers satisfy Criterion 3 of the NRC Policy Statement.

LCO All reactor building-to-suppression chamber vacuum breakers are required to be OPERABLE to satisfy the assumptions used in the safety analyses. The requirement ensures that the two vacuum breakers (check valve and air operated butterfly valve) in each of the two lines from the reactor building to (continued)

PBAPS UNIT 3 B 3.6-36 Revision No. 0

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES LCO the suppression chamber airspace are closed. Also, the (continued) requirement ensures both vacuum breakers in each line will open to relieve a negative pressure in the suppression chamber (except during testing or when performing their intended function).

In addition, for the reactor building-to-suppression chamber vacuum breakers to be considered OPERABLE and closed, the SGIG System supplying nitrogen gas to the air operated valves and inflatable seal of the vacuum breakers must be OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could result in excessive negative differential pressure across the drywell wall caused by the rapid depressurization of the drywell. The event that results in the limiting rapid depressurization of the drywell is the primary system rupture, which purges the drywell of air and fills the drywell free airspace with steam. Subsequent condensation of the steam would result in depressurization of the drywell. The limiting pressure and temperature of the primary system prior to a DBA occur in MODES 1, 2, and 3. Excessive negative pressure inside primary containment could also occur due to inadvertent initiation of the Drywell Spray System.

In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining reactor building-to-suppression chamber vacuum breakers OPERABLE is not required in MODE 4 or 5.

ACTIONS A Note has been added to provide clarification that, for the purpose of this LCO, separate Condition entry is allowed for each penetration flow path.

A._1 With one or more lines with one vacuum breaker not closed, the leak tight primary containment boundary may be threatened. Therefore, the inoperable vacuum breakers must be restored to OPERABLE status or the open vacuum breaker closed within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is consistent with requirements for inoperable suppression chamber-to-drywell vacuum breakers in LCO 3.6.1.6, (continued)

PBAPS UNIT 3 B 3.6-37 Revision No. 0

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES ACTIONS A.1 (continued)

"Suppression Chamber-to-Drywell Vacuum Breakers." The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundant capability afforded by the remaining breakers, the fact that the OPERABLE breaker in each of the lines is closed, and the low probability of an event occurring that would require the vacuum breakers to be OPERABLE during this period.

B.1 With one or more lines with two vacuum breakers not closed, primary containment integrity is not maintained. Therefore, one open vacuum breaker must be closed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, "Primary Containment," which requires that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

C.1 With one line with one or more vacuum breakers inoperable for opening, the leak tight primary containment boundary is intact. The ability to mitigate an event that causes a containment depressurization is threatened if one or more vacuum breakers in at least one vacuum breaker penetration are not OPERABLE. Therefore, the inoperable vacuum breaker must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This is consistent with the Completion Time for Condition A and the fact that the leak tight primary containment boundary is being maintained.

D.1 If one line has one or more vacuum breakers inoperable for opening and they are not restored within the Completion Time in Condition C, the remaining vacuum breakers in the remaining line can provide the opening function. The plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 1) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PBAPS UNIT 3 B 3.6-38 Revision No. 67

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES ACTIONS E.1 (continued)

With two lines with one or more vacuum breakers inoperable for opening, the primary containment boundary is intact.

However, in the event of a containment depressurization, the function of the vacuum breakers is lost. Therefore, all vacuum breakers in one line must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, which requires that primary containment be restored to OPERABLE status within I hour.

F.1 and F.2 If any Required Action and associated Completion Time for Conditions A, B, or E cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.5.1 REQUIREMENTS Verifying that the nitrogen inventory is equivalent to a level in the liquid nitrogen tank of Ž 22 inches water column (Ž 124,000 scf at 250 psig) will ensure at least 7 days of post-LOCA SGIG System operation. This minimum volume of nitrogen allows sufficient time after an accident to replenish the nitrogen supply in order to maintain the design function of the reactor building-to-suppression vacuum breakers. The inventory is verified to ensure that the system is capable of performing its intended isolation function when required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.5.2 This SR ensures that the pressure in the SGIG System header is Ž 80 psig. This ensures that the post-LOCA nitrogen pressure provided to the valve operators and valve seals that is adequate for the SGIG to perform its design function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.6-39 Revision No. 91

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES SURVEILLANCE SR 3.6.1.5.3 REQUIREMENTS (continued) Each vacuum breaker is verified to be closed to ensure that a potential breach in the primary containment boundary is not present. This Surveillance is performed by observing local or control room indications of vacuum breaker position or by verify'ing a differential pressure of 0.75 psid is maintained between the reactor building and suppression chamber. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Two Notes are added to this SR. The first Note allows reactor building-to-suppression chamber vacuum breakers opened in conjunction with the performance of a Surveillance to not be considered as failing this SR. These periods of opening vacuum breakers are controlled by plant procedures and do not represent inoperable vacuum breakers. A second Note is included to clarify that vacuum breakers open due to an actual differential pressure, are not considered as failing this SR.

SR 3.6.1.5.4 Verifying the correct alignment for each manual valve in the SGIG System required flow paths provides assurance that the proper flow paths exist for system operation. This SR does not apply to valves that are locked or otherwise secured in position, since these valves were verified to be in the correct position prior to locking or securing. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.6-40 Revision No. 87

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES SURVEILLANCE SR 3.6.1.5.5 REQUIREMENTS (continued) Each vacuum breaker must be cycled to ensure that it opens properly to perform its design function and returns to its fully closed position. This ensures that the safety analysis assumptions are valid. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.5.6 Demonstration of air operated vacuum breaker opening setpoint is necessary to ensure that the safety analysis assumption regarding vacuum breaker full open differential pressure of < 0.75 psid is valid. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.5.7 This SR ensures that in case the non-safety grade instrument air system is unavailable, the SGIG System will perform its design function to supply nitrogen gas at the required pressure for valve operators and valve seals supported by the SGIG System. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.6-41 Revision No. 87

Suppression Chamber-to-Drywe 11 Vacuum Breakers B 3.6.1.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.6 Suppression Chamber-to-Drywell Vacuum Breakers BASES BACKGROUND The function of the suppression chamber-to-drywell vacuum breakers is to relieve vacuum in the drywell. There are 12 internal vacuum breakers located on the vent header of the vent system between the drywell and the suppression chamber, which allow air and steam flow from the suppression chamber to the drywell when the drywell is at a negative pressure with respect to the suppression chamber.

Therefore, suppression chamber-to-drywell vacuum breakers prevent an excessive negative differential pressure across the wetwell drywell boundary. Each vacuum breaker is a self actuating valve, similar to a check valve, which can be remotely operated for testing purposes.

A negative differential pressure across the drywell wall is caused by rapid depressurization of the drywell. Events that cause this rapid depressurization are cooling cycles, drywell spray actuation, and steam condensation from sprays or subcooled water reflood of a break in the event of a primary system rupture. Cooling cycles result in minor pressure transients in the drywell that occur slowly and are normally controlled by heating and ventilation equipment.

Spray actuation or spill of subcooled water out of a break results in more significant pressure transients and becomes important in sizing the internal vacuum breakers.

In the event of a primary system rupture, steam condensation within the drywell results in the most severe pressure transient. Following a primary system rupture, air in the drywell is purged into the suppression chamber free airspace, leaving the drywell full of steam. Subsequent condensation of the steam can be caused in two possible ways, namely, Emergency Core Cooling Systems flow from a recirculation line break, or drywell spray actuation following a loss of coolant accident (LOCA). These two cases determine the maximum depressurization rate of the drywell.

In addition, the waterleg in the Mark I Vent System downcomer is controlled by the drywell-to-suppression chamber differential pressure. If the drywell pressure is less than the suppression chamber pressure, there will be an increase in the vent waterleg. This will result in an (continued)

PBAPS UNIT 3 B 3.6-42 Revision No. 0

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES BACKGROUND increase in the water clearing inertia in the event of a (continued) postulated LOCA, resulting in an increase in the peak drywell pressure. This in turn will result in an increase in the pool swell dynamic loads. The internal vacuum breakers limit the height of the waterleg in the vent system during normal operation.

APPLICABLE Analytical methods and assumptions involving the SAFETY ANALYSES suppression chamber-to-drywell vacuum breakers are used as part of the accident response of the primary containment systems. Internal (suppression chamber-to-drywell) and external (reactor building- to-suppression chamber) vacuum breakers are provided as part of the primary containment to limit the negative differential pressure across the drywell and suppression chamber walls that form part of the primary containment boundary.

The safety analyses assume that the internal vacuum breakers are closed initially and are fully open at a differential pressure of 0.5 psid. Additionally, 1 of the 9 internal vacuum breakers required to open is assumed to fail in a closed position. The results of the analyses show that the design pressure is not exceeded even under the worst case accident scenario. The vacuum breaker opening differential pressure setpoint and the requirement that 9 of 12 vacuum breakers be OPERABLE are a result of the requirement placed on the vacuum breakers to limit the vent system waterleg height. The total cross sectional area of the main vent system between the drywell and suppression chamber needed to fulfill this requirement has been established as a minimum of 51.5 times the total break area. In turn, the vacuum relief capacity between the drywell and suppression chamber should be 1/16 of the total main vent cross sectional area, with the valves set to operate at 0.5 psid differential pressure. This was the original design basis for Peach Bottom, which required 10 18" vacuum breakers to meet the 1/16 of the total main vent cross sectional area. However, the current design basis requirement for 9 vacuum breakers required to be operable, one of which is assumed to fail to open (single active failure), is found in Reference 2.

Design Basis Accident (DBA) analyses require the vacuum breakers to be closed initially and to remain closed and leak tight, until the suppression pool is at a positive pressure relative to the drywell. All suppression chamber-to-drywell vacuum breakers are considered closed if a leak test confirms that the bypass area between the drywell and suppression chamber is less than or equivalent to a one-inch diameter hole (Ref. 1).

The suppression chamber-to-drywell vacuum breakers satisfy Criterion 3 of the NRC Policy Statement.

(continued)

PBAPS UNIT 3 B 3.6-43 Revision No. 44

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES (continued)

LCO Only 9 of the 12 vacuum breakers must be OPERABLE for opening. All suppression chamber-to-drywell vacuum breakers are required to be closed (except when the vacuum breakers are performing their intended design function). All suppression chamber-to-drywell vacuum breakers are considered closed, even if position indication shows that one or more vacuum breakers is not fully seated, if a leak test confirms that the bypass area between the drywell and suppression chamber is less than or equivalent to a one-inch diameter hole. The vacuum breaker OPERABILITY requirement provides assurance that the drywell-to-suppression chamber negative differential pressure remains below the design value. The requirement that the vacuum breakers be closed ensures that there is no excessive bypass leakage should a LOCA occur.

APPLICABILITY In MODES 1, 2, and 3, a DBA could result in excessive negative differential pressure across the drywell wall, caused by the rapid depressurization of the drywell. The event that results in the limiting rapid depressurization of the drywell is the primary system rupture that purges the drywell of air and fills the drywell free airspace with steam. Subsequent condensation of the steam would result in depressurization of the drywell. The limiting pressure and temperature of the primary system prior to a DBA occur in MODES 1, 2, and 3. Excessive negative pressure inside the drywell could also occur due to inadvertent actuation of the Drywell Spray System.

In MODES 4 and 5, the probability and consequences of these events are reduced by the pressure and temperature limitations in these MODES; therefore, maintaining suppression chamber-to-drywell vacuum breakers OPERABLE is not required in MODE 4 or 5.

ACTIONS A.1 With one of the required vacuum breakers inoperable for opening (e.g., the vacuum breaker is not open and may be stuck closed or not within its opening setpoint limit, so that it would not function as designed during an event that depressurized the drywell), the remaining eight OPERABLE vacuum breakers are capable of providing the vacuum relief function. However, overall system reliability is reduced (continued)

PBAPS UNIT 3 B 3.6-44 Revision No. 0

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES ACTIONS A.i (continued) because a single failure in one of the remaining vacuum breakers could result in an excessive suppression chamber-to-drywell differential pressure during a DBA. Therefore, with one of the nine required vacuum breakers inoperable, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to restore the inoperable vacuum breaker to OPERABLE status so that plant conditions are consistent with those assumed for the design basis analysis. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is considered acceptable due to the low probability of an event in which the remaining vacuum breaker capability would not be adequate.

B.1 If a required suppression chamber-to-drywell vacuum breaker is inoperable for opening and is not restored to OPERABLE status within the required Completion Time, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 An open vacuum breaker allows communication between the drywell and suppression chamber airspace, and, as a result, there is the potential for suppression chamber overpressurization due to this bypass leakage if a LOCA were to occur. Therefore, the open vacuum breaker must be closed. A short time is allowed to close the vacuum breaker due to the low probability of an event that would pressurize primary containment. If vacuum breaker position indication is not reliable, an alternate method of verifying that the vacuum breakers are closed must be performed within 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months . All suppression chamber-to-drywell vacuum breakers are considered closed, even if the "not fully seated" indication is shown, if a leak test confirms that the bypass area between the drywell and suppress-ion chamber is less than or equivalent to a one-inch diameter hole (Ref. 1). The required 10 hour1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months Completion Time is considered adequate to perform this test. If the leak test fails, not only must the Actions be taken (close the open vacuum breaker within 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months ), but also the appropriate Condition and Required Actions of LCO 3.6.1.1, Primary Containment, must be entered.

(continued)

PBAPS UNIT 3 B 3.6-45 Revision No. 67

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES ACTIONS D.1 and D.2 If the open suppression chamber-to-drywell vacuum breaker cannot be closed within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.6.1 REQUIREMENTS Each vacuum breaker is verified closed to ensure that this potential large bypass leakage path is not present. This Surveillance is performed by observing the vacuum breaker position indication or by performing a leak test that confirms that the bypass area between the drywell and suppression chamber is less than or equivalent to a one-inch diameter hole. If the bypass test fails, not only must the vacuum breaker(s) be considered open and the appropriate Conditions and Required Actions of this LCO be entered, but also the appropriate Condition and Required Action of LCO 3.6.1.1 must be entered. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

A Note is added to this SR which allows suppression chamber-to-drywell vacuum breakers opened in conjunction with the performance of a Surveillance to not be considered as failing this SR. These periods of opening vacuum breakers are controlled by plant procedures and do not represent inoperable vacuum breakers.

SR 3.6.1.6.2 Each required vacuum breaker must be cycled to ensure that it opens adequately to perform its design function and returns to the fully closed position. This ensures that the safety analysis assumptions are valid. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.6-46 Revision No. 87

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES SURVEILLANCE SR 3.6.1.6.3 REQUIREMENTS (continued) Verification of the vacuum breaker setpoint for full opening is necessary to ensure that the safety analysis assumption regarding vacuum breaker full open differential pressure of 0.5 psid is valid. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Safety Evaluation by the Office of Nuclear Reactor Regulation Supporting Amendment Nos. 127 and 130 to Facility Operating License Nos. DPR-44 and DPR-56, dated February 18, 1988.

2. ME-0161, "Det. Actual # Wetwell to Drywell Vacuum Breakers Reqd."

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.6-47 Revision No. 87

Suppression Pool Average Temperature B 3.6.2.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.1 Suppression Pool Average Temperature BASES BACKGROUND The suppression chamber is a toroidal shaped, steel pressure vessel containing a volume of water called the suppression pool. The suppression pool is designed to absorb the decay heat and sensible energy released during a reactor blowdown from safety/relief valve discharges or from Design Basis Accidents (DBAs). The suppression pool must quench all the steam released through the downcomer lines during a loss of coolant accident (LOCA). This is the essential mitigative feature of a pressure suppression containment that ensures that the peak containment pressure is maintained below the maximum allowable pressure for DBAs (56 psig). The suppression pool must also condense steam from steam exhaust lines in the turbine driven systems (i.e., the High Pressure Coolant Injection System and Reactor Core Isolation Cooling System). Suppression pool average temperature (along with LCO 3.6.2.2, "Suppression Pool Water Level") is a key indication of the capacity of the suppression pool to fulfill these requirements.

The technical concerns that lead to the development of suppression pool average temperature limits are as follows:

a. Complete steam condensation-the original limit for the end of a LOCA blowdown was 170F, based on the Bodega Bay and Humboldt Bay Tests;

b. Primary containment peak pressure and temperature-

.design pressure is 56 psig and design temperature is 281"F (Ref. 1);

c. Condensation oscillation loads-maximum allowable initial temperature is 1100F.

APPLICABLE The postulated DBA against which the primary containment SAFETY ANALYSES performance is evaluated is the entire spectrum of postulated pipe breaks within the primary containment.

Inputs to the safety analyses include initial suppression pool water volume and suppression pool temperature (Ref. 2).

An initial pool temperature of 95°F is assumed for the (continued)

PBAPS UNIT 3 B 3.6-48 Revision No. 0

Suppression Pool Average Temperature B 3.6.2.1 BASES APPLICABLE Reference 1 and Reference 2 analyses. Reactor shutdown at a SAFETY ANALYSES pool temperature of 110*F and vessel depressurization at a (continued) pool temperature of 120*F are assumed for the Reference 2 analyses. The limit of 105°F, at which testing is terminated, is not used in the safety analyses because DBAs are assumed to not initiate during unit testing.

Suppression pool average temperature satisfies Criteria 2 and 3 of the NRC Policy Statement.

LCO A limitation on the suppression pool average temperature is required to provide assurance that the containment conditions assumed for the safety analyses are met. This limitation subsequently ensures that peak primary containment pressures and temperatures do not exceed maximum allowable values during a postulated DBA or any transient resulting in heatup of the suppression pool. The LCO requirements are:

a. Average temperature : 95 0 F when any OPERABLE wide range neutron monitor (WRNM) channel is at 1.OOEO %

power or above and no testing that adds heat to the suppression pool is being performed. This requirement ensures that licensing bases initial conditions are met.

b. Average temperature : 105 0 F when any OPERABLE WRNM channel is at 1.OOEO % power or above and testing that adds heat to the suppression pool is being performed.

This required value ensures that the unit has testing flexibility, and was selected to provide margin below the 110°F limit at which reactor shutdown is required.

When testing ends, temperature must be restored to

95°F within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months according to Required Action A.2. Therefore, the time period that the temperature is > 950 F is short enough not to cause a significant increase in unit risk.

c. Average temperature K 110°F when all OPERABLE WRNM channels are below 1.OOEO % power. This requirement ensures that the unit will be shut down at > 110 0 F.

The pool is designed to absorb decay heat and sensible heat but could be heated beyond design limits by the steam generated if the reactor is not shut down.

(continued)

PBAPS UNIT 3 B 3.6-49 Revision No. 17

Suppression Pool Average Temperature B 3.6.2.1 BASES I LCO Note that WRNM indication at 1.OOEO % power is a (continued) convenient measure of when the reactor is producing power essentially equivalent to 1% RTP. At this power level, heat input is approximately equal to normal system heat losses.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause significant heatup of the suppression pool. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES.

Therefore, maintaining suppression pool average temperature within limits is not required in MODE 4 or 5.

ACTIONS A.I and A.2 With the suppression pool average temperature above the specified limit when not performing testing that adds heat to the suppression pool and when above the specified power indication, the initial conditions exceed the conditions assumed for the Reference 1, 2, and 3 analyses. However, primary containment cooling capability still exists, and the primary containment pressure suppression function will occur at temperatures well above those assumed for safety analyses. Therefore, continued operation is allowed for a limited time. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is adequate to allow the suppression pool average temperature to be restored below the limit. Additionally, when suppression pool temperature is > 950 F, increased monitoring of the suppression pool temperature is required to ensure that it remains : 110°F. The once per hour Completion Time is adequate based on past experience, which has shown that pool temperature increases relatively slowly except when testing that adds heat to the suppression pool is being performed.

Furthermore, the once per hour Completion Time is considered adequate in view of other indications in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.

B.1 If the suppression pool average temperature cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the power must be reduced to below 1.OOEO % power for all OPERABLE WRNMs within (continuedl PBAPS UNIT 3 B 3.6-50 Revision No. 17

Suppression Pool Average Temperature B 3.6.2.1 BASES ACTIONS B.1 (continued) 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to reduce power from full power conditions in an orderly manner and without challenging plant systems.

C.'

Suppression pool average temperature is allowed to be > 950 F when any OPERABLE WRNM channel is at 1.OOEO % power or above, and when testing that adds heat to the suppression pool is being performed. However, if temperature is

> 105°F, all testing must be immediately suspended to preserve the heat absorption capability of the suppression pool. With the testing suspended, Condition A is entered and the Required Actions and associated Completion Times are applicable.

D.I. D.2, and D.3 Suppression pool average temperature > 110°F requires that the reactor be shut down immediately. This is accomplished by placing the reactor mode switch in the shutdown position.

Further cooldown to MODE 4 is required at normal cooldown rates (provided pool temperature remains - 120 0 F).

Additionally, when suppression pool temperature is > 110 0 F, increased monitoring of pool temperature is required to ensure that it remains < 120°F. The once per 30 minute Completion Time is adequate, based on operating experience.

Given the high suppression pool average temperature in this Condition, the monitoring Frequency is increased to twice that of Condition A. Furthermore, the 30 minute Completion Time is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.

E.1 and E.2 If suppression pool average temperature cannot be maintained at

120 0 F, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the reactor pressure must be reduced to < 200 psig within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and the plant must be brought to at least MODE 4 within (continued)

PBAPS UNIT 3 B 3.6-51 Revision No. 17

Suppression Pool Average Temperature B 3.6.2.1 BASES ACTIONS E.1 and E.2 (continued) 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Continued addition of heat to the suppression pool with suppression pool temperature > 12 0 'F could result in exceeding the design basis maximum allowable values for primary containment temperature or pressure. Furthermore, if a blowdown were to occur when the temperature was

> 120 0 F, the maximum allowable bulk and local temperatures could be exceeded very quickly.

SURVEILLANCE SR 3.6.2.1.1 REQUIREMENTS The suppression pool average temperature is regularly monitored to ensure that the required limits are satisfied.

The average temperature is determined by taking an arithmetic average of OPERABLE suppression pool water temperature channels. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The 5 minute Frequency during testing is justified by the rates at which tests will heat up the suppression pool, has been shown to be acceptable based on operating experience, and provides assurance that allowable pool temperatures are not exceeded. The Frequency is further justified in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.

REFERENCES 1. UFSAR, Section 5.2.

2. NEDC-32183P, "Power Rerate Safety Analysis Report for Peach Bottom 2 & 3," May 1993.

3. NUREG-0783.

PBAPS UNIT 3 B 3.6-52 Revision No. 87

Suppression Pool Water Level B 3.6.2.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.2 Suppression Pool Water Level BASES BACKGROUND The suppression chamber is a toroidal shaped, steel pressure vessel containing a volume of water called the suppression pool. The suppression pool is designed to absorb the energy associated with decay heat and sensible heat released during a reactor blowdown from safety/relief valve (S/RV) discharges or from a Design Basis Accident (DBA). The suppression pool must quench all the steam released through the downcomer lines during a loss of coolant accident (LOCA). This is the essential mitigative feature of a pressure suppression containment, which ensures that the peak containment pressure is maintained below the maximum allowable pressure for DBAs (56 psig). The suppression pool must also condense steam from the steam exhaust lines in the turbine driven systems (i.e., High Pressure Coolant Injection (HPCI) System and Reactor Core Isolation Cooling (RCIC) System) and provides the main emergency water supply source for the reactor vessel. The suppression pool volume ranges between 122,900 ft 3 at the low water level limit of 14.5 feet and 127,300 ft 3 at the high water level limit of 14.9 feet.

If the suppression pool water level is too low, an insufficient amount of water would be available to adequately condense the steam from the S/RV quenchers, main vents, or HPCI and RCIC turbine exhaust lines. Low suppression pool water level could also result in an inadequate emergency makeup water source to the Emergency Core Cooling System. The lower volume would also absorb less steam energy before heating up excessively. Therefore, a minimum suppression pool water level is specified.

If the suppression pool water level is too high, it could result in excessive clearing loads from S/RV discharges and excessive pool swell loads during a DBA LOCA. Therefore, a maximum pool water level is specified. This LCO specifies an acceptable range to prevent the suppression pool water level from being either too high or too low.

(continued)

PBAPS UNIT 3 B 3.6-53 Revision No. 0

Suppression Pool Water Level B 3.6.2.2 BASES (continued)

APPLICABLE Initial suppression pool water level affects suppression SAFETY ANALYSES pool temperature response calculations, calculated drywell pressure during vent clearing for a DBA, calculated pool swell loads for a DBA LOCA, and calculated loads due to S/RV discharges. Suppression pool water level must be maintained within the limits specified so that the safety analysis of Reference 1 remains valid.

Suppression pool water level satisfies Criteria 2 and 3 of the NRC Policy Statement.

LCO A limit that suppression pool water level be - 14.5 feet and

14.9 feet is required to ensure that the primary containment conditions assumed for the safety analyses are met. Either the high or low water level limits were used in the safety analyses, depending upon which is more conservative for a particular calculation.

APPLICABILITY In MODES 1, 2, and 3, a DBA would cause significant loads on the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. The requirement for maintaining suppression pool water level within limits in MODE 4 or 5 is addressed in LCO 3.5.2, "ECCS-Shutdown".

ACTIONS A.1 With suppression pool water level outside the limits, the conditions assumed for the safety analyses are not met. If water level is below the minimum level, the pressure suppression function still exists as long as main vents are covered, HPCI and RCIC turbine exhausts are covered, and S/RV quenchers are covered. If suppression pool water level is above the maximum level, protection against overpressurization still exists due to the margin in the peak containment pressure analysis and the capability of the Drywell Spray System. Therefore, continued operation for a limited time is allowed. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is sufficient to restore suppression pool water level to within limits. Also, it takes into account the low probability of an event impacting the suppression pool water level occurring during this interval.

(continued)

PBAPS UNIT 3 B 3.6-54 Revision No. 0

Suppression Pool Water Level B 3.6.2.2 BASES ACTIONS B.1 and B.2 (continued)

If suppression pool water level cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.2.2.1 REQUIREMENTS Verification of the suppression pool water level is to ensure that the required limits are satisfied. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Sections 5.2 and 14.6.3.

PBAPS UNIT 3 B 3.6-55 Revision No. 87

RHR Suppression Pool Cooling B 3.6.2.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling BASES BACKGROUND Following a Design Basis Accident (DBA), the RHR Suppression Pool Cooling System removes heat from the suppression pool.

The suppression pool is designed to absorb the sudden input of heat from the primary system. In the long term, the pool continues to absorb residual heat generated by fuel in the reactor core. Some means must be provided to remove heat from the suppression pool so that the temperature inside the primary containment remains within design limits. This function is provided by two redundant RHR suppression pool cooling subsystems. The purpose of this LCO is to ensure that both subsystems are OPERABLE in applicable MODES.

The RHR System has two loops with each loop consisting of two motor driven pumps, two heat exchangers, and associated piping and valves. There are two RHR suppression pool cooling subsystems per RHR System loop. The four RHR suppression pool cooling subsystems are manually initiated and independently controlled. The four RHR suppression pool cooling subsystems perform the suppression pool cooling function by circulating water from the suppression pool through the RHR heat exchangers and returning it to the suppression pool via the full flow test lines. Each full flow test line is common to the two RHR suppression pool cooling subsystems in an RHR System loop. The High Pressure Service Water (HPSW) System circulating through the tube side of the heat exchangers, exchanges heat with the suppression pool water and discharges this heat to the external heat sink.

The heat removal capability of one RHR pump and one heat exchanger in one subsystem is sufficient to meet the overall DBA pool cooling requirement for loss of coolant accidents (LOCAs) and transient events such as a turbine trip or stuck open safety/relief valve (S/RV). As a result, any one of the four RHR suppression pool cooling subsystems can provide the required suppression pool cooling function. S/RV leakage and High Pressure Coolant Injection System and Reactor Core Isolation Cooling System testing increase suppression pool temperature more slowly. The RHR Suppression Pool Cooling System is also used to lower the suppression pool water bulk temperature following such events.

(continued)

PBAPS UNIT 3 B 3.6-56 Revision No. 0

RHR Suppression Pool Cooling B 3.6.2.3 BASES (continued)

APPLICABLE Reference 1 contains the results of analyses used to predict SAFETY ANALYSES primary containment pressure and temperature following large and small break LOCAs. The intent of the analyses is to demonstrate that the heat removal capacity of the RHR Suppression Pool Cooling System is adequate to maintain the primary containment conditions within design limits. The suppression pool temperature is calculated to remain below the design limit.

The RHR Suppression Pool Cooling System satisfies Criterion 3 of the NRC Policy Statement.

LCO During a DBA, a minimum of one RHR suppression pool cooling subsystem is required to maintain the primary containment peak pressure and temperature below design limits (Ref. 1).

To ensure that these requirements are met, two RHR suppression pool cooling subsystems (one in each loop) must be OPERABLE with power from two safety related independent power supplies. (The two subsystems must be in separate loops since the full flow test line valves are common to both subsystems in a loop.) Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR suppression pool cooling subsystem is OPERABLE when one of the pumps, the associated heat exchanger, a HPSW System pump capable of providing cooling to the heat exchanger and associated piping, valves, instrumentation, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment and cause a heatup and pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, the RHR Suppression Pool Cooling System is not required to be OPERABLE in MODE 4 or 5.

ACTIONS A.1 With one RHR suppression pool cooling subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining RHR suppression pool cooling subsystem is adequate to perform the primary containment cooling function. However, the (continued)

PBAPS UNIT 3 B 3.6-57 Revision No. 0

RHR Suppression Pool Cooling B 3.6.2.3 BASES ACTIONS A.1 (continued) overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced primary containment cooling capability. The 7 day Completion Time is acceptable in light of the redundant RHR suppression pool cooling capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period, If one RHR suppression pool cooling subsystem is inoperable and is not restored to OPERABLE status within the required Completion Time, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 With two RHR suppression pool cooling subsystems inoperable, one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this condition, there is a substantial loss of the primary containment pressure and temperature mitigation function. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and because alternative methods to remove heat from primary containment are available.

D.1 and D.2 If the Required Action and associated Completion Time of Condition C cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PBAPS UNIT 3 B 3.6-58 Revision No. 67

RHR Suppression Pool Cooling B 3.6.2.3 BASES (continued)

SURVEILLANCE SR 3.6.2.3.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the RHR suppression pool cooling mode flow path provides assurance that the proper flow path exists for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position provided it can be aligned to the accident position within the time assumed in the accident analysis. This is acceptable since the RHR suppression pool cooling mode is manually initiated. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.2.3.2 Verifying that each required RHR pump develops a flow rate

Ž 10,000 gpm while operating in the suppression pool cooling mode with flow through the associated heat exchanger ensures that pump performance has not degraded during the cycle.

Flow is a normal test of centrifugal pump performance required by ASME Code (Ref. 3). This test confirms one point on the pump design curve, and the results are indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the Inservice Testing Program.

REFERENCES 1. UFSAR, Section 14.6.3.

2. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

3. ASME Code for Operation and Maintenance of Nuclear Power P1 ants.

PBAPS UNIT 3 B 3.6-59 Revision No. 87

RHR Suppression Pool Spray B 3.6.2.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.4 Residual Heat Removal (RHR) Suppression Pool Spray BASES BACKGROUND Following a Design Basis Accident (DBA), the RHR Suppression Pool Spray System removes heat from the suppression chamber airspace. The suppression pool is designed to absorb the sudden input of heat from the primary system from a DBA or a rapid depressurization of the reactor pressure vessel (RPV) through safety/relief valves. The heat addition to the suppression pool results in increased steam in the suppression chamber, which increases primary containment pressure. Steam blowdown from a DBA can also bypass the suppression pool and end up in the suppression chamber airspace. Some means must be provided to remove heat from the suppression chamber so that the pressure and temperature inside primary containment remain within analyzed design limits. This function is provided by two redundant RHR suppression pool spray subsystems. The purpose of this LCO is to ensure that both subsystems are OPERABLE in applicable MODES.

The RHR System has two loops with each loop consisting of two motor driven pumps, two heat exchangers, and associated piping and valves. There are two RHR suppression pool spray subsystems per RHR System loop. The four RHR suppression pool spray subsystems are manually, initiated and independently controlled. The four RHR suppression pool spray subsystems perform the suppression pool spray function by circulating water from the suppression pool through the RHR heat exchangers and returning it to the suppression pool spray spargers. Each suppression pool spray sparger line is common to the two RHR suppression pool spray subsystems in an RHR System loop. The spargers only accommodate a small portion of the total RHR pump flow; the remainder of the flow returns to the suppression pool through the suppression pool cooling return line. Thus, both suppression pool cooling and suppression pool spray functions are performed when the Suppression Pool Spray System is initiated. High Pressure Service Water, circulating through the tube side of the heat exchangers, exchanges heat with the suppression pool water and discharges this heat to the external heat (continued)

PBAPS UNIT 3 B 3.6-60 Revision No. 0

RHR Suppression Pool Spray B 3.6.2.4 BASES BACKGROUND sink. Any one of the four RHR suppression pool spray (continued) subsystems is sufficient to condense the steam from small bypass leaks from the drywell to the suppression chamber airspace during the postulated DBA.

APPLICABLE Reference I contains the results of analyses used to predict SAFETY ANALYSES primary containment pressure and temperature following large and small break loss of coolant accidents. The intent of the analyses is to demonstrate that the pressure reduction capacity of the RHR Suppression Pool Spray System is adequate to maintain the primary containment conditions within design limits. The time history for primary containment pressure is calculated to demonstrate that the maximum pressure remains below the design limit.

The RHR Suppression Pool Spray System satisfies Criterion 3 of the NRC Policy Statement.

LCO In the event of a DBA, a minimum of one RHR suppression pool spray subsystem is required to mitigate potential bypass leakage paths and maintain the primary containment peak pressure below the design limits (Ref. 1). To ensure that these requirements are met, two RHR suppression pool spray subsystems (one in each loop) must be OPERABLE with power from two safety related independent power supplies. (The two subsystems must be in separate loops since the suppression pool spray sparger line valves are common to both subsystems in a loop.) Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR suppression pool spray subsystem is OPERABLE when one of the pumps, the associated heat exchanger, a HPSW System pump capable of providing cooling to the heat exchanger and associated piping, valves, instrumentation, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining RHR suppression pool spray subsystems OPERABLE is not required in MODE 4 or 5.

(continued)

PBAPS UNIT 3 B 3.6-61 Revision No. 0

RHR Suppression Pool Spray B 3.6.2.4 BASES (continued)

ACTIONS A.1 With one RHR suppression pool spray subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE RHR suppression pool spray subsystem is adequate to perform the primary containment bypass leakage mitigation function.

However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced primary containment bypass mitigation capability. The 7 day Completion Time was chosen in light of the redundant RHR suppression pool spray capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.

With both RHR suppression pool spray subsystems inoperable, at least one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this Condition, there is a substantial loss of the primary containment bypass leakage mitigation function. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and because alternative methods to remove heat from primary containment are available.

C.1 If the inoperable RHR suppression pool spray subsystem(s) cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PBAPS UNIT 3 B 3.6-62 Revision No. 67

RHR Suppression Pool Spray B 3.6.2.4 BASES (continued)

SURVEILLANCE SR 3.6.2.4.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the RHR suppression pool spray mode flow path provides assurance that the proper flow paths will exist for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position provided it can be aligned to the accident position within the time assumed in the accident analysis. This is acceptable since the RHR suppression pool cooling mode is manually initiated. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.2.4.2 This Surveillance is performed to verify that the spray nozzles are not obstructed and that flow will be provided when required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Sections 5.2 and 14.6.3.

2. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.6-63 Revision No. 87

RHR Drywell Spray B 3.6.2.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.5 Residual Heat Removal (RHR) Drywell Spray BASES BACKGROUND Drywell Spray is a mode of the RHR system which may be initiated under post accident conditions to reduce the temperature and pressure of the primary containment atmosphere. The Drywell Spray function is credited in design basis analyses to limit peak drywell temperature following a steam line break inside of the Drywell and may be used to mitigate other loss of coolant accidents inside of the Drywell. This function is provided by two redundant Drywell Spray subsystems. The purpose of this LCO is to ensure that both subsystems are OPERABLE in applicable MODES.

The RHR System has two loops with each loop consisting of two motor driven pumps, two heat exchangers, and associated piping and valves. There are two RHR Drywell spray subsystems per RHR System loop. The four RHR drywell spray subsystems are manually, initiated and independently controlled. The four RHR drywell spray subsystems perform the drywell spray function by circulating water from the suppression pool through the RHR heat exchangers and discharging the cooled suppression pool water into the drywell air space through the drywell spray sparger and spray nozzles. The spray then effects a temperature and pressure reduction through the combined effects of evaporative and convective cooling, depending on the drywell atmosphere. If the atmosphere is superheated, a rapid evaporative cooling process will ensue. If the environment in the drywell is saturated, temperature and pressure will be reduced via a convective cooling process.

Each drywell spray sparger line is common to the two RHR drywell spray subsystems in an RHR System loop. If required, a small portion of the spray flow can be directed to the suppression pool spray sparger and spray nozzles.

High Pressure Service Water, circulating through the tube side of the heat exchangers, exchanges heat with the suppression pool water on the shell side of the heat exchangers and discharges this heat to the external heat sink.

(continued)

PBAPS UNIT 3 B 3.6-63a Revision No. 106 I

RHR Drywell Spray B 3.6.2.5 BASES (continued)

APPLICABLE Reference 2 contains the results of analyses used to SAFETY ANALYSES predict primary containment pressure and temperature response following a spectrum of small steam line break sizes. Steam line breaks are the most limiting events for drywell temperature response, since steam has higher energy content than liquid. These analyses, with primary focus on the drywell temperature response, take credit for containment sprays and structural heat sinks in the drywell and the suppression pool airspace. These analyses demonstrate that, with credit for containment spray (drywell and suppression pool), drywell temperature is maintained within limits for Environmental Qualification (EQ) of equipment located in the drywell for the analyzed spectrum of small steam line breaks. The RHR Drywell Spray System satisfies Criterion 3 of the NRC Policy Statement.

LCO In the event of a small steam line break in the drywell, a minimum of one RHR drywell spray subsystem is credited in design analyses to mitigate the rise in drywell temperature and pressure caused by the steam line break, and to maintain the primary containment peak temperature and pressure below the design limits (Ref. 2). To ensure that these requirements are met, two RHR drywell spray subsystems (one in each loop) must be OPERABLE with power from two safety related independent power supplies. (The two subsystems must be in separate loops since the drywell spray sparger line valves are common to both subsystems in a loop.) Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR drywell spray subsystem is OPERABLE when one of the pumps, the associated heat exchanger, a HPSW System pump capable of providing cooling to the heat exchanger and associated piping, valves, instrumentation, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a steam line break in the drywell could cause a rise in primary containment temperature and pressure. In MODES 4 and 5, the probability and consequences of steam line breaks are reduced due to the pressure and temperature limitations in these MODES.

Therefore, maintaining RHR drywell spray subsystems OPERABLE is not required in MODE 4 or 5.

(continued)

PBAPS UNIT 3 B 3.6-63b Revision No. 106 I

RHR Drywell Spray B 3.6.2.5 BASES (continued)

ACTIONS A.1 With one RHR drywell spray subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE RHR drywell spray subsystem is adequate to mitigate the effects of a steam line break in the drywell. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced ability to mitigate the temperature rise associated with a steam line break in the drywell, for which drywell sprays are credited. The 7 day Completion Time was chosen in light of the redundant RHR drywell spray capabilities afforded by the OPERABLE subsystem and the low probability of a steam line break in the drywell occurring during this period.

B.1 With both RHR drywell spray subsystems inoperable, at least one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this Condition, there is a substantial loss of the ability to mitigate the temperature rise associated with a steam line break in the drywell, for which drywell sprays are credited. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a steam line break in the drywell and because alternative methods to remove heat from primary containment are available.

C.1 and C.2 If the inoperable RHR drywell spray subsystem(s) cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PBAPS UNIT 3 B 3.6-63c Revision No. 106 1

RHR Drywell Spray B 3.6.2.5 BASES (continued)

SURVEILLANCE SR 3.6.2.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the RHR drywell spray mode flow path provides assurance that the proper flow paths will exist for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position provided it can be aligned to the acciden.t position within the time assumed in the accident analysis. This is acceptable since the RHR drywell mode is manually initiated. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.2.5.2 This Surveillance is performed to verify that the spray nozzles are not obstructed and that flow will be provided when required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Sections 5.2 and 14.6.3.

2. GE-NE-O000-O011-4483, Project Task Report, Peach Bottom Atomic Power Station, Units 2 and 3, SIL 636 Evaluation.

PBAPS UNIT 3 B 3.6-63d Revision No. 106 I

CAD System B 3.6.3.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.3.1 Deleted THE INFORMATION FROM THIS TECHNICAL SPECIFICATIONS BASES SECTION HAS BEEN DELETED. TECHNICAL SPECIFICATIONS BASES PAGES B 3.6-65 THROUGH B 3.6-69 HAVE BEEN INTENTIONALLY OMITTED.

PBAPS UNIT 3 B 3.6-64 Revision No. 81

Primary Containment Oxygen Concentration B 3.6.3.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.3.2 Primary Containment Oxygen Concentration BASES BACKGROUND All nuclear reactors must be designed to withstand events that generate hydrogen either due to the zirconium metal water reaction in the core or due to radiolysis. The primary method to control hydrogen is to inert the primary containment. With the primary containment inert, that is, oxygen concentration < 4.0 volume percent (v/o), a combustible mixture cannot be present in the primary containment for any hydrogen concentration. The capability to inert the primary containment and maintain oxygen

< 4.0 v/o works together with the Containment Atmospheric Dilution (CAD) System to provide redundant and diverse I methods to mitigate events that produce hydrogen. For example, an event that rapidly generates hydrogen from zirconium metal water reaction will result in excessive hydrogen in primary containment, but oxygen concentration will remain < 4.0 v/o and no combustion can occur. Long term generation of both hydrogen and oxygen from radiolytic decomposition of water may eventually result in a combustible mixture in primary containment, except that the CAD System dilutes and removes hydrogen and oxygen gases faster than they can be produced from radiolysis and again no combustion can occur. This LCO ensures that oxygen concentration does not exceed 4.0 v/o during operation in the applicable conditions.

APPLICABLE The Reference 1 calculations assume that the primary SAFETY ANALYSES containment is inerted when a Design Basis Accident loss of coolant accident occurs. Thus, the hydrogen assumed to be released to the primary containment as a result of metal water reaction in the reactor core will not produce combustible gas mixtures in the primary containment.

Oxygen, which is subsequently generated by radiolytic decomposition of water, is diluted and removed by the CAD System more rapidly than it is produced.

Primary containment oxygen concentration satisfies Criterion 2 of the NRC Policy Statement.

(continued)

PBAPS UNIT 3 B 3.6-70 Revision No. 81

Primary Containment Oxygen Concentration B 3.6.3.2 BASES (continued)

LCO The primary containment oxygen concentration is maintained

< 4.0 v/o to ensure that an event that produces any amount of hydrogen does not result in a combustible mixture inside primary containment.

APPLICABILITY The primary containment oxygen concentration must be within the specified limit when primary containment is inerted, except as allowed by the relaxations during startup and shutdown addressed below. The primary containment must be inert in MODE 1, since this is the condition with the highest probability of an event that could produce hydrogen.

Inerting the primary containment is an operational problem because it prevents containment access without an appropriate breathing apparatus. Therefore, the primary containment is inerted as late as possible in the plant startup and de-inerted as soon as possible in the plant shutdown. As long as reactor power is < 15% RTP, the potential for an event that generates significant hydrogen is low and the primary containment need not be inert.

Furthermore, the probability of an event that generates hydrogen occurring within the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of a startup, or within the last 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months before a shutdown, is low enough that these "windows," when the primary containment is not inerted, are also justified. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months time period is a reasonable amount of time to allow plant personnel to perform inerting or de-inerting.

ACTIONS A.__

If oxygen concentration is ! 4.0 v/o at any time while operating in MODE 1, with the exception of the relaxations allowed during startup and shutdown, oxygen concentration must be restored to < 4.0 v/o within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is allowed when oxygen concentration is 2 4.0 v/o because of the availability of other hydrogen mitigating systems (e.g., the CAD System) and the low probability and long duration of an event that would generate significant amounts of hydrogen occurring during this period.

(continued)

PBAPS UNIT 3 B 3.6-71 Revision No. 0

Primary Containment Oxygen Concentration B 3.6.3.2 BASES ACTIONS B.1 (continued)

If oxygen concentration cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, power must be reduced to _< 15% RTP within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable, based on operating experience, to reduce reactor power from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.3.2.1 REQUIREMENTS The primary containment (drywell and suppression chamber) must be determined to be inert by verifying that oxygen concentration is < 4.0 v/o. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 5.2.3.9.5.

PBAPS UNIT 3 B 3.6-72 Revision No. 87

Secondary Contai nment B 3.6.4.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.1 Secondary Containment BASES BACKGROUND The function of the secondary containment is to contain and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA). In conjunction with operation of the Standby Gas Treatment (SGT) System and closure of certain valves whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be OPERABLE, or that take place outside primary containment.

The secondary containment is a structure that completely encloses the primary containment and those components that may be postulated to contain primary system fluid. This structure forms a control volume that serves to hold up and dilute the fission products. It is possible for the pressure in the control volume to rise relative to the environmental pressure (e.g., due to pump and motor heat load additions). To prevent ground level exfiltration whil.e allowing the secondary containment to be designed as a conventional structure, the secondary containment requires support systems to maintain the control volume pressure at less than the external pressure. Requirements for these systems are specified separately in LCO 3.6.4.2, "Secondary Containment Isolation Valves (SCIVs)," and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System."

APPLICABLE There are two principal accidents for which credit is taken SAFETY ANALYSES for secondary containment OPERABILITY. These are a loss of coolant accident (LOCA) (Ref. 1) and a fuel handling accident inside secondary containment (Ref. 2) involving RECENTLY IRRADIATED FUEL. The secondary containment performs no active function in response to each of these limiting events; (continued)

PBAPS UNIT 3 B 3.6-73 Revision No. 76

Secondary Containment B 3.6.4.1 BASES APPLICABLE however, its leak tightness is required to ensure that fission SAFETY ANALYSES products entrapped within the secondary containment structure (continued) will be treated by the SGT System prior to discharge to the environment.

Secondary containment satisfies Criterion 3 of the NRC Policy Statement.

LCO An OPERABLE secondary containment provides a control volume into which fission products that leak from primary containment, or are released from the reactor coolant pressure boundary components located in secondary containment, can be processed prior to release to the environment. For the secondary containment to be considered OPERABLE, it must have adequate leak tightness to ensure that the required vacuum can be established and maintained.

APPLICABILITY In MODES 1, 2, and 3, a LOCA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, secondary containment OPERABILITY (IO is required during the same operating conditions that require primary containment OPERABILITY.

In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining secondary containment OPERABLE is not required in MODE 4 or 5, except for other situations for which significant releases of radioactive material can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs), or during movement of RECENTLY IRRADIATED FUEL assemblies in the secondary containment. However, outside ground level hatches (hatches H20 through H24 and Torus room access hatch H34) may not be opened during movement of irradiated fuel. This will maintain CR dose acceptable.

ACTIONS A.1 If secondary containment is inoperable, it must be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring secondary containment OPERABILITY) occurring during periods where secondary containment is inoperable is minimal.

(continued)

PBAPS UNIT 3 B 3.6-74 Revision No. 76

Secondary Containment B 3.6.4.1 BASES ACTIONS B.1 (continued)

If secondary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 Movement of RECENTLY IRRADIATED FUEL assemblies in the secondary containment and OPDRVs can be postulated to cause fission product release to the secondary containment. In such cases, the secondary containment is the only barrier to release of fission products to the environment. Therefore, movement of RECENTLY IRRADIATED FUEL assemblies must be immediately suspended if the secondary containment is inoperable.

Suspension of these activities shall not preclude completing an action that involves moving a component to a safe position. Also, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

Required Action C.1 has been modified by a Note stating that LCO 3.0.3 is not applicable, since the movement of RECENTLY IRRADIATED FUEL can only be performed in MODES 4 and 5.

(continued)

PBAPS UNIT 3 B 3.6-75 Revision No. 76

Secondary Containment B 3.6.4.1 BASES (continued)

SURVEILLANCE SR 3.6.4.1.1 and SR 3.6.4.1.2 REQUIREMENTS Verifying that secondary containment equipment hatches and one access door in each access opening are closed ensures that the infiltration of outside air of such a magnitude as to prevent maintaining the desired negative pressure does not occur. Verifying that all such openings are closed provides adequate assurance that exfiltration from the secondary containment will not occur. In this application, the term "sealed" has no connotation of leak tightness.

Maintaining secondary containment OPERABILITY requires verifying one door in the access opening is closed. An access opening contains one inner and one outer door. In some cases, secondary containment access openings are shared such that a secondary containment barrier may have multiple inner or multiple outer doors. The intent is to not breach secondary containment at any time when secondary containment is required. This is achieved by maintaining the inner or outer portion of the barrier closed at all times. However, all secondary containment access doors are normally kept closed, except when the access opening is being used for entry and exit or when maintenance is being performed on an access opening. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.4.1.3 and SR 3.6.4.1.4 The SGT System exhausts the secondary containment atmosphere to the environment through appropriate treatment equipment.

Each SGT subsystem is designed to draw down pressure in the secondary containment to Ž 0.25 inches of vacuum water gauge in

180 seconds and maintain pressure in the secondary containment at Ž 0.25 inches of vacuum water gauge for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months at a flow rate

10,500 cfm. To ensure that all fission products released to the secondary containment are treated, SR 3.6.4.1.3 and SR 3.6.4.1.4 verify that a pressure in the secondary containment this is less than the lowest postulated pressure external to the secondary containment boundary can rapidly be established and maintained. When the SGT System is operating as designed, the establishment and maintenance of secondary containment pressure cannot be accomplished if the secondary containment boundary is not intact.

Establishment of this pressure is confirmed by SR 3.6.4.1.3 which demonstrates that the secondary containment can be drawn down to Ž 0.25 inches of vacuum water gauge in

180 (continued)

PBAPS UNIT 3 B 3.6-76 Revision No. 87

Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR 3.6.4.1.3 and SR 3.6.4.1.4 (continued)

REQUIREMENTS seconds using one SGT subsystem. SR 3.6.4.1.4 demonstrates that the pressure in the secondary containment can be maintained Ž 0.25 inches of vacuum water gauge for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months using one SGT subsystem at a flow rate

10,500 cfm. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months test period allows secondary containment to be in thermal equilibrium at steady state conditions. The primary purpose of these SRs is to ensure secondary containment boundary integrity. The secondary purpose of these SRs is to ensure that the SGT subsystem being tested functions as designed. There is a Separate LCO with Surveillance Requirements which serves the primary purpose of ensuring OPERABLITY of the SGT System. The inoperability of a SGT subsystem does not necessarily constitute a failure of these Surveillances relative to the secondary containment OPERABILITY. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 14.6.3.

2. UFSAR, Section 14.6.4.

3 NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.6-77 Revision No. 97

SCIVs B 3.6.4.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.2 Secondary Containment Isolation Valves (SCIVs)

BASES BACKGROUND The function of the SCIVs, in combination with other accident mitigation systems, is to control fission product release during and following postulated Design Basis Accidents (DBAs) (Refs. 1 and 2). Secondary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that fission products that leak from primary containment following a DBA, or that are released during certain operations when primary containment is not required to be OPERABLE or take place outside primary containment, are maintained within the secondary containment boundary.

The OPERABILITY requirements for SCIVs help ensure that an adequate secondary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. These isolation devices consist of either passive devices or active (automatic) devices. Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), and blind flanges are considered passive devices.

Automatic SCIVs close on a secondary containment isolation signal to establish a boundary for untreated radioactive material within secondary containment following a DBA or other accidents.

Other penetrations are isolated by the use of valves in the closed position or blind flanges.

APPLICABLE The SCIVs must be OPERABLE to ensure the secondary SAFETY ANALYSES containment barrier to fission product releases is established. The principal accidents for which the secondary containment boundary is required are a loss of coolant accident (Ref. 1) and a fuel handling accident inside secondary containment (Ref. 2) involving RECENTLY IRRADIATED FUEL. The secondary containment performs no active function in response to either of these limiting events, but the (continued)

PBAPS UNIT 3 B 3.6-78 Revision No. 76

SCIVs B 3.6.4.2 BASES APPLICABLE boundary established by SCIVs is required to ensure that SAFETY ANALYSES leakage from the primary containment is processed by the (continued) Standby Gas Treatment (SGT) System before being released to the environment.

Maintaining SCIVs OPERABLE with isolation times within limits ensures that fission products will remain trapped inside secondary containment so that they can be treated by the SGT System prior to discharge to the environment.

SCIVs satisfy Criterion 3 of the NRC Policy Statement.

LCO SCIVs form a part of the secondary containment boundary.

The SCIV safety function is related to control of offsite radiation releases resulting from DBAs.

The power operated automatic isolation valves are considered OPERABLE when their isolation times are within limits and the valves actuate on an automatic isolation signal. The valves covered by this LCO, along with their associated stroke times, are listed in Reference 2.

The normally closed isolation valves or blind flanges are considered OPERABLE when manual valves are closed or open in accordance with appropriate administrative controls, automatic SCIVs are de-activated and secured in their closed position, and blind flanges are in place. These passive isolation valves or devices are listed in Reference 2.

APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to the primary containment that leaks to the secondary containment. Therefore, the OPERABILITY of SCIVs is required.

in MODES 4 and 5, the probability and consequences of these events are reduced due to pressure and temperature limitations in these MODES. Therefore, maintaining SCIVs OPERABLE is not required in MODE 4 or 5, except for other situations under which significant radioactive releases can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs) or during movement of RECENTLY IRRADIATED FUEL assemblies in the secondary containment. SCIVs are only required to be OPERABLE during handling RECENTLY IRRADIATED FUEL. Moving irradiated fuel assemblies in the secondary containment may also occur in MODES 1, 2, and 3.

(continued)

PBAPS UNIT 3 B 3.6-79 Revision No. 76

SCIVs B 3.6.4.2 BASES (continued)

ACTIONS The ACTIONS are modified by three Notes. The first Note allows penetration flow paths to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated.

The second Note provides clarification that for the purpose of this LCO separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SCIV. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SCIVs are governed by subsequent Condition entry and application of associated Required Actions.

The third Note ensures appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable SCIV.

A.1 and A.2 In the event that there are one or more penetration flow paths with one SCIV inoperable, the affected penetration flow path(s) must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and de-activated automatic SCIV, a closed manual valve, and a blind flange. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available device to secondary containment. The Required Action must be completed within the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time. The specified time period is reasonable considering the time required to isolate the penetration, and the probability of a DBA, which requires the SCIVs to close, occurring during this short time is very low.

For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that secondary (continued)

PBAPS UNIT 3 B 3.6-80 Revision No. 0

SCIVs B 3.6.4.2 BASES ACTIONS A.1 and A.2 (continued) containment penetrations required to be isolated following an accident, but no longer capable of being automatically isolated, will be in the isolation position should an event occur. The Completion Time of once per 31 days is appropriate because the isolation devices are operated under administrative controls and the probability of their misalignment is low. This Required Action does not require any testing or device manipulation. Rather, it involves verification that the affected penetration remains isolated.

Required Action A.2 is modified by two Notes. Note I applies to devices located in high radiation areas and allows them to be verified closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.

B.1 With two SCIVs in one or more penetration flow paths inoperable, the affected penetration flow path must be isolated within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable considering the time required to isolate the penetration and the probability of a DBA, which requires the SCIVs to close, occurring during this short time, is very low.

The Condition has been modified by a Note stating that Condition B is only applicable to penetration flow paths with two isolation valves. This clarifies that only Condition A is entered if one SCIV is inoperable in each of two penetrations.

(continued)

PBAPS UNIT 3 B 3.6-81 Revision No. 58

SCIVs B 3.6.4.2 BASES ACTIONS C.1 and C.2 (continued)

If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1 and D.2 If any Required Action and associated Completion Time are not met, the plant must be placed in a condition in which the LCO does not apply. If applicable, the movement of RECENTLY IRRADIATED FUEL assemblies in the secondary containment must be immediately suspended. Suspension of this activity shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be immediately initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

Required Action D.1 has been modified by a Note stating that LCO 3.0.3 is not applicable, since the movement of RECENTLY IRRADIATED FUEL can only be performed in MODES 4 and 5.

SURVEILLANCE SR 3.6.4.2.1 REQUIREMENTS This SR verifies that each secondary containment manual isolation valve and blind flange that is not locked, sealed, or otherwise secured and is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the secondary containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification that those SCIVs in secondary containment that are capable of being mispositioned are in the correct position.

(continued)

PBAPS UNIT 3 B 3.6-82 Revision No. 76

SCIVs B 3.6.4.2 BASES SURVEILLANCE SR 3.6.4.2.1 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

Two Notes have been added to this SR. The first Note applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing *verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these SCIVs, once they have been verified to be in the proper position, is low.

A second Note has been included to clarify that SCIVs that are open under administrative controls are not required to meet the SR during the time the SCIVs are open.

SR 3.6.4.2.2 Verifying that the isolation time of each power operated automatic SCIV is within limits is required to demonstrate OPERABILITY. The isolation time test ensures that the SCIV will isolate in a time period less than or equal to that assumed in the safety analyses. The Frequency of this SR is in accordance with the Inservice Testing Program.

SR 3.6.4.2.3 Verifying that each automatic SCIV closes on a secondary containment isolation signal is required to prevent leakage of radioactive material from secondary containment following a DBA or other accidents. This SR ensures that each automatic SCIV will actuate to the isolation position on a secondary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.6.2, "Secondary Containment Isolation Instrumentation," overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.6-83 Revision No. 87

SCIVs B 3.6.4.2 BASES (continued)

REFERENCES 1. UFSAR, Section 14.9.2.

2. Technical Requirements Manual.

PBAPS UNIT 3 B 3.6-84 Revision No. 87

SGT System B 3.6.4.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.3 Standby Gas Treatment (SGT) System BASES BACKGROUND The SGT System is required by UFSAR design criteria (Ref. 1). The function of the SGT System is to ensure that radioactive materials that leak from the primary containment into the secondary containment following a Design Basis Accident (DBA) are filtered and adsorbed prior to exhausting to the environment.

A single SGT System is common to both Unit 2 and Unit 3 and consists of two fully redundant subsystems, each with its own set of ductwork, dampers-, valves, charcoal filter train, and controls. Both SGT subsystems share a common inlet plenum. This inlet plenum is connected to the refueling floor ventilation exhaust duct for each Unit and to the suppression chamber and drywell of each Unit. Both SGT subsystems exhaust to the plant offgas stack through a common exhaust duct served by three 100% capacity system fans. SGT System fans OAV020 and OBV020 automatically start on Unit 2 secondary containment isolation signals. SGT System fans OCV020 and OBV020 automatically start on Unit 3 secondary containment isolation signals.

Each charcoal filter train consists of (components listed in order of the direction of the air flow):

a. A demister or moisture separator;

b. An electric heater;

c. A prefilter;

d. A high efficiency particulate air (HEPA) filter;

e. A charcoal adsorber; and

f. A second HEPA filter.

The SGT System is sized such that each 100% capacity fan will provide a flow rate of 10,500 cfm at 20 inches water gauge static pressure to support the control of fission product releases. The SGT System is designed to restore and maintain secondary containment at a negative pressure of 0.25 inches water gauge relative to the atmosphere following (continued)

PBAPS UNIT 3 B 3.6-85 Revision No. 0

SGT System B 3.6.4.3 BASES BACKGROUND the receipt of a secondary containment isolation signal.

(continued) Maintaining this negative pressure is based upon the existence of calm wind conditions (up to 5 mph), a maximum SGT System flow rate of 10,500 cfm, outside air temperature of 95°F and a temperature of 150°F for air entering the SGT System from inside secondary containment.

The demister is provided to remove entrained water in the air, while the electric heater reduces the relative humidity of the airstream to less than 70% (Ref. 2). The prefilter removes large particulate matter, while the HEPA filter removes fine particulate matter and protects the charcoal from fouling. The charcoal adsorber removes gaseous elemental iodine and organic iodides, and the final HEPA filter collects any carbon fines exhausted from the charcoal adsorber.

The SGT System automatically starts and operates in response to actuation signals indicative of conditions or an accident that could require operation of the system. Following initiation, two charcoal filter train fans (OCV020 and OBV020) start. Upon verification that both subsystems are operating, the redundant subsystem is normally shut down.

APPLICABLE The design basis for the SGT System is to mitigate the SAFETY ANALYSES consequences of a loss of coolant accident and fuel handling accidents (Ref. 2). For all events analyzed, the SGT System is shown to be automatically initiated to reduce, via filtration and adsorption, the radioactive material released to the environment.

The SGT System satisfies Criterion 3 of the NRC Policy Statement.

LCO Following a DBA, a minimum of one SGT subsystem is required to maintain the secondary containment at a negative pressure with respect to the environment and to process gaseous releases. Meeting the LCO requirements for two OPERABLE subsystems ensures operation of at least one SGT subsystem in the event of a single active failure.

(continued)

PBAPS UNIT 3 B 3.6-86 Revision No. 0

SGT System B 3.6.4.3 BASES LCO For Unit 3, one SGT subsystem is OPERABLE when one charcoal (continued) filter train, one fan (OCV020) and associated ductwork, dampers, valves, and controls are OPERABLE. The second SGT subsystem is OPERABLE when the other charcoal filter train, one fan (OBV020) and associated ductwork, damper, valves, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, SGT System OPERABILITY is required during these MODES.

In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the SGT System in OPERABLE status is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs) or during movement of RECENTLY IRRADIATED FUEL assemblies in the secondary containment. The SGT System is only required to be OPERABLE during OPRDVs or handling of RECENTLY IRRADIATED FUEL.

ACTIONS A.1 With one SGT subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status in 7 days. In this Condition, the remaining OPERABLE SGT subsystem is adequate to perform the required radioactivity release control function. However, the overall system reliability is reduced because a single failure in the OPERABLE subsystem could result in the radioactivity release control function not being adequately performed. The 7 day Completion Time is based on consideration of such factors as the availability of the OPERABLE redundant SGT subsystem and the low probability of a DBA occurring during this period.

If the SGT subsystem cannot be restored to OPERABLE status within the required Completion Time in MODE 1, 2, or 3, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the (cnntiniipd)

PBAPS UNIT 3 B 3.6-87 Revision No. 76

SGT System B 3.6.4.3 BASES ACTIONS B.1 (continued)

Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1, C.2.1 and C.2.2 During movement of RECENTLY IRRADIATED FUEL assemblies, in the secondary containment or during OPDRVs, when Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE SGT subsystem should immediately be placed in operation. This action ensures that the remaining subsystem is OPERABLE, that no failures that could prevent automatic actuation have occurred, and that any other failure would be readily detected.

An alternative to Required Action C.1 is to immediately suspend activities that represent a potential for releasing radioactive material to the secondary containment, thus placing the plant in a condition that minimizes risk. If applicable, movement of RECENTLY IRRADIATED FUEL assemblies must immediately be suspended. Suspension of this activity must not preclude completion of movement of a component to a safe position. Also, if applicable, actions must immediately be initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

.The Required Actions of Condition C have been modified by a Note stating that LCO 3.0.3 is not applicable, since the movement of RECENTLY IRRADIATED FUEL can only be performed in MODES 4 and 5.

(continued)

PBAPS UNIT 3 B 3.6-88 Revision No. 76

SGT System B 3.6.4.3 BASES ACTIONS D.1 (continued)

If both SGT subsystems are inoperable in MODE 1, 2, or 3, the SGT System may not be capable of supporting the required radioactivity release control function. Therefore, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.1 and E.2 When two SGT subsystems are inoperable, if applicable, movement of RECENTLY IRRADIATED FUEL assemblies in secondary containment must immediately be suspended. Suspension of this activity shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must immediately be initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

Required Action E.1 has been modified by a Note stating that LCO 3.0.3 is not applicable, since the movement of RECENTLY IRRADIATED FUEL can only be performed in MODES 4 and 5.

SURVEILLANCE SR 3.6.4.3.1 REQUIREMENTS Operating each SGT subsystem (including each filter train fan) for 2 15 minutes ensures that both subsystems are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. Operation with the heaters on (automatic heater cycling to maintain temperature) for Ž 15 minutes periodically is sufficient to eliminate moisture on the adsorbers and HEPA filters since during idle periods instrument air is injected into the filter plenum to keep the filters dry. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.6-89 Revision No. 87

SGT System B 3.6.4.3 BASES SURVEILLANCE SR 3.6.4.3.2 REQUIREMENTS (continued) This SR verifies that the required SGT filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations).

Specific test frequencies and additional information are discussed in detail in the VFTP.

SR 3.6.4.3.3 This SR verifies that each SGT subsystem starts on receipt of an actual or simulated initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.6.2, "Secondary Containment Isolation Instrumentation," overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 1.5.1.6.

2. UFSAR, Section 14.9.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.6-90 Revision No. 87

HPSW System B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 High Pressure Service Water (HPSW) System BASES BACKGROUND The HPSW System is designed to provide cooling water for the Residual Heat Removal (RHR) System heat exchangers, required for a safe reactor shutdown following a Design Basis Accident (DBA) or transient. The HPSW System is operated whenever the RHR heat exchangers are required to operate in the shutdown cooling mode or in the suppression pool cooling or spray mode of the RHR System.

The HPSW System consists of two independent and redundant loops. Each loop is made up of a header, two 4500 gpm pumps, a suction source, valves, piping and associated instrumentation. Either of the two loops is capable of providing the required cooling capacity with one pump operating to maintain safe shutdown conditions. Therefore, there are two HPSW subsystems with each subsystem consisting of a HPSW loop with one OPERABLE HPSW pump in the loop. The two subsystems are separated from each other by normally closed motor operated cross tie valves, so that failure of one subsystem will not affect the OPERABILITY of the other subsystem. A line connecting the HPSW System of each unit is also provided. Separation of the two units HPSW Systems is provided by a series of two locked closed, manually operated valves. The HPSW System is designed with sufficient redundancy so that no single active component failure can prevent it from achieving its design function.

The HPSW System is described in the UFSAR, Section 10.7, Reference 1.

Normal cooling water is pumped by the HPSW pumps from the Conowingo Pond through the tube side of the RHR heat exchangers, and discharges to the discharge pond. The required level for the HPSW pumps in the pump bay of the pump structure is Ž 98.5 ft Conowingo Datum (CD) and

113 ft CD. The minimum level ensures net positive suction head and the maximum level corresponds to the level in the pump bay with water solid up to the motor baseplate. An alternate supply and discharge path (from the emergency heat sink) is available in the unlikely event the Conowingo dam fails or the pond floods. This lineup, however, has to be manually aligned.

(continued)

PBAPS UNIT 3 B 3.7-1 Revision No. 89

HPSW System B 3.7.1 BASES BACKGROUND The system is initiated manually from the control room. If (continued) operating during a loss of coolant accident (LOCA), the system is automatically tripped to allow the diesel generators to automatically power only that equipment necessary to reflood the core. The system is assumed in the analysis to be manually started 10 minutes after the LOCA.

The RHR System design permits the system to be initiated as early as 5 minutes after LPCI initiation.

APPLICABLE The HPSW System removes heat from the suppression pool to SAFETY ANALYSES limit the suppression pool temperature and primary containment pressure following a LOCA. This ensures that the primary containment can perform its function of limiting the release of radioactive materials to the environment following a LOCA. The ability of the HPSW System to support long term cooling of the reactor or primary containment is discussed in References 2 and 3. These analyses explicitly assume that the HPSW System will provide adequate cooling support to the equipment required for safe shutdown. These analyses include the evaluation of the long term primary containment response after a design basis LOCA.

The safety analyses for long term cooling were performed for various combinations of RHR System failures. The worst case single failure that would affect the performance of the HPSW System is any failure that would disable one loop of the HPSW System. As discussed in the UFSAR, Section 14.6.3 (Ref. 4) for these analyses, manual initiation of the OPERABLE HPSW subsystem and the associated RHR System is assumed to occur 10 minutes after a DBA. The HPSW flow assumed in the analyses is 4500 gpm with one pump operating in one loop, providing flow through one RHR heat exchanger.

In this case, the maximum suppression chamber water temperature and pressure are 206°F and approximately 33 psig, respectively, well below the design temperature of 281=F and maximum allowable pressure of 56 psig.

The HPSW System satisfies Criterion 3 of the NRC Policy Statement.

LCO Two HPSW subsystems are required to be OPERABLE to provide the required redundancy to ensure that the system functions to remove post accident heat loads, assuming the worst case single active failure occurs coincident with the loss of offsite power.

(continued)

PBAPS UNIT 3 B 3.7-2 Revision No. 0

HPSW System B 3.7.1 BASES LCO A HPSW subsystem is considered OPERABLE when:

(continued)

a. One pump is OPERABLE; and

b. An OPERABLE flow path is capable of taking suction from the pump structure and transferring the water to the required RHR heat exchanger at the assumed flow rate.

An adequate suction source is not addressed in this LCO since the minimum net positive suction head (98.5 ft Conowingo Datum (CD) in the pump bay) and normal heat sink temperature requirements are bounded by the emergency service water pump and normal heat sink requirements (LCO 3.7.2, "Emergency Service Water (ESW) System and Normal Heat Sink").

APPLICABILITY In MODES 1, 2, and 3, the HPSW System is required to be OPERABLE to support the OPERABILITY of the RHR System for primary containment cooling (LCO 3.6.2.3, "Residual Heat Removal (RHR) Suppression Pool Cooling," and LCO 3.6.2.4, "Residual Heat Removal (RHR) Suppression Pool Spray") and decay heat removal (LCO 3.4.7, "Residual Heat Removal (RHR)

Shutdown Cooling System-Hot Shutdown"). The Applicability is therefore consistent with the requirements of these systems.

In MODES 4 and 5, the OPERABILITY requirements of the HPSW System are determined by the systems it supports, and therefore, the requirements are not the same for all facets of operation in MODES 4 and 5. Thus, the LCOs of the RHR shutdown cooling system, which requires portions of the HPSW System to be OPERABLE, will govern HPSW System operation in MODES 4 and 5.

ACTIONS A.1 With one HPSW subsystem inoperable, the inoperable HPSW subsystem must be restored to OPERABLE status within 7 days.

With the unit in this condition, the remaining OPERABLE HPSW subsystem is adequate to perform the HPSW heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE HPSW subsystem (continued)

PBAPS UNIT 3 R 3.7-3 Revision No. 89

HPSW System B 3.7.1 BASES ACTIONS A.1 (continued) could result in loss of HPSW function. The Completion Time is based on the redundant HPSW capabilities afforded by the OPERABLE subsystem and the low probability of an event occurring requiring HPSW during this period.

The Required Action is modified by a Note indicating that the applicable Conditions of LCO 3.4.7, be entered and Required Actions taken if an inoperable HPSW subsystem results in an inoperable RHR shutdown cooling subsystem.

This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.

B.1 If one HPSW subsystem is inoperable and not restored within the provided Completion Time, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 5) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 With both HPSW subsystems inoperable, the HPSW System is not capable of performing its intended function. At least one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time for restoring one HPSW subsystem to OPERABLE status, is based on the Completion Times provided for the RHR suppression pool cooling and spray functions.

The Required Action is modified by a Note indicating that the applicable Conditions of LCO 3.4.7, be entered and Required Actions taken if an inoperable HPSW subsystem results in an inoperable RHR shutdown cooling subsystem.

This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.

(continued)

PBAPS UNIT 3 B 3.7-4 Revision No. 67

HPSW System B 3.7.1 BASES ACTIONS D.1 and D.2 (continued)

If the HPSW subsystems cannot be restored to OPERABLE status within the associated Completion Time of Condition C, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.1.1 REQUIREMENTS Verifying the correct alignment for each manual and power operated valve in each HPSW subsystem flow path provides assurance that the proper flow paths will exist for HPSW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position, and yet considered in the correct position, provided it can be realigned to its accident position. This is acceptable because the HPSW System is a manually initiated system.

This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 10.7.

2. UFSAR, Chapter 14.

3. NEDC-32183P, "Power Rerate Safety Analysis Report For Peach Bottom 2 & 3," May 1993.

4. UFSAR, Section 14.6.3.

5. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.7-5 Revision No. 87

ESW System and Norma 1 Heat Sink B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Emergency Service Water (ESW) System and Normal Heat Sink BASES BACKGROUND The ESW System is a standby system which is shared between Units 2 and 3. It is designed to provide cooling water for the removal of heat from equipment, such as the diesel generators (DGs) and room coolers for Emergency Core Cooling System equipment, required for a safe reactor shutdown following a Design Basis Accident (DBA) or transient. Upon receipt of a loss of offsite power signal, or whenever any diesel generator is in operation, the ESW System will provide cooling water to its required loads.

The ESW System consists of two redundant subsystems. Each of the two ESW subsystems consist of a 100% capacity 8000 gpm pump, a suction source, valves, piping and associated instrumentation. Either of the two subsystems is capable of providing the required cooling capacity to support the required systems for both units. Each subsystem provides coolant in separate piping to common headers; one each for the DG coolers, Unit 2 safeguard equipment coolers, and Unit 3 safeguard equipment coolers. The design is such that any single active failure will not affect the ESW System from providing coolant to the required loads.

Cooling water is pumped from the normal heat sink (Conowingo Pond) via the pump structure bay by the ESW pumps to the essential components. After removing heat from the components, the water is discharged to the discharge pond, or the emergency cooling tower in certain test alignments.

An alternate suction supply and discharge path (from the emergency heat sink) is available in the unlikely event the Conowingo dam fails or the pond floods. This lineup, however, has to be manually aligned.

APPLICABLE Sufficient water inventory is available for all ESW System SAFETY ANALYSES post LOCA cooling requirements for a 30 day period with no additional makeup water source available. The ability of the ESW System to support long term cooling of the reactor containment is assumed in evaluations of the equipment required for safe reactor shutdown presented in the UFSAR, Chapter 14 (Ref. 1). These analyses include the evaluation of the long term primary containment response after a design basis LOCA.

(continued)

PBAPS UNIT 3 B 3.7-6 Revision No. 4

ESW System and Normal Heat Sink B 3.7.2 BASES APPLICABLE The ability of the ESW System to provide adequate cooling to SAFETY ANALYSES the identified safety equipment is an implicit assumption (continued) for the safety analyses evaluated in Reference 1. The ability to provide onsite emergency AC power is dependent on the ability of the ESW System to cool the DGs. The long term cooling capability of the RHR and core spray pumps is also dependent on the cooling provided by the ESW System.

ESW provides cooling to the HPCI and RCIC room coolers; however, cooling function is not required to support HPCI or RCIC System operability.

The ESW System, together with the Normal Heat Sink, satisfy Criterion 3 of the NRC Policy Statement.

LCO The ESW subsystems are independent to the degree that each ESW pump has separate controls, power supplies, and the operation of one does not depend on the other. In the event of a DBA, one subsystem of ESW is required to provide the minimum heat removal capability assumed in the safety analysis for the system to which it supplies cooling water.

To ensure this requirement is met, two subsystems of ESW must be OPERABLE. At least one subsystem will operate, if the worst single active failure occurs coincident with the loss of offsite power.

A subsystem is considered OPERABLE when it has an OPERABLE normal heat sink, one OPERABLE pump, and an OPERABLE flow path capable of taking suction from the pump structure and transferring the water to the appropriate equipment.

The OPERABILITY of the normal heat sink is based on having a minimum and maximum water level in the pump bay of 98.5 ft Conowingo Datum (CD) and 113 ft CD respectively and a maximum water temperature of 92°F. I The isolation of the ESW System to components or systems may render those components or systems inoperable, but does not affect the OPERABILITY of the ESW System.

APPLICABILITY In MODES 1, 2, and 3, the ESW System and normal heat sink are required to be OPERABLE to support OPERABILITY of the equipment serviced by the ESW System. Therefore, the ESW System and normal heat sink are required to be OPERABLE in these MODES.

(continued)

PBAPS UNIT 3 B 3.7-7 Revision No. 109

ESW System and Normal Heat Sink B 3.7.2 BASES APPLICABILITY In MODES 4 and 5, the OPERABILITY requirements of the ESW (continued) System and normal heat sink are determined by the systems they support, and therefore the requirements are not the same for all facets of operation in MODES 4 and 5. Thus, the LCOs of the systems supported by the ESW System and normal heat sink will govern ESW System and normal heat sink OPERABILITY requirements in MODES 4 and 5.

ACTIONS A.1 With one ESW subsystem inoperable, the ESW subsystem must be restored to OPERABLE status within 7 days. With the unit in this condition, the remaining OPERABLE ESW subsystem is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE ESW subsystem could result in loss of ESW function.

The 7 day Completion Time is based on the redundant ESW System capabilities afforded by the OPERABLE subsystem, the low probability of an event occurring during this time period, and is consistent with the allowed Completion Time for restoring an inoperable DG.

B.1 and B.2 If the ESW System cannot be restored to OPERABLE status within the associated Completion Time, or both ESW subsystems are inoperable, or the normal heat sink is inoperable, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies the water level in the pump bay of the pump structure to be sufficient for the proper operation of the ESW pumps (the pump's ability to meet the minimum flow rate and anticipatory actions required for flood conditions are considered in determining these limits). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.7-8 Revision No. 109

ESW System and Normal Heat Sink B 3.7.2 BASES SURVEILLANCE SR 3.7.2.2 REQUIREMENTS (continued) Verification of the normal heat sink temperature ensures that the heat removal capability of the ESW and HPSW systems is within DBA analysis. The water temperature is determined by using instrumentation that averages multiple inputs that measure the normal heat sink temperature. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Additionally, to ensure that the 920 F normal heat sink temperature is not exceeded, this surveillance requires hourly monitoring of the normal heat sink when the temperature is greater than 90 0 F. The once per hour monitoring takes into consideration normal heat sink temperature variations and the increased monitoring frequency needed to ensure design basis assumptions and equipment limitations are not exceeded in this condition.

SR 3.7.2.3 Verifying the correct alignment for each manual and power operated valve in each ESW subsystem flow path provides assurance that the proper flow paths will exist for ESW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position, and yet considered in the correct position, provided it can be automatically realigned to its accident position within the required time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

This SR is modified by a Note indicating that i.solation of the ESW System to components or systems may render those components or systems inoperable, but does not affect the OPERABILITY of the ESW System. As such, when all ESW pumps, valves, and piping are OPERABLE, but a branch connection off the main header is isolated, the ESW System is still OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UN.IT 3 B 3.7-9 Revision No. 109

ESW System and Normal Heat Sink B 3.7.2 BASES SURVEILLANCE SR 3.7.2.4 REQUIREMENTS (continued) This SR verifies that the ESW System pumps will automatically start to provide cooling water to the required safety related equipment during an accident event. This is demonstrated by the use of an actual or simulated initiation signal The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Chapter 14.

2. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.7-10 Revision No. 87

Emergency Heat Sink B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 Emergency Heat Sink BASES BACKGROUND The function of the emergency heat sink is to provide heat removal capability so that the Unit 2 and 3 reactors can be safely shutdown in the event of the unavailability of the normal heat sink (Conowingo Pond). The emergency heat sink supports the dissipation of sensible and decay heat so that the two reactors can be shutdown when the normal heat sink is unavailable due to flooding or failure of the Conowingo dam. This function is provided via the Emergency Service Water (ESW) System and the High Pressure Service Water System (HPSW).

The emergency heat sink consists of an induced draft three cell cooling tower with an integral storage reservoir, three emergency cooling tower fans, two ESW booster pumps, valves, piping, and associated instrumentation. The emergency cooling tower, equipment, valves, and piping of the emergency heat sink are designed in accordance with seismic Class I criteria. Standby power is provided to ensure the emergency heat sink is capable of operating during a loss of offsite power.

When the normal heat sink (Conowingo Pond) is lost or when flooding occurs, sluice gates in the pump structure housing the ESW pumps and HPSW pumps are closed. Water is then provided through two gravity fed lines from the emergency heat sink reservoir into the pump structure pump bays. The ESW and HPSW pumps then pump cooling water to heat exchangers required to bring the Unit 2 and 3 reactors to safe shutdown conditions. Return water from the HPSW System flows directly to two of the three cells of the emergency cooling tower. Return water from the ESW System flows through one of the two ESW booster pumps and is pumped into one of the emergency cooling tower cells used by the HPSW System. This configuration allows for closed cycle operation of the ESW and HPSW Systems.

Sufficient capacity (3.55 million gallons of water) is available, when the minimum water level is 17 feet above the bottom of the emergency heat sink reservoir, to support simultaneous shutdown of Units 2 and 3 for 7 days without makeup water. After 7 days, makeup water will be provided from the Susquehanna River or from tank trucks.

(continued)

PBAPS UNIT 3 B 3.7-11 Revision No. 68

Emergency Heat Sink B 3.7.3 BASES (continued)

APPLICABLE The emergency heat sink is required to support removal of SAFETY ANALYSES heat from the Unit 2 and 3 reactors, primary containments, and other safety related equipment by providing a seismic Class I heat sink for the ESW and HPSW Systems for shutdown of the reactors when the normal non-safety grade heat sink (Conowingo Pond) is unavailable. Sufficient water inventory is available to supply all the ESW and HPSW System cooling requirements of both units during shutdown with a concurrent loss of offsite power for a 7 day period with no additional makeup water available. The ability of the emergency heat sink to support the shutdown of both Units 2 and 3 in the event of the loss of the normal heat sink is presented in the UFSAR (Ref. 1).

The Emergency Heat Sink satisfies Criterion 3 of the NRC Policy Statement.

LCO In the event the normal heat sink is unavailable and offsite power is lost, the emergency heat sink is required to provide the minimum heat removal capability for the ESW and HPSW Systems to safely shutdown both units. To ensure this requirement is met, the emergency heat sink must be OPERABLE.

The emergency heat sink is considered OPERABLE for Unit 3 when it has an OPERABLE flow path from the ESW System with one OPERABLE ESW booster pump, an OPERABLE flow path from the Unit 3 HPSW System, two of the three cooling tower cells I and two of the three associated fans OPERABLE, one OPERABLE gravity feed line from the emergency heat sink reservoir into the pump structure bays with the capability to connect the Unit 2 and 3 pump structure bays, or one OPERABLE gravity feed line from the emergency heat sink to the Unit 3 pump structure bay with the Unit 2 and 3 pump structure bays not connected, and the capability exists to manually isolate the ESW and HPSW pump structure bays from the Conowingo Pond. Valves in the required flow paths are considered OPERABLE if they can be manually aligned to their correct position. The OPERABILITY of the emergency heat sink also requires a minimum water level in the emergency heat sink reservoir of 17 feet.

(continued)

PBAPS UNIT 3 B 3.7-12 Revision No. 92

Emergency Heat Sink B 3.7.3 BASES LCO Emergency heat sink water temperature is not addressed in (continued) this LCO since the maximum water temperature of the emergency cooling tower reservoir has been demonstrated, based on historical data, to be bounded by the normal heat sink requirements (LCO 3.7.2, "Emergency Service Water (ESW)

System and Normal Heat Sink").

APPLICABILITY In MODES 1, 2, and 3, the emergency heat sink is required to be OPERABLE to provide a seismic Class I source of cooling water to the ESW and HPSW Systems when the normal heat sink is unavailable. Therefore, the emergency heat sink is required to be OPERABLE in these MODES.

In MODES 4 and 5, the OPERABILITY requirements of the emergency heat sink are determined by the systems it supports in the event the normal heat sink is unavailable.

ACTIONS A.1 With one required emergency cooling tower fan inoperable, action must be taken to restore the required emergency cooling tower fan to OPERABLE status within 14 days. The 14 day Completion Time is based on the remaining heat removal capability, the low probability of an event occurring requiring the inoperable emergency cooing tower fan to function, and the capability of the remaining emergency cooling tower fan.

B.1 With the emergency heat sink inoperable for reasons other than Condition A, the emergency heat sink must be restored to OPERABLE status within 7 days. With the unit in this condition, the normal heat sink (Conowingo Pond) is adequate to perform the heat removal function; however, the overall reliability is reduced. The 7 day Completion Time is based on the remaining heat removal capability and the low probability of an event occurring requiring the emergency heat sink to be OPERABLE during this time period.

(continued)

PBAPS UNIT 3 B 3.7-13 Revision No. 1

Emergency Heat Sink B 3.7.3 BASES ACTIONS C.1 and C.2 (continued)

If the emergency heat sink cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.3.1 REQUIREMENTS This SR ensures adequate long term (7 days) cooling can be maintained in the event of flooding or loss of the Conowingo Pond. With the emergency heat sink water source below the minimum level, the emergency heat sink must be declared inoperable. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.3.2 Operating each required emergency cooling tower fan for

Ž 15 minutes ensures that all required fans are OPERABLE and that all associated controls are functioning properly. It also ensures that fan or motor failure, or excessive vibration, can be detected for corrective action. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 10.24.

PBAPS UNIT 3 B 3.7-14 Revision No. 87

MCREV System B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Main Control Room Emergency Ventilation (MCREV) System BASES BACKGROUND The MCREV System provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals, or smoke.

The MCREV System consists of two independent and redundant high efficiency air filtration subsystems and two 100%

capacity emergency ventilation supply fans which supply and provide emergency treatment of outside supply air and a CRE boundary that limits the inleakage of unfiltered air. Each filtration subsystem consists of a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section, a second HEPA filter, and the associated ductwork, valves or dampers, doors, barriers and instrumentation. Either emergency ventilation supply fan can operate in conjunction with either filtration subsystem.

HEPA filters remove particulate matter, which may be radioactive. The charcoal adsorbers provide a holdup period for gaseous iodine, allowing time for decay. A dry gas purge is provided to each MCREV subsystem during idle periods to prevent moisture accumulation in the filters.

The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions.

This area encompasses the control room, and may encompass other non-critical areas to which other frequent personnel access or continuous occupancy is not necessary in the event of an accident. The CRE is protected during normal operation, natural events, and accidents conditions. The CRE boundary is the combination of walls, floor, roof, ducting, dampers, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the in leakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing bases analyses of design basis accident (DBA) consequences and chemical hazards to CRE occupants. Since the equipment required and the allowable inleakage is different for radiological and chemical events, the CRE boundary distinguishes between the boundaries required for each event. The CRE and its boundaries are defined in the Control Room Envelop Habitability Program.

(continued)

PBAPS UNIT 3 B 3.7-15 Revision No. 114

MCREV System B 3.7.4 BASES BACKGROUND The MCREV System is a standby system that is common to both (continued) Unit 2 and Unit 3. The two MCREV subsystems must be OPERABLE if conditions requiring MCREV System OPERABILITY exist in either Unit 2 or Unit 3. Upon receipt of the initiation signal(s) (indicative of conditions that could result in radiation exposure to CRE occupants), the MCREV System automatically starts and pressurizes the CRE to minimize infiltration of contaminated air into the CRE. A system of dampers isolates the CRE along the radiological boundary, and outside air, taken in at the normal ventilation intake, is passed through one of the charcoal I

adsorber filter subsystems for removal of airborne radioactive particles. During normal control room ventilation system restoration following operation of the MCREV system, the automatic initiation function of MCREV will briefly be satisfied by operator actions and controlled procedural steps.

If all normal ventilation and air conditioning were lost, the control room operator would initiate an emergency shutdown of non-essential equipment and lighting to reduce the heat generation to a minimum. Heat removal would be accomplished by conduction through the floors, ceilings, and walls to adjacent rooms and to the environment. Additionally, the MCREV System is designed to maintain a habitable environment in the CRE for a 30 day continuous occupancy after a DBA without exceeding 5 rem total effective dose equivalent (TEDE). A single MCREV subsystem will pressurize the CRE relative to the external areas adjacent to the CRE radiological boundary to minimize infiltration of air from all surrounding areas adjacent to the CRE radiological boundary. MCREV System operation in maintaining CRE habitability is discussed in the UFSAR, Chapters 7, 10, and 12, (Refs. 1, 2, and 3, respectively).

APPLICABLE The ability of the MCREV System to maintain the habitability SAFETY ANALYSES of the CRE is an explicit assumption for the safety analyses presented in the UFSAR, Chapters 10 and 12 (Refs. 2 and 3, respectively). The MCREV System is assumed to operate following a DBA, as discussed in the UFSAR, Section 14.9 (Ref. 4). The radiological doses to the CRE occupants as a result of the various DBAs are summarized in Reference 4.

No single active or passive electrical failure will cause the loss of outside or recirculated air from the CRE.

(continued)

PBAPS UNIT 3 B 3.7-16 Revision No. 114

MCREV System B 3.7.4 BASES APPLICABLE The MCREV System provides protection from smoke or hazardous SAFETY ANALYSES chemicals to the CRE occupants. A periodic offsite chemical (continued) survey, and procedures for controlling onsite chemicals, are essential elements of CRE protection against hazardous chemicals. The system design is based on low probability of offsite sources of toxic gas, based on a chemical survey of the surrounding areas. Those offsite sources of toxic gas with a greater than low probability are evaluated in accordance with Regulatory Guide 1.78 (Ref. 10) or Regulatory Guide 1.95 (Ref. 11) and determined to be acceptable for continued habitability. The offsite chemical survey is conducted periodically to determine any change of condition that may need to be addressed. The onsite chemicals are controlled procedurally such that they do not affect CRE habitability adversely.

Although the MCREV system does not have a toxic gas mode, evaluations have been performed to assess the impact of toxic gas on control room habitability. The evaluations have concluded that based on either the low probability of hazardous chemical events occurring or operator action to don Self Contained Breathing Apparatuses (SCBAs) and secure the control room ventilation, additional protection from offsite hazardous chemicals is not required. Only new chemicals or changes in quantities of chemicals identified as part of the chemical survey will be analyzed further for control room habitability purposes.

The MCREV System satisfies Criterion 3 of the NRC Policy Statement.

LCO Two redundant subsystems of the MCREV System are required to be OPERABLE to ensure that at least one is available, if a single active failure disables the other subsystem. Total MCREV System failure, such as. from a loss of both ventilation subsystems or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem total effective dose equivalent (TEDE) to the CRE occupants in the event of a DBA or for toxic gas events, result in incapacitation of the CRE inhabitants.

Each MCREV subsystem is considered OPERABLE when the individual components necessary to limit CRE occupant radiation exposure are OPERABLE. A subsystem is considered OPERABLE when:

a: One fan is OPERABLE; (continued)

PBAPS UNIT 3 B 3.7-16a Revision No. 114

MCREV System B 3.7.4 BASES LCO b. HEPA filter and charcoal adsorbers are not excessively (continued) restricting flow and are capable of performing their filtration functions; and

c. Ductwork, valves, and dampers are OPERABLE, and air flow can be maintained.

A subsystem may be considered operable using either the A or B fan combined with either the A or B Filter bank.

In order for the MCREV subsystem to be considered OPERABLE, the CRE radiological boundary must be maintained such that the CRE occupant dose from the large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs.

In order for the MCREV subsystem to be considered OPERABLE, the CRE boundaries must be maintained OPERABLE, including the integrity of the walls, floors, ceilings, and ductwork.

Temporary seals may be used to maintain the boundary. For hazardous chemical events, the CRE chemical boundary is OPERABLE when the CRE occupants can be protected from hazardous chemicals. The in leakage limit for hazardous chemicals is defined and established in the hazardous chemical analyses (Ref. 12). If measured inleakage is greater than the limit established in the analyses, or if a new hazardous chemical (not meeting the screening criteria of Reference 10 or Reference 11) or increased quantity of an existing chemical is determined to exist, then the CRE chemical boundary is considered inoperable, unless continued habitability is evaluated as being acceptable (Ref. 10, 11).

For smoke events, the CRE boundary is OPERABLE when the CRE occupants can be protected from smoke events external or internal to the plant. For smoke events, no regulatory limit exists for the amount of smoke allowed in the CRE. However, if smoke enters the CRE such that mitigating actions are required, then the CRE boundary is considered inoperable.

The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls.

This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.

(continued)

PBAPS UNIT 3 B 3.7-16b Revision No. 114

MCREV System B 3.7.4 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, the MCREV System must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA, since the DBA could lead to a fission product release.

In MODES 4 and 5, the probability and consequences of a DBA are reduced because of the pressure and temperature limitations in these MODES. Therefore, maintaining the MCREV System OPERABLE is not required in MODE 4 or 5, except for the following situations under which significant radioactive releases can be postulated:

a. During operations with potential for draining the reactor vessel (OPDRVs);

b. During CORE ALTERATIONS; and

c. During movement of irradiated fuel assemblies in the secondary containment.

ACTIONS A.1 With one MCREV subsystem inoperable, for reasons other than an inoperable CRE boundary, the inoperable MCREV subsystem must be restored to OPERABLE status within 7 days. With the unit in this condition, the remaining OPERABLE MCREV subsystem is adequate to maintain control room temperature and to perform the CRE occupant protection function.

However, the overall reliability is reduced because a failure in the OPERABLE subsystem could result in loss of the MCREV System function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and that the remaining subsystem can provide the required capabilities.

B.1, B.2 and B.3 If the unfiltered inleakage of potentially contaminated air past a CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem total effective dose equivalent (TEDE)),

or inadequate protection of CRE occupants from hazardous chemicals or smoke that have been licensed to occur, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.

(continued)

PBAPS UNIT 3 B 3.7-17 Revision No. 114

MCREV System B 3.7.4 BASES ACTIONS B.1, B.2 and B.3 (continued)

During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke (Refs. 6, 7, 10 and 11). Action must be I taken within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke as required. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24-hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the initiation of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and repair, and test most problems with the CRE boundary.

C.1 In MODE 1, 2, or 3, if the inoperable MCREV subsystem or the CRE boundary cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE that minimizes overall plant risk. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 5) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems..

(continued)

PBAPS UNIT 3 B 3.7-18 Revision No. 114

MCREV System B 3.7.4 BASES ACTIONS D.1, D.2.1, D.2.2, and D.2.3 (continued)

The Required Actions of Condition D are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.

Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

During movement of irradiated fuel assemblies in the secondary containment, during CORE ALTERATIONS, or during OPDRVs, if the inoperable MCREV subsystem cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE MCREV subsystem may be placed in operation. This action ensures that the remaining subsystem is OPERABLE, that no failures that would prevent automatic actuation will occur, and that any active failure will be readily detected.

An alternative to Required Action D.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk.

If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended.

E.1 If both MCREV subsystems are inoperable in MODE 1, 2, or 3 for reasons other than an inoperable CRE boundary (i.e.,

Condition B), the MCREV System may not be capable of performing the intended function. Therefore, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref.

5) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PBAPS UNIT 3 B 3.7-19 Revision No. 69

MCREV System B 3.7.4

.BASES ACTIONS F.1. F.2 and F.3 (continued)

The Required Actions of Condition F are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.

Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

During movement of irradiated fuel assemblies in the secondary containment, during CORE ALTERATIONS, or during OPDRVs, with two MCREV subsystems inoperable or with one or more MCREV subsystems inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that present a potential for releasing radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk.

If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment must be suspended immediately. Suspension of these activities shall

not preclude completion of movement of a component to a safe position. If applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended.

SURVEILLANCE SR 3.7.4.1 REQUIREMENTS This SR verifies that a subsystem in a standby mode starts on demand and continues to operate for Ž 15 minutes.

Standby systems should be checked periodically to ensure that they start and function properly. As the environmental and normal operating conditions of this system are not severe, testing each subsystem periodically provides an adequate check on this system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.4.2 This SR verifies that the required MCREV testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations).

Specific test frequencies and additional information are discussed in detail in the VFTP.

(continued)

PBAPS UNIT 3 B 3.7-20 Revision No. 87

MCREV System B 3.7.4 BASES SURVEILLANCE SR 3.7.4.3 REQUIREMENTS (continued) This SR verifies that on an actual or simulated initiation signal, each MCREV subsystem starts and operates. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.7.1.4 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.4.4 This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are.specified in the Control Room Envelope Habitability Program.

The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem whole body dose or its equivalent to any part of the body and the CRE occupants are protected from hazardous chemicals and smoke that have been licensed to occur. This SR verifies that the unfiltered air inleakage into the CRE through the radiological and chemical boundaries is no greater than the flow rates assumed in the licensing basis analyses of DBA consequences and control room habitability evaluations for hazardous chemicals. When unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered. Required Action B.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident.

Mitigating actions are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref. 6) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 7). These mitigating actions may also be used as mitigating actions as required by Required Action B.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 9). Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence or chemical habitability analyses, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.

(continued)

PBAPS UNIT 3 B 3.7-20a Revision No. 114

MCREV System B 3.7.4 BASES (continued)

REFERENCES 1. UFSAR, Section 7.19.

2. UFSAR, Section 10.13.

3. UFSAR, Section 12.3.4.

4. UFSAR, Section 14.9.

5. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

6. Regulatory Guide 1.196, "Control Room Habitability at Light-Water Nuclear Power Reactors", May 2003.

7. NEI 99-03, "Control Room Habitability Assessment", June 2001.

8. TSTF-448, Rev. 3, "Control Room Habitability" dated 8/8/06 and "Corrected Pages for TSTF-488, Rev. 3, Control Room Habitability", dated 12/29/06.

9. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White Paper, Use of Generic Letter 91-18 process and Alternative Source Terms in the Context of Control Room Habitability."

10. NRC Regulatory Guide 1.78, Evaluating the Habitability of a Nuclear Power Plant Control Room during a Postulated Hazardous Chemical Release, Rev. 0.

11. NRC Regulatory Guide 1.95, Protection of Nuclear Power Plant Control Room Operators Against an Accidental Chlorine Release, Rev. 0.

12. Calculation PM-1085, "Peach Bottom Atomic Power Station Control Room Habitability Analysis for the Off-site Chemicals Stored at Calpine Site."

PBAPS UNIT 3 B 3.7-21 Revision No. 114

Main Condenser Offgas B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Main Condenser Offgas BASES BACKGROUND During unit operation, steam from the low pressure turbine is exhausted directly into the condenser. Air and noncondensible gases are collected in the condenser, then exhausted through the steam jet air ejectors (SJAEs) to the Main Condenser Offgas System. The offgas from the main condenser normally includes radioactive gases.

The Main Condenser Offgas System has been incorporated into the unit design to reduce the gaseous radwaste emission.

This system uses a catalytic recombiner to recombine radiolytically dissociated hydrogen and oxygen. The gaseous mixture is cooled and water vapor removed by the offgas recombiner condenser; the remaining water and condensibles are stripped out by the cooler condenser and moisture separator. The remaining gaseous mixture (i.e., the offgas recombiner effluent) is then processed by a charcoal adsorber bed prior to release.

APPLICABLE The main condenser offgas gross gamma activity rate is an SAFETY ANALYSES initial condition of the Main Condenser Offgas System failure event, discussed in the UFSAR, Section 9.4.5 (Ref. 1). The analysis assumes a gross failure in the Main Condenser Offgas System that results in the rupture of the Main Condenser Offgas System pressure boundary. The gross gamma activity rate is controlled to ensure that, during the event, the calculated offsite doses will be well within the limits of 10 CFR 100 (Ref. 2) or the NRC staff approved licensing basis.

The main condenser offgas limits satisfy Criterion 2 of the NRC Policy Statement.

LCO To ensure compliance with the assumptions of the Main Condenser Offgas System failure event (Ref. 1), the fission product release rate should be consistent with a noble gas release to the reactor coolant of 100 pCi/MWt-second after decay of 30 minutes. The LCO is established consistent (continued)

PBAPS UNIT 3 B 3.7-22 Revision No. 0

Main Condenser Offgas B 3.7.5 BASES LCO with this requirement (3293 MWt x 100 IiCi/MWt-second =

(continued) 320,000, liCi/second) and is based on the original licensed rated thermal power.

APPLICABILITY The LCO is applicable when steam is being exhausted to the main condenser and the resulting noncondensibles are being processed via the Main Condenser Offgas System. This occurs during MODE 1, and during MODES 2 and 3 with any main steam line not isolated and the SJAE in operation. In MODES 4 and 5, steam is not being exhausted to the main condenser and the requirements are not applicable.

ACTIONS A.1 If the offgas radioactivity rate limit is exceeded, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to restore the gross gamma activity rate to within the limit. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on engineering judgment, the time required to complete the Required Action, the large margins associated with permissible dose and exposure limits, and the low probability of a Main Condenser Offgas System rupture.

B.1, B.2, and B.3 If the gross gamma activity rate is not restored to within the limits in the associated Completion Time, all main steam lines or the SJAE must be isolated. This isolates the Main Condenser Offgas System from the source of the radioactive steam. The main steam lines are considered isolated if at least one main steam isolation valve in each main steam line is closed, and at least one main steam line drain valve in each drain line inboard of the main steam isolation valves is closed. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to perform the actions from full power conditions in an orderly manner and without challenging unit systems.

An alternative to Required Actions B.1 and B.2 is to place the unit in a MODE in which the overall plant risk is minimized. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3) and because the time spent in MODE 3 to (continued)

PBAPS UNIT 3 B 3.7-23 Revision No. 67

Main Condenser Offgas B 3.7.5 BASES ACTIONS B.I. B.2, and B.3 (continued) perform the necessary repairs to restore the system to OPERABLE status will be short. However" voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.5.1 REQUIREMENTS This SR requires an isotopic analysis of an offgas sample to ensure that the required limits are satisfied. The noble gases to be sampled are Xe-133, Xe-135, Xe-138, Kr-85m, Kr-87, and Kr-88. If the measured rate of radioactivity increases significantly (by Ž 50% after correcting for expected increases due to changes in THERMAL POWER), an isotopic analysis is also performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the increase is noted, to ensure that the increase is not indicative of a sustained increase in the radioactivity rate. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note indicating that the SR is not required to be performed until 31 days after any main steam line is not isolated and the SJAE is in operation. Only in this condition can radioactive fission gases be in the Main Condenser Offgas System at significant rates.

REFERENCES 1. UFSAR, Section 9.4.5.

2. 10 CFR 100.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.7-24 Revision No. 87

Main Turbine Bypass System B 3.7.6 B 3.7 Plant SYSTEMS B 3.7.6 Main Turbine Bypass System BASES BACKGROUND The Main Turbine Bypass System is designed to control steam pressure when reactor steam generation exceeds turbine requirements during unit startup, sudden load reduction, and cooldown. It allows excess steam flow from the reactor to the condenser without going through the turbine. The bypass capacity of the system is 25% of the Nuclear Steam Supply System rated steam flow. Sudden load reductions within the capacity of the steam bypass can be accommodated without safety relief valves opening or a reactor scram. The Main Turbine Bypass System consists of nine modulating type hydraulically actuated bypass valves mounted on a valve manifold. The manifold is connected with two steam lines to the four main steam lines upstream of the turbine stop valves. The bypass valves are controlled by the bypass control unit of the Pressure Regulator and Turbine Generator Control System, as discussed in the UFSAR, Section 7.11.3 (Ref. 1). The bypass valves are normally closed. However, if the total steam flow signal exceeds the turbine control valve flow signal of the Pressure Regulator and Turbine Generator Control System, the bypass control unit processes these signals and will output a bypass flow signal to the bypass valves. The bypass valves will then open sequentially to bypass the excess flow through connecting piping and a pressure reducing orifice to the condenser.

APPLICABLE The Main Turbine Bypass System is expected to function SAFETY ANALYSES during the electrical load rejection transient, the turbine trip transient, and the feedwater controller failure maximum demand transient, as described in the UFSAR, Section 14.5.1.1 (Ref. 2), Section 14.5.1.2.1 (Ref. 3), and Section 14.5.2.2 (Ref. 4). However, the feedwater controller maximum demand transient is the limiting licensing basis transient which defines the MCPR operating limit if the Main Turbine Bypass System is inoperable.

Opening the bypass valves during the pressurization events mitigates the increase in reactor vessel pressure, which affects the MCPR during the event.

The Main Turbine Bypass System satisfies Criterion 3 of the NRC Policy Statement.

(continued)

PBAPS UNIT 3 B 3.7-25 Revision No. 0

Main Turbine Bypass System B 3.7.6 BASES (continued)

LCO The Main Turbine Bypass System is required to be OPERABLE to limit peak pressure in the main steam lines and maintain reactor pressure within acceptable limits during events that cause rapid pressurization, so that the Safety Limit MCPR is not exceeded. With the Main Turbine Bypass System inoperable, modifications to the APLHGR operating limits (LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)"), the MCPR operating limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), and the LHGR operating limits (LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)") may be applied to allow this LCO to be met. The operating limits for the inoperable Main Turbine Bypass System are specified in the COLR. An OPERABLE Main Turbine Bypass System requires the minimum number of bypass valves, specified in the COLR, to open in response to increasing main steam line pressure. This response is within the assumptions of the applicable analyses (Refs. 2, 3, and 4).

APPLICABILITY The Main Turbine Bypass System is required to be OPERABLE at

> 25% RTP to ensure that the fuel cladding integrity Safety Limit and the cladding 1% plastic strain limit are not violated during the applicable safety analyses transients.

As discussed in the Bases for LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)," and LCO 3.2.2, sufficient margin to these limits exists at < 25% RTP. Therefore, these requirements are only necessary when operating at or above this power level.

ACTIONS A.1 If the Main Turbine Bypass System is inoperable (onp or more required bypass valves as specified in the COLR inoperableJ, or the required thermal operating limits for an inoperable Main Turbine Bypass System, as specified in the COLR, are not applied, the assumptions of the design basis transient analyses may not be met. Under such circumstances, prompt action should be taken to restore the Main Turbine Bypass System to OPERABLE status or adjust the thermal operating limits accordingly. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time *is reasonable, based on the time to complete the Required Action and the low probability of an event occurring during this period requiring the Main Turbine Bypass System.

(continued)

PBAPS UNIT 3 B 3.7-26 Revision No. 50

Main Turbine Bypass System B 3.7.6 BASES ACTIONS B.1 (continued)

If the Main Turbine Bypass System cannot be restored to OPERABLE status or the required thermal operating limits for an inoperable Main Turbine Bypass System are not applied, THERMAL POWER must be reduced to < 25% RTP. As discussed in the Applicability section, operation at < 25% RTP results in sufficient margin to the required limits, and the Main Turbine Bypass System is not required to protect fuel integrity during the applicable safety analyses transients.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner without challenging unit systems.

SURVEILLANCE SR 3.7.6.1 REQUIREMENTS Cycling each main turbine bypass valve through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and will function when required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.6.2 The Main Turbine Bypass System is required to actuate automatically to perform its design function. This SR demonstrates that, with the required system initiation signals, the valves will actuate to their required position.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3. 7-27 Revision No. 87

Main Turbine Bypass System B 3.7.6 BASES SURVEILLANCE SR 3.7.6.3 REQUIREMENTS (continued) This SR ensures that the TURBINE BYPASS SYSTEM RESPONSE TIME is in compliance with the assumptions of the appropriate safety analyses. The response time limits are specified in COLR. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 7.11.3.

2. UFSAR, Section 14.5.1.1.

3. UFSAR, Section 14.5.1.2.1.

4. UFSAR, Section 14.5.2.2.

5. Deleted PBAPS UNIT 3 8 3.7-28 Revision No. III

Spent Fuel Storage Pool Water Level B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Spent Fuel Storage Pool Water Level BASES BACKGROUND The minimum water level in the spent fuel storage pool meets the assumptions of iodine decontamination factors following a fuel handling accident.

A general description of the spent fuel storage pool design is found in the UFSAR, Section 10.3 (Ref. 1). The assumptions of the fuel handling accident are found in the UFSAR, Section 14.6.4 (Ref. 2).

APPLICABLE The water level above the irradiated fuel assemblies is an SAFETY ANALYSES implicit assumption of the fuel handling accident. A fuel handling accident is evaluated to ensure that the radiological consequences are well below the guidelines set forth in 10 CFR 50.67 (Ref. 3) as modified in Regulatory Guide 1.183, Table 6. A fuel handling accident could release a fraction of the fission product inventory by breaching the fuel rod cladding as discussed in Reference 2.

The fuel handling accident is evaluated for the dropping of an irradiated fuel assembly onto the reactor core. The consequences of a fuel handling accident over the spent fuel storage pool are less severe than those of the fuel handling accident over the reactor core. The water level in the spent fuel storage pool provides for absorption of water soluble fission product gases before being released to the secondary containment atmosphere. Noble gases are not retained in the water and particulates are retained (RG 1.185, Appendix B, Item 3).

The spent fuel storage pool water level satisfies Criteria 2 and 3 of the NRC Policy Statement.

LCO The specified water level (232 ft 3 inches plant elevation, which is equivalent to 22 ft over the top of irradiated fuel assemblies seated in the spent fuel storage pool racks) preserves the assumptions of the fuel handling accident analysis (Ref. 2). As such, it is the minimum required for fuel movement within the spent fuel storage pool.

(continued)

PBAPS UNIT 3 B 3.7-29 Revision No. 76

Spent Fuel Storage Pool Water Level B 3.7.7 BASES (continued)

APPLICABILITY This LCO applies during movement of fuel assemblies in the spent fuel storage pool since the potential for a release of fission products exists.

ACTIONS A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply. If moving fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of fuel assemblies is not a sufficient reason to require a reactor shutdown.

When the initial conditions for an accident cannot be met, action must be taken to preclude the accident from occurring. If the spent fuel storage pool level is less than required, the movement of fuel assemblies in the spent fuel storage pool is suspended immediately. Suspension of this activity shall not preclude completion of movement of a fuel assembly to a safe position. This effectively precludes a spent fuel handling accident from occurring.

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS This SR verifies that sufficient water is available in the event of a fuel handling accident. The water level in the spent fuel storage pool must be checked periodically. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 10.3.

2. UFSAR, Section 14.6.4.

3. 10 CFR 50.67.

PBAPS UNIT 3 B 3. 7-30 Revision No. 87

AC Sources-Operating B 3.8.1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources-Operating BASES BACKGROUND The unit AC sources for the Class 1E AC Electrical Power Distribution System consist of the offsite power sources, and the onsite standby power sources (diesel generators (DGs)). As required by UFSAR Sections 1.5 and 8.4.2 (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.

The Class 1E AC distribution system is divided into redundant load groups, so loss of any one group does not prevent the minimum safety functions from being performed.

Each load group has connections to two qualified circuits that connect the unit to multiple offsite power supplies and a single DG.

The two qualified circuits between the offsite transmission network and the onsite Class 1E AC Electrical Power Distribution System are supported by multiple, independent offsite power sources. One of these qualified circuits can be connected to either of two offsite sources: the preferred offsite source is the 230 kV Nottingham-Cooper line which supplies the plant through the 230/13.8 kV startup and emergency auxiliary transformer no. 2; the alternate offsite source is the auto-transformer (500/230 kV) at North Substation which feeds a 230/13.8 kV regulating transformer (startup and emergency auxiliary transformer no. 3), the 3SU regulating transformer switchgear, and the 2SUA switchgear. The aligned source is further stepped down via the 2SU startup transformer switchgear through the 13.2/4.16 kV emergency auxiliary transformer no. 2. The other qualified circuit can be connected to either of two offsite sources: the preferred offsite source is the 230 kV Peach Bottom-Newlinville line which supplies a 230/13.8 kV transformer (startup transformer no. 343); the alternate offsite source is the auto-transformer (500/230 kV) at North Substation which feeds a 230/13.8 kV regulating transformer (startup and emergency auxiliary transformer no. 3) and the 3SU regulating transformer switchgear. The aligned source is further stepped down via the 343SU transformer switchgear (continued)

PBAPS UNIT 3 B 3.8-1 Revision No. 83

AC Sources-Operating B 3.8.1 BASES BACKGROUND through the 13.2/4.16 kV emergency auxiliary transformer (continued) no. 3. In addition, the alternate source can only be used to meet the requirements of one offsite circuit. A detailed description of the offsite power network and circuits to the onsite Class 1E ESF buses is found in the UFSAR, Sections 8.3 and 8.4 (Ref. 2).

A qualified offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class 1E emergency bus or buses. The determination of the operability of a qualified source of offsite power is dependent upon grid and plant factors that, when taken together, describe the design basis calculation requirements for voltage regulation. The combination of these factors ensures that the offsite source(s), which provide power to the plant emergency buses, will be fully capable of supporting the equipment required to achieve and maintain safe shutdown during postulated accidents and transients.

The plant factors consist of the status of the Startup Transformers' (2SU, 343SU, 3SU) load tap changers (LTC's), the status of the Safeguard Transformers (2EA and 3EA) and the alignment of the emergency buses on the Safeguard Buses (OOAO19 and OOA020). For an offsite source to be considered operable, its respective LTC's must be in service and in automatic.

The grid factors consist of actual grid voltage levels (real time) and the post trip contingency voltage drop percentage value.

The minimum offsite source voltage levels are established by the voltage regulation calculation. The transmission system operator (TSO) will notify Peach Bottom when an agreed upon limit is approached.

The post trip contingency percentage voltage drop is a calculated value determined by the TSO that would occur as a result of the tripping of one Peach Bottom generator. The TSO will notify Peach Bottom when an agreed upon limit is exceeded.

The voltage regulation calculation establishes the acceptable percentage voltage drop based upon plant configuration.

(continued)

PBAPS UNIT 3 B 3.8-2 Revision No. 90

AC Sources-Operating B 3.8.1 BASES BACKGROUND Due to the 3SU source being derived from the tertiary of the (continued) #1 Auto Transformer, its operability is influenced by both the 500 kV and 230 kV systems. The 2SU and 343SU sources operability is influenced only by the 230 kV system.

Peach Bottom unit post trip contingency voltage drop percentage calculations are performed by the PJM Energy Management System (EMS). The PJM EMS consists of a primary and backup system.

Peach Bottom will be notified if the real time contingency analysis capability of PJM is lost. Upon receipt of this notification, Peach Bottom is to request PJM to provide an assessment of the current condition of the grid based on the tools that PJM has available. The determination of the operability of the offsite sources would consider the assessment provided by PJM and whether the current condition of the grid is bounded by the grid studies previously performed for Peach Bottom.

Variations to any of these factors is permissible, usually at the sacrifice of another factor, based on plant conditions.

Specifics regarding these variations are controlled by plant procedures or by condition specific design calculations.

A description of the Unit 2 offsite power sources is provided in the Bases for Unit 2 LCO 3.8.1, "AC Sources-Operating." The description is identical with the exception that the two offsite circuits provide power to the Unit 2 4 kV emergency buses (i.e., each Unit 3 offsite circuit is common to its respective Unit 2 offsite circuit except for the 4 kV emergency bus feeder breakers).

(continued)

PBAPS UNIT 3 B 3.8-2a Revision No. 90

AC Sources-Operating B 3.8.1 BASES BACKGROUND The onsite standby power source for the four 4 kV emergency (continued) buses in each unit consists of four DGs. The four DGs provide onsite standby power for both Unit 2 and Unit 3.

Each DG provides standby power to two 4 kV emergency buses-one associated with Unit 2 and one associated with Unit 3.

A OG starts automatically on a loss of coolant accident (LOCA) signal (i.e., low reactor water level signal or high drywell pressure signal) from either Unit 2 or Unit 3 or on an emergency bus degraded voltage or undervoltage signal.

After the DG has started, it automatically ties to its respective bus after offsite power is tripped as a consequence of emergency bus undervoltage or degraded voltage, independent of or coincident with a LOCA signal.

The DGs also start and operate in the standby mode without tying to the emergency bus on a LOCA signal alone.

Following the trip of offsite power, all loads are stripped from the emergency bus. When the DG is tied to the emergency bus, loads are then sequentially connected to its respective emergency bus by individual timers associated with each auto-connected load following a permissive from a voltage relay monitoring each emergency bus.

In the event of a loss of both offsite power sources, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown of both units and to mitigate the consequences of a Design Basis Accident (DBA) such as a LOCA. Within 59 seconds after the initiating signal is received, all automatically connected loads needed to recover the unit or maintain it in a safe condition are returned to service. The failure of any one DG does not impair safe shutdown because each DG serves an independent, redundant 4 kV emergency bus for each unit. The remaining DGs and emergency buses have sufficient capability to mitigate the consequences of a DBA, support the shutdown of the other unit, and maintain both units in a safe condition.

Ratings for the DGs satisfy the requirements of Regulatory Guide 1.9 (Ref. 12) except that the loading of DG E2 may I exceed the 2000 hour rating during the first 10 minutes of a DBA LOCA. Each of the four DGs have the following ratings:

a. 2600 kW-continuous,

b. 3000 kW-2000 hours,

c. 3100 kW-200 hours,

d. 3250 kW-30 minutes.

(continued)

PBAPS UNIT 3 B 3.8-3 Revision No. 95

AC Sources-Operating B 3.8.1 BASES (continued)

APPLICABLE The initial conditions of DBA and transient analyses in the SAFETY ANALYSES UFSAR, Chapter 14 (Ref. 4), assume ESF systems are OPERABLE.

The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.5, Emergency Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling (RCIC) System; and Section 3.6, Containment Systems.

The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining the onsite or offsite AC sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC power; and

b. A worst case single failure.

AC sources satisfy Criterion 3 of the NRC Policy Statement.

LCO Two qualified circuits between the offsite transmission network and the onsite Class 1E Distribution System and four separate and independent DGs ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an abnormal operational transient or a postulated DBA. In addition, since some equipment required by Unit 3 is powered from Unit 2 sources (i.e., Containment Atmospheric Dilution System, Standby Gas Treatment System, Emergency Service Water System, Main Control Room Emergency Ventilation System, and Unit 2 125 VDC battery chargers), qualified circuit(s) between the offsite transmission network and the Unit 2 onsite Class 1E distribution subsystem(s) needed to support this equipment must also be OPERABLE.

An OPERABLE qualified Unit 3 offsite circuit consists of the incoming breaker and disconnect to the startup and emergency auxiliary transformer, the respective circuit path to the emergency auxiliary transformer, and the circuit path to at least three Unit 3 4 kV emergency buses including feeder (continued)

PBAPS UNIT 3 B 3.8-4 Revision No. 0

AC Sources--Operating B 3.8.1 BASES LCO breakers to the three Unit 3 4 kV emergency buses. If at (continued) least one of the two circuits does not provide power or is not capable of providing power to all four Unit 3 4 kV emergency buses, then the Unit 3 4 kV emergency buses that each circuit powers or is capable of powering cannot all be the same (i.e., two feeder breakers on one Unit 3 4 kV emergency bus cannot be inoperable). If two feeder breakers are inoperable on the same 4kV bus, then Condition A (and Condition E if an inoperable DG exists) must be entered for one offsite circuit being inoperable even if both offsite circuits otherwise provide power or are capable of providing power to the other three 4kV buses. An OPERABLE qualified Unit 2 offsite circuit's requirements are the same as the Unit 3 circuit's requirements, except that the circuit path, including the feeder breakers, is to the Unit 2 4 kV emergency buses required to be OPERABLE by LCO 3.8.7, "Distribution Systems--Operating." Each offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the emergency buses.

Each DG has two ventilation supply fans; a main supply fan and a supplemental supply fan. The supplemental supply fan provides additional air cooling to the generator area.

Whenever outside air temperature is greater than or equal to 800 F, each DG's main supply fan and supplemental supply fan are required to be OPERABLE for the associated DG to be OPERABLE. Whenever, outside air temperature is less than 80° F, the supplemental supply fan is not required to be OPERABLE for the associated DG to be OPERABLE, however, the main supply fan is required to be OPERABLE for the associated DG to be OPERABLE.

Each DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective Unit 3 4 kV emergency bus on detection of bus undervoltage. This sequence must be accomplished within 10 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the emergency buses. These capabilities are required to be met from a variety of initial conditions, such as DG in standby with the engine hot and DG in standby with the engine at ambient condition. Additional DG capabilities must be demonstrated to meet required Surveillances, e.g., capability of the DG to revert to standby status on an ECCS signal while operating in parallel test mode. Proper sequencing of loads, including tripping of all loads, is a required function for DG OPERABILITY.

(continued)

PBAPS UNIT 3 B 3.8-5 Revision No. 74

AC Sources-Operating B 3.8.1 BASES LCO In addition, since some equipment required by Unit 3 is (continued) powered from Unit 2 sources, the DG(s) capable of supplying the Unit 2 onsite Class 1E AC electrical power distribution subsystem(s) needed to support this equipment must be OPERABLE. The OPERABILITY requirements for these DGs are the same as described above, except that each required DG must be capable of connecting to its respective Unit 2 4 kV emergency bus. (In addition, the Unit 2 ECCS initiation logic SRs are not applicable, as described in SR 3.8.1.21 Bases. )

The AC sources must be separate and independent (to the extent possible) of other AC sources. For the DGs, the separation and independence are complete. For the offsite AC sources, the separation and independence are to the extent practical. A circuit may be connected to more than one 4 kV emergency bus division, with automatic transfer capability to the other circuit OPERABLE, and not violate separation criteria. A circuit that is not connected to at least three 4 kV emergency buses is required to have OPERABLE automatic transfer interlock mechanisms such that it can provide power to at least three 4 kV emergency buses to support OPERABILITY of that circuit.

APPLICABILITY The AC sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of abnormal operational transients; and

b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

The AC power requirements for MODES 4 and 5 are covered in LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 To ensure a highly reliable power source remains with one offsite circuit inoperable, it is necessary to verify the availability of the remaining offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does (continued)

PBAPS UNIT 3 B 3.8-6 Revision No. 53

AC Sources -Operating B 3.8.1 BASES ACTIONS A.1 (continued) not result in a Required Action not met. However, if a second circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition D, for two offsite circuits inoperable, is entered.

A.2 Required Action A.2, which only applies if one 4 kV emergency bus cannot be powered from any offsite source, is intended to provide assurance that an event with a coincident single failure of the associated DG does not result in a complete loss of safety function of critical systems. These features (e.g., system, subsystem, division, component, or device) are designed to be powered from redundant safety related 4 kV emergency buses. Redundant required features failures consist of inoperable features associated with an emergency bus redundant to the emergency bus that has no offsite power.

The Completion Time for Required Action A.2 is intended to allow time for the operator to evaluate and repair any discovered inoperabilities. This Completion Time also allows an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action the Completion Time only begins on discovery that both:

a. A 4 kV emergency bus has no offsite power supplying its loads; and

b. A redundant required feature on another 4 kV emergency bus is inoperable.

If, at any time during the existence of this Condition (one offsite circuit inoperable) a required feature subsequently becomes inoperable, this Completion Time would begin to be tracked.

Discovering no offsite power to one 4 kV emergency bus of the onsite Class 1E Power Distribution System coincident with one or more inoperable required support or supported features, or both, that are associated with any other emergency bus that has offsite power, results in starting the Completion Times for the Required Action. Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before the unit is subjected to transients associated with shutdown.

(continued)

PBAPS UNIT 3 B 3.8-7 Revision No. 5

AC Sources-Operating B 3.8.1 BASES ACTIONS A.2 (continued)

The remaining OPERABLE offsite circuits and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection may have been lost for the required feature's function; however, function is not lost. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

A.3 The 4 kV emergency bus design and loading is sufficient to allow operation to continue in Condition A for a period not to exceed 7 days. With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this condition, however, the remaining OPERABLE offsite circuits and the four DGs are adequate to supply electrical power to the onsite Class 1E Distribution System.

The 7 day Completion Time takes into account the redundancy, capacity, and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

(continued)

PBAPS UNIT 3 B 3.8-8 Revision No. 86

AC Sources-Operating B 3.8.1 BASES ACTIONS B.1 (continued)

The 33 kV Conowingo Tie-Line, using a separate 33/13.8 kV transformer, can be used to supply the circuit normally supplied by startup and emergency auxiliary transformer no.

2. While not a qualified circuit, this alternate source is a direct tie to the Conowingo Hydro Station that provides a highly reliable source of power because: the line and transformers at both ends of the line are dedicated to the support of PBAPS; the tie line is not subject to damage from adverse weather conditions; and, the tie line can be isolated from other parts of the grid when necessary to ensure its availability and stability to support PBAPS. The availability of this highly reliable source of offsite power permits an extension of the allowable out of service time for a DG to 14 days from the discovery of failure to meet LCO 3.8.1.a or b (per Required Action B.5). Therefore, when a DG is inoperable, it is necessary to verify the availability of the Conowingo Tie-Line immediately and once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. The Completion Time of "Immediately" reflects the fact that in order to ensure that the full 14 day Completion Time of Required Action B.5 is available for completing preplanned maintenance of a DG, prudent plant practice at PBAPS dictates that the availability of the Conowingo Tie-Line be verified prior to making a DG inoperable for preplanned maintenance. The Conowingo Tie-Line is available and satisfies the requirements of Required Action B.1 if: 1) the Conowingo line is supplying power to the 13.8kV SBO Switchgear 00A306;

2) all equipment required, per SE-I1, to connect power from the Conowingo Tie-Line to the emergency 4kV buses and to isolate all non-SBO loads from the Conowingo Tie-Line is available and accessible; and 3) communications with the Conowingo control room i-ndicate that required equipment at Conowingo is available. If Required Action B.1 is not met or the (continued)

PBAPS UNIT 3 B 3.8-9 Revision No. 86

AC Sources -Operating B 3.8.1 BASES ACTIONS B.1 (continued) status of the Conowingo Tie-Line changes after Required Action B.1 is initially met, Condition C must be immediately entered.

B.2 To ensure a highly reliable power source remains with one DG inoperable, it is necessary to verify the availability of the required offsite circuits on a more frequent basis.

Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions must then be entered.

B.3 Required Action B.3 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed to be powered from redundant safety related 4 kV emergency buses. Redundant required features failures consist of inoperable features associated with an emergency bus redundant to the emergency bus that has an inoperable DG.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

In this Required Action the Completion Time only begins on discovery that both:

a. An inoperable DG exists; and

b. A redundant required feature on another 4 kV emergency bus is inoperable.

If, at any time during the existence of this Condition (one DG inoperable), a required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

Discovering one DG inoperable coincident with one or more inoperable required support or supported features, or both, that are associated with the OPERABLE DGs results in (continued)

PBAPS UNIT 3 B 3.8-10 Revision No. 5

AC Sources-Operating B 3.8.1 BASES ACTIONS B;3 (continued) starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.

The remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period.

B.4.1 and B.4.2 Required Action B.4.1 provides an allowance to avoid unnecessary testing of OPERABLE DGs. If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DGs, SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on other DG(s), they are declared inoperable upon discovery, and Condition F or H of LCO 3.8.1 is entered, as applicable.

Once the failure is repaired, and the common cause failure no longer exists, Required Action B.4.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DGs, performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of those DGs.

In the event the inoperable DG is restored to OPERABLE status prior to completing either B.4.1 or B.4.2, the PBAPS Corrective Action Program will continue to evaluate the common cause possibility. This continued evaluation, however, isno longer required under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B.

According to Generic Letter 84-15 (Ref. 5), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is a reasonable time to confirm that the OPERABLE DGs are not affected by the same problem as the inoperable DG.

(continued)

PBAPS UNIT 3 B 3.8-11 Revision No. 61

AC Sources -Operating B 3.8.1 BASES ACTIONS B.5 (continued)

The availability of the Conowingo Tie-Line provides an additional source which permits operation to continue in Condition B for a period that should not exceed 14 days from discovery of the failure to meet LCO 3.8.1.a or b. In Condition B, the remaining OPERABLE DGs and the normal offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. The Completion Time of Required Action B.5 takes into account the enhanced reliability and availability of offsite sources due to the Conowingo Tie-Line, the redundancy, capacity, and capability of the other remaining AC sources, reasonable time for repairs of the affected DG, and low probability of a DBA occurring during this period.

The Completion Time for Required Action B.5 also establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet LCO 3.8.1.a or b.

If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently restored OPERABLE, the LCO may already have been not met for up to 7 days. This situation could lead to a total of 14 days, since initial failure of LCO 3.8.1.a or b, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 7 days (for a total of 21 days) allowed prior to complete restoration of the LCO. The 14 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meetLCO 3.8.1.a or

b. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The 14 day Completion Time would also limit the maximum time a DG is inoperable if the status of the Conowingo Tie-Line changes from being available to being not available (this is discussed in Required Action C.1 Bases discussion).

As in Required Action B.3, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This exception results in establishing the "time zero" at the time that the LCO was initially not met, instead of the time that Condition B was entered.

(continued)

PBAPS UNIT 3 B 3.8-12 Revision No. 1

AC Sources-Operating B 3.8.1 BASES ACTIONS B.5 (continued)

The extended Completion Time for restoration of an inoperable DG afforded by the availability of the Conowingo Tie-Line is intended to allow completion of a diesel generator overhaul; however, subject to the diesel generator reliability program, INPO performance criteria, and good operating practices, using the extended Completion Time is permitted for other reasons. Activities or conditions that increase the probability of a loss of offsite power (i.e.,

switchyard maintenance or severe weather) should be considered when scheduling a diesel generator outage. In addition, the effect of other inoperable plant equipment should be considered when scheduling a diesel generator outage.

C.1 If the availability of the Conowingo Tie-Line is not verified within the Completion Time of Required Action B.1, or if the status of the Conowingo Tie-Line changes after Required Action B.1 is initially met, the DG must be restored to OPERABLE status within 7 days. The 7 day Completion Time begins upon entry into Condition C (i.e.,

upon discovery of failure to meet Required Action B.1).

However, the total time to restore an inoperable DG cannot exceed 14 days (per the Completion Time of Required Action B.5).

The 4 kV emergency bus design and loading is sufficient to allow operation to continue in Condition B for a period that should not exceed 7 days, if the Conowingo Tie-Line is not available (refer to Required Action B.1 Bases discussion).

In Condition C, the remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. The 7 day Completion Time takes into account the redundancy, capacity, and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period.

(continued)

PBAPS UNIT 3 B 3.8-13 Revision No. 0

AC Sources-Operating B 3.8.1 BASES ACTIONS D.1 and D.2 (continued)

Required Action D.1 addresses actions to be taken in the event of inoperability of redundant required features concurrent with inoperability of two or more offsite circuits. Required Action D.1 reduces the vulnerability to a loss of function. The Completion Time for taking these actions is reduced to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from that allowed with one 4 kV emergency bus without offsite power (Required Action A.2). The rationale for the reduction to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two offsite circuits inoperable, based upon the assumption that two complete safety divisions are OPERABLE. (While this Action allows more than two circuits to be inoperable, Regulatory Guide 1.93 assumed two circuits were all that were required by the LCO, and a loss of those two circuits resulted in a loss of all offsite power to the Class IE AC Electrical Power Distribution System. Thus, with the Peach Bottom Atomic Power Station design, a loss of more than two offsite circuits results in the same conditions assumed in Regulatory Guide 1.93.) When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are designed with redundant safety related 4 kV emergency buses. Redundant required features failures consist of any of these features that are inoperable because any inoperability is on an emergency bus redundant to an emergency bus with inoperable offsite circuits.

The Completion Time for Required Action D.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. Two or more offsite circuits are inoperable; and

b. A required feature is inoperable.

(continued)

PBAPS UNIT 3 B 3.8-14 Revision No. 0

AC Sources-Operating B 3.8.1 BASES ACTIONS D.1 and D.2 (continued)

If, at any time during the existence of this Condition (two or more offsite circuits inoperable i.e., any combination of Unit 2 and Unit 3 offsite circuits inoperable), a required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition D for a period that should not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This level of degradation means that the offsite electrical power system may not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.

Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable. However, two factors tend to decrease the severity of this degradation level:

a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and

b. The time required to detect and restore an unavailable-offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With two or more of the offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to effect restoration of all but one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

(continued)

PBAPS UNIT 3 B 3.8-15 Revision No.'O

AC Sources-Operating B 3.8.1 BASES ACTIONS D.1 and D.2 (continued)

According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC sources two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If all offsite sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue. If all but one offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance with Condition A.

E.1 and E.2 Pursuant to LCO 3.0.6, the Distribution Systems-Operating ACTIONS would not be entered even if all AC sources to it were inoperable, resulting in de-energization. Therefore, the Required Actions of Condition E are modified by a Note to indicate that when Condition E is entered with no AC source to any 4 kV emergency bus, ACTIONS for LCO 3.8.7, "Distribution Systems-Operating," must be immediately entered. This allows Condition E to provide requirements for the loss of the offsite circuit and one DG without regard to whether a 4 kV emergency bus is de-energized.

LCO 3.8.7 provides the appropriate restrictions for a de-energized 4 kV emergency bus.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition E for a period that should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In Condition E, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition D (loss of two or more offsite circuits). Thisdifference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

(continued)

PBAPS UNIT 3 B 3.8-16 Revision No. 0

AC Sources-Operating B 3.8.1 BASES ACTIONS F.1 (continued)

With two or more DGs inoperable, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions.

Since the offsite electrical power system is the only source of AC power for the majority of ESF equipment at this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown. (The immediate shutdown could cause grid instability, which could result in a total loss of AC power.) Since any inadvertent unit generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

According to Regulatory Guide 1.93 (Ref. 6), with two or more DGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . (Regulatory Guide 1.93 assumed the unit has two DGs. Thus, a loss of both DGs results in a total loss of onsite power. Therefore, a loss of more than two DGs, in the Peach Bottom Atomic Power Station design, results in degradation no worse than that assumed in Regulatory Guide 1.93.)

G.1 If the inoperable AC electrical power source(s) cannot be restored to OPERABLE status within the associated Completion Time (Required Action and associated Completion Time of Condition A, C, D, E, or F not met; or Required Action B.2, B.3, B.4.1, B.4.2, or B.5 and associated Completion Time not met), the unit must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 11) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PBAPS UNIT 3 B 3.8-17 Revision No. 67

AC Sources--Operating B 3.8.1 BASES ACTIONS H.1 (continued)

Condition H corresponds to a level of degradation in which redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system may cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.

SURVEILLANCE The AC sources are designed to permit inspection and REQUIREMENTS testing of all important areas and featuies, especially those that have a standby function, in accordance with UFSAR, Section 1.5.1 (Ref. 7). Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions). The SRs for demonstrating the OPERABILITY of the DGs are consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3),

Regulatory Guide 1.108 (Ref. 8), and Regulatory Guide 1.137 (Ref. 9).

As Noted at the beginning of the SRs, SR 3.8.1.1 through SR 3.8.1.20 are applicable only to the Unit 3 AC sources and SR 3.8.1.21 is applicable only to the Unit 2 AC sources.

Where the SRs discussed herein specify voltage and frequency tolerances, the following summary is applicable. The minimum steady state output voltage of 4160 V corresponds to the minimum steady state voltage analyzed in the PBAPS emergency DG voltage regulation study. This value allows for voltage drops to motors and other equipment down through the 120 V level. The specified maximum steady state output voltage of 4400 V is equal to the maximum steady state operating voltage specified for 4000 V motors. It ensures that for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors is no more than the maximum rated steady state operating voltages. The specified minimum and maximum frequencies of the DG are 58.8 Hz and 61.2 Hz, respectively. These values are equal to +/- 2% of the 60 Hz nominal frequency and are derived from the recommendations found in Regulatory Guide 1.9 (Ref. 3).

The surveillance requirement allowance of +/- 2% for the EDG frequency is intended to allow for EDG transient operations during testing. The nominal frequency value of 60 Hz is credited in plant analyses for ECCS performance.

(continued)

PBAPS UNIT 3 B 3.8-18 Revision No. 72

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.1 REQUIREMENTS (continued) This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source and that appropriate independence of offsite circuits is maintained.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.2 and SR 3.8.1.7 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs have been modified by a Note (Note 2 for SR 3.8.1.2 and Note 1 for SR 3.8.1.7) to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup prior to loading.

For the purposes of this testing, the DGs are started from standby conditions. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.

In order to reduce stress and wear on diesel engines, the manufacturer recommends a modified start in which the starting speed of DGs is limited, warmup is limited to this lower speed, and the DGs are gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of Note 3 to SR 3.8.1.2, which is only applicable when such modified start procedures are recommended by the manufacturer.

SR 3.8.1.7 requires that the DG starts from standby conditions and achieves required voltage and frequency within 10 seconds. The minimum voltage and frequency stated in the SR are those necessary to ensure the (continued)

PBAPS UNIT 3 B 3.8-19 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.7 (continued)

REQUIREMENTS DG can accept DBA loading while maintaining acceptable voltage and frequency levels. Stable operation at the nominal voltage and frequency values is also essential to establishing DG OPERABILITY, but a time constraint is not imposed. This is because a typical DG will experience a period of voltage and frequency oscillations prior to reaching steady state operation if these oscillations are not damped out by load application. The surveillance requirement allowance of +/- 2% for the EDG frequency is intended to allow for EDG transient operations during testing. The nominal frequency value of 60 Hz is credited in plant analyses for ECCS performance. This period may extend beyond the 10 second acceptance criteria and could be a cause for failing the SR. In lieu of a time constraint in the SR, PBAPS will monitor and trend the actual time to reach steady state operation as a means of ensuring there is no voltage regulator or governor degradation which could cause a DG to become inoperable. The 10 second start requirement supports the assumptions in the design basis LOCA analysis of UFSAR, Section 8.5 (Ref. 10). The 10 second start requirement is not applicable to SR 3.8.1.2 (see Note 3 of SR 3.8.1.2), when a modified start procedure as described above is used. If a modified start is not used, the 10 second start requirement of SR 3.8.1.7 applies.

Since SR 3.8.1.7 requires a 10 second start, it is more restrictive than SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2. This procedure is the intent of Note 1 of SR 3.8.1.2.

To minimize testing of the DGs, Note 4 to SR 3.8.1.2 and Note 2 to SR 3.8.1.7 allow a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.8-20 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 REQUIREMENTS (continued) This Surveillance verifies that the DGs are capable of synchronizing and accepting a load approximately equivalent to that corresponding to the continuous rating. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source.

This Surveillance verifies, indirectly, that the DGs are capable of synchronizing and accepting loads equivalent to post accident loads. The DGs are tested at a load approximately equivalent to their continuous duty rating, even though the post accident loads exceed the continuous rating. This is acceptable because regular surveillance testing at post accident loads is injurious to the DG, and imprudent because the same level of assurance in the ability of the DG to provide post accident loads can be developed by monitoring engine parameters during surveillance testing.

The values of the testing parameters can then be qualitatively compared to expected values at post accident engine loads. In making this comparison it is necessary to consider the engine parameters as interrelated indicators of remaining DG capacity, rather than independent indicators.

The important engine parameters to be considered in making this comparison include, fuel rack position, scavenging air pressure, exhaust temperature and pressure, engine output, jacket water temperature, and lube oil temperature. With the DG operating at or near continuous rating and the observed values of the above parameters less than expected post accident values, a qualitative extrapolation which shows the DG is capable of accepting post accident loads can be made without requiring detrimental testing.

Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.8-21 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 (continued)

REQUIREMENTS Note 1 modifies this Surveillance to indicate that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized.

Note 2 modifies this Surveillance by stating that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit do not invalidate the test.

Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.

Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.

To minimize testing of the OGs, Note 5 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units, with the DG synchronized to the 4 kV emergency bus of Unit 3 for one periodic test and synchronized to the 4 kV emergency bus of Unit 2 during the next periodic test. This is allowed since the main purpose of the Surveillance, to ensure DG OPERABILITY, is still being verified on the proper frequency, and each unit's breaker control circuitry, which is only being tested every second test (due to the staggering of the tests),

historically have a very low failure rate. Note 5 modifies the specified frequency for each unit's breaker control circuitry to the total of the combined Unit 2 and Unit 3 frequencies. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit. In addition, if the test is scheduled to be performed on Unit 2, and the Unit 2 TS allowance that provides an exception to performing the test is used (i.e., when Unit 2 is in MODE 4 or 5, or moving irradiated fuel assemblies in the secondary containment, the Note to Unit 2 SR 3.8.2.1 provides an exception to performing this test) or if it is not preferable to perform the test on a unit due to operational concerns (however time is not to exceed the total combined frequency plus grace), then the test shall be performed synchronized to the Unit 3 4 kV emergency bus.

(cnnti numd PBAPS UNIT 3 B 3.8-22 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.4 REQUIREMENTS (continued) This allowance is acceptable provided that the associated unit's breaker control circuitry portion of the Surveillance is performed within the total combined frequency plus SR 3.0.2 allowed grace period or the next scheduled Surveillance after theTechnical Specification allowance is no longer applicable.

This SR provides verification that the level of fuel oil in the day tank is adequate for a minimum of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of DG operation at full load. The level, which includes margin to account for the unusable volume of oil, is expressed as an equivalent volume in gallons.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.5 Microbiological fouling is a major cause of fuel oil degra.dation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Periodic removal of water from the fuel oil day tanks eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR is for preventive maintenance. The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of this Surveillance.

SR 3.8.1.6 This Surveillance demonstrates that each required fuel oil transfer pump operates and automatically transfers fuel oil from its associated storage-tank to its associated day tank.

It is required to support continuous operation of standby power sources. This Surveillance provides assurance that (continued)

PBAPS UNIT 3 B 3.8-23 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6 (continued)

REQUIREMENTS the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.8 Transfer of each 4 kV emergency bus power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit distribution network to power the shutdown loads. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The reason for the Note is that, during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems. This Surveillance tests the applicable logic associated with Unit 3. The comparable test specified in Unit 2 Technical Specifications tests the applicable logic associated with Unit 2. Consequently, a test must be performed within the specified Frequency for each unit. As the Surveillance represents separate tests, the Note (continued)

PBAPS UNIT 3 B 3.8-24 Revision No. 104

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.8 (continued)

REQUIREMENTS specifying the restriction for not performing the test while the unit is in MODE 1 or 2 does not have applicability to Unit 2. The Note only applies to Unit 3, thus the Unit 3 Surveillance shall not be performed with Unit 3 in MODE I or

2. Credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.9 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip. The largest single load for each DG is a residual heat removal pump (2000 bhp). This Surveillance may be accomplished by: 1) tripping the DG output breakers with the DG carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power, or while solely supplying the bus, or 2) tripping its associated single largest post-accident load with the DG solely supplying the bus. Currently, the second option is the method PBAPS utilizes because the first method will result in steady state operation outside the allowable voltage and frequency limits. Consistent with Regulatory Guide 1.9 (Ref. 3), the load rejection test is acceptable if the diesel speed does not exceed the nominal (synchronous) speed plus 75% of the difference between nominal speed and the overspeed trip setpoint, or 115% of nominal speed, whichever is lower.

The time, voltage, and frequency tolerances specified in this SR are derived from Regulatory Guide 1.9 (Ref. 3) recommendations for response during load sequence intervals.

The 1.8 seconds specified for voltage and the 2.4 seconds specified for frequency are equal to 60% and 80%,

respectively, of the 3 second load sequence interval associated with sequencing the next load following the residual heat removal (RHR) pumps during an undervoltage on the bus concurrent with a LOCA. The voltage and frequency specified are consistent with the design range of the (continued)

PBAPS UNIT 3 B 3.8-25 Revision No. 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 (continued)

REQUIREMENTS equipment powered by the DG. SR 3.8.1.9.a corresponds to the maximum frequency excursion, while SR 3.8.1.9.b and SR 3.8.1.9.c provide steady state voltage and frequency values to which the system must recover following load rejection. The surveillance requirement allowance of +/- 2%

for the EDG frequency is intended to allow for EDG transient operations during testing. The nominal frequency value of 60 Hz is credited in plant analyses for ECCS performance.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. Note 1 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of

0.89. This power factor is representative of the actual inductive loading a DG would see under design basis accident conditions. Under certain conditions, however, Note 1 allows the Surveillance to be conducted at a power factor other than

0.89. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to

0.89 results in voltages on the emergency busses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.89 while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the DG excitation levels needed to obtain a power factor of 0.89 may not cause unacceptable voltages on the emergency busses, but the excitation levels are in excess of those recommended for the DG. In such cases, the power factor shall be maintained as close as practicable to 0.89 without exceeding the DG excitation limits.

To minimize testing of the DGs, Note 2 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these.

Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

(continued)

PBAPS UNIT 3 B 3.8-26 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 REQUIREMENTS Consistent with Regulatory Guide 1.9 (Ref. 3),

paragraph C.2.2.8, this Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits. The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG does not trip upon loss of the load. These acceptance criteria provide DG damage protection. While the DG is not expected to experience this transient during an event, and continue to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. Note 1 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of

0.89. This power factor is representative of the actual inductive loading a DG would see under design basis accident conditions. Under certain conditions, however, Note 1 allows the Surveillance to be conducted at a power factor other than

0.89. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to

0.89 results in voltages on the emergency busses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.89 while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the DG excitation levels needed to obtain a power factor of 0.89 may not cause unacceptable voltages on the emergency busses, (rnnti nuPd)

PBAPS UNIT 3 B 3.8-27 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS but the excitation levels are in excess of those recommended for the DG. In such cases, the power factor shall be maintained as close as practicable to 0.89 without exceeding the OG excitation limits. To minimize testing of the DGs, Note 2 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

SR 3.8.1.11 Consistent with Regulatory Guide 1.9 (Ref. 3),

paragraph C.2.2.4, this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of all loads and energization of the emergency buses and respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.

The DG auto-start and energization of the associated 4 kV emergency bus time of 10 seconds is derived from requirements of the accident analysis for responding to a design basis large break LOCA. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.

(continued)

PBAPS UNIT 3 B 3.8-27a Revision No. 58 I

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS The requirement to verify the connection and power supply of auto-connected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, or systems are not capable of being operated at full flow, or RHR systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of the connection and loading of these loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs shall be started from standby conditions, that is, with the engine coolant and oil being continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical-distribution system, and challenge safety systems. This Surveillance tests the applicable logic associated with Unit 3. The comparable test specified in the Unit 2 Technical Specifications tests the applicable logic associated with Unit 2. Consequently, a test must be performed within the specified Frequency for each unit. The surveillance requirement allowance of +/- 2% for the EDG frequency is intended to allow for EDG transient operations during testing. The nominal frequency value of 60 Hz is credited in plant analyses for ECCS performance. As the Surveillance represents separate tests, the Note specifying the restriction for not performing the test while the unit is in MODE 1, 2, or 3 does not have applicability to Unit 2.

The Note only applies to Unit 3, thus the Unit 3 Surveillances shall not be performed with Unit 3 in MODE 1, 2, or 3. Credit may be taken for unplanned events that satisfy this SR.

(continued)

PBAPS UNIT 3 B3.8-28 Revision No. 87

AC Sources--Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.12 (continued)

Consistent with Regulatory Guide 1.9 (Ref. 3),

paragraph C.2.2.5, this Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (10 seconds) from the design basis actuation signal (LOCA signal) and operates for Ž 5 minutes. The minimum voltage and frequency stated in the SR are those necessary to ensure the DG can accept DBA loading while maintaining acceptable voltage and frequency levels. The surveillance requirement allowance of

+/- 2% for the EDG frequency is intended to allow for EDG transient operations during testing. The nominal frequency value of 60 Hz is credited in plant analyses for ECCS performance. Stable operation at the nominal voltage and frequency values is also essential to establishing DG OPERABILITY, but a time constraint is not imposed. This is because a typical DG will experience a period of voltage and frequency oscillations prior to reaching steady state operation if these oscillations are not damped out by load application. This period may extend beyond the 10 second acceptance criteria and could be a cause for failing the SR.

In lieu of a time constraint in the SR, PBAPS will monitor and trend the actual time to reach steady state operation as a means of ensuring there is no voltage regulator or governor degradation which could cause a DG to become inoperable. The 5 minute period provides sufficient time to demonstrate stability. SR 3.8.1.12.d and SR 3.8.1.12.e ensure that permanently connected loads and emergency loads are energized from the offsite electrical power system on a LOCA signal without loss of offsite power.

The requirement to verify the connection and power supply of permanent and autoconnected loads is intended to satisfactorily show the relationship of these loads to the loading logic for loading onto offsite power. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, ECCS injection valves are not desired to be stroked open, ECCS systems are not capable of being operated at full flow, or RHR systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of the connection and loading of these loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

(continued)

PBAPS UNIT 3 B 3.8-29 Revision No. 72

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The reason for the Note is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil being continuously circulated and temperature maintained consistent with manufacturer recommendations.

SR 3.8.1.13 Consistent with Regulatory Guide 1.9 (Ref. 3),

paragraph C.2.2.12, this Surveillance demonstrates that DG noncritical protective functions (e.g., high jacket water temperature) are bypassed on an ECCS initiation test signal.

Noncritical automatic trips are all automatic trips except:

engine overspeed, generator differential overcurrent, generator ground neutral overcurrent, and manual cardox initiation. The noncritical trips are bypassed during DBAs and continue to provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The DG availability t.o mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG. DG emergency automatic trips will be tested periodically per the station periodic maintenance program.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

To minimize testing of the DGs, the Note to this SR allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

(continued)

PBAPS UNIT 3 B 3.8-30 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 REQUIREMENTS (continued) Consistent with Regulatory Guide 1.9 (Ref. 3),

paragraph C.2.2.9, this Surveillance requires demonstration that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

However, load values may deviate from the Regulatory Guide such that the DG operates for 22 hours2.546296e-4 days 0.00611 hours 3.637566e-5 weeks 8.371e-6 months at a load approximately equivalent to 92% to 108% of the continuous duty rating of the DG, and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of which is at a load approximately equivalent to 108% to 115% of the continuous duty rating of the DG. The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelube and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.

This Surveillance verifies, indirectly, that the DGs are capable of synchronizing and accepting loads equivalent to post accident loads. The DGs are tested at a load approximately equivalent to their continuous duty rating, even though the post accident loads exceed the continuous rating. This is acceptable because regular surveillance testing at post accident loads is injurious to the DG, and imprudent because the same level of assurance in the ability of the DG to provide post accident loads can be developed by monitoring engine parameters during surveillance testing.

The values of the testing parameters can then be qualitatively compared to expected values at post. accident engine loads. In making this comparison it is necessary to consider the engine parameters as interrelated indicators of remaining DG capacity, rather than independent indicators.

The important engine parameters to be considered in making this comparison include, fuel rack position, scavenging air pressure, exhaust temperature and pressure, engine output, jacket water temperature, and lube oil temperature. With the DG operating at or near continuous rating and the observed values of the above parameters less than expected post accident values, a qualitative extrapolation which shows the DG is capable of accepting post accident loads can be made without requiring detrimental testing.

(continued)

PBAPS UNIT 3 B 3.8-31 Revision No. 58 N

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS A load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This Surveillance has been modified by three Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit do not invalidate the test. Note 2 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of

0.89. This power factor is representative of the actual inductive loading a DG would see under design basis accident conditions. Under certain conditions, however, Note 2 allows the Surveillance to be conducted at a power factor other than

0.89. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to ! 0.89 results in voltages on the emergency busses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.89 while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the DG excitation levels needed to obtain a power factor of 0.89 may not cause unacceptable voltages on the emergency busses, but the excitation levels are in excess of those recommended for the DG. In such cases, the power factor shall be maintained as close as practicable to 0.89 without exceeding the DG excitation limits. To minimize testing of the DGs, Note 3 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

SR 3.8.1.15 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 10 seconds. The minimum voltage and frequency stated in the SR are those necessary to ensure the DG can accept DBA loading while maintaining acceptable voltage and frequency levels. Stable operation at the nominal voltage and frequency values is also essential to establishing DG OPERABILITY, but a time constraint is not imposed. This is because a typical DG will experience a (continued)

PBAPS UNIT 3 B 3.8-32 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.15 (continued)

REQUIREMENTS period of voltage and frequency oscillations prior to reaching steady state operation if these oscillations are not damped out by load application. The surveillance requirement allowance of +/- 2% for the EDG frequency is intended to allow for EDG transient operations during testing. The nominal frequency value of 60 Hz is credited in plant analyses for ECCS performance. This period may extend beyond the 10 second acceptance criteria and could be a cause for failing the SR. In lieu of a time constraint in the SR, PBAPS will monitor and trend the actual time to reach steady state operation as a means of ensuring there is no voltage regulator or governor degradation which could cause a DG to become inoperable. The 10 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by three Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The requirement that the diesel has operated for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months at full load conditions prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. The load band is provided to avoid routine overloading of the DG. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing. To minimize testing of the DGs, Note 3 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

SR 3.8.1.16 Consistent with Regulatory Guide 1.9 (Ref. 3),

paragraph C.2.2.11, this Surveillance ensures that the manual synchronization and load transfer from the DG to the offsite source can be made and that the DG can be returned (continued)

PBAPS UNIT 3 B 3.8-33 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.16 (continued)

REQUIREMENTS to ready-to-load status when offsite power is restored. It also ensures that the auto-start logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs.

The DG is considered to be in ready-to-load status when the DG is at rated speed and voltage, the output breaker is open and can receive an auto-close signal on bus undervoltage, and individual load timers are reset.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical.

distribution system, and challenge safety systems. This Surveillance tests the applicable logic associated with Unit 3. The comparable test specified in the Unit 2 Technical Specifications tests the applicable logic associated with Unit 2. Consequently, a test must be performed within the specified Frequency for each unit. As the Surveillance represents separate tests, the Note specifying the restriction for not performing the test while the unit is in MODE 1, 2, or 3 does not have applicability to Unit 2. The Note only applies to Unit 3, thus the Unit 3 Surveillances shall not be performed with Unit 3 in MODE 1, 2, or 3. Credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.17 Consistent with Regulatory Guide 1.9 (Ref 3),

paragraph C.2.2.13, demonstration of the test mode override ensures that the DG availability under accident conditions is not compromised as the result of testing. Interlocks to the LOCA sensing circuits cause the DG to automatically reset to ready-to-load operation if a Unit 3 ECCS initiation signal is received during operation in the test mode while synchronized to either Unit 2 or a Unit 3 4 kV emergency bus. Ready-to-load operation is defined as the DG running at rated speed and voltage with the DG output breaker open.

(continued)

PBAPS UNIT 3 B 3.8-34 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.17 (continued)

REQUIREMENTS The requirement to automatically energize the emergency loads with offsite power ensures that the emergency loads will connect to an offsite source. This is performed by ensuring that the affected 4 kV bus remains energized following a simulated LOCA trip of the DG output breaker, and ensuring 4kV and ECCS logic performs as designed to connect all emergency loads to an offsite source. The requirement for 4kV bus loading is covered by overlapping SRs specified in Specification 3.8.1, "AC Sources-Operating" and 3.3.5.1 "ECCS Instrumentation". In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the emergency loads to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading is verified.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

To minimize testing of the DGs, the Note allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

SR 3.8.1.18 Under accident and loss of offsite power conditions, loads are sequentially connected to the bus by individual load timers. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs due to high motor starting currents. The 10% load sequence time interval tolerance ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated. Reference 10 provides a summary of the automatic loading of emergency buses.

(conti nipd)

PBAPS UNIT 3 B 3.8-35 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.18 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This Surveillance tests the applicable logic associated with Unit 3. The comparable test specified in the Unit 2 Technical Specifications tests the applicable logic associated with Unit 2. Consequently, a test must be performed within the specified Frequency for each unit. As the Surveillance represents separate tests, the Note specifying the restriction for not performing the test while the unit is in MODE 1, 2, or 3 does not have applicability to Unit 3. The Note only applies to Unit 3, thus the Unit 3 Surveillances shall not be performed with Unit 3 in MODE 1, 2, or 3. Credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.19 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.

This Surveillance demonstrates DG operation, as discussed in the Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal in conjunction with an ECCS initiation signal. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.8-36 Revision No. 87

AC Sources--Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.19 (continued)

REQUIREMENTS This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil being continuously circulated and temperature maintained consistent with manufacturer recommendations. The surveillance requirement allowance of +/- 2% for the EDG frequency is intended to allow for EDG transient operations during testing. The nominal frequency value of 60 Hz is credited in plant analyses for ECCS performance. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This Surveillance tests the applicable logic associated with Unit 3. The comparable test specified in the Unit 2 Technical Specifications tests the applicable logic associated with Unit 2. Consequently, a test must be performed within the specified Frequency for each unit. As the Surveillance represents separate tests, the Note specifying the restriction for not performing the test while the unit is in MODE 1, 2, or 3 does not have applicability to Unit 2. The Note only applies to Unit 3, thus the Unit 3 Surveillances shall not be performed with Unit 3 in MODE 1, 2, or 3. Credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.20 This Surveillance demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously.

The minimum voltage and frequency stated in the SR are those necessary to ensure the DG can accept DBA loading while maintaining acceptable voltage and frequency levels. The surveillance requirement allowance of +/- 2% for the EDG frequency is intended to allow for EDG transient operations during testing. The nominal frequency value of 60 Hz is credited in plant analyses for ECCS performance. Stable operation at the nominal voltage and frequency values is also essential to establishing DG OPERABILITY, but a time constraint is not imposed. This is because a typical DG will experience a period of voltage and frequency oscillations prior to reaching steady state operation if these oscillations are not damped out by load application.

This period may extend beyond the 10 second acceptance criteria and could be a cause for failing the SR. In lieu of a time constraint in the SR, PBAPS will monitor and trend the actual time to reach steady state operation as a means of ensuring there is no voltage regulator or governor degradation which could cause a DG to become inoperable.

(continued)

PBAPS UNIT 3 B 3.8-37 Revision No. 72

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.20 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR is modified by two Notes. The reason for Note 1 is to minimize wear on the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. To minimize testing of the DGs, Note 2 allows a single test (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If a DG fails one of these Surveillances, a DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

SR 3.8.1.21 With the exception of this Surveillance, all other Surveillances of this Specification (SR 3.8.1.1 through SR 3.8.1.20) are applied only to the Unit 3 AC sources.

This Surveillance is provided to direct that the appropriate Surveillances for the required Unit 2 AC sources are governed by the applicable Unit 2 Technical Specifications.

Performance of the applicable Unit 2 Surveillances will satisfy Unit 2 requirements, as well as satisfying this Unit 3 Surveillance Requirement. Six exceptions are noted to the Unit 2 SRs of LCO 3.8.1. SR 3.8.1.8 is excepted when only one Unit 2 offsite circuit is required by the Unit 3 Specification, since there is not a second circuit to transfer to. SR 3.8.1.12, SR 3.8.1.13, SR 3.8.1.17, SR 3.8.1.18 (ECCS load block requirements only), and SR 3.8.1.19 are excepted since these SRs test the Unit 2 ECCS initiation signal, which is not needed for the AC sources to be OPERABLE on Unit 3.

The Frequency required by the applicable Unit 2 SR also governs performance of that SR for Unit 3.

As Noted, if Unit 2 is in MODE 4 or 5, or moving irradiated fuel assemblies i'n the secondary containment, the Note to Unit 2 SR 3.8.2.1 is applicable. This ensures that a Unit 3 SR will not require a Unit 2 SR to be performed, when the (rnntinijpd)

PBAPS UNIT 3 B 3.8-38 Revision No. 87

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.21 (continued)

REQUIREMENTS Unit 2 Technical Specifications exempts performance of a Unit 2 SR (However, as stated in the Unit 2 SR 3.8.2.1 Note, while performance of an SR is exempted, the SR still must be met).

REFERENCES 1. UFSAR, Sections 1.5 and 8.4.2.

2. UFSAR, Sections 8.3 and 8.4.

3. Regulatory Guide 1.9, July 1993.

4. UFSAR, Chapter 14.

5. Generic Letter 84-15.

6. Regulatory Guide 1.93, December 1974.

7. UFSAR, Section 1.5.1.

8. Regulatory Guide 1.108, August 1977.

9. Regulatory Guide 1.137, October 1979.

10. UFSAR, Section 8.5.

11. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

12. Regulatory Guide 1.9 (Safety Guide 9), March 1971.

PBAPS UNIT 3 B 3.8-39 Revision No. 95

AC Sources-Shutdown B 3.8.2 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.2 AC Sources-Shutdown BASES BACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1, "AC Sources-Operating."

APPLICABLE The OPERABILITY of the minimum AC sources during MODES 4 SAFETY ANALYSES and 5 and during movement of irradiated fuel assemblies in secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident.

In general, when the unit is shut down the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or loss of all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, and 3 have no specific analyses in MODES 4 and 5. Worst case bounding events are deemed not credible in MODES 4 and 5 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and corresponding stresses result in the probabilities of occurrences significantly reduced or eliminated, and minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.

During MODES 1, 2, and 3, various deviations from the analysis assumptions and design requirements are allowed within the ACTIONS. This allowance is in recognition that (continued)

PBAPS UNIT 3 B 3.8-40 Revision No. 0

AC Sources-Shutdown B 3.8.2 BASES APPLICABLE certain testing and maintenance activities must be SAFETY ANALYSES conducted, provided an acceptable level of risk is not (continued) exceeded. During MODES 4 and 5, performance of a significant number of required testing and maintenance activities is also required. In MODES 4 and 5, the activities are generally planned and administratively controlled. Relaxations from typical MODES 1, 2, and 3 LCO requirements are acceptable during shutdown MODES, based on:

a. The fact that time in an outage is limited. This is a risk prudent goal as well as a utility economic consideration.

b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operation MODE analyses, or both.

c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.

d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODES 1, 2, and 3 OPERABILITY requirements) with systems assumed to function during an event.

In the event of an accident during shutdown, this LCO ensures the capability of supporting systems necessary for avoiding immediate difficulty, assuming either a loss of all offsite power or a loss of all onsite (diesel generator (DG)) power.

The AC sources satisfy Criterion 3 of the NRC Policy Statement.

LCO One offsite circuit supplying the Unit 3 onsite Class 1E power distribution subsystem(s) of LCO 3.8.8, "Distribution Systems-Shutdown," ensures that all required Unit 3 powered loads are powered from offsite power. Two OPERABLE DGs, associated with the Unit 3 onsite Class 1E power distribution subsystem(s) required OPERABLE by LCO 3.8.8, ensures that a diverse power source is available for providing electrical power support assuming a loss of the (continued)

PBAPS UNIT 3 B 3.8-41 Revision No.. 0

AC Sources-Shutdown B 3.8.2 BASES LCO offsite circuit. In addition some equipment that may be (continued) required by Unit 3 is powered from Unit 2 sources (e.g.,

Containment Atmospheric Dilution System, Standby Gas Treatment System, Emergency Service Water System, and:Main Control Room Emergency Ventilation System). Therefore, qualified circuits between the offsite transmission network and th'e Unit 2 onsite Class 1E AC electrical power distribution subsystem(s), and the DG(s) (not necessarily different DG(s) from those being used to meet LCO 3.8.2.b requirements) capable of supplying power to the required Unit 2 subsystems of each of the required components must also be OPERABLE'. Together, OPERABILITY of the required offsite circuit(s) and required DG(s) ensures the availability of sufficient AC sources to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents and reactor vessel draindown). Automatic initiation of the required DG during shutdown conditions is specified in LCO 3.3.5.1, ECCS Instrumentation, and LCO 3.3.8.1, LOP Instrumentation.

The qualified Unit 3 offsite circuit must be capable of maintaining rated frequency and voltage while connected to the respective Unit 3 4 kV emergency bus(es), and of accepting required loads during an accident. Qualified offsite circuits are those that are described in the UFSAR, Technical Specification Bases Section 3.8.1 and are part of the licensing basis for the unit. A Unit 3 offsite circuit consists of the incoming breaker and disconnect to the startup and emergency auxiliary transformer, the respective circuit path to the emergency auxiliary transformer and the circuit path to the Unit 3 4 kV emergency buses required by LCO 3.8.8, including feeder breakers to the required Unit 3 4 kV emergency buses. A qualified Unit 2 offsite circuit's requirements are the same as the Unit 3 circuit's requirements, except that the circuit path, including the feeder breakers, is to the Unit 2 4 kV emergency buses required to be OPERABLE by LCO 3.8.8.

The required DGs must be capable of starting, accelerating to rated speed and voltage, and connecting to their respective Unit 3 emergency bus on detection of bus undervoltage. This sequence must be accomplished within 10 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the 4 kV emergency buses. These capabilities are required to be met from a variety of initial conditions such as DG in standby with engine hot and DG in standby with engine at ambient conditions. Additional (continued)

PBAPS UNIT 3 B 3.8-42 Revision No. 58

AC Sources-Shutdown B 3.8.2 BASES LCO DG capabilities must be demonstrated to meet required (continued) Surveillances, e.g., capability of the DG to revert to standby status on an ECCS signal while operating in parallel test mode. Proper sequencing of loads is a required function for DG OPERABILITY. The necessary portions of the Emergency Service Water System are also required to provide appropriate cooling to each required DG.

The OPERABILITY requirements for the DG capable of supplying power to the Unit 2 powered equipment are the same as described above, except that the required DG must be capable of connecting to its respective Unit 2 4 kV emergency bus.

(In addition, the Unit 2 ECCS initiation logic SRs are not applicable, as described in SR 3.8.2.2 Bases.)

It is acceptable for 4 kV emergency buses to be cross tied during shutdown conditions, permitting a single offsite power circuit to supply all required buses. No automatic transfer capability is required for offsite circuits to be considered OPERABLE.

APPLICABILITY The AC sources are required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment to provide assurance that:

a. Systems providing adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core in case of an inadvertent draindown of the reactor vessel;

b. Systems needed to mitigate a fuel handling accident are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

AC power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.1.

(continued)

PBAPS UNIT 3 B 3.8-43 Revision No. 0

AC Sources-Shutdown B 3.8.2 BASES (continued)

ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement-can occur in MODE 1, 2, or 3, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be sufficient reason to require a reactor shutdown.

A.1 and B.1 With one or more required offsite circuits inoperable, or with one DG inoperable, the remaining required sources may be capable of supporting sufficient required features (e.g.,

system, subsystem, division, component, or device) to allow continuation of CORE ALTERATIONS, fuel movement, and operations with a potential for draining the reactor vessel.

For example, if two or more 4 kV emergency buses are required per LCO 3.8.8, one 4 kV emergency bus with offsite power available may be capable of supplying sufficient required features. By the allowance of the option to declare required features inoperable that are not powered from offsite power (Required Action A.1) or capable of being powered by the required DG (Required Action B.I),

appropriate restrictions can be implemented in accordance with the affected feature(s) LCOs' ACTIONS. Required features remaining powered from a qualified offsite power circuit, even if that circuit is considered inoperable because it is not powering other required features, are not declared inoperable by this Required Action. If a single DG is credited with meeting both LCO 3.8.2.d and one of the DG requirements of LCO 3.8.2.b, then the required features remaining capable of being powered by the DG are not declared inoperable by this Required Action, even if the DG is considered inoperable because it is not capable of powering other required features.

A.2.1. A.2.2. A.2.3. A.2.4. B.2.1, B.2.2, B.2.3. B.2.4. C.1, C.2, C.3, and C.4 With an offsite circuit not available to all required 4 kV emergency buses or one required DG inoperable, the option still exists to declare all required features inoperable (continued)

PBAPS UNIT 3 B 3.8-44 Revision No. 0

AC Sources-Shutdown B 3.8.2 BASES ACTIONS A.2.1, A.2.2, A.2.3. A.2.4, B.2.1. B.2.2, B.2.3, B.2.4, C.1, C.2, C.3. and C.4 (continued)

(per Required Actions A.1 and B.1). Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. With two or more required DGs inoperable, the minimum required diversity of AC power sources may not be available. It is, therefore, required to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies in the secondary containment, and activities that could result in inadvertent draining of the reactor vessel.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.

These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the plant safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power.

Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore, the Required Actions of Condition A have been modified by a Note to indicate that when Condition A is entered with no AC power to any required 4 kV emergency bus, ACTIONS for LCO 3.8.8 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite circuit whether or not a required bus is de-energized. LCO 3.8.8 provides the appropriate restrictions for the situation involving a de-energized bus.

SURVEILLANCE SR 3.8.2.1 REQUIREMENTS SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the Unit 3 AC sources in other than MODES 1, 2, and 3. SR 3.8.1.8 is not (continued)

PBAPS UNIT 3 B 3.8-45 Revision No. 0

AC Sources -Shutdown B 3.8.2 BASES SURVEILLANCE SR 3.8.2.1, (continued)

REQUIREMENTS required to be met since only one offsite circuit is required to be OPERABLE. SR 3.8.1.17 is not required to be met because the required OPERABLE DG(s) is not required to undergo periods of being synchronized to the offslte circuit. SR 3.8.1.20 is excepted because starting independence is not required with the DG(s) that is not required to be OPERABLE. Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR.

This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DG(s) from being paralleled with the offslte power network or otherwise rendered inoperable during the performance of SRs, and to preclude de-energizing a required 4 kV emergency bus or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit and the DG. It is the intent that these SRs must still be capable of being met, but actual performance is not required during periods when the DG and offsite circuit are required to be OPERABLE.

This SR is modified by a second Note. The reason for the Note is to preclude requiring the automatic functions of the DG(s) on an ECCS initiation to be functional during periods when ECCS are not required. Periods in which ECCS are not required are specified in LCO 3.5.2, "ECCS - Shutdown".

SR 3.8.2.2 This Surveillance is provided to direct that the appropriate Surveillances for the required Unit 2 AC sources are governed by the Unit 2 Technical Specifications.

Performance of the applicable Unit 2 Surveillances will satisfy Unit 2 requirements, as well as satisfying this Unit 3 Surveillance Requirement. Seven exceptions are noted to the Unit 2 SRs of LCO 3.8.1. SR 3.8.1.8 is excepted when only one Unit 2 offsite circuit is required by the Unit 3 Specification, since there is not a second circuit to transfer to. SR 3.8.1.12, SR 3.8.1.13, SR 3.8.1.17, SR 3.8.1.18 (ECCS load block requirements only), and SR 3.8.1.19 are excepted since these SRs test the Unit 2 ECCS initiation signal, which is not needed for the AC sources to be OPERABLE on Unit 3. SR 3.8.1.20 is excepted since starting independence is not required with the DG(s) that is not required to be OPERABLE.

(continued)

PBAPS UNIT 3 B 3.8-46 Revision No. i6 Amendment No. 6

AC Sources- Shutdown B 3.8.2 BASES SURVEILLANCE S 3... 2 (continued)

REQUIREMENTS The Frequency required by the applicable Unit 2 SR also governs performance of that SR for Unit 3.

As Noted, if Unit 2 is not in MODE 1, 2, or 3, the Note to Unit 2 SR 3.8.2.1 is applicable. This ensures that a Unit 3 SR will not require a Unit 2 SR to be performed, when the Unit 2 Technical Specifications exempts performance of a Unit 2 SR or when Unit 2 is defueled. (However, as stated in the Unit 2 SR 3.8.2.1 Note, while performance of an SR is exempted, the SR still must be met).

REFERENCES None.

PBAPS UNIT 3 B 3.8-47 Revision No. 18 Amendment No. 226

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air BASES BACKGROUND Each of the four diesel generators (DGs) is provided with an associated storage tank which collectively have a fuel oil capacity sufficient to operate all four DGs for a period of 7 days while the DG is supplying maximum post loss of coolant accident (LOCA) load demand discussed in UFSAR, Section 8.5.2 (Ref. 1). The maximum load demand is calculated using the time dependent loading of each DG and the assumption that all four DGs are available. This onsite fuel oil capacity is sufficient to operate the DGs for longer than the time to replenish the onsite supply from outside sources. Post accident electrical loading and fuel consumption is not equally shared among the DGs. Therefore, it may be necessary to transfer post accident loads between DGs or to transfer fuel oil between storage tanks to achieve 7 days of post accident operation for all four DGs. Each storage tank contains sufficient fuel to support the operation of the DG with the heaviest load (with four DGs available) for greater than 6 days with 31,000 gallons initially in each tank.

Each DG is equipped with a day tank and an associated fuel transfer pump that will automatically transfer oil from a fuel storage tank to the day tank of the associated DG when actuated by a float switch in the day tank. Additionally, the capability exists to transfer fuel oil between storage tanks. Redundancy of pumps and piping precludes the failure of one pump, or the rupture of any pipe, valve, or tank to result in the loss of more than one DG. All outside tanks and piping are located underground.

For proper operation of the standby DGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses the recommended fuel oil practices as supplemented by ANSI N195 (Ref. 3). The fuel oil properties governed by these SRs are the water and sediment content, the kinematic viscosity, specific gravity (or API gravity), and impurity level.

(continued)

PBAPS UNIT 3 B 3.8-48 Revision No. 105

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES BACKGROUND The DG lubrication system is designed to provide sufficient (continued) lubrication to permit proper operation of its associated DG under all loading conditions. The system is required to circulate the lube oil to the diesel engine working surfaces and to remove excess heat generated by friction during operation. Each engine oil sump and associated lube oil storage tank contain an inventory capable of supporting a minimum of 7 days of operation. Each lube oil sump utilizes a mechanical float-type level controller to automatically maintain the sump at the "full level running" level via gravity feed from the associated lube oil storage tank.

Onsite storage of lube oil also helps ensure a 7 day supply is maintained. This supply is sufficient to allow the operator to replenish lube oil from outside sources.

Each DG has an air start system that includes two air start receivers; each with adequate capacity for five successive normal starts on the DG without recharging the air start receiver.

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in UFSAR, Chapter 8 (Ref. 4), and Chapter 14 (Ref. 5), assume Engineered Safety Feature (ESF) systems are OPERABLE. The DGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.5, Emergency Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling (RCIC) System; and Section 3.6, Containment Systems.

Since diesel fuel oil, lube oil, and starting air subsystem support the operation of the standby AC power sources, they satisfy Criterion 3 of the NRC Policy Statement.

LCO Stored diesel fuel oil is required to have sufficient supply for 7 days of operation at the worst case post accident time-dependent load profile. It is also required to meet specific standards for quality. Additionally, sufficient lube oil supply must be available to ensure the capability to operate at full load for 7 days. This requirement, in (continued)

PBAPS UNIT 3 B 3.8-49 Revision No. 0

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES LCO conjunction with an ability to obtain replacement supplies (continued) within 7 days, supports the availability of DGs required to shut down both the Unit 2 and Unit 3 reactors and to maintain them in a safe condition for an abnormal operational transient or a postulated DBA in one unit with loss of offsite power. DG day tank fuel oil requirements, as well as transfer capability from the storage tank to the day tank, are addressed in LCO 3.8.1, "AC Sources-Operating," and LCO 3.8.2, "AC Sources-Shutdown."

The starting air system is required to have a minimum capacity for five successive DG normal starts without recharging the air start receivers. Only one air start receiver per DG is required, since each air start receiver has the required capacity.

APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the availability of the required power to shut down both the Unit 2 and Unit 3 reactors and maintain them in a safe shutdown condition after an abnormal operational transient or a postulated DBA in either Unit 2 or Unit 3.

Because stored diesel fuel oil, lube oil, and starting air subsystem support LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil, lube oil, and starting air are required to be within limits when the associated DG is required to be OPERABLE.

ACTIONS The Actions Table is modified by a Note indicating that separate Condition entry is allowed for each DG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable DG subsystem. Complying with the Required Actions for one inoperable DG subsystem may allow for continued operation, and subsequent inoperable DG subsystem(s) are governed by separate Condition entry and application of associated Required Actions.

(continued)

PBAPS UNIT 3 B 3.8-50 Revision No. 0

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS A.1 (continued)

With fuel oil level < 31,000 gal in a storage tank (which includes margin for the unusable volume of oil), the 7 day fuel oil supply for a DG is not available. However, the Condition is restricted to fuel oil level reductions that maintain at least a 6 day supply (with fuel oil transfer between storage tanks). These circumstances may be caused by events such as:

a. Full load operation required for an inadvertent start while at minimum required level; or

b. Feed and bleed operations that may be necessitated by increasing particulate levels or any number of other oil quality degradations.

This restriction allows sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of the fuel oil to the tank. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration of the required level prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity (> 6 days), the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period.

B.1 With lube oil inventory < 350 gal, sufficient lube oil to support 7 days of continuous DG operation at full load conditions may not be available. However, the Condition is restricted to lube oil volume reductions that maintain at least a 6 day supply. This restriction allows sufficient time for obtaining the requisite replacement volume. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration of the required volume prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity (> 6 days), the low rate of usage, the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period.

(continued)

PBAPS UNIT 3 B 3.8-51 Revision No. 105

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS C.1 (continued)

This Condition is entered as a result of a failure to meet the acceptance criterion for particulates. Normally, trending of particulate levels allows sufficient time to correct high particulate levels prior to reaching the limit of acceptability. Poor sample procedures (bottom sampling),

contaminated sampling equipment, and errors in laboratory analysis can produce failures that do not follow a trend.

Since the presence of particulates does not mean failure of the fuel oil to burn properly in the diesel engine, since particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and since proper engine performance has been recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated DG inoperable. The 7 day Completion Time allows for further evaluation, resampling, and re-analysis of the DG fuel oil.

D.1 With the new fuel oil properties defined in the Bases for SR 3.8.3.3 not within the required limits, a period of 30 days is allowed for restoring the stored fuel oil properties. This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, or to restore the stored fuel oil properties. This restoration may involve feed and bleed procedures, filtering, or combination of these procedures. Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits, there is high likelihood that the DG would still be capable of performing its intended function.

E.1 With required starting air receiver pressure < 225 psig, sufficient capacity for five successive DG normal starts does not exist. However, as long as the receiver pressure is > 150 psig, there is adequate capacity for at least one start attempt, and the DG can be considered OPERABLE while (continued)

PBAPS UNIT 3 B 3.8-52 Revision No. 0

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS E.1 (continued) the air receiver pressure is restored to the required limit.

A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration to the required pressure prior to declaring the DG inoperable. This period is acceptable based on the remaining air start capacity, the fact that most DG starts are accomplished on the first attempt, and the low probability of an event during this brief period.

F.1 With a Required Action and associated Completion Time of Condition A, B, C, D, or E not met, or the stored diesel fuel oil, lube oil, or starting air subsystem not within limits for reasons other than addressed by Conditions A through E, the associated DG may be incapable of performing its intended function and must be immediately declared inoperable.

SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate useable inventory of fuel oil in the storage tanks to support each DG's operation of all four DGs for 7 days at the worst case post accident time-dependent load profile.

The 7 day period is sufficient time to place both Unit 2 and Unit 3 in a safe shutdown condition and to bring in replenishment fuel from an offsite location.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.3.2 This Surveillance ensures that sufficient lubricating oil inventory (combined inventory in the DG lube oil sump, lube oil storage tank, and in the warehouse) is available to support at least 7 days of full load operation for each DG.

The 350 gal requirement is conservative with respect to the OG manufacturer's consumption values for the run time of the DG. Implicit in this SR is the requirement to verify the (continued)

PBAPS UNIT 3 B 3.8-53 Revision No. 87

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.2 (continued)

REQUIREMENTS capability to transfer the lube oil from its storage location to the DG to maintain adequate inventory for 7 days of full load operation without the level reaching the manufacturer's recommended minimum level.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.3.3 The tests of new fuel oil prior to addition to the storage tanks are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate detrimental .impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between the sample (and corresponding results) of new fuel and addition of new fuel oil to the storage tanks to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows:

a. Sample the new fuel oil in accordance with ASTM D4057-81 (Ref. 6);

b. Verify in accordance with the tests specified in ASTM D975-81 (Ref. 6) as discussed in Reference 7 that the sample has a kinematic viscosity at 40'C of Ž 1.9 centistokes and

4.1 centistokes (if specific gravity was not determined by comparison with the supplier's certification), and a flash point of Ž 125°F;

c. Verify in accordance with tests specified in ASTM D1298-80 (Ref. 6) as discussed in Reference 7 that the sample has an absolute specific gravity at 60/60°F of

Ž 0.83 and

0.89 , or an absolute specific gravity of within 0.0016 at 60/60'F when compared to the supplier's certificate, or an API gravity at 60'F of

, 270 and

390, or an API gravity of within 0.30 at 60°F when compared to the supplier's certification; and (continued)

PBAPS UNIT 3 B 3.8-54 Revision No. 87'

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQUIREMENTS

d. Verify that the new fuel oil has a clear and bright appearance with proper color when tested in accordance with ASTM D4176-82 (Ref. 6) as discussed in Reference 7; or verify, in accordance with ASTM D975-81 (Ref.

6), that the sample has a water and sediment content

0.05 volume percent when dyes have been intentionally added to fuel oil (for example due to sulfur content).

Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.

Following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table I of ASTM D975-81 (Ref. 6) are met for new fuel oil when tested in accordance with ASTM D975-81 (Ref. 6) as discussed in Reference 7, except that the analysis for sulfur may be performed in accordance with ASTM D1552-79 (Ref. 6) or ASTM D2622-82 (Ref. 6) or ASTM D5453 (for ultra low sulfur diesel). Additionally, other fuel oil properties for ultra low sulfur diesel fuel oil are included (e.g.,

lubricity). These additional analyses are required by Specification 5.5.9, "Diesel Fuel Oil Testing Program," to be performed within 31 days following sampling and addition.

This 31 day requirement is intended to assure that: 1) the new fuel oil sample taken is no more than 31 days old at the time of adding the new fuel oil to the DG storage tank, and

2) the results of the new fuel oil sample are obtained within 31 days after addition of the new fuel oil to the DG storage tank. The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on DG operation. This Surveillance ensures the availability of high quality fuel oil for the DGs.

Fuel oil degradation during long term storage shows up as an increase in particulate, mostly due to oxidation. The presence of particulate does not mean that the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure. The fuel oil properties which can affect diesel generator performance (flash point, cetane number, viscosity, cloud point) do not change during storage. If these properties are within specification when the fuel is placed in storage, they will remain within specification unless other non-specification petroleum products are added to the storage tanks. The addition of non-specification petroleum products is precluded by above described surveillance test program.

Particulate concentrations should be determined in accordance with ASTM D2276-78 (Ref. 6), Method A, as discussed in Reference 7 except that the filters specified (continued)

PBAPS UNIT 3 B 3.8-55 Revision No. 108

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQUIREMENTS in ASTM D2276-78, (Sections 3.1.6 and 3.1.7) may have a nominal pore size up to three microns. This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l.

It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing. For the Peach Bottom Atomic Power Station design in which the total volume of stored fuel oil is contained in four interconnected tanks, each tank must be considered and tested separately.

The Frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between Frequency intervals.

SR 3.8.3.4 This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each DG is available. The system design requirements provide for a minimum of five normal engine starts without recharging. The pressure specified in this SR is intended to reflect the lowest value at which the five starts can be accomplished.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.3.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Periodic removal of water from the fuel storage tanks eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and from (continued)

PBAPS UNIT 3 B 3.8-56 Revision No. 87

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.5 (continued)

REQUIREMENTS breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR is for preventive maintenance. The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during performance of the Surveillance.

REFERENCES 1. UFSAR, Section 8.5.2.

2. Regulatory Guide 1.137, Revision 1.

3. ANSI N195, 1976.

4. UFSAR, Chapter 6.

5. UFSAR, Chapter 14.

6. ASTM Standards: D4057-81; D975-81; 01298-80; D4176-82; D1552-79; D2622-82; and D2276-78.

7. Letter from G.A. Hunger (PECO Energy) to USNRC Document Control Desk; Peach Bottom Atomic Power Station Units 2 and 3, Supplement 7 to TSCR 93-16, Conversion to Improved Technical Specifications; dated May 24, 1995.

PBAPS UNIT 3 B 3.8-57 Revision No. 87

DC Sources--Operating B 3.8.4 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.4 DC Sources--Operating BASES BACKGROUND The DC electrical power system provides the AC emergency power system with control power. It also provides a source of reliable, uninterruptible 125/250 VDC power and 125 VDC control power and instrument power to Class IE and non-Class 1E loads during normal operation and for safe shutdown of the plant following any plant design basis event or accident as documented in the UFSAR (Ref. I), independent of AC power availability. The DC Electrical Power System meets the intent of the Proposed IEEE Criteria for Class 1E Electrical Systems for Nuclear Power Generating Stations (Ref. 2). The DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure.

The DC power sources provide both motive and control power, and instrument power, to selected safety related equipment, as well as to the nonsafety related equipment. There are two independent divisions per unit, designated Division I and Division II. Each division consists of two 125 VDC batteries. The two 125 VDC batteries in each division are connected in series. Each 125 VDC battery has two chargers (one normally inservice charger and one spare charger) that are exclusively associated with that battery and cannot be interconnected with any other 125 VDC battery. The chargers are supplied from separate 480 V motor control centers (MCCs). Each of these MCCs is connected to an independent emergency AC bus. Some of the chargers are capable of being supplied by Unit 2 MCCs, which receive power from a 4 kV emergency bus, via manual transfer switches. However, for a required battery charger to be considered OPERABLE when the unit is in MODE 1, 2, or 3, it must receive power from its associated Unit 3 MCC. The safety related loads between the 125/250 VDC subsystem are not transferable except for the Automatic Depressurization System (ADS) valves and logic circuits and the main steam safety/relief valves. The ADS logic circuits and valves and the main steam safety/relief valves are normally fed from the Division I DC system.

(continued)

PBAPS UNIT 3 B 3.8-58 Revision No. 0

DC Sources-Operating B 3.8.4 BASES BACKGROUND During normal operation, the DC loads are powered from the (continued) battery chargers with the batteries floating on the system.

In case of loss of normal power to the battery charger, the DC loads are powered from the batteries.

The DC power distribution system is described in more detail in Bases for LCO 3.8.7, "Distribution System-Operating,"

and LCO 3.8.8, "Distribution System-Shutdown."

Each battery has adequate storage capacity to carry the required load continuously for approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

Each of the unit's two DC electrical power divisions, consisting of two 125 V batteries in series, four battery chargers (two normally inservice chargers and two spare chargers), and the corresponding control equipment and interconnecting cabling, is separately housed in a ventilated room apart from its chargers and distribution centers. Each division is separated electrically from the other division to ensure that a single failure in one division does not cause a failure in a redundant division.

There is no sharing between redundant Class 1E divisions such as batteries, battery chargers, or distribution panels.

The batteries for DC electrical power subsystems are sized to produce required capacity at 80% of nameplate rating, corresponding to warranted capacity at end of life cycles and the 100% design demand. The minimum design voltage for sizing the battery using the methodology in IEEE 485 (Ref. 3) is based on a traditional 1.81 volts per cell at the end of a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months load profile. The battery terminal voltage using 1.81 volts per cell is 105 V. Using the LOOP/LOCA load profile, the predicted value of the battery terminals is greater than 105 VDC at the end of the profile.

Many 1E loads operate exclusively at the beginning of the profile and require greater than the design minimum terminal voltage. The analyzed voltage of the distribution panels and the MCCs is greater than that required during the LOOP/LOCA to support the operation of the 1E loads during the time period they are required to operate.

Each required battery charger of DC electrical power subsystem has ample power output capacity for the steady state operation of connected loads required during normal operation, while at the same time maintaining its battery (continued)

PBAPS UNIT 3 B 3.8-59 Revision No. 0

DC Sources-Operating B 3.8.4 BASES BACKGROUND bank fully charged. Each battery charger has sufficient (continued) capacity to restore the battery from the design minimum charge to its fully charged state within 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months while supplying normal steady state loads following a LOCA coincident with a loss of offsite power.

A description of the Unit 2 DC power sources is provided in the Bases for Unit 2 LCO 3.8.4, "DC Sources-Operating."

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 14 (Ref. 1), assume that Engineered Safety Feature (ESF) systems are OPERABLE.

The DC electrical power system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation. The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining DC sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite AC power or all onsite AC power; and

b. A worst case single failure.

The DC sources satisfy Criterion 3 of the NRC Policy Statement.

LCO The Unit 3 Division I and Division II DC electrical power subsystems, with each DC subsystem consisting of two 125 V station batteries in series, two battery chargers (one per battery), and the corresponding control equipment and interconnecting cabling supplying power to the associated bus, are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an abnormal operational transient or a postulated DBA. In addition, DC control power (which provides control power for the 4 kV load circuit breakers and the feeder breakers to the 4 kV emergency bus) for two of the four 4 kV emergency buses, as well as control power for two of the diesel generators, is provided by the Unit 2 DC electrical power subsystems.

Therefore, Unit 2 Division I and Division II DC electrical power subsystems are also required to be OPERABLE. A Unit 2 (continued)

PBAPS UNIT 3 B 3.8-60 Revision No. 0

DC Sources-Operating B 3.8.4 BASES LCO DC electrical power subsystem OPERABILITY requirements are (continued) the same as those required for a Unit 3 DC electrical power subsystem, except that the Unit 2: 1) Division I DC electrical power subsystem is allowed to consist of only the 125 V battery A, an associated battery charger, and the corresponding control equipment and interconnecting cabling supplying 125 V power to the associated bus; and 2)

Division II DC electrical power subsystem is allowed to consist of only the 125 V battery B, an associated battery charger, and the corresponding control equipment and interconnecting cabling supplying 125 V power to the associated bus. This exception is allowed only if all 250 VDC loads are removed from the associated bus. In addition, a Unit 2 battery charger can be powered from a Unit 3 AC source, (as described in the Background section of the Bases for Unit 2 LCO 3.8.4, "DC Sources-Operating"),

and be considered OPERABLE for the purposes of meeting this LCO. Thus, loss of any DC electrical power subsystem does not prevent the minimum safety function from being performed.

APPLICABILITY The DC electrical power sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure safe unit operation and to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of abnormal operational transients; and

b. Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.

The DC electrical power requirements for MODES 4 and 5 are addressed in LCO 3.8.5, "DC Sources- Shutdown."

ACTIONS A.I Pursuant to LCO 3.0.6, the Distribution Systems-Operating ACTIONS would not be entered even if the DC electrical power subsystem inoperability resulted in de-energization of an AC or DC bus. Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A (continued)

PBAPS UNIT 3 B 3.8-61 Revision No. 0

DC Sources-Operating B 3.8.4 BASES ACTIONS A.1 (continued) results in de-energization of a Unit 3 4 kV emergency bus or a Unit 2 DC bus, Actions for LCO 3.8.7 must be immediately entered. This allows Condition A to provide requirements for the loss of a Unit 2 DC electrical power subsystem (due to performance of SR 3.8.4.7 or SR 3.8.4.8) without regard to whether a bus is de-energized. LCO 3.8.7 provides the appropriate restriction for a de-energized bus.

If one Unit 2 DC electrical power subsystem is inoperable due to performance of SR 3.8.4.7 or SR 3.8.4.8, the remaining DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate an accident condition. In the case of an inoperable Unit 2 DC electrical power subsystem, since a subsequent postulated worst case single failure could result in the loss of safety function, continued power operation should not exceed 7 days. The 7 day Completion Time is based upon the Unit 2 DC electrical power subsystem being inoperable due to performance of SR 3.8.4.7 or SR 3.8.4.8. Performance of these two SRs will result in inoperability of the Unit 2 DC divisional batteries since these batteries are needed for Unit 3 operation, more time is provided to restore the batteries, if the batteries are inoperable for performance of required Surveillances, to preclude the need for a dual unit shutdown to perform these Surveillances. The Unit 2 DC electrical power subsystems also do not provide power to the same type of equipment as the Unit 3 DC sources. The Completion Time also takes into account the capacity and capability of the remaining DC sources.

B.1 Pursuant to LCO 3.0.6, the Distribution Systems-Operating ACTIONS would not be entered even if the DC electrical power subsystem inoperability resulted in de-energization of an AC bus. Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A results in de-energization of a Unit 3 4 kV emergency bus, Actions for LCO 3.8.7 must be immediately entered. This allows Condition A to provide requirements for the loss of a Unit 2 DC electrical power subsystem without regard to whether a bus is de-energized. LCO 3.8.7 provides the appropriate restriction for a de-energized bus.

(continued)

PBAPS UNIT 3 B 3.8-62 Revision No. 0

DC Sources-Operating B 3.8.4 BASES ACTIONS B.1 (continued)

If one of the Unit 2 DC electrical power subsystems is inoperable for reasons other than Condition A, the remaining DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate the accident condition.

Since a subsequent worst case single failure could, however, result in a loss of minimum necessary DC electrical subsystems to mitigate a worst case accident, continued power operation should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and takes into consideration the importance of the Unit 2 DC electrical power subsystem.

C.1 Condition C represents one Unit 3 division with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation.

It is therefore imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power.

If one of the Unit 3 DC electrical power subsystems is inoperable (e.g., inoperable battery/batteries, inoperable required battery charger/chargers, or inoperable required battery charger/chargers and associated battery/batteries),

the remaining DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst case single failure could result in the loss of minimum necessary DC electrical subsystems to mitigate a worst case accident, continued power operation should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is consistent with Regulatory Guide 1.93 (Ref. 4) and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power division and, if the Unit 3 DC electrical power division is not restored to OPERABLE status, to prepare to initiate an orderly and safe unit shutdown. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is also consistent with the allowed time for an inoperable Unit 3 DC Distribution System division.

(continued)

PRAPS IUNTT I *# Ig

Vg I

I 3 V R 3.-3 Revision No. 0

DC Sources-Operating B 3.8.4 BASES ACTIONS D.1 (continued)

If the DC electrical power subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 6) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.1 Condition E corresponds to a level of degradation in the DC electrical power subsystems that causes a required safety function to be lost. When more than one DC source is lost, this results in a loss of a required function, thus the plant is in a condition outside the accident analysis.

Therefore, no additional time is justified for continued operation. LCO 3.0.3 must be entered immediately to commence a controlled shutdown.

SURVEILLANCE As Noted at the beginning of the SRs, SR 3.8.4.1 through REQUIREMENTS SR 3.8.4.8 are applicable only to the Unit 3 DC electrical power subsystems and SR 3.8.4.9 is applicable only to the Unit 2 DC electrical power subsystems.

SR 3.8.4.1 Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the charging system and the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery (or battery cell) and maintain the battery (or a battery cell) in a fully charged state. The voltage requirements are (rontimnipd PBAPS UNIT 3 B 3.8-64 Revision No. 67

DC Sources-Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.1 (continued)

REQUIREMENTS based on the minimum cell voltage that will maintain a charged cell. This is consistent with the assumptions in the battery sizing calculations. The SR must be performed unless the battery is on equalize charge or has been on equalize charge any time during the previous 1 day. This allows the routine Frequency to be extended until such a time that the SR can be properly performed and meaningful results obtained. The surveillance frequency is applicable and continues during the time that the battery is on equalize with the exception that the surveillance does not need to be performed if the battery has been on equalize during the previous 1 day. The additional 1 day allows time for battery.voltage to return to normal after the equalize charge and time to perform the test. The intent of the Note is to allow orderly, yet prompt performance of the surveillance that will produce meaningful results once the equalize charge is complete. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.4.2 Visual inspection to detect corrosion of the battery cells and connections or measurement of the resistance of each inter-cell, inter-rack, inter-tier, and terminal connection, provides an indication of physical damage or abnormal deterioration that could potentially degrade battery performance.

The battery connection resistance limits are established to maintain connection resistance as low as reasonably possible to minimize the overall voltage drop across the battery, and the possibility of battery damage due to heating of connections.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.4.3 Visual inspection of the battery cells, cell plates, and battery racks provides an indication of physical damage or abnormal deterioration that could potentially degrade battery performance. The presence of physical damage or deterioration does not necessarily represent a failure of (continued)

PBAPS UNIT 3 B 3.8-65 Revision No. 87

DC Sources-Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.3 (continued)

REQUIREMENTS this SR, provided an evaluation determines that the physical damage or deterioration does not affect the OPERABILITY of the battery (its ability to perform its design function).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.4.4 and SR 3.8.4.5 Visual inspection and resistance measurements of inter-cell, inter-rack, inter-tier, and terminal connections provides an indication of physical damage or abnormal deterioration that could indicate degraded battery condition. The anti-corrosion material is used to help ensure good electrical connections and to reduce terminal deterioration. The visual inspection for corrosion is not intended to require removal of and inspection under each terminal connection.

The removal of visible corrosion is a preventive maintenance SR. The presence of visible corrosion does not necessarily represent a failure of this SR, provided visible corrosion is removed during performance of this Surveillance.

The battery connection resistance limits are established to maintain connection resistance as low as reasonably possible to minimize the overall voltage drop across the battery, and the possibility of battery damage due to heating of connections.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.4.6 Battery charger capability requirements are based on the design capacity of the chargers. The minimum charging capacity requirement is based on the capacity to maintain the associated battery in its fully charged condition, and (continued)

PBAPS UNIT 3 B 3.8-66 Revision No. 87

DC Sources-Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.6 (continued)

REQUIREMENTS to restore the battery to its fully charged condition following the worst case design discharge while supplying normal steady state loads. The minimum required amperes and duration ensures that these requirements can be satisfied.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.4.7 A battery service test is a special test of the battery's capability, as found, to satisfy the design requirements (battery duty cycle) of the DC Electrical Power System. The discharge rate and test length corresponds to the design duty cycle requirements.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. Note 1 allows performance of either a modified performance discharge test or a performance discharge test (described in the Bases for SR 3.8.4.8) in lieu of a service test provided the test performed envelops the duty cycle of the battery. This substitution is acceptable because as long as the test current is greater than or equal to the actual duty cycle of the battery, SR 3.8.4.8 represents a more severe test of battery capacity than a service test.

(continued)

PBAPS UNIT 3 B 3.8-67 Revision No. 87

DC Sources-Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.7 (continued)

REQUIREMENTS The reason for Note 2 is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the Electrical Distribution System, and challenge safety systems. Credit may be taken for unplanned events that satisfy the Surveillance.

SR 3.8.4.8 A battery performance discharge test is a test of the constant current capacity of a battery, performed between 3 and 30 days after an equalize charge of the battery, to detect any change in the capacity determined by the acceptance test. The test is intended to determine overall battery degradation due to age and usage.

A battery modified performance discharge test is a simulated duty cycle consisting of just two rates; the one minute-rate published for the battery or the largest current load of the duty cycle, followed by the test rate employed for the performance test, both of which envelope the duty cycle of the service test. Since the ampere-hours removed by a rated one minute discharge represents a very small portion of the battery capacity, the test rate can be changed to that for the performance test without compromising the results of the performance discharge test. The battery terminal voltage for the modified performance discharge test should remain greater than or equal to the minimum battery terminal voltage specified in the battery performance discharge test.

A modified performance discharge test is a test of the battery capacity and its ability to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will often confirm the battery's ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for a performance discharge test.

Either the battery performance discharge test or the modified performance discharge test is acceptable for satisfying SR 3.8.4.8; however, the discharge test may be (continued)

PBAPS UNIT 3 B 3.8-68 Revision No. 0

DC Sources-Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.8 (continued)

REQUIREMENTS used to satisfy SR 3.8.4.8 while satisfying the requirements of SR 3.8.4.7 at the same time only if the test envelops the duty cycle of the battery.

The acceptance criteria for this Surveillance is consistent with IEEE-450 (Ref. 5) and IEEE-485 (Ref. 3). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. If the battery shows degradation, or if the battery has reached 85% of its expected life and capacity is < 100% of the manufacturers rating, the Surveillance Frequency is reduced to 12 months.

However, if the battery shows no degradation but has reached 85% of its expected life, the Surveillance Frequency is only reduced to 24 months for batteries that retain capacity

Ž 100% of the manufacturer's rating. Degradation is indicated, according to IEEE-450 (Ref. 5), when the battery capacity drops by more than 10% relative to its capacity on the previous performance test or when it is 10% below the manufacturer's rating. If the rate of discharge varies significantly from the previous discharge test, the absolute battery capacity may change significantly, resulting in a capacity drop exceeding the criteria specified above. This absolute battery capacity change could be a result of acid concentration in the plate material, which is not an indication of degradation. Therefore, results of tests with significant rate differences should be discussed with the vendor and evaluated to determine if degradation has occurred. All these Frequencies, with the exception of the 24 month Frequency, are consistent with the recommendations in IEEE-450 (Ref. 5). The 24 month Frequency is acceptable, given the battery has shown no signs of degradation, the unit conditions required to perform the test and other requirements existing to ensure battery performance during these 24 month intervals. In addition, the 24 month Frequency is intended to be consistent with expected fuel cycle lengths.

(continued)

PBAPS UNIT 3 B 3.8-69 Revision No. 87

DC Sources-Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.8 (continued)

REQUIREMENTS This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. Credit may be taken for unplanned events that satisfy the Surveillance. The DC batteries of the other unit are exempted from this restriction since they are required to be OPERABLE by both units and the Surveillance cannot be performed in the manner required by the Note without resulting in a dual unit shutdown.

SR 3.8.4.9 With the exception of this Surveillance, all other Surveillances of this Specification (SR 3.8.4.1 through SR 3.8.4.8) are applied only to the Unit 3 DC electrical power subsystems. This Surveillance is provided to direct that the appropriate Surveillances for the required Unit 2 DC electrical power subsystems are governed by the Unit 2 Technical Specifications. Performance of the applicable Unit 2 Surveillances will satisfy Unit 2 requirements, as well as satisfying this Unit 3 Surveillance Requirement.

The Frequency required by the applicable Unit 2 SR also governs performance of that SR for Unit 3. As Noted, if Unit 2 is in MODE 4 or 5, or moving irradiated fuel assemblies in the secondary containment, the Note to Unit 2 SR 3.8.5.1 is applicable. This ensures that a Unit 3 SR will not require a Unit 2 SR to be performed, when the Unit 2 Technical Specifications exempts performance of a Unit 2 SR. (However, as stated in the Unit 2 SR 3.8.5.1 Note, while performance of the SR is exempted, the SR still must be met.)

REFERENCES 1. UFSAR, Chapter 14.

2. "Proposed IEEE Criteria for Class 1E Electrical Systems for Nuclear Power Generating Stations," June 1969.

3. IEEE Standard 485, 1983.

(continued)

V.

PBAPS UNIT 3 B 3.8-70 Revision No. 0

DC Sources-Operating B 3.8.4 BASES REFERENCES 4. Regulatory Guide 1.93, December 1974.

(continued)

5. IEEE Standard 450, 1987.

6. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.8-71 Revision No. 67

DC Sources-Shutdown B 3.8.5 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.5 DC Sources-Shutdown BASES BACKGROUND A description of the DC sources is provided in the Bases for LCO 3.8.4, "DC Sources-Operating."

APPLICABLE The initial conditions of Design Basis Accident and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 14 (Ref. 1), assume that Engineered Safety Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the diesel generators (DGs), emergency auxiliaries, and control and switching during all MODES of operation.

The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum DC electrical power sources during MODES 4 and 5 and during movement of irradiated fuel assemblies in secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident.

The DC sources satisfy Criterion 3 of the NRC Policy Statement.

LCO The Unit 3 DC electrical power subsystems, with each DC subsystem consisting of two 125 V station batteries in series, two battery chargers (one per battery), and the corresponding control equipment and interconnecting cabling supplying power to the associated bus, are required to be (continued)

PBAPS UNIT 3 B 3.8-72 Revision No. 0.

DC Sources-Shutdown B 3.8.5 BASES LCO OPERABLE to support Unit 3 DC distribution subsystems (continued) required OPERABLE by LCO 3.8.8, "Distribution Systems-Shutdown." When the equipment required OPERABLE:

1) does not require 250 VDC from the DC electrical power subsystem; and 2) does not require 125 VDC from one of the two 125 V batteries of the DC electrical power subsystem, the Unit 3 DC electrical power subsystem requirements can be modified to only include one 125 V battery (the battery needed to provide power to required equipment), an associated battery charger, and the corresponding control equipment and interconnecting cabling supplying 125 V power to the associated bus. This exception is allowed only if all 250 VDC loads are removed from the associated bus. In addition, DC control power (which provides control power for the 4 kV load circuit breakers and the feeder breakers to the 4 kV emergency bus) for two of the four 4 kV emergency buses, as well as control power for two of the diesel generators, is provided by the Unit 2 DC electrical power subsystems. Therefore, the Unit 2 DC electrical power subsystems needed to support required components are also required to be OPERABLE. The Unit 2 DC electrical power subsystem OPERABILITY requirements are the same as those required for a Unit 3 DC electrical power subsystem. In addition, battery chargers (Unit 2 and Unit 3) can be powered from the opposite unit's AC source (as described in the Background section of the Bases for LCO 3.8.4, "DC Sources-Operating"), and be considered OPERABLE for the purpose of meeting this LCO.

This requirement ensures the availability of sufficient DC electrical power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents and inadvertent reactor vessel draindown).

APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment provide assurance that:

a. Required features to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core in case of an inadvertent draindown of the reactor vessel; (continued)

PBAPS UNIT 3 B 3.8-73 Revision No. 0

DC Sources-Shutdown B 3.8.5 BASES APPLICABILITY b. Required features needed to mitigate a fuel handling (continued) accident are available;

c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The DC electrical power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.4.

ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be sufficient reason to require a reactor shutdown.

A.1, A.2.1. A.2.2, A.2.3. and A.2.4 If more than one DC distribution subsystem is required according to LCO 3.8.8, the DC electrical power subsystems remaining OPERABLE with one or more DC electrical power subsystems inoperable may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, fuel movement, and operations with a potential for draining the reactor vessel.

By allowance of the option to declare required features inoperable with associated DC electrical power subsystems inoperable, appropriate restrictions are implemented in accordance with the affected system LCOs' ACTIONS. However, in many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies in secondary containment, and any activities that could result in inadvertent draining of the reactor vessel).

(continued)

PBAPS UNIT 3 B 3.8-74 Revision No. 0

DC Sources-Shutdown B 3.8.5 BASES ACTIONS A.1. A.2.1, A.2.2. A.2.3. and A.2.4 (continued)

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.

These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystems and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the plant safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystems should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power.

SURVEILLANCE SR 3.8.5.1 REQUIREMENTS SR 3.8.5.1 requires performance of all Surveillances required by SR 3.8.4.1 through SR 3.8.4.8. Therefore, see the corresponding Bases for LCO 3.8.4 for a discussion of each SR.

This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC electrical power subsystems from being discharged below their capability to provide the required power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that these SRs must still be capable of being met, but actual performance is not required.

SR 3.8.5.2 This Surveillance is provided to direct that the appropriate Surveillances for the required Unit 2 DC electrical power subsystems are governed by the Unit 2 Technical Specifications. Performance of the applicable Unit 2 Surveillances will satisfy Unit 2 requirements, as well as satisfying this Unit 3 Surveillance Requirement. The Frequency required by the applicable Unit 2 SR also governs performance of that SR for Unit 3.

(continued)

PBAPS UNIT 3 B 3.8-75 Revision No. 0

DC Sources--Shutdown B 3.8.5 BASES SURVEILLANCE SR 3.8.5.2 (continued)

REQUI REMENTS As Noted, if Unit 2 is in MODE 4 or 5, or moving irradiated fuel assemblies in the secondary containment, the Note to Unit 2 SR 3.8.5.1 is applicable. This ensures that a Unit 3 SR will not require a Unit 2 SR to be performed, when the Unit 2 Technical Specifications exempts performance of a Unit 2 SR. (However, as stated in the Unit 2 SR 3.8.5.1 Note, while performance of an SR is exempted, the SR still must be met.)

REFERENCES 1. UFSAR, Chapter 14.

PBAPS UNIT 3 B 3.8-76 Revision No. 0

Battery Cell Parameters B 3.8.6 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.6 Battery Cell Parameters BASES BACKGROUND This LCO delineates the limits on electrolyte temperature, level, float voltage, and specific gravity for the DC electrical power subsystems batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC Sources-Operating," and LCO 3.8.5, "DC Sources-Shutdown."

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in UFSAR, Chapter 14 (Ref, 1), assume Engineered Safety Feature systems are OPERABLE. The DC electrical power subsystems provide normal and emergency DC electrical power for the diesel generators (DGs), emergency auxiliaries, and control and switching during all MODES of operation.

The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit as discussed in I. the Bases of LCO 3.8.4, "DC Sources-Operating," and LCO 3.8.5, "DC Sources-Shutdown.

Since battery cell parameters support the operation of the DC electrical power subsystems, they satisfy Criterion 3 of the NRC Policy Statement.

LCO Battery cell parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an abnormal operational transient or a postulated DBA.

Electrolyte limits are conservatively established, allowing continued DC electrical system function even with Category A and B limits not met.

APPLICABILITY The battery cell parameters are required solely for the support of the associated DC electrical power subsystem.

Therefore, these cell parameters are only required when the DC power source is required to be OPERABLE. Refer to the Applicability discussions in Bases for LCO 3.8.4 and LCO 3.8.5.

(continued)

PBAPS UNIT 3 B 3.8-77 Revision No. 0

Battery Cell Parameters B 3.8.6 BASES (continued)

ACTIONS A.1. A.2, and A.3 With parameters of one or more cells in one or more batteries not within limits (i.e., Category A limits not met or Category B limits not met, or Category A and B limits not met) but within the Category C limits specified in Table 3.8.6-1, the battery is degraded but there is still sufficient capacity to perform the intended function.

Therefore, the affected battery is not required to be considered inoperable solely as a result of Category A or B limits not met, and continued operation is permitted for a limited period.

The pilot cell electrolyte level and float voltage are required to be verified to meet the Category C limits within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (Required Action A.1). This check provides a quick indication of the status of the remainder of the battery cells. One hour provides time to inspect the electrolyte level and to confirm the float voltage of the pilot cells.

One hour is considered a reasonable amount of time to perform the required verification.

Verification that the Category C limits are met (Required Action A.2) provides assurance that during the time needed to restore the parameters to the Category A and B limits, the battery is still capable of performing its intended function. A period of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed to complete the initial verification because specific gravity measurements must be obtained for each connected cell. Taking into consideration both the time required to perform the required verification and the assurance that the battery cell parameters are not severely degraded, this time is considered reasonable. The verification is repeated at 7 day intervals until the parameters are restored to Category A or B limits. This periodic verification is consistent with the normal Frequency of pilot cell surveillances.

Continued operation is only permitted for 31 days before battery cell parameters must be restored to within Category A and B limits. Taking into consideration that, while battery capacity is degraded, sufficient capacity exists to perform the intended function and to allow time to fully restore the battery cell parameters to normal limits, this time is acceptable for operation prior to declaring the DC batteries inoperable.

(continued)

PBAPS UNIT 3 B 3.8-78 Revision No. 0

Battery Cell Parameters B 3.8.6 BASES ACTIONS B.1 (continued)

When any battery parameter is outside the Category C limit for any connected cell, sufficient capacity to supply the maximum expected load requirement is not ensured and the corresponding DC electrical power subsystem must be declared inoperable. Additionally, other potentially extreme conditions, such as not completing the Required Actions of Condition A within the required Completion Time or average electrolyte temperature of representative cells falling below 40'F, also are cause for immediately declaring the associated DC electrical power subsystem inoperable.

SURVEILLANCE SR 3.8.6.1 REQUIREMENTS This SR verifies that Category A battery cell parameters are consistent with IEEE-450 (Ref. 2), which recommends regular battery inspections including voltage, specific gravity, and electrolyte temperature of pilot cells. The SR must be performed unless the battery is on equalize charge or has been on equalize charge any time during the previous 4 days.

This allows the routine Frequency to be extended until such a time that the SR can be properly performed and meaningful results obtained. The surveillance frequency is applicable and continues during the time that the battery is on equalize with the exception that the surveillance does not need to be performed if the battery has been on equalize

during the previous 4 days. The additional 4 days allows time for battery parameters to return to normal after the equalize charge (nominally 3 days) and time to perform the test (nominally 1 day). The intent of the Note is to allow orderly, yet prompt performance of the surveillance that will produce meaningful results once the equalize charge is complete. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.6.2 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. In addition, within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of a battery discharge < 100 V or within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of a battery overcharge > 145 V, the battery must be demonstrated to meet Category B limits. Transients, such as motor starting transients which may momentarily cause battery voltage to drop to ! 100 V, do not constitute battery discharge provided the battery terminal voltage and float current return to pre-transient values. This inspection is also consistent with IEEE-450 (Ref. 2), which recommends special inspections following a severe discharge or overcharge, to ensure that no significant degradation of the battery occurs as a consequence of such discharge or overcharge.

(continued)

PBAPS UNIT 3 B 3.8-79 Revision No. 87

Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE SR 3.8.6.3 REQUIREMENTS (continued) The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Lower than normal temperatures act to inhibit or reduce battery capacity. This SR ensures that the operating temperatures remain within an acceptable operating range.

Table 3.8.6-1 This table delineates the limits on electrolyte level, float voltage, and specific gravity for three different categories. The meaning of each category is discussed below.

Category A defines the normal parameter limit for each designated pilot cell in each battery. The cells selected as pilot cells are those whose temperature, voltage, and electrolyte specific gravity approximate the state of charge of the entire battery.

The Category A limits specified for electrolyte level are based on manufacturer's recommendations and are consistent with the guidance in IEEE-450 (Ref. 2), with the extra 14 inch allowance above the high water level indication for operating margin to account for temperature and charge effects. In addition to this allowance, footnote a to Table 3.8.6-1 permits the electrolyte level to be above the specified maximum level during equalizing charge, provided it is not overflowing. These limits ensure that the plates suffer no physical damage, and that adequate electron transfer capability is maintained in the event of transient conditions. IEEE-450 (Ref. 2) recommends that electrolyte level readings should be made only after the battery has been at float charge for at least 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The Category A limit specified for float voltage is Ž 2.13 V per cell. This value is based on the recommendation of IEEE-450 (Ref. 2), which states that prolonged operation of cells below 2.13 V can reduce the life expectancy of cells.

The Category A limit specified for specific gravity for each pilot cell is Ž 1.195 (0.020 below the manufacturer's fully (continued)

PBAPS UNIT 3 B 3.8-80 Revision No. 87

Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE Table 3.8.6-1 (continued)

REQUIREMENTS charged nominal specific gravity or a battery charging current that had stabilized at a low value). This value is characteristic of a charged cell with adequate capacity.

According to IEEE-450 (Ref. 2), the specific gravity readings are based on a temperature of 77°F (25°C).

The specific gravity readings are corrected for actual electrolyte temperature and level. For each 3°F (1.67°C) above 77°F (25°C), 1 point (0.001) is added to the reading; 1 point is subtracted for each 39F below 77°F. The specific gravity of the electrolyte in a cell increases with a loss of water due to electrolysis or evaporation. Level correction will be in accordance with manufacturer's recommendations.

Category B defines the normal parameter limits for each connected cell. The term "connected cell" excludes any battery cell that may be jumpered out.

The Category B limits specified for electrolyte level and float voltage are the same as those specified for Category A and have been discussed above. The Category B limit specified for specific gravity for each connected cell is

ý 1.195 (0.020 below the manufacturer's fully charged, nominal specific gravity) with the average of all connected cells 1.205 (0.010 below the manufacturer's fully charged, nominal specific gravity). These values were developed from manufacturer's recommendations. The minimum specific gravity value required for each cell ensures that the effects of a highly charged or newly installed cell do not mask overall degradation of the battery.

Category C defines the limit for each connected cell. These values, although reduced, provide assurance that sufficient capacity exists to perform the intended function and maintain a margin of safety. When any battery parameter is outside the Category C limit, the assurance of sufficient capacity described above no longer exists, and the battery must be declared inoperable.

The Category C limit specified for electrolyte level (above the top of the plates and not overflowing) ensure that the plates suffer no physical damage and maintain adequate electron transfer capability. The Category C Allowable Value for voltage is based on IEEE-450 (Ref. 2), which (continued)

PBAPS UNIT 3 B 3.8-81 Revision No. 0

Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE Table 3.8.6-1 (continued)

REQUIREMENTS states that a cell voltage of 2.07 V or below, under float conditions and not caused by elevated temperature of the cell, indicates internal cell problems and may require cell replacement.

The Category C limit of average specific gravity ý 1.190, is based on manufacturer's recommendations. In addition to that limit, it is required that the specific gravity for each connected cell must be no less than 0.020 below the average of all connected cells. This limit ensures that the effect of a highly charged or new cell does not mask overall degradation of the battery.

The footnotes to Table 3.8.6-1 that apply to specific gravity are applicable to Category A, B, and C specific gravity. Footnote b of Table 3.8.6-1 requires the above mentioned correction for electrolyte level and temperature, with the exception that level correction is not required when battery charging current, while on float charge, is

< 1 amp. This current provides, in general, an indication of overall battery condition.

Because of specific gravity gradients that are produced during the recharging process, delays of several days may occur while waiting for the specific gravity to stabilize.

A stabilized charger current is an acceptable alternative to specific gravity measurement for determining the state of charge of the designated pilot cell. This phenomenon is discussed in IEEE-450 (Ref. 2). Footnote c to Table 3.8.6-1 allows the float charge current to be used as an alternate to specific gravity for up to 180 days following a battery recharge after a deep discharge. Within 180 days each connected cell's specific gravity must be measured to confirm the state of charge. Following a minor battery recharge (such as equalizing charge that does not follow a deep discharge) specific gravity gradients are not significant, and confirming measurements must be made within 30 days.

REFERENCES 1. UFSAR, Chapter 14.

2. IEEE Standard 450, 1987.

PBAPS UNIT 3 B 3.8-82 Revision No. 0

Distribution Systems-Operating B 3.8.7 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.7 Distribution Systems-Operating BASES BACKGROUND The onsite Class IE AC and DC electrical power distribution system is divided into redundant and independent AC and DC electrical power distribution subsystems.

The primary AC distribution system for Unit 3 consists of four 4 kV emergency buses each having two offsite sources of power as well as an onsite diesel generator (DG) source.

Each 4 kV emergency bus is connected to its normal source of power via either emergency auxiliary transformer no. 2 or no. 3. During a loss of the normal supply of offsite power to the 4 kV emergency buses, the alternate supply breaker from the alternate supply of offsite power for the 4 kV emergency buses attempts to close. If all offsite sources are unavailable, the onsite emergency DGs supply power to the 4 kV emergency buses. (However, these supply breakers are not governed by this LCO; they are governed by LCO 3.8.1, "AC Sources-Operating".)

The secondary plant distribution system for Unit 3 includes 480 VAC load centers E134, E234, E334, and E434.

There are two independent 125/250 VDC electrical power distribution subsystems for Unit 3 that support the necessary power for ESF functions.

In addition, since some components required by Unit 3 receive power through Unit 2 electrical power distribution subsystems, the Unit 2 AC and DC electrical power distribution subsystems needed to support the required equipment are also addressed in LCO 3.8.7. A description of the Unit 2 AC and DC Electrical Power Distribution System is provided in the Bases for Unit 2 LCO 3.8.7, "Distribution System-Operating."

The list of required Unit 3 distribution buses is presented in Table B 3.8.7-1.

(continued)

PBAPS UNIT 3 B 3.8-83 Revision No. 0

Distribution Systems-Operating B 3.8.7 BASES (continued)

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 14 (Ref. 1), assume Engineered Safety Feature (ESF) systems are OPERABLE. The AC and DC electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.5, Emergency Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling (RCIC) System; and Section 3.6 Containment Systems.

The OPERABILITY of the AC and DC electrical power distribution subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining distribution systems OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC electrical power; and

b. A postulated worst case single failure.

The AC and DC electrical power distribution system satisfies Criterion 3 of the NRC Policy Statement.

LCO The Unit 3 AC and DC electrical power distribution subsystems are required to be OPERABLE. The required Unit 3 electrical power distribution subsystems listed in Table B 3.8.7-1 ensure the availability of AC and DC electrical power for the systems required to-shut down the reactor and maintain it in a safe condition after an abnormal operational transient or a postulated DBA. As stated in the Table, each division of the AC and DC electrical power distribution systems is a subsystem. In addition, since some components required by Unit 3 receive power through Unit 2 electrical power distribution subsystems (e.g., Containment Atmospheric Dilution (CAD)

System, Standby Gas Treatment (SGT) System, Emergency Service Water System, Main Control Room Emergency Ventilation (MCREV) System, and DC control power for two of the four 4 kV emergency buses, as well as control power for (continued)

PBAPS UNIT 3 B 3.8-84 Revision No. 0

Distribution Systems-Operating B 3.8.7 BASES LCO two of the diesel generators), the Unit 2 AC and DC (continued) electrical power distribution subsystems needed to support the required equipment must also be OPERABLE. The Unit 2 electrical power distribution subsystems that may be required are listed in Unit 2 Table B 3.8.7-1.

Maintaining the Unit 3 Division I and II and required Unit 2 AC and DC electrical power distribution subsystems OPERABLE ensures that the redundancy incorporated into the design of ESF is not defeated. Therefore, a single failure within any system or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor.

The Unit 2 and Unit 3 AC electrical power distribution subsystems require the associated buses and electrical circuits to be energized to their proper voltages. The Unit 2 and Unit 3 DC electrical power distribution subsystems require the associated buses to be energized to their proper voltage from either the associated batteries or chargers. However, when a Unit 2 DC electrical power subsystem is only required to have one 125 V battery and associated battery charger to be considered OPERABLE (as described in the LCO section of the Bases for LCO 3.8.4, "DC Sources-Operating"), the proper voltage to which the associated bus is required to be energized is lowered from 250 V to 125 V (as read from the associated battery charger).

Based on the number of safety significant electrical loads associated with each electrical power distribution component (i.e., bus, load center, or distribution panel) listed in Table B 3.8.7-1, if one or more of the electrical power distribution components within a division (listed in Table 3.8.7-1) becomes inoperable, entry into the appropriate ACTIONS of LCO 3.8.7 is required. Other electrical power distribution components, such as motor control centers (MCC) and distribution panels, which help comprise the AC and DC distribution systems are not listed in Table B 3.8.7-1. The loss of electrical loads associated with these electrical power distribution components may not result in a complete loss of a redundant safety function necessary to shut down the reactor and maintain it in a safe condition. Therefore, should one or more of these electrical power distribution components become inoperable due to a failure not affecting the OPERABILITY of an electrical power distribution component listed in Table B 3.8.7-1 (e.g., a breaker (continued)

PBAPS UNIT 3 B 3.8-85 Revision No. 0

Distribution Systems-Operating B 3.8.7 BASES LCO supplying a single MCC fails open), the individual loads on (continued) the electrical power distribution component would be considered inoperable, and the appropriate Conditions and Required Actions of the LCOs governing the individual loads would be entered. If however, one or more of these electrical power distribution components is inoperable due to a failure also affecting the OPERABILITY of an electrical power distribution component listed in Table B 3.8.7-1 (e.g., loss of a 4 kV emergency bus, which results in de-energization of all electrical power distribution components powered from the 4 kV emergency bus), while these electrical power distribution components and individual loads are still considered inoperable, the Conditions and Required Actions of the LCO for the individual loads are not required to be entered, since LCO 3.0.6 allows this exception (i.e., the loads are inoperable due to the inoperability of a support system governed by a Technical Specification; the 4 kV emergency bus).

In addition, transfer switches between redundant safety related Unit 2 and Unit 3 AC and DC power distribution subsystems must be open. This prevents any electrical malfunction in any power distribution subsystem from propagating to the redundant subsystem, which could cause the failure of a redundant subsystem and a loss of essential safety function(s). If any transfer switches are closed, the electrical power distribution subsystem which is not being powered from its normal source (i.e., it is being powered from its redundant electrical power distribution subsystem) is considered inoperable. This applies to the onsite, safety related, redundant electrical power distribution subsystems. It does not, however, preclude redundant Class 1E 4 kV emergency buses from being powered from the same offsite circuit.

APPLICABILITY The electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of abnormal operational transients; and

b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

(continued)

PBAPS UNIT 3 B 3.8-86 Revision No. 0

Distribution Systems--Operating B 3.8.7 BASES APPLICABILITY Electrical power distribution subsystem requirements for (continued) MODES 4 and 5 and other conditions in which AC and DC electrical power distribution subsystems are required, are covered in LCO 3.8.8, "Distribution Systems-Shutdown."

ACTIONS A.1 Pursuant to LCO 3.0.6, the DC Sources-Operating ACTIONS would not be entered even if the AC electrical power distribution subsystem inoperability resulted in de-energization of a required battery charger. Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A results in de-energization of a required Unit 2 battery charger, Actions for LCO 3.8.4 must be immediately entered. This allows Condition A to provide requirements for the loss of a Unit 2 AC electrical power distribution subsystem without regard to whether a battery charger is de-energized. LCO 3.8.4 provides the appropriate restriction for a de-energized battery charger.

If one or more of the required Unit 2 AC electrical power distribution subsystems are inoperable, and a loss of function has not occurred as described in Condition F, the remaining AC electrical power distribution subsystems have the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst case single failure could, however, result in the loss of certain safety functions, continued power operation should not exceed 7 days. The 7 day Completion Time takes into account the capacity and capability of the remaining AC electrical power distribution subsystems, and is based on the shortest restoration time allowed for the systems affected by the inoperable AC electrical power distribution subsystem in the respective system Specification.

B.1 If one of the Unit 2 DC electrical power distribution subsystems is inoperable, the remaining DC electrical power distribution subsystems have the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst case single failure could, however, result in the loss of safety function, continued power operation (continued)

PBAPS UNIT 3 B 3.8-87 Revision No. 0

Distribution Systems-Operating B 3.8.7 BASES ACTIONS B.1 (continued) should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power distribution subsystem and takes into consideration the importance of the Unit 2 DC electrical power distribution subsystem.

C.'

With one Unit 3 AC electrical power distribution subsystem inoperable, the remaining AC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure.

The overall reliability is reduced, however, because a single failure in the remaining power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the Unit 3 AC electrical power distribution subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

The Condition C worst scenario is one 4 kV emergency bus without AC power (i.e., no offsite power to the 4 kV emergency bus and the associated DG inoperable). In this Condition, the unit is more vulnerable to a complete loss of Unit 3 AC power. It is, therefore, imperative that the unit operators' attention be focused on minimizing the potential for loss of power to the remaining buses by stabilizing the-unit, and on restoring power to the affected bus(es). The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time limit before requiring a unit shutdown in this Condition is acceptable because:

a. There is a potential for decreased safety if the unit operators' attention is diverted from the evaluations and actions necessary to restore power to the affected bus(es) to the actions associated with taking the unit to shutdown within this time limit.

b. The potential for an event in conjunction with a single failure of a redundant component in the division with AC power. (The redundant component is verified OPERABLE in accordance with Specification 5.5.11, "Safety Function Determination Program (SFDP).")

(continued)

PBAPS UNIT 3 B 3.8-88 Revision No. 0

Distribution Systems-Operating B 3.8.7 BASES ACTIONS D.1 (continued)

With one Unit 3 DC electrical power distribution subsystem inoperable, the remaining DC electrical power distribution subsystem is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure.

The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution subsystem could result in the minimum required ESF functions not being supported. Therefore, the Unit 3 DC electrical power distribution subsystem must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

Condition D represents one Unit 3 electrical power distribution subsystem without adequate OC power, potentially with both the battery(s) significantly degraded and the associated charger(s) nonfunctioning. In this situation the plant is significantly more vulnerable to a complete loss of all Unit 3 DC power. It is, therefore, imperative that the operator's attention focus on (continued)

PBAPS UNIT 3 B 3.8-89 Revision No. 86

Distribution Systems-Operating B 3.8.7 BASES ACTIONS D.1 (continued) stabilizing the plant, minimizing the potential for loss of power to the remaining electrical power distribution subsystem, and restoring power to the affected electrical power distribution subsystem.

This 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the majority of components that would be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , is acceptable because of:

a. The potential for decreased safety when requiring a change in plant conditions (i.e., requiring a shutdown) while not allowing stable operations to continue;

b. The potential for decreased safety when requiring entry into numerous applicable Conditions and Required Actions for components without DC power, while not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected subsystem;

c. The potential for an event in conjunction with a single failure of a redundant component.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for DC electrical power distribution subsystems is consistent with Regulatory Guide 1.93 (Ref. 2).

(continued)

PBAPS UNIT 3 B 3.8-90 Revision No. 86

Distribution Systems-Operating B 3.8.7 BASES ACTIONS E.1 (continued)

If the inoperable electrical power distribution subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

F.1 Condition F corresponds to a level of degradation in the electrical power distribution system that causes a required safety function to be lost. When more than one Condition is entered, and this results in the loss of a required function, the plant is in a condition outside the accident analysis. Therefore, no additional time is justified for continued operation. LCO 3.0.3 must be entered immediately to commence a controlled shutdown.

SURVEILLANCE SR 3.8.7.1 REQUIREMENTS This Surveillance verifies that the AC and DC electrical power distribution systems are functioning properly, with the correct circuit breaker alignment (for the AC electrical power distribution system only). The correct AC breaker alignment ensures the appropriate separation and independence of the electrical buses are maintained, and power is available to each required bus. The verification of indicated power availability on the AC and DC buses (continued)

PBAPS UNIT 3 B 3.8-91 Revision No. 86

Distribution Systems-Operating B 3.8.7 BASES SURVEILLANCE SR 3.8.7.1 (continued)

REQUIREMENTS ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. This may be performed by verification of absence of low voltage alarms. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Chapter 14.

2. Regulatory Guide 1.93, December 1974.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

PBAPS UNIT 3 B 3.8-92 Revision No. 87

Distribution Systems-Operating B 3.8.7 Table B 3.8.7-1 (page 1 of 1)

AC and DC Electrical Power Distribution Systems TYPE VOLTAGE DIVISION I* - DIVISION II*

AC buses 4160 V Emergency Buses Emergency Buses E13, E33 E23, E43 480 V Load Centers Load Centers E134, E334 E234, E434 DC buses 250 V Distribution Panel Distribution Panel 3AD18 3BD18

Each division of the AC and DC electrical power distribution systems is a subsystem.

PBAPS UNIT 3 B 3.8-93 Revision No. 0

Distribution Systems-Shutdown B 3.8.8 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.8 Distribution Systems-Shutdown BASES BACKGROUND A description of the AC and DC electrical power distribution system is provided in the Bases for LCO 3.8.7, "Distribution Systems-Operating."

APPLICABLE The initial conditions of Design Basis Accident and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 14 (Ref. 1), assume Engineered Safety Feature (ESF) systems are OPERABLE. The AC and DC electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.

The OPERABILITY of the AC and DC electrical power distribution system is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum AC and DC electrical power sources and associated power distribution subsystems during MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate power is provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident.

The AC and DC electrical power distribution systems satisfy Criterion 3 of the NRC Policy Statement.

(continued)

PBAPS UNIT 3 B 3.8-94 Revision No. 0

Distribution Systems-Shutdown B 3.8.8 BASES (continued)

LCO Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific plant condition. Implicit in those requirements is the required OPERABILITY of necessary support required features. This LCO explicitly requires energization of the portions of the Unit 3 electrical distribution system necessary to support OPERABILITY of Technical Specifications required systems, equipment, and components-both specifically addressed by their own LCO, and implicitly required by the definition of OPERABILITY.

In addition some components that may be required by Unit 3 receive power through Unit 2 electrical power distribution subsystems (e.g., Standby Gas Treatment System, Main Control Room Emergency Ventilation System, and DC control power for two of the four 4 kV emergency buses, as well as control power for two of the diesel generators). Therefore, Unit 2 AC and DC electrical power distribution subsystems needed to support the required equipment must also be OPERABLE.

In addition, it is acceptable for required buses to be cross-tied during shutdown conditions, permitting a single source to supply multiple redundant buses, provided the (46 source is capable of maintaining proper frequency (if required) and voltage.

Maintaining these portions of the distribution system energized ensures the availability of sufficient power to operate the plant in a safe manner to mitigate the consequences of postulated events during shutdown (e.g.,

fuel handling accidents and inadvertent reactor vessel draindown).

APPLICABILITY The AC and DC electrical power distribution subsystems required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core in case of an inadvertent draindown of the reactor vessel;

b. Systems needed to mitigate a fuel handling accident are available; (continued)

P.

PRAPq IINTT I 'R 54.I ARo aici*nn Nn n

Di stri buti on Systems-Shutdown B 3.8.8 BASES APPLICABILITY c. Systems necessary to mitigate the effects of events (continued) that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The AC and DC electrical power distribution subsystem requirements for MODES 1, 2, and 3 are covered in LCO 3.8.7.

ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be sufficient reason to require a reactor shutdown.

A.1, A.2.1, A.2.2, A.2.3, A.2.4. and A.2.5 Although redundant required features may require redundant electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, fuel movement, and operations with a potential for draining the reactor vessel. By allowing the option to declare required features inoperable with associated electrical power distribution subsystems inoperable, appropriate restrictions are implemented in accordance with the affected distribution subsystem LCO's Required Actions.

However, in many instances this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made, (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies in the secondary containment, and any activities that could result in inadvertent draining of the reactor vessel).

(continued)

PBAPS UNIT 3 B 3.8-96 Revision No. 0

Distribution Systems-Shutdown B 3.8.8 BASES ACTIONS A.1, A.2.1, A.2.2. A.2.3. A.2.4, and A.2.5 (continued)

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.

These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the plant safety systems.

Notwithstanding performance of the above conservative Required Actions, a required residual heat removal-shutdown cooling (RHR-SDC) subsystem may be inoperable. In this case, Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the RHR-SDC ACTIONS would not be entered. Therefore, Required Action A.2.5 is provided to direct declaring RHR-SDC inoperable, which results in taking the appropriate RHR-SDC ACTIONS.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required electrical power distribution subsystems should be completed as quickly as possible in order to minimize the time the plant safety systems may be without power.

SURVEILLANCE SR 3.8.8.1 REQUIREMENTS This Surveillance verifies that the AC and DC electrical power distribution subsystem is functioning properly, with the buses energized. The verification of indicated power availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. This may be performed by verification of absence of low voltage alarms. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Chapter 14.

Ke PBAPS UNIT 3 B 3.8-97 Revision No. 87

Refueling Equipment Interlocks B 3.9.1 B 3.9 REFUELING OPERATIONS B 3.9.1 Refueling Equipment Interlocks BASES BACKGROUND Refueling equipment interlocks restrict the operation of the refueling equipment or the withdrawal of control rods to reinforce unit procedures that prevent the reactor from achieving criticality during refueling. The refueling interlock circuitry senses the conditions of the refueling equipment and the control rods. Depending on the sensed conditions, interlocks are actuated to prevent the operation of the refueling equipment or the withdrawal of control rods.

Design criteria require that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1).

The control rods, when fully inserted, serve as the system capable of maintaining the reactor subcritical in cold conditions during all fuel movement activities and accidents.

One channel of instrumentation is provided to sense the position of the refueling platform, the loading of the refueling platform fuel grapple and the full insertion of all control rods. Additionally, inputs are provided for the loading of the refueling platform frame mounted auxiliary hoist and the loading of the refueling platform monorail mounted hoist. With the reactor mode switch in the shutdown or refueling position, the indicated conditions are combined in logic circuits to determine if all restrictions on refueling equipment operations and control rod insertion are satisfied.

A control rod not at its full-in position interrupts power to the refueling equipment and prevents operating the equipment over the reactor core when loaded with a fuel assembly. Conversely, the refueling equipment located over the core and loaded with fuel inserts a control rod withdrawal block in the Reactor Manual Control System to prevent withdrawing a control rod.

(continued)

PBAPS UNIT 3 B 3.9-1 Revision No. 29

Refueling Equipment Interlocks B 3.9.1 BASES BACKGROUND The refueling platform has two mechanical switches that open (continued) before the platform or any of its hoists are physically located over the reactor vessel. All refueling hoists have switches that open when the hoists are loaded with fuel.

The refueling interlocks use these indications to prevent operation of the refueling equipment with fuel loaded over the core whenever any control rod is withdrawn, or to prevent control rod withdrawal whenever fuel loaded refueling equipment is over the core (Ref. 2).

The hoist switches open at a load lighter than the weight of a single fuel assembly in water.

APPLICABLE The refueling interlocks are explicitly assumed in the UFSAR SAFETY ANALYSES analyses for the control rod removal error during refueling (Ref. 3) and the fuel assembly insertion error during refueling (Ref. 4). These analyses evaluate the consequences of control rod withdrawal during refueling and also fuel assembly insertion with a control rod withdrawn.

A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment.

Criticality and, therefore, subsequent prompt reactivity excursions are prevented during the insertion of fuel, provided all control rods are fully inserted during the fuel insertion. The refueling interlocks accomplish this by preventing loading of fuel into the core with any control rod withdrawn or by preventing withdrawal of a rod from the core during fuel loading.

The refueling platform location switches activate at a point outside of the reactor core such that, with a fuel assembly loaded and a control rod withdrawn, the fuel is not over the core.

Refueling equipment interlocks satisfy Criterion 3 of the NRC Policy Statement.

(continued)

PBAPS UNIT 3 B 3.9-2 Revision No. 0

Refueling Equipment Interlocks B 3.9.1 BASES (continued)

LCO To prevent criticality during refueling, the refueling interlocks ensure that fuel assemblies are not loaded with any control rod withdrawn.

To prevent these conditions from developing, the all-rods-in, the refueling platform position, the refueling platform fuel grapple fuel loaded, the refueling platform frame mounted auxiliary hoist fuel loaded, and the refueling platform monorail mounted hoist fuel loaded inputs are required to be OPERABLE. These inputs are combined in logic circuits, which provide refueling equipment or control rod blocks to prevent operations that could result in criticality during refueling operations.

APPLICABILITY In MODE 5, a prompt reactivity excursion could cause fuel damage and subsequent release of radioactive material to the environment. The refueling equipment interlocks protect against prompt reactivity excursions during MODE 5. The interlocks are required to be OPERABLE during in-vessel fuel movement with refueling equipment associated with the interlocks.

In MODES 1, 2, 3, and 4, the reactor pressure vessel head is on, and in-vessel fuel movements are not possible.

Therefore, the refueling interlocks are not required to be OPERABLE in these MODES.

ACTIONS A.1 With one or more of the required refueling equipment interlocks inoperable, the unit must be placed in a condition in which the LCO does not apply. In-vessel fuel movement with the affected refueling equipment must be immediately suspended. This action ensures that operations are not performed with equipment that would potentially not be blocked from unacceptable operations (e.g., loading fuel into a cell with a control rod withdrawn). Suspension of in-vessel fuel movement shall not preclude completion of movement of a component to a safe position.

(continued)

PBAPS UNIT 3 B 3.9-3 Revision No. 29

Refueling Equipment Interlocks B 3.9.1 BASES (continued)

SURVEILLANCE SR 3.9.1.1 REQUIREMENTS Performance of a CHANNEL FUNCTIONAL TEST demonstrates each required refueling equipment interlock will function properly when a simulated or actual signal indicative of a required condition is injected into the logic. The CHANNEL FUNCTIONAL TEST may be performed by any series of sequential, overlapping, or total channel steps so that the entire channel is tested.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Sections 1.5.1.1, 1.5.1.8.1, 1.5.2.2.7, and 1.5.2.7.1.

2. UFSAR, Section 7.6.3.

3. UFSAR, Section 14.5.3.3.

4. UFSAR, Section 14.5.3.4.

PBAPS UNIT 3 B 3.9-4 Revision No. 87

Refuel Position One-Rod-Out Interlock B 3.9.2 B 3.9 REFUELING OPERATIONS B 3.9.2 Refuel Position One-Rod-Out Interlock BASES BACKGROUND The refuel position one-rod-out interlock restricts the movement of control rods to reinforce unit procedures that prevent the reactor from becoming critical during refueling operations. During refueling operations, no more than one control rod is permitted to be withdrawn.

The UFSAR design criteria require that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods serve as the system capable of maintaining the reactor subcritical in cold conditions.

The refuel position one-rod-out interlock prevents the selection of a second control rod for movement when any other control rod is not fully inserted (Ref. 2). It is a logic circuit that has redundant channels. It uses the all-rods-in signal (from the control rod full-in position indicators discussed in LCO 3.9.4, "Control Rod Position Indication") and a rod selection signal (from the Reactor Manual Control System).

This Specification ensures that the performance of the refuel position one-rod-out interlock in the event of a Design Basis Accident meets the assumptions used in the safety analysis of Reference 3.

APPLICABLE - The refueling position one-rod-out interlock is explicitly SAFETY ANALYSES assumed in the UFSAR analysis for the control rod withdrawal error during refueling (Ref. 3). This analysis evaluates the consequences of control rod withdrawal during refueling.

A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment.

The refuel position one-rod-out interlock and adequate SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") prevent criticality by preventing withdrawal of more than one control rod. With one control rod withdrawn, the core will remain subcritical, thereby preventing any prompt critical excursion.

(continued)

PBAPS UNIT 3 B 3.9-5 Revision No. 0

Refuel Position One-Rod-Out Interlock B 3.9.2 BASES APPLICABLE The refuel position one-rod-out interlock satisfies SAFETY ANALYSES Criterion 3 of the NRC Policy Statement.

(continued)

LCO To prevent criticality during MODE 5, the refuel position one-rod-out interlock ensures no more than one control rod may be withdrawn. Both channels of the refuel position one-rod-out interlock are required to be OPERABLE, and the reactor mode switch must be locked in the Refuel position to support the OPERABILITY of these channels.

APPLICABILITY In MODE 5, with the reactor mode switch in the refuel position, the OPERABLE refuel position one-rod-out interlock provides protection against prompt reactivity excursions.

In MODES 1, 2, 3, and 4, the refuel position one-rod-out interlock is not required to be OPERABLE and is bypassed.

In MODES 1 and 2, the Reactor Protection System (LCO 3.3.1.1) and the control rods (LCO 3.1.3) provide mitigation of potential reactivity excursions. In MODES 3 and 4, with the reactor mode switch in the shutdown position, a control rod block (LCO 3.3.2.1) ensures all control rods are inserted, thereby preventing criticality during shutdown conditions.

ACTIONS A.1 and A.2 With one or both channels of the refueling position one-rod-out interlock inoperable, the refueling interlocks may not be capable of preventing more than one control rod from being withdrawn. This condition may lead to criticality.

Control rod withdrawal must be immediately suspended, and action must be immediately initiated to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Action must continue until all such control rods are fully inserted. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and, therefore, do not have to be inserted.

(continued)

V. PBAPS UNIT 3 B 3.9-6 Revision No. 0

Refuel Position One-Rod-Out Interlock B 3.9.2 BASES (continued)

SURVEILLANCE SR 3.9.2.1 REQUIREMENTS Proper functioning of the refueling position one-rod-out interlock requires the reactor mode switch to be in Refuel.

During control rod withdrawal in MODE 5, improper positioning of the reactor mode switch could, in some instances, allow improper bypassing of required interlocks.

Therefore, this Surveillance imposes an additional level of assurance that the refueling position one-rod-out interlock will be OPERABLE when required. By "locking" the reactor mode switch in the proper position (i.e., removing the reactor mode switch key from the console while the reactor mode switch is positioned in refuel), an additional administrative control is in place to preclude operator errors from resulting in unanalyzed operation.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.9.2.2 Performance of a CHANNEL FUNCTIONAL TEST on each channel demonstrates the associated refuel position one-rod-out interlock will function properly when a simulated or actual signal indicative of a required condition is injected into the logic. The CHANNEL FUNCTIONAL TEST may be performed by any series of sequential, overlapping, or total channel steps so that the entire channel is tested. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. To perform the required testing, the applicable condition must be entered (i.e., a control rod must be withdrawn from its full-in position).

Therefore, SR 3.9.2.2 has been modified by a Note that states the CHANNEL FUNCTIONAL TEST is not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after any control rod is withdrawn.

REFERENCES 1. UFSAR, Section 1.5.

2. UFSAR, Section 7.6.

3. UFSAR, Section 14.5.3.3.

PBAPS UNIT 3 B 3.9-7 Revision No. 87

Control Rod Position B 3.9.3 B 3.9 REFUELING OPERATIONS B 3.9.3 Control Rod Position BASES BACKGROUND Control rods provide the capability to maintain the reactor subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the Reactor Manual Control System. During refueling, movement of control rods is limited by the refueling interlocks (LCO 3.9.1 and LCO 3.9.2) or the control rod block with the reactor mode switch in the shutdown position (LCO 3.3.2.1).

UFSAR design criteria require that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1).

The control rods serve as the system capable of maintaining the reactor subcritical in cold conditions.

The refueling interlocks allow a single control rod to be withdrawn at any time unless fuel is being loaded into the core. To preclude loading fuel assemblies into the core with a control rod withdrawn, all control rods must be fully inserted. This prevents the reactor from achieving criticality during refueling operations.

APPLICABLE Prevention and mitigation of prompt reactivity excursions SAFETY ANALYSES during refueling are provided by the refueling interlocks (LCO 3.9.1 and LCO 3.9.2), the SDM (LCO 3.1.1), the wide range neutron monitor period-short scram (LCO 3.3.1.1), and the control rod block instrumentation (LCO 3.3.2.1).

The safety analysis for the control rod withdrawal error during refueling in the UFSAR (Ref. 2) assumes the functioning of the refueling interlocks and adequate SDM.

The analysis for the fuel assembly insertion error (Ref. 3) assumes all control rods are fully inserted. Thus, prior to fuel reload, all control rods must be fully inserted to minimize the probability of an inadvertent criticality.

Control rod position satisfies Criterion 3 of the NRC Policy Statement.

(continued)

PBAPS UNIT 3 B 3.9-8 Revision No. 17

Control Rod Position B 3.9.3 BASES (continued)

LCO All control rods must be fully inserted during applicable refueling conditions to minimize the probability of an inadvertent criticality during refueling.

APPLICABILITY During MODE 5, loading fuel into core cells with control rods withdrawn may result in inadvertent criticality.

Therefore, the control rods must be inserted before loading fuel into a core cell. All control rods must be inserted before loading fuel to ensure that a fuel loading error does not result in loading fuel into a core cell with the control rod withdrawn.

In MODES 1, 2, 3, and 4, the reactor pressure vessel head is on, and no fuel loading activities are possible. Therefore, this Specification is not applicable in these MODES.

ACTIONS A.1 With all control rods not fully inserted during the applicable conditions, an inadvertent criticality could occur that is not analyzed in the UFSAR. All fuel loading operations must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.9.3.1 REQUIREMENTS During refueling, to ensure that the reactor remains subcritical, all control rods must be fully inserted prior to and during fuel loading. Periodic checks of the control rod position ensure this condition is maintained.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 1.5.

2. UFSAR, Section 14.5.3.3.

3. UFSAR, Section 14.5.3.4.

PBAPS UNIT 3 B 3.9-9 Revision No. 87

Control Rod Position Indication B 3.9.4 B 3.9 REFUELING OPERATIONS B 3.9.4 Control Rod Position Indication BASES BACKGROUND The full-in position indication for each control rod provides necessary information to the refueling interlocks to prevent inadvertent criticalities during refueling operations. During refueling, the refueling interlocks (LCO 3.9.1 and LCO 3.9.2) use the full-in position indication to limit the operation of the refueling equipment and the movement of the control rods. The absence of the full-in position indication signal for any control rod removes the all-rods-in permissive for the refueling equipment interlocks and prevents fuel loading. Also, this condition causes the refuel position one-rod-out interlock to not allow the withdrawal of any other control rod.

UFSAR design criteria require that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1).

The control rods serve as the system capable of maintaining the reactor subcritical in cold conditions.

APPLICABLE Prevention and mitigation of prompt reactivity excursions SAFETY ANALYSES during refueling are provided by the refueling interlocks (LCO 3.9.1 and LCO 3.9.2), the SDM (LCO 3.1.1), the wide range neutron monitor period-short scram (LCO 3.3.1.1), and the control rod block instrumentation (LCO 3.3.2.1).

The safety analysis for the control rod withdrawal error during refueling (Ref. 2) assumes the functioning of the refueling interlocks and adequate SDM. The analysis for the fuel assembly insertion error (Ref. 3) assumes all control rods are fully inserted. The full-in position indication is required to be OPERABLE so that the refueling interlocks can ensure that fuel cannot be loaded with any control rod withdrawn and that no more than one control rod can be withdrawn at a time.

Control rod position indication satisfies Criterion 3 of the NRC Policy Statement.

(continued)

PBAPS UNIT 3 B 3.9-10 Revision No. 17

Control Rod Position Indication B 3.9.4 BASES (continued)

LCO Each control rod full-in position indication must be OPERABLE to provide the required input to the refueling interlocks. A full-in position indication is OPERABLE if it provides correct position indication to the refueling interlock logic.

APPLICABILITY During MODE 5, the control rods must have OPERABLE full-in position indication to ensure the applicable refueling interlocks will be OPERABLE.

In MODES I and 2, requirements for control rod position are specified in LCO 3.1.3, "Control Rod OPERABILITY." In MODES 3 and 4, with the reactor mode switch in the shutdown position, a control rod block (LCO 3.3.2.1) ensures all control rods are inserted, thereby preventing criticality during shutdown conditions.

ACTIONS A Note has been provided to modify the ACTIONS related to control rod position indication channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable control rod position indications provide appropriate compensatory measures for separate inoperable channels. As such, this Note has been provided, which allows separate Condition entry for each inoperable required control rod position indication.

A.1.1. A.1.2, A.1.3, A.2.1 and A.2.2 With one or more required full-in position indications inoperable, compensating actions must be taken to protect against potential reactivity excursions from fuel assembly insertions or control rod withdrawals. This may be accomplished by immediately suspending invessel fuel movement and control rod withdrawal, and immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies.

(continued)

PBAPS UNIT 3 B 3.9-11 Revision No. 0

Control Rod Position Indication B 3.9.4 BASES ACTIONS A.I.1. A.1.2, A.1.3, A.2.1 and A.2.2 (continued)

Actions must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted. Suspension of invessel fuel movements and control rod withdrawal shall not preclude moving a component to a safe position.

Alternatively, actions must be immediately initiated to fully insert the control rod(s) associated with the inoperable full-in position indicator(s) and disarm (electrically or hydraulically) the drive(s) to ensure that the control rod is not withdrawn. A control rod can be hydraulically disarmed by closing the drive water and exhaust water isolation valves. A control rod can be electrically disarmed by disconnecting power from all four direction control valve solenoids. Actions must continue until all associated control rods are fully inserted and drives are disarmed. Under these conditions (control rod fully inserted and disarmed), an inoperable full-in position indication may be bypassed to allow refueling operations to proceed. An alternate method must be used to ensure the control rod is fully inserted (e.g., use the "00" notch position indication).

SURVEILLANCE SR 3.9.4.1 REQUIREMENTS The full-in position indications provide input to the one-rod-out interlock and other refueling interlocks that require an all-rods-in permissive. The interlocks are actuated when the full-in position indication for any control rod is not present, since this indicates that all rods are not fully inserted. Therefore, testing of the full-in position indications is performed to ensure that when a control rod is withdrawn, the full-in position indication is not present. The full-in position indication is considered inoperable even with the control rod fully inserted, if it would continue to indicate full-in with the control rod withdrawn. Performing the SR each time a control rod is withdrawn is considered adequate because of the procedural controls on control rod withdrawals and the visual and audible indications available in the control room to alert the operator to control rods not fully inserted.

(continued)

PBAPS UNIT 3 B 3.9-12 Revision No. 0

Control Rod Position Indication B 3.9.4 BASES (continued)

REFERENCES 1. UFSAR, Section 1.5.

2. UFSAR, Section 14.5.3.3.

3. UFSAR, Section 14.5.3.4.

PBAPS UNIT 3 B 3.9-13 Revision No. 0

Control Rod OPERABILITY- Refueling B 3.9.5 B 3.9 REFUELING OPERATIONS B 3.9.5 Control Rod OPERABILITY-Refueling BASES BACKGROUND Control rods are components of the Control Rod Drive (CRD)

System, the primary reactivity control system for the reactor. In conjunction with the Reactor Protection System, the CRD System provides the means for the reliable control of reactivity changes during refueling operation. In addition, the control rods provide the capability to maintain the reactor subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the CRD System.

UFSAR design criteria require that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1).

The CRD System is the system capable of maintaining the reactor subcritical in cold conditions.

APPLICABLE Prevention and mitigation of prompt reactivity excursions SAFETY ANALYSES during refueling are provided by refueling interlocks (LCO 3.9.1 and LCO 3.9.2), the SDM (LCO 3.1.1), the wide range neutron monitor period-short scram (LCO 3.3.1.1), and the control rod block instrumentation (LCO 3.3.2.1).

The safety analyses for the control rod withdrawal error during refueling (Ref. 2) and the fuel assembly insertion error (Ref. 3) evaluate the consequences of control rod withdrawal during refueling and also fuel assembly insertion with a control rod withdrawn. A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment. Control rod scram provides protection should a prompt reactivity excursion occur.

Control rod OPERABILITY during refueling satisfies Criterion 3 of the NRC Policy Statement.

LCO Each withdrawn control rod must be OPERABLE. The withdrawn control rod is considered OPERABLE if the scram accumulator pressure is ; 940 psig and the control rod is capable of (continued)

PBAPS UNIT 3 B 3.9-14 Revision No. 17

Control Rod OPERABILITY-Refueling B 3.9.5 BASES LCO being automatically inserted upon receipt of a scram signal.

(continued) Inserted control rods have already completed their reactivity control function, and therefore, are not required to be OPERABLE.

APPLICABILITY During MODE 5, withdrawn control rods must be OPERABLE to ensure that in a scram the control rods will insert and provide the required negative reactivity to maintain the reactor subcritical.

For MODES 1 and 2, control rod requirements are found in LCO 3.1.2, "Reactivity Anomalies," LCO 3.1.3, "Control Rod OPERABILITY," LCO 3.1.4, "Control Rod Scram Times," and LCO 3.1.5, "Control Rod Scram Accumulators." During MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod OPERABILITY during these conditions.

ACTIONS A.1 With one or more withdrawn control rods inoperable, action must be immediately initiated to fully insert the inoperable control rod(s). Inserting the control rod(s) ensures the shutdown and scram capabilities are not adversely affected.

Actions must continue until the inoperable control rod(s) is fully inserted.

SURVEILLANCE SR 3.9.5.1 and SR 3.9.5.2 REQUIREMENTS During MODE 5, the OPERABILITY of control rods is primarily required to ensure a withdrawn control rod will automatically insert if a signal requiring a reactor shutdown occurs. Because no explicit analysis exists for automatic shutdown during refueling, the shutdown function is satisfied if the withdrawn control rod is capable of automatic insertion and the associated CRD scram accumulator pressure is - 940 psig.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.9-15 Revision No. 87

Control Rod OPERABILITY-Refueling B 3.9.5 BASES SURVEILLANCE SR 3.9.5.1 and SR 3.9.5.2 (continued)

REQUIREMENTS SR 3.9.5.1 is modified by a Note that allows 7 days after withdrawal of the control rod to perform the Surveillance.

This acknowledges that the control rod must first be withdrawn before performance of the Surveillance, and therefore avoids potential conflicts with SR 3.0.3 and SR 3.0.4.

REFERENCES 1. UFSAR, Section 1.5.

2. UFSAR, Section 14.5.3.3.

3. UFSAR, Section 14.5.3.4.

PBAPS UNIT 3 B 3.9-16 Revision No. 0

RPV Water Level B 3.9.6 B 3.9 REFUELING OPERATIONS B 3.9.6 Reactor Pressure Vessel (RPV) Water Level BASES BACKGROUND The movement of fuel assemblies or handling of control rods within the RPV requires a minimum water level of 458 inches above RPV instrument zero. During refueling, this maintains a sufficient water level in the reactor vessel cavity and spent fuel pool. Sufficient water is necessary to retain iodine fission product activity in the water in the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite doses from the accident to well below the guidelines set forth in 10 CFR 50.67 (Ref. 3) as modified in Regulatory Guide 1.183, Table 6.

APPLICABLE During movement of fuel assemblies or handling of control SAFETY ANALYSES rods, the water level in the RPV and the spent fuel pool is an implicit initial condition design parameter in the analysis of a fuel handling accident in containment postulated in Reference 1. A minimum water level of 20 ft 11 inches above the top of the RPV flange allows a partition factor of 200 to be used in the accident analysis for halogens (Ref. 1).

Analysis of the fuel handling accident inside containment is described in Reference 1. With a minimum water level of 458 inches above RPV instrument zero (20 ft 11 inches above the top of the RPV flange) and a minimum decay time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months prior to fuel handling, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water and that offsite doses are maintained within allowable limits (Ref. 3).

While the worst case assumptions include the dropping of an irradiated fuel assembly onto the reactor core, the possibility exists of the dropped assembly striking the RPV flange and releasing fission products. Therefore, the minimum depth for water coverage to ensure acceptable radiological consequences is specified from the RPV flange.

Since the worst case event results in failed fuel assemblies seated in the core, as well as the dropped assembly, (continued)

PBAPS UNIT 3 B 3.9-17 Revision No. 76

RPV Water Level B 3.9.6 BASES APPLICABLE dropping an assembly on the RPV flange will result in SAFETY ANALYSES reduced releases of fission gases. Based on this judgement, (continued) and the physical dimensions which preclude normal operation with water level 23 feet above the flange, a slight reduction in this water level (to 20 ft 11 inches above the flange) is acceptable (Ref. 3).

RPV water level satisfies Criterion 2 of the NRC Policy Statement.

LCO A minimum water level of 458 inches above RPV instrument zero (20 ft 11 inches above the top of the RPV flange) is required to ensure that the radiological consequences of a postulated fuel handling accident are within acceptable limits.

APPLICABILITY LCO 3.9.6 is applicable when moving fuel assemblies or handling control rods (i.e., movement with other than the normal control rod drive) within the RPV. The LCO minimizes the possibility of a fuel handling accident in containment that is beyond the assumptions of the safety analysis. If irradiated fuel is not present within the RPV, there can be no significant radioactivity release as a result of a postulated fuel handling accident. Requirements for fuel handling accidents in the spent fuel storage pool are covered by LCO 3.7.7, "Spent Fuel Storage Pool Water Level."

ACTIONS A.1 If the water level is < 458 inches above RPV instrument zero, all operations involving movement of fuel assemblies and handling of control rods within the RPV shall be suspended immediately to ensure that a fuel handling accident cannot occur. The suspension of fuel movement and control rod handling shall not preclude completion of movement of a component to a safe position.

(continued)

PBAPS UNIT 3 B 3.9-18 Revision No. 0

RPV Water Level B 3.9.6 BASES (continued)

SURVEILLANCE SR 3.9.6.1 REQUIREMENTS Verification of a minimum water level of 458 inches above RPV instrument zero ensures that the design basis for the postulated fuel handling accident analysis during refueling operations is met. Water at the required level limits the consequences of damaged fuel rods, which are postulated to result from a fuel handling accident in containment (Ref. 1).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 14.6.4.

2. UFSAR, Section 10.3.

3. 10 CFR 50.67.

PBAPS UNIT 3 B 3.9-19 Revision No. 87

RHR-High Water Level B 3.9.7 B 3.9 REFUELING OPERATIONS B 3.9.7 Residual Heat Removal (RHR)-High Water Level BASES BACKGROUND The purpose of the RHR System in MODE 5 is to remove decay heat and sensible heat from the reactor coolant, as required in UFSAR, Section 1.5. The RHR System has two loops with each loop consisting of two motor driven pumps, two heat exchangers, and associated piping and valves. There are two RHR shutdown cooling subsystems per RHR System loop. The four RHR shutdown cooling subsystems have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after it has been cooled by circulation through the respective heat exchangers, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the High Pressure Service Water System.

The RHR shutdown cooling mode is manually controlled. Any one of the four RHR shutdown cooling subsystems can provide the required decay heat removal function.

In addition to the RHR subsystems, the volume of water above the reactor pressure vessel (RPV) flange provides a heat sink for decay heat removal.

APPLICABLE With the unit in MODE 5, the RHR System is not required to SAFETY ANALYSES mitigate any events or accidents evaluated in the safety analyses. The RHR System is required for removing decay heat to maintain the temperature of the reactor coolant.

The RHR System satisfies Criterion 4 of the NRC Policy Statement.

LCO Only one RHR shutdown cooling subsystem is required to be OPERABLE and in operation in MODE 5 with irradiated fuel in the RPV and the water level 2 458 inches above RPV instrument zero. Only one subsystem is required because the volume of water above the RPV flange provides backup decay heat removal capability.

An OPERABLE RHR shutdown cooling subsystem consists of an RHR pump, a heat exchanger, a High Pressure Service Water System pump capable of providing cooling to the heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path. In MODE 5, the RHR cross-tie (continued)

PBAPS UNIT 3 B 3.9-20 Revision No. 0

RHR-High Water Level B 3.9.7 BASES LCO valve is not required to b~e closed; thus the valve may be (continued) opened to allow an RHR pump in one loop to discharge through the opposite recirculation loop to make a complete subsystem. In addition, the HPSW cross-tie valve may be open to allow a HPSW pump in one loop to provide cooling to a heat exchanger in the opposite loop to make a complete subsystem.

Additionally, each RHR shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. Operation (either continuous or intermittent) of one subsystem can maintain and reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. A Note is provided to allow a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months exception to shut down the operating-subsystem every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

APPLICABILITY One RHR shutdown cooling subsystem must be OPERABLE and in operation in MODE 5, with irradiated fuel in the RPV and the water level z 458 inches above RPV instrument zero (20 ft 11 inches above the top of the RPV flange), to provide decay heat removal. RHR shutdown cooling subsystem requirements in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS); Section 3.5, Emergency Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling (RCIC)

System; and Section 3.6, Containment Systems. RHR Shutdown Cooling System requirements in MODE 5 with irradiated fuel in the RPV and the water level < 458 inches above RPV instrument zero are given in LCO 3.9.8.

ACTIONS A._1 With no RHR shutdown cooling subsystem OPERABLE, an alternate method of decay heat removal must be established within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . In this condition, the volume of water above the RPV flange provides adequate capability to remove decay heat from the reactor core. However, the overall reliability is reduced because loss of water level could result in reduced decay heat removal capability. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on decay heat removal function and (continued)

PBAPS UNIT 3 B 3.9-21 Revision No. 0

RHR-High Water Level B 3.9.7 BASES ACTIONS A.1 (continued) the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of these alternate method(s) must be reconfirmed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. This will ensure continued heat removal capability.

Alternate decay heat removal methods are available to the operators for review and preplanning in the unit's Operating Procedures. For example, this may include the use of the Reactor Water Cleanup System, operating with the regenerative heat exchanger bypassed. The method used to remove the decay heat should be the most prudent choice based on unit conditions.

B.1, B.2. B.3. and B.4 If no RHR shutdown cooling subsystem is OPERABLE and an alternate method of decay heat removal is not available in accordance with Required Action A.1, actions shall be taken immediately to suspend operations involving an increase in reactor decay heat load by suspending loading of irradiated fuel assemblies into the RPV.

Additional actions are required to minimize any potential fission product release to the environment. This includes ensuring secondary containment is OPERABLE; one standby gas treatment subsystem for Unit 3 is OPERABLE; and secondary containment isolation capability (i.e., one secondary containment isolation valve and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability) in each associated penetration not isolated that is assumed to be isolated to mitigate radioactive releases. This may be performed as an administrative check, by examining logs or other information to determine whether the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, a surveillance may need to be performed to restore the component to OPERABLE status.

Actions must continue until all required components are OPERABLE.

(continued)

PBAPS UNIT 3 B 3.9-22 Revision No. 0

RHR-High Water Level B 3.9.7 BASES ACTIONS C.1 and C.2 (continued)

If no RHR shutdown cooling subsystem is in operation, an alternate method of coolant circulation is required to be established within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This alternate method may utilize forced or natural circulation cool ing. The Completion Time is modified such that the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable separately for each occurrence involving a loss of coolant circulation.

During the'period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem), the reactor coolant temperature must be periodically monitored to ensure proper functioning of the alternate method. The once per hour Completion Time is deemed appropriate.

SURVEILLANCE SR 3.9.7.1 REQUIREMENTS This Surveillance demonstrates that the RHR shutdown cooling subsystem is in operation and circulating reactor coolant.

The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES None.

PBAPS UNIT 3 B 3.9-23 Revision No. 87

RHR-Low Water Level B 3.9.8 B 3.9 REFUELING OPERATIONS B 3.9.8 Residual Heat Removal (RHR)-Low Water Level BASES BACKGROUND The purpose of the RHR System in MODE 5 is to remove decay heat and sensible heat from the reactor coolant, as required in UFSAR Section 1.5. The RHR System has two loops with each loop consisting of two motor driven pumps, two heat exchangers, and associated piping and valves. There are two RHR shutdown cooling subsystems per RHR System loop. The four RHR shutdown cooling subsystems have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after it has been cooled by circulation through the respective heat exchangers, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the High Pressure Service Water System.

The RHR shutdown cooling mode is manually controlled. Any one of the four RHR shutdown cooling subsystems can provide the required decay heat removal function.

APPLICABLE With the unit in MODE 5, the RHR System is not required to SAFETY ANALYSES mitigate any events or accidents evaluated in the safety analyses. The RHR System is required for removing decay heat to maintain the temperature of the reactor coolant.

The RHR System satisfies Criterion 4 of the NRC Policy Statement.

LCO In MODE 5 with irradiated fuel in the RPV and the water level < 458 inches above reactor pressure vessel (RPV) instrument zero both RHR shutdown cooling subsystems must be OPERABLE.

An OPERABLE RHR shutdown cooling subsystem consists of an RHR pump, a heat exchanger, a High Pressure Service Water System pump capable of providing cooling to the heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path. The two subsystems have a common suction source and are allowed to have common discharge piping. Since piping is a passive component that is assumed not to fail, it is allowed to be common to both subsystems. In MODE 5, the RHR cross-tie valve is not required to be closed, thus the valve may be opened to allow (continued)

PBAPS UNIT 3 B 3.9-24 Revision No. 0

RHR-Low Water Level B 3.9.8 BASES LCO an RHR pump in one loop to discharge through the opposite (continued) recirculation loop to make a complete subsystem. In addition, the HPSW cross-tie valve may be open to allow a HPSW pump in one loop to provide cooling to a heat exchanger in the opposite loop to make a complete subsystem.

Additionally, each RHR shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. Operation (either continuous or intermittent) of one subsystem can maintain and reduce the reactor coolant temperature as required. Hpwever, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. A Note is provided to allow a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months exception to shut down the operating subsystem every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

APPLICABILITY Two RHR shutdown cooling subsystems are required to be OPERABLE, and one must be in operation in MODE 5, with irradiated fuel in the RPV and the water level < 458 inches above RPV instrument zero (20 ft 11 inches above the top of the RPV flange), to provide decay heat removal. RHR shutdown cooling subsystem requirements in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS); Section 3.5, Emergency Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling (RCIC) System; and Section 3.6, Containment Systems. RHR Shutdown Cooling System requirements in MODE 5 with irradiated fuel in the RPV and the water level : 458 inches above RPV instrument zero are given in LCO 3.9.7, "Residual Heat Removal (RHR)-High Water Level."

ACTIONS A._1 With one of the two required RHR shutdown cooling subsystems inoperable, the remaining subsystem is capable of providing the required decay heat removal. However, the overall reliability is reduced. Therefore an alternate method of decay heat removal must be provided. With both required RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability. This re-establishes backup decay heat removal capabilities, similar to the requirements of the (continued)

PBAPS UNIT 3 B 3.9-25 Revision No. 0

RHR-Low Water Level B 3.9.8' BASES ACTIONS A.1 (continued)

LCO. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of this alternate method(s) must be reconfirmed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. This will ensure continued heat removal capability.

Alternate decay heat removal methods are available to the operators for review and preplanning in the unit's Operating Procedures. For example, this may include the use of the Reactor Water Cleanup System, operating with the regenerative heat exchanger bypassed. The method used to remove decay heat should be the most prudent choice based on unit conditions.

B.I. B.2. and B.3 With the required decay heat removal subsystem(s) inoperable and the required alternate method(s) of decay heat removal not available in accordance with Required Action A.1, additional actions are required to minimize any potential fission product release to the environment. This includes ensuring secondary containment is OPERABLE; one standby gas treatment subsystem for Unit 3 is OPERABLE; and secondary containment isolation capability (i.e., one secondary containment isolation valve and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability) in each associated penetration that is assumed to be isolated to mitigate radioactive releases. This may be performed as an administrative check, by examining logs or other information to determine whether the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components.

If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the surveillance may need to be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE.

(continued)

PBAPS UNIT 3 B 3.9-26 Revision No. 0

RHR-Low Water Level B 3.9.8 BASES ACTIONS C.1 and C.2 (continued)

If no RHR shutdown cooling subsystem is in operation, an alternate method of coolant circulation is required to be established within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This alternate method may utilize forced or natural circulation cooling. The Completion Time is modified such that the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable separately for each occurrence involving a loss of coolant circulation.

During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem), the reactor coolant temperature must be periodically monitored to ensure proper functioning of the alternate method. The once per hour Completion Time is deemed appropriate.

SURVEILLANCE SR 3.9.8.1 REQUIREMENTS This Surveillance demonstrates that one RHR shutdown cooling subsystem is in operation and circulating reactor coolant.

The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability.

The Surveillance Frequency is controlled, under the Surveillance Frequency Control Program.

REFERENCES None.

PBAPS UNIT 3 B 3.9-27 Revision No. 87

Inservice Leak and Hydrostatic Testing Operation B 3.10.1 B 3.10 SPECIAL OPERATIONS B 3.10.1 Inservice Leak and Hydrostatic Testing Operation BASES BACKGROUND The purpose of this Special Operations LCO is to allow certain reactor coolant pressure tests to be performed in MODE 4 when the metallurgical characteristics of the reactor pressure vessel (RPV) or plant temperature control I capabilities during these tests require the pressure testing at temperatures > 212°F (normally corresponding to MODE.3).

Inservice hydrostatic testing and system leakage pressure tests required by Section XI of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (Ref. 1) are performed prior to the reactor going critical after a refueling outage. Recirculation pump operation and a water solid RPV (except for an air bubble for pressure control) are used to achieve the necessary temperatures and pressures required for these tests. The minimum temperatures (at the required pressures) allowed for these tests are determined from the RPV pressure and temperature (P/T) limits required by LCO 3.4.9, "Reactor Coolant System (RCS) Pressure and Temperature (P/T) Limits." These limits are conservatively based on the fracture toughness of the reactor vessel, taking into account anticipated vessel neutron fluence.

With increased reactor vessel fluence over time, the minimum allowable vessel temperature increases at a given pressure.

Periodic updates to the RCS P/T limit curves are performed as necessary, based upon the results of analyses of irradiated surveillance specimens removed from the vessel.

Hydrostatic and leak testing may eventually be required with minimum reactor coolant temperatures > 2129F.

APPLICABLE Allowing the reactor to be considered in MODE 4 during SAFETY ANALYSES hydrostatic or leak testing, when the reactor coolant temperature is > 2120F, effectively provides an exception to MODE 3 requirements, including OPERABILITY of primary containment and the full complement of redundant Emergency Core Cooling Systems. Since the hydrostatic or leak tests are performed nearly water solid (except for an air bubble for pressure control), at low decay heat values, and near MODE 4 conditions, the stored energy in the reactor core will be very low. Under these conditions, the potential for (conti nued)

PBAPS UNIT 3 B 3. 10-1 Revision No. 1

Inservice Leak and Hydrostatic Testing Operation B 3.10.1 BASES APPLICABLE failed fuel and a subsequent increase in coolant activity SAFETY ANALYSES above the LCO 3.4.6, "RCS Specific Activity," limits are (continued) minimized. In addition, the secondary containment will be OPERABLE, in accordance with this Special Operations LCO, and will be capable of handling any airborne radioactivity or steam leaks that could occur during the performance of hydrostatic or leak testing. The required pressure testing conditions provide adequate assurance that the consequences of a steam leak will be conservatively bounded by the consequences of the postulated main steam line break outside of primary containment described in Reference 2. Therefore, these requirements will conservatively limit radiation releases to the environment.

In the event of a large primary system leak, the reactor vessel would rapidly depressurize, allowing the low pressure core cooling systems to operate. The capability of the low pressure coolant injection and core spray subsystems, as required in MODE 4 by LCO 3.5.2, "ECCS-Shutdown," would be more than adequate to keep the core flooded under this low decay heat load condition. Small system leaks would be detected by leakage inspections before significant inventory loss occurred.

For the purposes of this test, the protection provided by normally required MODE 4 applicable LCOs, in addition to the secondary containment requirements required to be met by this Special Operations LCO, will ensure acceptable consequences during normal hydrostatic test conditions and during postulated accident conditions.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Policy Statement apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation at reactor coolant temperatures > 212°F can be in accordance with Table 1.1-1 for MODE 3 operation without meeting this Special Operations LCO or its ACTIONS. This option may be required due to P/T (continued)

PBAPS UNIT 3 B 3.10-2 Revision No. 0

Inservice Leak and Hydrostatic Testing Operation B 3.10.1 BASES LCO limits, however, which require testing at temperatures (continued) > 212°F, while the ASME inservice test itself requires the safety/relief valves to be gagged, preventing their OPERABILITY.

If it is desired to perform these tests while complying with this Special Operations LCO, then the MODE 4 applicable LCOs and specified MODE 3 LCOs must be met. This Special Operations LCO allows changing Table 1.1-1 temperature limits for MODE 4 to "NA" and suspending the requirements of LCO 3.4.8, "Residual Heat Removal (RHR) Shutdown Cooling System-Cold Shutdown." The additional requirements for secondary containment LCOs to be met will provide sufficient protection for operations at reactor coolant temperatures

> 212°F for the purpose of performing either an inservice leak or hydrostatic test.

This LCO allows primary containment to be open for frequent unobstructed access to perform inspections, and for outage activities on various systems to continue consistent with the MODE 4 applicable requirements that are in effect immediately prior to and immediately after this operation.

APPLICABILITY The MODE 4 requirements may only be modified for the performance of inservice leak or hydrostatic tests so that these operations can be considered as in MODE 4, even though the reactor coolant temperature is > 212°F. The additional requirement for secondary containment OPERABILITY according to the imposed MODE 3 requirements provides conservatism in the response of the unit to any event that may occur.

Operations in all other MODES are unaffected by this LCO.

ACTIONS A Note has been provided to modify the ACTIONS related to inservice leak and hydrostatic testing operation.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits, will not result in separate entry into the Condition.

Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for each requirement of the LCO not met provide appropriate (continued)

PBAPS UNIT 3 B 3.10-3 Revision No. 0

Inservice Leak and Hydrostatic Testing Operation B 3.10.1 BASES ACTIONS compensatory measures for separate requirements that are (continued) not met. As such, a Note has been provided that allows separate Condition entry for each requirement of the LCO.

A.1 If an LCO specified in LCO 3.10.1 is not met, the ACTIONS applicable to the stated requirements are entered immediately and complied with. Required Action A.1 has been modified by a Note that clarifies the intent of another LCO's Required Action to be in MODE 4 includes reducing the average reactor coolant temperature to

212°F.

A.2.1 and A.2.2 Required Action A.2.1 and Required Action A.2.2 are alternate Required Actions that can be taken instead of Required Action A.1 to restore compliance with the normal MODE 4 requirements, and thereby exit this Special Operation LCO's Applicability. Activities that could further increase reactor coolant temperature or pressure are suspended immediately, in accordance with Required Action A.2.1, and the reactor cool anaT-temperature is reduced to establish normal MODE 4 requirements. The allowed Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Required Action A.2.2 is based on engineering judgment and provides sufficient time to reduce the average reactor coolant temperature from the highest expected value to : 212°F with normal cooldown procedures. The Completion Time is also consistent with the time provided in LCO 3.0.3 to reach MODE 4 from MODE 3.

SURVEILLANCE SR 3.10.1.1 REQUIREMENTS The LCOs made applicable are required to have their Surveillances met to establish that this LCO is being met.

A discussion of the applicable SRs is provided in their respective Bases.

REFERENCES 1. American Society of Mechanical Engineers, Boiler and Pressure Vessel Code, Section XI.

2. UFSAR, Section 14.6.5.

PBAPS UNIT 3 B 3.10-4 Revision No. 0

Reactor Mode Switch Interlock Testing B 3.10.2 B 3.10 SPECIAL OPERATIONS B 3.10.2 Reactor Mode Switch Interlock Testing BASES BACKGROUND The purpose of this Special Operations LCO is to permit operation of the reactor mode switch from one position to another to confirm certain aspects of associated interlocks during periodic tests and calibrations in MODES 3, 4, and 5.

The reactor mode switch is a conveniently located, multiposition, keylock switch provided to select the necessary scram functions for various plant conditions (Ref. 1). The reactor mode switch selects the appropriate trip relays for scram functions and provides appropriate bypasses. The mode switch positions and related scram interlock functions are summarized as follows:

a. Shutdown- Initiates a reactor scram; bypasses main steam line isolation and main condenser low vacuum scrams;

b. Refuel - Selects Neutron Monitoring System (NMS) scram function for low neutron flux level operation (wide range neutron monitors and average power range monitor setdown scram); bypasses main steam line isolation and main condenser low vacuum scrams;

c. Startup/Hot Standby- Selects NMS scram function for low neutron flux level operation (wide range neutron monitors and average power range monitors); bypasses main steam line isolation and main condenser low vacuum scrams; and

d. Run-Selects NMS scram function for power range operation.

The reactor mode switch also provides interlocks for such functions as control rod blocks, scram discharge volume trip bypass, refueling interlocks, and main steam isolation valve isolations.

APPLICABLE The acceptance criterion for reactor mode switch interlock SAFETY ANALYSES testing is to prevent fuel failure by precluding reactivity excursions or core criticality. The interlock functions of (continued)

PBAPS UNIT 3 B 3.10-5 Revision No. 17

Reactor Mode Switch Interlock Testing B 3.10.2 BASES APPLICABLE the shutdown and refuel positions normally maintained for SAFETY ANALYSES the reactor mode switch in MODES 3, 4, and 5 are provided to (continued) preclude reactivity excursions that could potentially result in fuel failure. Interlock testing that requires moving the reactor mode switch to other positions (run, startup/hot standby, or refuel) while in MODE 3, 4, or 5, requires administratively maintaining all control rods inserted and no other CORE ALTERATIONS in progress. With all control rods inserted in core cells containing one or more fuel assemblies, and no CORE ALTERATIONS in progress, there are no credible mechanisms for unacceptable reactivity excursions during the planned interlock testing.

For postulated accidents, such as control rod removal error during refueling or loading of fuel with a control rod withdrawn, the accident analysis demonstrates that fuel failure will not occur (Refs. 2 and 3). The withdrawal of a single control rod will not result in criticality when adequate SDM is maintained. Also, loading fuel assemblies into the core with a single control rod withdrawn will not result in criticality, thereby preventing fuel failure.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Policy Statement apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. MODES 3, 4, and 5 operations not specified in Table 1.1-1 can be performed in accordance with other Special Operations LCOs (i.e., LCO 3.10.1, "Inservice Leak and Hydrostatic Testing Operation,"

LCO 3.10.3, "Single Control Rod Withdrawal--Hot Shutdown,"

LCO 3.10.4, "Single Control Rod Withdrawal--Cold Shutdown,"

and LCO 3.10.8, "SDM Test-Refueling") without meeting this LCO or its ACTIONS. If any testing is performed that involves the reactor mode switch interlocks and requires repositioning beyond that specified in Table 1.1-1 for the current MODE of operation, the testing can be performed, provided all interlock functions potentially defeated are administratively controlled. In MODES 3, 4, and 5 with the reactor mode switch in shutdown as specified in Table 1.1-1, all control rods are fully inserted and a control rod block (continued)

PBAPS UNIT 3 B 3.10-6 Revision No. 0

Reactor Mode Switch Interlock Testing B 3.10.2 BASES LCO is initiated. Therefore, all control rods in core cells (continued) that contain one or more fuel assemblies must be verified fully inserted while in MODES 3, 4, and 5, with the reactor mode switch in other than the shutdown position. The additional LCO requirement to preclude CORE ALTERATIONS is appropriate for MODE 5 operations, as discussed below, and is inherently met in MODES 3 and 4 by the definition of CORE ALTERATIONS, which cannot be performed with the vessel head in place.

In MODE 5, with the reactor mode switch in the refuel position, only one control rod can be withdrawn under the refuel position one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock"). The refueling equipment interlocks (LCO 3.9.1, "Refueling Equipment Interlocks")

appropriately control other CORE ALTERATIONS. Due to the increased potential for error in controlling these multiple interlocks, and the limited duration of tests involving the reactor mode switch position, conservative controls are required, consistent with MODES 3 and 4. The additional controls of administratively not permitting other CORE ALTERATIONS will adequately ensure that the reactor does not become critical during these tests.

APPLICABILITY Any required periodic interlock testing involving the reactor mode switch, while in MODES 1 and 2, can be performed without the need for Special Operations exceptions. Mode switch manipulations in these MODES would likely result in unit trips. In MODES 3, 4, and 5, this Special Operations LCO is only permitted to be used to allow reactor mode switch interlock testing that cannot conveniently be performed without this allowance or testing which must be performed prior to entering another MODE.

Such interlock testing may consist of required Surveillances, or may be the result of maintenance, repair, or troubleshooting activities. In MODES 3, 4, and 5, the interlock functions provided by the reactor mode switch in shutdown (i.e., all control rods inserted and incapable of withdrawal) and refueling (i.e., refueling interlocks to prevent inadvertent criticality during CORE ALTERATIONS) positions can be administratively controlled adequately during the performance of certain tests.

(continued)

PBAPS UNIT 3 B 3.1I0-7 Revision No. 0

Reactor Mode Switch Interlock Testing B 3.10.2 BASES (continued)

ACTIONS A.1, A.2, A.3.1. and A.3.2 These Required Actions are provided to restore compliance with the Technical Specifications overridden by this Special Operations LCO. Restoring compliance will also result in exiting the Applicability of this Special Operations LCO.

All CORE ALTERATIONS except control rod insertion, if in progress, are immediately suspended in accordance with Required Action A.1, and all insertable control rods in core cells that contain one or more fuel assemblies are fully inserted within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , in accordance with Required Action A.2. This will preclude potential mechanisms that could lead to criticality. Suspension of CORE ALTERATIONS shall not preclude the completion of movement of a component to a safe condition. Placing the reactor mode switch in the shutdown position will ensure that all inserted control rods remain inserted and result in operating in accordance with Table 1.1-1. Alternatively, if in MODE 5, the reactor mode switch may be placed in the refuel position, which will also result in operating in accordance with Table 1.1-1. A Note is added to Required Action A.3.2 to indicate that this Required Action is only applicable in MODE 5, since only the shutdown position is-allowed in MODES 3 and 4. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for Required Action A.2, Required Action A.3.1, and Required Action A.3.2 provides sufficient time to normally insert the control rods and place the reactor mode switch in the required position, based on operating experience, and is acceptable given that all operations that could increase core reactivity have been suspended.

SURVEILLANCE SR 3.10.2.1 and SR 3.10.2.2 REQUIREMENTS Meeting the requirements of this Special Operations LCO maintains operation consistent with or conservative to operating with the reactor mode switch in the shutdown position (or the refuel position for MODE 5). The functions of the reactor mode switch interlocks that are not in effect, due to the testing in progress, are adequately compensated for by the Special Operations LCO requirements.

The administrative controls are to be periodically verified to ensure that the operational requirements continue to be met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.10-8 Revision No. 87

Reactor Mode Switch Interlock Testing B 3.10.2 BASES (continued)

REFERENCES 1. UFSAR, Section 7.2.3.7.

2. UFSAR, Section 14.5.3.3.

3. UFSAR, Section 14.5.3.4.

PBAPS UNIT 3 B 3.10-9 Revision No. 87

Single Control Rod Withdrawal-Hot Shutdown B 3.10.3 B 3.10 SPECIAL OPERATIONS B 3.10.3 Single Control Rod Withdrawal-Hot Shutdown BASES BACKGROUND The purpose of this. MODE 3 Special Operations LCO is to permit the withdrawal of a single control rod for testing while in hot shutdown, by imposing certain restrictions. In MODE 3, the reactor mode switch is in the shutdown position, and all control rods are inserted and blocked from withdrawal. Many systems and functions are not required in these conditions, due to the other installed interlocks that are actuated when the reactor mode switch is in the shutdown position. However, circumstances may arise while in MODE 3 that present the need to withdraw a single control rod for various tests (e.g., friction tests, scram timing, and coupling integrity checks). These single control rod withdrawals are normally accomplished by selecting the refuel position for the reactor mode switch. This Special Operations LCO provides the appropriate additional controls to allow a single control rod withdrawal in MODE 3.

APPLICABLE With the reactor mode switch in the refuel position, the SAFETY ANALYSES analyses for control rod withdrawal during refueling are applicable and, provided the assumptions of these analyses are satisfied in MODE 3, these analyses will bound the consequences of an accident. Explicit safety analyses in the UFSAR (Refs. I and 2) demonstrate that the functioning of the refueling interlocks and adequate SDM will preclude unacceptable reactivity excursions.

Refueling interlocks restrict the movement of control rods to reinforce operational procedures that prevent the reactor from becoming critical. These interlocks prevent the withdrawal of more than one control rod. Under these conditions, since only one control rod can be withdrawn, the core will always be shut down even with the highest worth control rod withdrawn if adequate SDM exists.

The control rod scram function provides backup protection to normal refueling procedures and the refueling interlocks, which prevent inadvertent criticalities during refueling.

(continued)

PBAPS UNIT 3 B 3.10-10 Revision No. 0

Single Control Rod Withdrawal--Hot Shutdown B 3.10.3 BASES APPLICABLE Alternate backup protection can be obtained by ensuring SAFETY ANALYSES that five by five array of control rods; centered on the (continued) withdrawn control rod, are inserted and incapable of withdrawal.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Policy Statement apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 3 with the reactor mode switch in the refuel position can be performed in accordance with other Special Operations LCOs (i.e.,

LCO 3.10.2, "Reactor Mode Switch Interlock Testing") without meeting this Special Operations LCO or its ACTIONS.

However, if a single control rod withdrawal is desired in MODE 3, controls consistent with those required during refueling must be implemented and this Special Operations LCO applied. "Withdrawal," in this application, includes the actual withdrawal of the control rod, as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod. The refueling interlocks of LCO 3.9.2, "Refuel Position One-Rod-Out Interlock," required by this Special Operations LCO, will ensure that only one control rod can be withdrawn; To back up the refueling interlocks (LCO 3.9.2), the ability to scram the withdrawn control rod in the event of an inadvertent criticality is provided by this Special Operations LCO's requirements in Item d.1. Alternately, provided a sufficient number of control rods in the vicinity of the withdrawn control rod are known to be inserted and incapable of withdrawal, Item d.2, the possibility of criticality on withdrawal of this control rod is sufficiently precluded, so as not to require the scram capability of the withdrawn control rod. Also, once this alternate (d.2) is completed, the SDM requirement to account for both the withdrawn untrippable (inoperable) control rod, and the highest worth control rod may be changed to allow the withdrawn untrippable (inoperable) control rod to be the single highest worth control rod.

(continued)

PBAPS UNIT 3 B 3.10-11 Revision No. 0

Single Control Rod Withdrawal--Hot Shutdown B 3.10.3 BASES (continued)

APPLICABILITY Control rod withdrawals are adequately controlled in MODES 1, 2, and 5 by existing LCOs. In MODES 3 and 4, control rod withdrawal is only allowed if performed in accordance with this Special Operations LCO or Special Operations LCO 3.10.4, and if limited to one control rod.

This allowance is only provided with the reactor mode switch in the refuel position. For these conditions, the one-rod-out interlock (LCO 3.9.2), control rod position indication (LCO 3.9.4, "Control Rod Position Indication"),

full insertion requirements for all other control rods and scram functions (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," and LCO 3.9.5, Control Rod OPERABILITY-Refueling"), or the added administrative controls in Item d.2 of this Special Operations LCO, minimize potential reactivity excursions.

ACTIONS A Note has been provided to modify the ACTIONS related to a single control rod withdrawal while in MODE 3. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for each requirement of the LCO not met provide appropriate compensatory measures for separate requirements that are not met. As such, a Note has been provided that allows separate Condition entry for each requirement of the LCO.

A.1 If one or more of the requirements specified in this Special Operations LCO are not met, the ACTIONS applicable to the stated requirements of the affected LCOs are immediately entered as directed by Required Action A.I. Required Action A.1 has been modified by a Note that clarifies the intent of any other LCO's Required Action to insert all control rods. This Required Action includes exiting this Special Operations Applicability by returning the reactor mode switch to the shutdown position. A second Note has been added, which clarifies that this Required Action is only applicable if the requirements not met are for an affected LCO.

(cnntinuid)

PBAPS UNIT 3 B 3.10-12 Revision No. 0

Single Control Rod Withdrawal-Hot Shutdown B 3.10.3 BASES ACTIONS A.2.1 and A.2.2 (continued)

Required Actions A.2.1 and A.2.2 are alternate Required Actions that can be taken instead of Required Action A.1 to restore compliance with the normal MODE 3 requirements, thereby exiting this Special Operations LCO's Applicability.

Actions must be initiated immediately to insert all insertable control rods. Actions must continue until all such control rods are fully inserted. Placing the reactor mode switch in the shutdown position will ensure all inserted rods remain inserted and restore operation in accordance with Table 1.1-1. The allowed Completion Time of I hour to place the reactor mode switch in the shutdown position provides sufficient time to normally insert the control rods.

SURVEILLANCE SR 3.10.3.1. SR 3.10.3.2. and SR 3.10.3.3 REQUIREMENTS The other LCOs made applicable in this Special Operations LCO are required to have their Surveillances met to establish that this Special Operations LCO is being met. If the local array of control rods is inserted and disarmed while the scram function for the withdrawn rod is not available, periodic verification in accordance with SR 3.10.3.2 is required to preclude the possibility of criticality. SR 3.10.3.2 has been modified by a Note, which clarifies that this SR is not required to be met if SR 3.10.3.1 is satisfied for LCO 3.10.3.d.1 requirements, since SR 3.10.3.2 demonstrates that the alternative LCO 3.10.3.d.2 requirements are satisfied. Also, SR 3.10.3.3 verifies that all control rods other than the control rod being withdrawn are fully inserted. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 7.6.4.

2. UFSAR, Section 14.5.3.3.

PBAPS UNIT 3 B 3.10-13 Revision No. 87

Single Control Rod Withdrawal--Cold Shutdown B 3.10.4 B 3.10 SPECIAL OPERATIONS B 3.10.4 Single Control Rod Withdrawal--Cold Shutdown BASES BACKGROUND The purpose of this MODE 4 Special Operations LCO is to permit the withdrawal of a single control rod for testing or maintenance, while in cold shutdown, by imposing certain restrictions. In MODE 4, the reactor mode switch is in the shutdown position, and all control rods are inserted and blocked from withdrawal. Many systems and functions are not required in these conditions, due to the installed interlocks associated with the reactor mode switch in the shutdown position. Circumstances may arise while in MODE 4, however, that present the need to withdraw a single control rod for various tests (e.g., friction tests, scram time testing, and coupling integrity checks). Certain situations may also require the removal of the associated control rod drive (CRD). These single control rod withdrawals and possible subsequent removals are normally accomplished by selecting the refuel position for the reactor mode switch.

APPLICABLE With the reactor mode switch in the refuel position, the SAFETY ANALYSES analyses for control rod withdrawal during refueling are applicable and, provided the assumptions of these analyses are satisfied in MODE 4, these analyses will bound the consequences of an accident. Explicit safety analyses in the UFSAR (Refs. I and 2) demonstrate that the functioning of the refueling interlocks and adequate SDM will preclude unacceptable reactivity excursions.

Refueling interlocks restrict the movement of control rods to reinforce operational procedures that prevent the reactor from becoming critical. These interlocks prevent the withdrawal of more than one control rod. Under these conditions, since only one control rod can be withdrawn, the core will always be shut down even with the highest worth control rod withdrawn if adequate SDM exists.

The control rod scram function provides backup protection in the event of normal refueling procedures and the refueling interlocks fail to prevent inadvertent criticalities during refueling. Alternate backup protection can be obtained by ensuring that a five by five array of control rods, centered on the withdrawn control rod, are inserted and incapable of (continued)

PBAPS UNIT 3 B 3.10-14 Revision No. 0

Single Control Rod Withdrawal--Cold Shutdown B 3.10.4 BASES APPLICABLE withdrawal. This alternate backup protection is required SAFETY ANALYSES when removing a CRD because this removal renders the (continued) withdrawn control rod incapable of being scrammed.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Policy Statement apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 4 with the reactor mode switch in the refuel position can be performed in accordance with other LCOs (i.e., Special Operations LCO 3.10.2, "Reactor Mode Switch Interlock Testing") without meeting this Special Operations LCO or its ACTIONS. If a single control rod withdrawal is desired in MODE 4, controls consistent with those required during refueling must be implemented and this Special Operations LCO applied.

"Withdrawal," in this application, includes the actual withdrawal of the control rod, as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod.

The refueling interlocks of LCO 3.9.2, "Refuel Position One-Rod-Out Interlock," required by this Special Operations LCO will ensure that only one control rod can be withdrawn.

At the time CRD removal begins, the disconnection of the position indication probe will cause LCO 3.9.4, "Control Rod Position Indication," and therefore, LCO 3.9.2 to fail to be met. Therefore, prior to commencing CRD removal, a control rod withdrawal block is required to be inserted to ensure that no additional control rods can be withdrawn and that compliance with this Special Operations LCO is maintained.

To back up the refueling interlocks (LCO 3.9.2) or the control rod withdrawal block, the ability to scram the withdrawn control rod in the event of an inadvertent criticality is provided by the Special Operations LCO requirements in Item c.1. Alternatively, when the scram (continued)

PBAPS UNIT 3 B 3.10-15 Revision No. 0

Single Control Rod Withdrawal--Cold Shutdown B 3.10.4 BASES LCO function is not OPERABLE, or when the CRD is to be removed, (continued) a sufficient number of rods in the vicinity of the withdrawn control rod are required to be inserted and made incapable of withdrawal (Item c.2). This precludes the possibility of criticality upon withdrawal of this control rod. Also, once this alternate (Item c.2) is completed, the SDM requirement to account for both the withdrawn untrippable (inoperable) control rod, and the highest worth control rod may be changed to allow the withdrawn untrippable (inoperable) control rod to be the single highest worth control rod.

APPLICABILITY Control rod withdrawals are adequately controlled in MODES 1, 2, and 5 by existing LCOs. In MODES 3 and 4, control rod withdrawal is only allowed if performed in accordance with Special Operations LCO 3.10.3, or this Special Operations LCO, and if limited to one control rod.

This allowance is only provided with the reactor mode switch in the refuel position.

During these conditions, the full insertion requirements for all other control rods, the one-rod-out interlock (LCO 3.9.2), control rod position indication (LCO 3.9.4),

and scram functions (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," and LCO 3.9.5, "Control Rod OPERABILITY-Refueling"), or the added administrative controls in Item b.2 and Item c.2 of this Special Operations LCO, provide mitigation of potential reactivity excursions.

ACTIONS A Note has been provided to modify the ACTIONS related to a single control rod withdrawal while in MODE 4. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for each requirement of the LCO not met provide appropriate compensatory measures for separate requirements that are not met. As such, a Note has been provided that allows separate Condition entry for each requirement of the LCO.

(continued)

PBAPS UNIT 3 B 3.10-16 Revision No. 0

Single Control Rod Withdrawal-Cold Shutdown B 3.10.4 BASES ACTIONS A.I. A.2.1, and A.2.2 (continued)

If one or more of the requirements of this Special Operations LCO are not met with the affected control rod insertable, these Required Actions restore operation consistent with normal MODE 4 conditions (i.e., all rods inserted) or with the exceptions allowed in this Special Operations LCO. Required Action A.1 has been modified by a Note that clarifies that the intent of any other LCO's Required Action is to insert all control rods. This Required Action includes exiting this Special Operations Applicability by returning the reactor mode switch to the shutdown position. A second Note has been added to Required Action A.1 to clarify that this Required Action is only applicable if the requirements not met are for an affected LCO.

Required Actions A.2.1 and A.2.2 are specified, based on the assumption that the control rod is being withdrawn. If the control rod is still insertable, actions must be immediately initiated to fully insert all insertable control rods and within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months place the reactor mode switch in the shutdown position. Actions must continue until all such control rods are fully inserted. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for placing the reactor mode switch in the shutdown position provides sufficient time to normally insert the control rods.

B.1, B.2.1. and B.2.2 If one or more of the requirements of this Special Operations LCO are not met with the affected control rod not insertable, withdrawal of the control rod and removal of the associated CRD must be immediately suspended. If the CRD has been removed, such that the control rod is not insertable, the Required Actions require the most expeditious action be taken to either initiate action to restore the CRD and insert its control rod, or initiate action to restore compliance with this Special Operations LCO.

(continued)

PBAPS UNIT 3 B 3.10-17 Revision No. 0

Single Control Rod Withdrawal-Cold Shutdown B 3.10.4 BASES (continued)

SURVEILLANCE SR 3.10.4.1. SR 3.10.4.2. SR 3.10.4.3. and SR 3.10.4.4 REQUIREMENTS The other LCOs made applicable by this Special Operations LCO are required to have their associated surveillances met to establish that this Special Operations LCO is being met.

If the local array of control rods is inserted and disarmed while the scram function for the withdrawn rod is not available, periodic verification is required to ensure that the possibility of criticality remains precluded.

Verification that all the other control rods are fully inserted is required to meet the SDM requirements.

Verification that a control rod withdrawal block has been inserted ensures that no other control rods can be inadvertently withdrawn under conditions when position indication instrumentation is inoperable for the affected control rod. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.10.4.2 and SR 3.10.4.4 have been modified by Notes, which clarify that these SRs are not required to be met if the alternative requirements demonstrated by SR 3.10.4.1 are satisfied.

REFERENCES 1. UFSAR, Section 7.6.4.

2. UFSAR, Section 14.5.3.3.

'K PBAPS UNIT 3 B 3. 10 - 18 Revision No. 87

Single CRD Removal--Refueling B 3.10.5 B 3.10 SPECIAL OPERATIONS B 3.10.5 Single Control Rod Drive (CRD) Removal--Refueling BASES BACKGROUND The purpose of this MODE 5 Special Operations LCO is to permit the removal of a single CRD during refueling operations by imposing certain administrative controls.

Refueling interlocks restrict the movement of control rods and the operation of the refueling equipment to reinforce operational procedures that prevent the reactor from becoming critical during refueling operations. During refueling operations, no more than one control rod is permitted to be withdrawn from a core cell containing one or more fuel assemblies. The refueling interlocks use the "full-in" position indicators to determine the position of all control rods. If the "full-in" position signal is not present for every control rod, then the all rods in permissive for the refueling equipment interlocks is not present and fuel loading is prevented. Also, the refuel position one-rod-out interlock will not allow the withdrawal of a second control rod.

The control rod scram function provides backup protection in the event normal refueling procedures, and the refueling interlocks described above fail to prevent inadvertent criticalities during refueling. The requirement for this function to be OPERABLE precludes the possibility of removing the CRD once a control rod is withdrawn from a core cell containing one or more fuel assemblies. This Special Operations LCO provides controls sufficient to ensure the possibility of an inadvertent criticality is precluded, while allowing a single CRD to be removed from a core cell containing one or more fuel assemblies. The removal of the CRD involves disconnecting the position indication probe, which causes noncompliance with LCO 3.9.4, "Control Rod Position Indication," and, therefore, LCO 3.9.1, "Refueling Equipment Interlocks," and LCO 3.9.2, "Refueling Position One-Rod-Out Interlock." The CRD removal also requires isolation of the CRD from the CRD Hydraulic System, thereby causing inoperability of the control rod (LCO 3.9.5, "Control Rod OPERABILITY-Refueling").

(continued)

PBAPS UNIT 3 B 3.10-19 Revision No. 0

Single CRD Removal--Refueling B 3.10.5 BASES (continued)

APPLICABLE With the reactor mode switch in the refuel position, the SAFETY ANALYSES analyses for control rod withdrawal during refueling are applicable and, provided the assumptions of these analyses are satisfied, these analyses will bound the consequences of accidents. Explicit safety analyses in the UFSAR (Refs. I and 2) demonstrate that proper operation of the refueling interlocks and adequate SDM will preclude unacceptable reactivity excursions.

Refueling interlocks restrict the movement of control rods and the operation of the refueling equipment to reinforce operational procedures that prevent the reactor from becoming critical. These interlocks prevent the withdrawal of more than one control rod. Under these conditions, since only one control rod can be withdrawn, the core will always be shut down even with the highest worth control rod withdrawn if adequate SDM exists. By requiring all other control rods to be inserted and a control rod withdrawal block initiated, the function of the inoperable one-rod-out interlock (LCO 3.9.2) is adequately maintained. This Special Operations LCO requirement to suspend all CORE ALTERATIONS adequately compensates for the inoperable all rods in permissive for the refueling equipment interlocks (LCO 3.9.1).

The control rod scram function provides backup protection to normal refueling procedures and the refueling interlocks, which prevent inadvertent criticalities during refueling.

Since the scram function and refueling interlocks may be suspended, alternate backup protection required by this Special Operations LCO is obtained by ensuring that a five by five array of control rods, centered on the withdrawn control rod, are inserted and are incapable of being withdrawn, and all other control rods are inserted and incapable of being withdrawn (by insertion of a control rod block).

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Policy Statement apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

(continued)

PBAPS UNIT 3 B 3.10-20 Revision No. 0

Single CRD Removal--Refueling B 3.10.5 BASES (continued)

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 5 with any of the following LCOs, LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," LCO 3.3.8.2, "Reactor Protection System (RPS) Electric Power Monitoring," LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, or LCO 3.9.5 not met, can be performed in accordance with the Required Actions of these LCOs without meeting this Special Operations LCO or its ACTIONS.

However, if a single CRD removal from a core cell containing one or more fuel assemblies is desired in MODE 5, controls consistent with those required by LCO 3.3.1.1, LCO 3.3.8.2, LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 must be implemented, and this Special Operations LCO applied.

By requiring all other control rods to be inserted and a control rod withdrawal block initiated, the function of the inoperable one-rod-out interlock (LCO 3.9.2) is adequately maintained. This Special Operations LCO requirement to suspend all CORE ALTERATIONS adequately compensates for the inoperable all rods in permissive for the refueling equipment interlocks (LCO 3.9.1). Ensuring that the five by five array of control rods, centered on the withdrawn control rod, are inserted and incapable of withdrawal adequately satisfies the backup protection that LCO 3.3.1.1 and LCO 3.9.2 would have otherwise provided. Also, once these requirements (Items a, b, and c) are completed, the SDM requirement to account for both the withdrawn untrippable (inoperable) control rod and the highest worth control rod may be changed to allow the withdrawn untrippable (inoperable) control rod to be the single highest worth control rod.

APPLICABILITY Operation in MODE 5 is controlled by existing LCOs. The allowance to comply with this Special Operations LCO in lieu of the ACTIONS of LCO 3.3.1.1, LCO 3.3.8.2, LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 is appropriately controlled with the additional administrative controls required by this Special Operations LCO, which reduce the potential for reactivity excursions.

(continued)

PBAPS UNIT 3 B 3.10-21 Revision No. 0

Single CRD Removal-Refueling B 3.10.5 BASES (continued)

ACTIONS A.1, A.2.1, and A.2.2 If one or more of the requirements of this Special Operations LCO are not met, the immediate implementation of these Required Actions restores operation consistent with the normal requirements for failure to meet LCO 3.3.1.1, LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 (i.e., all control rods inserted) or with the allowances of this Special Operations LCO. The Completion Times for Required Action A.1, Required Action A.2.1, and Required Action A.2.2 are intended to require that these Required Actions be implemented in a very short time and carried through in an expeditious manner to either initiate action to restore the CRD and insert its control rod, or initiate action to restore compliance with this Special Operations LCO.

Actions must continue until either Required Action A.2.1 or Required Action A.2.2 is satisfied.

SURVEILLANCE SR 3.10.5.1. SR 3.10.5.2. SR 3.10.5.3. SR 3.10.5.4.

REQUIREMENTS and SR 3.10.5.5 Verification that all the control rods, other than the control rod withdrawn for the removal of the associated CRD, are fully inserted is required to ensure the SDM is within limits. Verification that the local five by five array of control rods, other than the control rod withdrawn for removal of the associated CRD, is inserted and disarmed, while the scram function for the withdrawn rod is not available, is required to ensure that the possibility of criticality remains precluded. Verification that a control rod withdrawal block has been inserted ensures that no other control rods can be inadvertently withdrawn under conditions when position indication instrumentation is inoperable for the withdrawn control rod. The Surveillance for LCO 3.1.1, which is made applicable by this Special Operations LCO, is required in order to establish that this Special Operations LCO is being met. Verification that no other CORE ALTERATIONS are being made is required to ensure the assumptions of the safety analysis are satisfied.

Periodic verification of the administrative controls established by this Special Operations LCO is prudent to preclude the possibility of an inadvertent criticality. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PBAPS UNIT 3 B 3.10-22 Revision No. 87

Single CRD Removal-Refueling B 3.10.5 BASES (continued)

REFERENCES 1. UFSAR, Section 7.6.4.

2. UFSAR, Section 14.5.3.3.

K.

PBAPS UNIT 3 B 3.10-23 Revision No. 0

Multiple Control Rod Withdrawal--Refueling B 3.10.6 B 3.10 SPECIAL OPERATIONS B 3.10.6 Multiple Control Rod Withdrawal--Refueling BASES BACKGROUND The purpose of this MODE 5 Special Operations LCO is to permit multiple control rod withdrawal during refueling by imposing certain administrative controls.

Refueling interlocks restrict the movement of control rods and the operation of the refueling equipment to reinforce operational procedures that prevent the reactor from becoming critical during refueling operations. During refueling operations, no more than one control rod is permitted to be withdrawn from a core cell containing one or more fuel assemblies. When all four fuel assemblies are removed from a cell, the control rod may be withdrawn with no restrictions. Any number of control rods may be withdrawn and removed from the reactor vessel if their cells contain no fuel.

The refueling interlocks use the "full-in" position indicators to determine the position of all control rods.

If the "full-in" position signal is not present for every control rod, then the all rods in permissive for the refueling equipment interlocks is not present and fuel loading is prevented. Also, the refuel position one-rod-out interlock will not allow the withdrawal of a second control rod.

To allow more than one control rod to be withdrawn during refueling, these interlocks must be defeated. This Special Operations LCO establishes the necessary administrative controls to allow bypassing the "full-in" position indicators.

APPLICABLE Explicit safety analyses in the UFSAR (Refs. 1, 2, and 3)

SAFETY ANALYSES demonstrate that the functioning of the refueling interlocks and adequate SDM will prevent unacceptable reactivity excursions during refueling. To allow multiple control rod withdrawals, control rod removals, associated control rod drive (CRD) removal, or any combination of these, the "full in" position indication is allowed to be bypassed for each withdrawn control rod if all fuel has been removed from the cell. With no fuel assemblies in the core cell, the (continued)

PBAPS UNIT 3 B 3.10-24 Revision No. 0

Multiple Control Rod Withdrawal--Refueling B 3.10.6 BASES APPLICABLE associated control rod has no reactivity control function SAFETY ANALYSES and is not required to remain inserted.- Prior to reloading (continued) fuel into the cell, however, the associated control rod must be inserted to ensure that an inadvertent criticality does not occur, as evaluated in the Reference 3 analysis.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Policy Statement apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 5 with either LCO 3.9.3, "Control Rod Position," LCO 3.9.4, "Control Rod Position Indication," or LCO 3.9.5, "Control Rod OPERABILITY-Refueling," not met, can be performed in accordance with the Required Actions of these LCOs without meeting this Special Operations LCO or its ACTIONS. If multiple control rod withdrawal or removal, br CRD removal is desired, all four fuel assemblies are required to be removed from the associated cells. Prior to entering this LCO, any fuel remaining in a cell whose CRD was previously removed under the provisions of another LCO must be removed.

"Withdrawal," in this application, includes the actual withdrawal of the control rod, as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod.

When fuel is loaded into the core with multiple control rods withdrawn, special modified quadrant spiral reload sequences are used to ensure that reactivity additions are minimized.

Spiral reloading encompasses reloading a cell (four fuel locations immediately adjacent to a control rod) on the edge of a continuous fueled region (the cell can be loaded in any sequence). Otherwise, all control rods must be fully inserted before loading fuel.

(continued)

PBAPS UNIT 3 B 3.10-25 Revision No. 0

Multiple Control Rod Withdrawal-Refueling B 3.10.6 BASES (continued)

APPLICABILITY Operation in MODE 5 is controlled by existing LCOs. The exceptions from other LCO requirements (e.g., the ACTIONS of LCO 3.9.3, LCO 3.9.4, or LCO 3.9.5) allowed by this Special Operations LCO are appropriately controlled by requiring all fuel to be removed from cells whose "full-in" indicators are allowed to be bypassed.

ACTIONS A.1. A.2, A.3.1. and A.3.2 If one or more of the requirements of this Special Operations LCO are not met, the immediate implementation of these Required Actions restores operation consistent with the normal requirements for refueling (i.e., all control rods inserted in core cells containing one or more fuel assemblies) or with the exceptions granted by this Special Operations LCO. The Completion Times for Required Action A.1, Required Action A.2, Required Action A.3.1, and Required Action A.3.2 are intended to require that these Required Actions be implemented in a very short time and carried through in an expeditious manner to either initiate action to restore the affected CRDs and insert their control rods, or initiate action to restore compliance with this Special Operations LCO.

SURVEILLANCE SR 3.10.6.1. SR 3.10.6.2. and SR 3.10.6.3 REQUIREMENTS Periodic verification of the administrative controls established by this Special Operations LCO is prudent to preclude the possibility of an inadvertent criticality. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 7.6.4.

2. UFSAR, Section 14.5.3.3.

3. UFSAR, Section 14.5.3.4.

PBAPS UNIT 3 B 3.10-26 Revision No. 87

Control Rod Testing-Operating B 3.10.7 B 3.10 SPECIAL OPERATIONS B 3.10.7 Control Rod Testing-Operating BASES BACKGROUND The purpose of this Special Operations LCO is to permit control rod testing, while in MODES 1 and 2, by imposing certain administrative controls. Control rod patterns during startup conditions are controlled by the operator and the rod worth minimizer (RWM) (LCO 3.3.2.1, "Control Rod Block Instrumentation"), such that only the specified control rod sequences and relative positions required by LCO 3.1.6, "Rod Pattern Control," are allowed over the operating range from all control rods inserted to the low power setpoint (LPSP) of the RWM. The sequences effectively limit the potential amount and rate of reactivity increase that could occur during a control rod drop accident (CRDA).

During these conditions, control rod testing is sometimes required that may result in control rod patterns not in compliance with the prescribed sequences of LCO 3.1.6.

These tests include SDM demonstrations, control rod scram time testing, control rod friction testing, and testing performed during the Startup Test Program. This Special Operations LCO provides the necessary exemption to the requirements of LCO 3.1.6 and provides additional administrative controls to allow the deviations in such tests from the prescribed sequences in LCO 3.1.6.

APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the CRDA are summarized in References 1 and 2. CRDA analyses assume the reactor operator follows prescribed withdrawal sequences. These sequences define the potential initial conditions for the CRDA analyses. The RWM provides backup to operator control of the withdrawal sequences to ensure the initial conditions of the CRDA analyses are not violated. For special sequences developed for control rod testing, the initial control rod patterns assumed in the safety analysis of References 1 and 2 may not be preserved.

Therefore special CRDA analyses are required to demonstrate that these special sequences will not result in unacceptable consequences, should a CRDA occur during the testing. These analyses, performed in accordance with an NRC approved methodology, are dependent on the specific test being performed.

(continued)

PBAPS UNIT 3 B 3.10-27 Revision No. 0

Control Rod Testing-Operating B 3.10.7 BASES APPLICABLE As described in LCO 3.0.7, compliance with Special SAFETY ANALYSES Operations LCOs is optional, and therefore, no criteria of (continued) the NRC Policy Statement apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Control rod testing may be performed in compliance with the prescribed sequences of LCO 3.1.6, and during these tests, no exceptions to the requirements of LCO 3.1.6 are necessary. For testing performed with a sequence not in compliance with LCO 3.1.6, the requirements of LCO 3.1.6 may be suspended, provided additional administrative controls are placed on the test to ensure that the assumptions of the special safety analysis for the test sequence are satisfied. Assurances-that the test sequence is followed can be provided by either programming the test sequence into the RWM, with conformance verified as specified in SR 3.3.2.1.8 and allowing the RWM to monitor control rod withdrawal and provide appropriate control rod blocks if necessary, or by verifying conformance to the approved test sequence by a second licensed operator or other qualified member of the technical staff. These controls are consistent with those normally applied to operation in the startup range as defined in the SRs and ACTIONS of LCO 3.3.2.1, "Control Rod Block Instrumentation."

APPLICABILITY Control rod testing, while in MODES]1 and 2, with THERMAL POWER greater than 10% RTP, is adequately controlled by the existing LCOs on power distribution limits and control rod block instrumentation. Control rod movement during these conditions is not restricted to prescribed sequences and can be performed within the constraints of LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)," LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)," and LCO 3.3.2.1. With THERMAL POWER less than or equal to 10% RTP, the provisions of this Special Operations LCO are necessary to perform special tests that are not in conformance with the prescribed sequences of LCO 3.1.6. While in MODES 3 and 4, control rod withdrawal is only allowed if performed in accordance with (continued)

PBAPS UNIT 3 B 3.10-28 Revision No. 0

Control Rod Testing-Operating B 3.10.7 BASES APPLICABILITY Special Operations LCO 3.10.3, "Single Control Rod (continued) Withdrawal-Hot Shutdown," or Special Operations LCO 3.10.4, "Single Control Rod Withdrawal-Cold Shutdown," which provide adequate controls to ensure that the assumptions of the safety analyses of Reference 1 and 2 are satisfied.

During these Special Operations and while in MODE 5, the one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock,") and scram functions (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," and LCO 3.9.5, "Control Rod OPERABILITY-Refueling"), or the added administrative controls prescribed in the applicable Special Operations LCOs, provide mitigation of potential reactivity excursions.

ACTIONS A._I With the requirements of the LCO not met (e.g., the control rod pattern is not in compliance with the special test sequence, the sequence is improperly loaded in the RWM) the testing is required to be immediately suspended. Upon suspension of the special test, the provisions of LCO 3.1.6 are no longer excepted, and appropriate actions are to be taken to restore the control rod sequence to the prescribed sequence of LCO 3.1.6, or to shut down the reactor, if required by LCO 3.1.6.

SURVEILLANCE SR 3.10.7.1 REQUIREMENTS With the special test sequence not programmed into the RWM, a second licensed operator or other qualified member of the technical staff (i.e., personnel trained in accordance with an approved training program for this test) is required to verify conformance with the approved sequence for the test.

This verification must be performed during control rod movement to prevent deviations from the specified sequence.

A Note is added to indicate that this Surveillance does not need to be met if SR 3.10.7.2 is satisfied.

(continued)

PBAPS UNIT 3 B 3.10-29 Revision No. 0

Control Rod Testing-Operating B 3.10.7 BASES SURVEILLANCE SR 3.10.7.2 REQUIREMENTS (continued) When the RWM provides conformance to the special test sequence, the test sequence must be verified to be correctly loaded into the RWM prior to control rod movement. This Surveillance demonstrates compliance with SR 3.3.2.1.8, thereby demonstrating that the RWM is OPERABLE. A Note has been added to indicate that this Surveillance does not need to be met if SR 3.10.7.1 is satisfied.

A1. NEDE-24011-P-A, "General Electric Standard Application I REFERENCES for Reactor Fuel," latest approved revision.

2. Letter from T. Pickens (BWROG) to G.C. Lainas (NRC)

"Amendment 17 to General Electric Licensing Topical Report NEDE-24011-P-A," August 15, 1986.

PBAPS UNIT 3 B 3.10-30 Revision No. 73

SDM Test- Refueling B 3.10.8 B 3.10 SPECIAL OPERATIONS B 3.10.8 SHUTDOWN MARGIN (SDM) Test- Refueling BASES BACKGROUND The purpose of this MODE 5 Special Operations LCO is to permit SDM testing to be performed for those plant configurations in which the reactor pressure vessel (RPV) head is either not in place or the head bolts are not fully tensioned.

LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," requires that adequate SDM be demonstrated following fuel movements or control rod replacement within the RPV. The demonstration must be performed prior to or within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after criticality is reached. This SDM test may be performed prior to or during the first startup following the refueling. Performing the SDM test prior to startup requires the test to be performed while in MODE 5, with the vessel head bolts less than fully tensioned (and possibly with the vessel head removed).

While in MODE 5, the reactor mode switch is required to be in the shutdown or refuel position, where the applicable control rod blocks ensure that the reactor will not become critical. The SDM test requires the reactor mode switch to be in the startup/hot standby position, since more than one control rod will be withdrawn for the purpose of demonstrating adequate SDM. This Special Operations LCO provides the appropriate additional controls to allow withdrawing more than one control rod from a core cell containing one or more fuel assemblies when the reactor vessel head bolts are less than fully tensioned.

APPLICABLE Prevention and mitigation of unacceptable reactivity SAFETY ANALYSES excursions during control rod withdrawal, with the reactor mode switch in the startup/hot standby position while in MODE 5, is provided by the wide range neutron monitor (WRNM) period-short scram (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), and control rod block instrumentation (LCO 3.3.2.1, "Control Rod Block Instrumentation"). The limiting reactivity excursion during startup conditions while in MODE 5 is the control rod drop accident (CRDA).

(continued)

PBAPS UNIT 3 B 3.10-31 Revision No. 17

SDM Test -Refueling B 3.10.8 BASES APPLICABLE CRDA analyses assume that the reactor operator follows SAFETY ANALYSES prescribed withdrawal sequences. For SDM tests performed (conti nued) within these defined sequences, the analyses of References I and 2 are applicable. However, for some sequences developed for the SDM testing, the control rod patterns assumed in the safety analyses of References 1 and 2 may not be met.

Therefore, special CRDA analyses, performed in accordance with an NRC approved methodology, are required to demonstrate the SDM test sequence will not result in unacceptable consequences should a CRDA occur during the testing. For the purpose of this test, the protection provided by the normally required MODE 5 applicable LCOs, in addition to the requirements of this LCO, will maintain normal test operations as well as postulated accidents within the bounds of the appropriate safety analyses-(Refs. 1 and 2). In addition to the added requirements for the RWM, WRNM, APRM, and control rod coupling, the notch out mode is specified for out of sequence withdrawals.

Requiring the notch out mode limits withdrawal steps to a single notch, which limits inserted reactivity, and allows adequate monitoring of changes in neutron flux, which may occur during the test.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria'of the NRC Policy Statement apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is.optional. SDM tests may be performed while in MODE 2, in accordance with Table 1.1-1, without meeting this Special Operations LCO or its ACTIONS. For SDM tests performed while in MODE 5, additional requirements must be met to ensure that adequate protection against potential reactivity excursions is available. To provide additional scram protection beyond the normally required WRNMs, the APRMs are also required to be OPERABLE (LCO 3.3.1.1, Functions 2a, 2.d and 2e) as though the reactor were in MODE 2. Because multiple control rods will be withdrawn and the reactor will potentially become critical, the approved control rod withdrawal sequence must be enforced by the RWM (LCO 3.3.2.1, Function 2, MODE 2), or must be verified by a (continued)

PBAPS UNIT 3 B 3.10-32 Revision No. 30

SDM Test-Refueling B 3.10.8 BASES LCO second licensed operator or other qualified member of the (continued) technical staff. To provide additional protection against an inadvertent criticality, control rod withdrawals that do not conform to the analyzed rod position sequence specified in LCO 3.1.6, "Rod Pattern Control," (i.e., out of sequence control rod withdrawals) must be made in the individual notched withdrawal mode to minimize the potential reactivity insertion associated with each movement. Coupling integrity of withdrawn control rods is required to minimize the probability of a CRDA and ensure proper functioning of the withdrawn control rods, if they are required to scram.

Because the reactor vessel head may be removed during these tests, no other CORE ALTERATIONS may be in progress.

Furthermore, since the control rod scram function with the RCS at atmospheric pressure relies solely on the CRD accumulator, it is essential that the CRD charging water header remain pressurized. This Special Operations LCO then allows changing the Table 1.1-1 reactor mode switch position requirements to include the startup/hot standby position, such that the SDM tests may be performed while in MODE 5.

APPLICABILITY These SDM test Special Operations requirements are only applicable if the SDM tests are to be performed while in MODE 5 with the reactor vessel head removed or the head bolts not fully tensioned. Additional requirements during these tests to enforce control rod withdrawal sequences and restrict other CORE ALTERATIONS provide protection against potential reactivity excursions. Operations in all other MODES are unaffected by this LCO.

ACTIONS A.1 and A.2 With one or more control rods discovered uncoupled during this Special Operation, a controlled insertion of each uncoupled control rod is required; either to attempt recoupling, or to preclude a control rod drop. This controlled insertion is preferred since, if the control rod fails to follow the drive as it is withdrawn (i.e., is "stuck" in an inserted position), placing the reactor mode switch in the shutdown position per Required Action B.1 could cause substantial secondary damage. If recoupling is not accomplished, operation may continue, provided the control rods are fully inserted within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months and disarmed (electrically or hydraulically) within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Inserting a (continued)

PBAPSý UNIT 3 B 3.1i0- 33 Revision No. 64

SDM Test-Refueling B 3.10.8 BASES ACTIONS A.1 and A.2 (continued) control rod ensures the shutdown and scram capabilities are not adversely affected. The control rod is disarmed to prevent inadvertent withdrawal during subsequent operations.

The control rods can be hydraulically disarmed by closing the drive water and exhaust water isolation valves.

Electrically, the control rods can be disarmed by disconnecting power from all four directional control valve solenoids. Required Action A.1 is modified by a Note that allows the RWM to be bypassed if required to allow insertion of the inoperable control rods and continued operation.

LCO 3.3.2.1, "Control Rod Block Instrumentation," ACTIONS provide additional requirements when the RWM is bypassed to ensure compliance with the CRDA analysis.

The allowed Completion Times are reasonable, considering the small number of allowed inoperable control rods, and provide time to insert and disarm the control rods in an orderly manner and without challenging plant systems.

Condition A is modified by a Note allowing separate Condition entry for each uncoupled control rod. This is acceptable since the Required Actions for this Condition provide appropriate compensatory actions for each uncoupled control rod. Complying with the Required Actions-may allow for continued operation. Subsequent uncoupled control rods are governed by subsequent entry into the Condition and application of the Required Actions.

B.1 With one or more of the requirements of this LCO not met for reasons other than an uncoupled control rod, the testing should be immediately stopped by placing the reactor mode switch in the shutdown or refuel position. This results in a condition that is consistent with the requirements for MODE 5 where the provisions of this Special Operations LCO are no longer required.

(continued)

PBAPS UNIT 3 B 3.10-34 Revision No. 0

SDM Test-Refueling B 3.10.8 BASES (continued)

SURVEILLANCE SR 3.10,8.1. SR 3.10.8.2. and SR 3.10.8.3 REQUIREMENTS LCO 3.3.1.1, Functions 2a, 2.d and 2e, made applicable in this Special Operations LCO, are required to have their Surveillances met to establish that this Special Operations LCO is being met. However, the control rod withdrawal sequences during the SDM tests may be enforced by the RWM (LCO 3.3.2.1, Function 2, MODE 2 requirements) or by a second licensed operator or other qualified member of the technical staff. As noted, either the applicable SRs for the RWM (LCO 3.3.2.1) must be satisfied according to the applicable Frequencies (SR 3.10.8.2), or the proper movement of control rods must be verified (SR 3.10.8.3). This latter verification (i.e., SR 3.10.8.3) must be performed during control rod movement to prevent deviations from the specified sequence. These surveillances provide adequate assurance that the specified test sequence is being fol 1owed.

SR 3.10.8.4 Periodic verification of the administrative controls established by this LCO will ensure that the reactor is operated within the bounds of the safety analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.10.8.5 Coupling verification is performed to ensure the control rod is connected to the control rod drive mechanism and will perform its intended function when necessary. The verification is required to be performed any time a control rod is withdrawn to the "full out" notch position, or prior to declaring the control rod OPERABLE after work on the control rod or CRD System that could affect coupling. This Frequency is acceptable, considering the low probability that a control rod will become uncoupled when it is not being moved as well as operating experience related to uncoupling events.

(continued)

PBAPS UNIT 3 B 3.10-35 Revision No. 87

SDM Test-Refueling B 3.10.8 BASES SURVEILLANCE SR 3.10.8.6 REQUIREMENTS (continued) CRD charging water header pressure verification is performed to ensure the motive force is available to scram the control rods in the event of a scram signal. Since the reactor is depressurized in MODE 5, there is insufficient reactor pressure to scram the control rods. Verification of charging water header pressure ensures that if a scram were required, capability for rapid control rod insertion would exist. The minimum pressure of 940 psig is well below the expected pressure of approximately 1450 psig while still ensuring sufficient pressure for rapid control rod insertion. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel," latest approved revision.

2. Letter from T. Pickens (BWROG) to G.C. Lainas, NRC, "Amendment 17 to General Electric Licensing Topical Report NEDE-24011-P-A," August 15, 1986.

PBAPS UNIT 3 B 3. 10 -36 Revision No. 87

ML15133A500

Text

Navigation menu

Search