Text

Submittal of Changes to Technical Specifications Bases
	ML18108A176
Person / Time
Site:	Three Mile Island
Issue date:	04/13/2018
From:	Jim Barstow; Exelon Generation Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	TMl-18-050, TS 6.18.d
	Download: ML18108A176 (211)
	v • d • e

7

_=

7

Exelon Generation r* 200 Exelon Way Kerinett Square. PA 19348 www.exeloncorp.com TS 6.18.d TMl-18-050 April 13, 2018 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555 Three Mile Island Nuclear Station, Unit 1 Renewed Facility Operating License No. DPR-50 NRC Docket No. 50-289

Subject:

Submittal of Changes to Technical Specifications Bases In accordance with the requirement of Three Mile Island Nuclear Station (TMI), Unit 1 Technical Specification 6.18.d, Exelon Generation Company, LLC hereby submits a complete updated copy of the TMI, Unit 1 Technical Specifications and Bases. The enclosed Technical Specifications and Bases include changes through the date of this letter. **

If you have any questions or require further information, please contact Frank J. Mascitelli at 610-765-5512.

Sincerely, d~U;-

James Barstow Director, Licensing & Regulatory Affairs Exelon Generation Company, LLC

Enclosure:

Three Mile Island Nuclear Station, Unit 1 Technical Specifications and Bases cc: USNRC Administrator, Region 1 (w/o enclosure)

USNRC Senior Resident Inspector, TMl-1 (w/o enclosure)

USNRC Project Manager, TMl-1 (w/ enclosure)

R.R. Janati, Pennsylvania Bureau of Radiation Protection (w/o enclosures)

SECTION 3.0 LIMITING CONDITIONS FOR OPERATION j

\

'3 . LIMITING CONDITIONS FOR OPERATION 3.0 GENERAL ACTION REQUIREMENTS 3.0.1 When a Limiting Condition for Operation is not met, except as provided in action called for in the specification, within one* hour action shall be initiated to place the unit in a condition in which the specification does not apply by placing it, as applicable, in:

1. At least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

2. At least HOT SHUTDOWN within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and

3. At least COLD SHUTDOWN within the subsequent 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Where corrective measures are completed that permit operation under the action requirements, the action may be taken in accordance with the time limits of the specification as measured from the time of failure to meet the Limiting Condition for Operation. Applicability of these requirements is stated in the individual specifications.

Specification 3.0.1 is not applicable in COLD SHUTDOWN OR REFUELING SHUTDOWN.

BASES This specification delineates the action to be taken for circumstances not directly provided for in the action requirements of individual specifications and whose occurrence would violate the intent of the specification .

The NRC approved TS Amendment 98 on 08/07/84 which incorporated General Specification 3.0.1 above. The TMI amendment request and NRC approval specified that this General Specification was incorporated only where it was determined to specifically apply by stating "specification 3.0.1 applies."

3-1

Amendment No. 98, AR 4048309

3.1 REACTOR COOLANT SYSTEM

3.1.1 OPERATIONAL COMPONENTS Applicability Applies to the operating status of reactor coolant system components.

Objective To specify those limiting conditions for operation of reactor coolant system components which must be met to ensure safe reactor operations.

Specification 3.1.1.1 Reactor Coolant Pumps

a. Pump combinations permissible for given power levels shall be as shown in Specification Table 2.3.1.

b. Power operation with one idle reactor coolant pump in each loop shall be restricted to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If the reactor is not returned to an acceptable RC pump operating combination at the end of the 24-hour period, the reactor shall be in a hot shutdown condition within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

C. The boron concentration in the reactor coolant system shall not be reduced unless at least one reactor coolant pump or one decay heat removal pump is circulating reactor coolant.

3.1.1.2 Steam Generator (SG) Tube Integrity

a. Whenever the reactor coolant average temperature is above 200°F, the following conditions are required:

(1.) SG tube integrity shall be maintained.

(2.) All SG tubes satisfying the tube plugging criteria shall be plugged in accordance with the Steam Generator Program. (The Steam Generator Program is described in Section 6.19.)

ACTIONS:

1\JO"fE--------------------------------------------------

Entry into Sections 3.1.1.2.a.(3.) and (4.), below, is allowed for each SG tube.

(3.) If the requirements of Section 3.1.1.2.a.(2.) are not met for one or more tubes then perform the following:

Amendment l\lo. 12, 17, 28, 47, 98, 261 278, 279 3-1a

With one or more SG tubes satisfying the tube plugging criteria and not plugged in accordance with the Steam Generator Program:

a. Verify within 7 days *that tube integrity of the affected tube(s) is maintained until the next refueling outage or SG tube inspection, AND

b. Plug the affected tube(s) in accordance with the Steam Generator Program prior to exceeding a reactor coolant average temperature of 200°F following the next refueling outage or SG tube inspection.

(4.) If Action 3., above, is not completed within the specified completion times, or SG tube integrity is not maintained, be in HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and be in COLD SHUTDOWN within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

3.1.1.3 Pressurizer Safety Valves

a. The reactor shall not remain critical unless both pressurizer code safety valves are operable with a lift setting of 2500 psig +/- 1%.

b. When the reactor is subcritical, at least one pressurizer code safety valve shall be operable if all reactor coolant system openings are closed, except for hydrostatic tests in accordance with ASME Boiler and Pressure Vessel Code, Section Ill .

3-1b

Amendment No. 2e:1-, 279

The limitation on power operation with one idle RC pump in each loop has been imposed since the ECCS cooling performance has not been calculated in accordance with the Final Acceptance Criteria requirements specifically for this mode of reactor operation. A time period of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed for operation with one idle RC pump in each loop to effect repairs of the idle pump(s) and to return the reactor to an acceptable combination of operating RC pumps. The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for this mode of operation is acceptable since this mode is expected to have considerable margin for the peak cladding temperature limit and since the likelihood of a LOCA within the 24-hour period is considered very remote.

A reactor coolant pump or decay heat removal pump is required to be in operation before the boron concentration is reduced by dilution with makeup water. Either pump will provide mixing which will prevent sudden positive reactivity changes caused by dilute coolant reaching the reactor. One decay heat removal pump will circulate the equivalent of the reactor coolant system volume in one-half hour or less.

The decay heat removal system suction piping is designed for 300°F and 370 psig; thus, the system can remove decay heat when the reactor coolant system is below this temperature (References 1, 2, and 3).

Management of gas voids is important to OHR System OPERABILITY.

Both steam generators must have tube integrity before heatup of the. Reactor Coolant System to insure system integrity against leakage under normal and transient conditions. Only one steam generator is required for decay heat removal purposes. Refer to Section 3.1.6.3 for allowable primary-to-secondary leakage. Refer to Section 4.19 for Bases for Steam Generator tube integrity.

One pressurizer code safety valve is capable of preventing overpressurization when the reactor is not critical since its relieving capacity is greater than that required by the sum of the available heat sources which are pump energy, pressurizer heaters, and reactor decay heat. Both pressurizer code safety valves are required to be in service prior to criticality to conform to the system design relief capabilities. The code safety valves prevent overpressure for a rod withdrawal or feedwater line break accidents (Reference 4). The pressurizer code safety valve lift set point shall be set at 2500 psig +/-1% allowance for error. Surveillance requirements are specified in the INSERVICE TESTING PROGRAM. Pressurizer code safety valve setpoint drift of up to 3% is acceptable in accordance with the assumptions of the TMl-1 safety analysis (Reference 5).

References (1) UFSAR, Tables 9.5-1 and 9.5-2 (2) UFSAR, Sections 4.2.5.1 and 9.5 - "Decay Heat Removal" (3) UFSAR, Section 4.2.5.4 - "Secondary System" (4) UFSAR, Section 4.3.10.4- "System Minimum Operational Components" (5) UFSAR, Section 4.3.7 - "Overpressure Protection" 3-2

Amendment No. 47 (12+22/7B),+a7,',ae4,296, ~ . 290

3.1.2 PRESSURIZATION HEATUP AND COOLDOWN LIMITATIONS Applicability Applies to pressurization, heatup and cooldown of the reactor coolant system.

Objectives To assure that temperature and pressure changes in the reactor coolant system do not cause cyclic loads in excess of design for reactor coolant system components.

To assure that reactor vessel integrity by maintaining the stress intensity factor as a result of operational plant heatup and cooldown conditions and inservice leak and hydro test conditions below values which may result in non-ductile failure.

Specification 3.1.2.1 For operations until 50.2 effective full power years, the reactor coolant pressure and the system heatup and cooldown rates (with the exception of the pressurizer) shall be limited in accordance with Figures 3.1-1, 3.1-2, and 3.1-3 and are as follows:

Heatup/Cooldown Allowable combinations of pressure and temperature shall be to the right of and below the limit line in Figures 3.1-1 and 3.1-2. Heatup and cooldown rates shall not exceed those shown on Figures 3.1-1 and 3.1-2. When the core is critical, allowable combinations of pressure and temperature shall be to the right of the criticality limit curve shown on Figure 3.1-1. *

3.1.2.2 lnservice Leak and Hydrostatic Testing Allowable combinations of pressure and temperature shall be to the right of and below the limit line in Figure 3.1-3. Heatup and cooldown rates shall not exceed those shown on Figure 3.1-3.

The secondary side of the steam generator shall not be pressurized above 200 psig if the temperature of the steam generator shell is below 100°F.

3.1.2.3 The pressurizer heatup and cooldown rates shall not exceed 100°F in any one hour.

The spray shall not be used if the temperature difference between the pressurizer and the spray fluid is greater than 430°F.

3.1.2.4 DELETED 3.1.2.5 DELETED

Amendment No. 29, 134,176, 20B, 234 278,281 3-3

Bases All reactor coolant system components are designed to withstand the effects of cyclic loads due to system temperature and pressure changes (Reference 1). These cyclic loads are introduced by unit load transients, reactor trips, and unit heatup and cooldown operations. The number of thermal and loading cycles used for design purposes are shown in Table 4.1-1 of the UFSAR. The maximum unit heatup and cooldown rates satisfy stress limits for cyclic operation (Reference 2). The 200 psig pressure limit for the secondary side of the steam generator at a temperature less than 100°F satisfies stress levels for temperatures below the Nil Ductility Transition Temperature (NDTI).

The heatup and cooldown rate limits in this specification are based on linear heatup and cooldown ramp rates which by analysis have been extended to accommodate 15°F step changes at any time with the appropriate soak (hold) times. Also, an addi~ional temperature step change has been included in the analysis with no additional soak time to accommodate decay heat initiation at approximately 240°F indicated RCS temperature.

The unirradiated reference nil ductility temperature (RT NOT) for all Linde 80 welds were determined in accordance with BAW-2308, Rev. 1-A and Rev. 2-A,. and 10 CFR 50, Appendices G and H. For the beltline plate and forging materials, 10CFR 50 Appendices G and H were used to calculate the unirradiated reference nil ductility temperature (RT NOT), For other beltline region materials and other reactor coolant pressure boundary materials, the unirradiated impact properties were estimated using the methods described in BAW-10046A, Rev. 2.

As a result of fast neutron irradiation in the beltline region of the core, there will be an increase in the RT NOT with accumulated nuclear operations. The adjusted reference temperatures have been calculated as described in Reference No. 5. *

The predicted RT NOT was calculated using the respective predicted neutron fluence at 50.2 effective full power years of operation and the procedures defined in Regulatory Guide 1.99, Rev. 2, Section C.1.1 for the plate metals and for the limiting weld metals (WF-70, WF-8, and SA-1526).

Analyses of the activation detectors in the TMl-1 surveillance capsules have provided estimates of reactor vessel wall fast neutron fluxes for cycles 1 through 17. Extrapolation of reactor vessel fluxes and corresponding fluence accumulations, based on predicted fuel cycle design conditions through 50.2 effective full power years of operation are described in Reference 6 with effective full power years clarified in Reference 7 .

Amendment No. 29, 134, 1 §7, 17G, 208, 234, 281 3-4

3

~

CD

r a.

Figure 3.1-1 Reactor Coolant System Heatup and Criticality Limitations 3 [Applicable through 50.2 EFPY]

CD

r

.-+

2400 2200 HU Limits Adjusted Reference 280. 2398 r ,J f 320, 2398 I Criticality Limits Temp Press Temperature Temp Press J

60 575 Beltfine 1L4T 263 0 270, 2057 310, 2057 2000 101 575 ..... Circ. Weld 234.5 .,F 263 1111 ......

C)

-U) 1800 120 150 599 662 -

Axial Weld 184.7 "F Beltfine 3/4T I J Joo, 1m I 272 280 1235 1360 -

Circ. Weld 178.5 "F

) 290 I\)

180 778: 1548 OJ C.

255, 1657 c,J I

Q,)"'

1600 200 220 890 1079

.... Axial Weld 126.8 "F Closure Head 60 "F

'190, 1548 300 310 1777 2057 01 en Nozzles 60 "F ) 2398 l

Ill 240 1360 320 U) .....

...a..cu 1400 1657 1--

255 2j°, 136/ 28~, 1360 270 2057 280 2398 272, 1235 U) 1200 1 0 220.1J1s /

i ( 263, 11 11 0::

,:,. 1000 G) i200. 890/ (

1a

-(J

, :I 800 1ao. ns C:

600 ,__ 60,575 ....

101, 575 -

120,599 150, 662

( Criticality Limits l 400 1

200 263, 0 See Following Notes 0 ' ~

0 50 100 150. 200 250 300 350 400 450 500 Indicated RCS Inlet Temperature, °F

1 - Temperatures:

Notes to Figure 3.1-1 All Temperatures are the indicated values in the operating RC pump(s) Cold Leg.

Except:

When the DHRS is operating without any RC Pumps operating, then the indicated DHRS return temperature to the Reactor Vessel shall be used.

2 - Heatup:

50F/Hr or 15F/18 Min. Steps 3 - RC Pump Combinations for Heatups:

Ts 100 No RC Pumps Operating 100 < T s 199 Any 1 or 2 Pump Combination (2/0, 0/2, 1/1) 200 <Ts 349 Any Pump Combination except 2/2 T ~ 350 Any Pump Combination 4 - Criticality Limits:

When the core is critical, allowable combinations of pressure and temperature shall be to the right of the criticality limit curve .

Amendment No. 281 3-5b

)>

3 CD Figure 3.1-2 Reactor Coolant System Cooldown Limitations

i a.

3 [Applicable through 50.2 EFPY]

CD

i 2400 I r 265. 2400 CD Limits Adjusted Reference I 2200 Temp Press (F) 70 (psig) 519 Temperature Beltline 1L4T Circ. Weld 234.5 °F .

I .

J, 260 2220 2000 101 519 Axial Weld 184.?°F JJ 250, 1909 C) 130 574 Beltline 3L4T u, 1800 160 698 Circ. Weld 178.5 °F

-I\J a.

e.. 1600 /1240, 190 921 Axial Weld 126.8 °F (X) 220 1276 Closure Head 60 °F 1619

J 240 1619 Nozzles 60 °F u,

~

250 1909 wI 0,

...a. 1400 en 1200 260 2220 265 2400 J 220, 1276 C')

0

~ 1000 I

-Cl) ca

-~ 800 "C

/1,90, 921

/ ~60,69!

C 600 70,519:: .... 130,574 101,519 400 200 See Following Notes 0

0 50 100 150 200 250 300 350 400 450 500 Indicated RCS Inlet Temperature, °F

Notes to Figure 3.1-2

1 - Temperatures:

All Temperatures are the indicated values in the operating RC pump(s) Cold Leg.

Except:

When the DHRS is operating without any RC Pumps operating, then the indicated DHAS return temperature to the Reactor Vessel shall be used.

2 - Cooldown:

T > 255F 100F/Hr or 15F/9 Min. Steps T :;; 255F 30F/Hr or 15F/30 Min. Steps 3 - RC Pump Combinations for Cooldowns:

T :;; 100 No RC Pumps Operating 100 < T:;; 199 Any 1 or 2 Pump Combination ( 2/0, 0/2, 1/1) 200< T:;; 349 Any Pump Combination except 2/2 T ~ 350 Any Pump Combination

Amendment No. 281 3-5d

)>

3

<ti a.

Figure 3.1-3 Reactor Coolant lnservice Leak Hydrostatic Test 3

[Applicable through 50.2 EFPV]

-z p

<ti I I J, I I 2400 Adjusted Reference [ 260, 24~0 ISLHLimits**

Temperature Temp Press 2200 I 255, 2244 Be!tline 1L4T {F) (psig)

Circ. Weld 234.5 °F J 60 671 2000 Axial Weld 184.7 °F 65 724 C, BeltHne 3L4T 90 724

'240, 1848

';; 1800 ctrc. Weld 178.5 "F 120 759 I\)

co C.

1600 Axial 'Wefd 126.8 "F Closure Head 60 "F I 150 180 894 1067 c,.:,

U)

._ 1400 Nozzles 60 OF I/I210, 1335 210 240 255 1335 1848 2244 I

C1I Q. 260 2400

<ti U> 1200 V /.1so, 1061 0

0:::

,~

'C 1000 a.,

~ ~

-<.)

'C 800 65. 724

- Jiilf"'

120,759 150,894

-C 600 60,671 90,724 400 200 I See Following Notes r 0

0 50 100 150 200 250 300 350 400 450 500 Indicated RCS Inlet Temperature, °F

Notes to Figure 3.1-3

1 - Temperatures:

All Temperatures are the indicated values in the operating RC pump(s) Cold Leg.

Except:

When the DHRS is operating without any RC Pumps operating, then the indicated DHRS return temperature to the Reactor Vessel shall be used.

2 - Heatup:

50F/Hr or 15F/18 Min. Steps 3 - Cooldown:

T > 255F 1OOF/Hr or 15F/9 Min. Steps T s 255F 30F/Hr or 15F/30 Min. Steps 4 - RC Pump Combinations for Heatups / Cooldowns:

T:::; 100 No RC Pumps Operating 100 < T s 199 Any 1 or 2 Pump Combination (2/0, 0/2, 1/1) 200 <Ts 349 Any Pump Combination except 2/2 T <:!: 350 Any Pump Combination

Amendment No. 281 3-51

3.1.3 MINIMUM CONDITIONS FOR CRITICALITY

Applicability Applies to reactor coolant system conditions required prior to criticality.

Objective

a. To limit the magnitude of any power excursions resulting from reactivity insertion due to moderator pressure and moderator temperature coefficients.

b. To assure that the reactor coolant system will not go solid in the event of a rod withdrawal or startup accident.

c. To assure sufficient pressurizer heater capacity to maintain natural circulation conditions during a loss of offsite power.

Specification 3.1.3.1 The reactor coolant temperature shall be above 525°F except for portions of low power physics testing when the requirements of Specification 3.1.9 shall apply.

3.1.3.2 Reactor coolant temperature shall be above DTI +10° F.

3.1.3.3 When the reactor coolant temperature is below the minimum temperature specified in 3.1.3.1 above, except for portions of low power physics testing when the requirements of Specification 3.1.9 shall apply, the reactor shall be subcritical by an amount equal to or greater than the calculated reactivity insertion due to depressurization.

3.1.3.4 Pressurizer 3.1 .3.4.1 The reactor shall be maintained subcritical by at least one percent delta k/k until a steam bubble is formed and an indicated water level between 80 and 385 inches is established in the pressurizer.

(a) With the pressurizer level outside the required band, be in at least HOT SHUTDOWN with the reactor trip breakers open within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and be in COLD SHUTDOWN within an additional 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

3.1.3.4.2 A minimum of 107 kw of pressurizer heaters, from each of two pressurizer heater groups shall be OPERABLE. Each OPERABLE 107 kw of pressurizer heaters shall be capable of receiving power from a 480 volt ES bus via the established manual transfer scheme.

3-6 Amendment No. 78, 167 278

CON11ROLUED

( a) with the pressurizer inoperaole due to one Cl) inoperable*

emergency power supply to the pressurizeT beaters either rest~re the inoperaole emergency power supply within 7 days or be in at lease HOT STANDBY within the next 6 nours and in HOT SHUTDOWN within the following 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

(b) With the pressurizer inoperable due to two (2) inoperable emergency power supplies to the pressurizer heateTs either restore the inoperable emergency power supplies within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or ~e in at least HOT srAilD~Y within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in HOT SHUTDOWN within the following 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

3.l.3.5 Safety rod groups shall be fully witndrawn prior to lny othl!T reduction in shutdown mar 6 in by deboration or regulating rod withdrawal during the approach to criticality with the follqw-in6 exceptions:

a. Inoperable rod per 3.5.2.2.

b. Phvsics resting per 3.1. 9.

c. Shutdown margin may not be reduced belm;r 1%~k/k per 3.5.2.l.

d. Exercising rods per 4.1.2.

Following safety rod withdrawal, the regulating Tods shall be positioned within their position limits as defined by Specifi-cation 3.5.2.5 prior to deooration *

Amendment No. 78 3-oa

CONTROLLED COPY At the beginning of life of the initial fuel cycle, the moderator temperature coefficient is expected to be slightly positive at operating temperatures with the operating configuration of control rods~

Calculations show that above 525°F the positive moderator coefficient is acceptable.

Since the moderator temperature coefficient at lower temperatures will be less negative or more positive than at operating temperature, startup and operation of the reactor when reactor coolant temperature is less than 525°F is prohibited except where necessary for low power physics tests. *

The potential reactivity insertion dl:ie to the moderator pressure coefficient that could-result from depressurizing the coolant from 2100 psia to saturation pressure of 900 psia is approximately 0.1 percent delta k/k.

During physics tests, special operating precautions will be taken. In addition, the strong negative Doppler coefficient and the small integrated delta k/k would limit the magnitude of a power excursion resulting from a reduction of moderator density.

The requirement that the reactor is not to be made critical below OTT+10°F provides increased assurances that the proper relationship between primary coolant pressure and temperatures will be maintained relative to the NOTT of the _primary coolant system. Heatup to this temperature will be accomplished by operating the reactor coolant pumps.

If the shutdown margin required by Specification 3.5.2 is maintained, there is no possibility of an accidental criticality as a result of a decrease of coolant pressure.

The availability of at least 107 kw in pressurizer heater capability is sufficient to maintain primary system pressure assuming normal system heat losses. Emergency power to heater groups 8 or 9, supplied via a manual transfer scheme, assures redundant capability upon loss of offsite power.

The requirements that the safety rod groups be fully withdrawn before criticality ensures shutdown capability during startup. This requirement does not prohibit rod withdrawal when the reactor will remain more than 1 % dk/k shutdown with the rod(s) withdrawn (e.g., rod latch verification).

The requirements for regulating rods being within their rod position limits ensures that the shutdown margin and ejected rod criteria at hot zero power are not violated.

3-7 Amendment No. 78, 157, ECR TM 04-00911

3.1.4 REACTOR COOLANT SYSTEM (RCS) ACTIVITY 3.1.4.1 LIMITING CONDITION FOR OPERATION RCS DOSE EQUIVALENT 1-131 and DOSE EQOIV ALENT Xe-133 specific activity shall be limited to:

a. Less than or equal to 0.35 microcuries/gram DOSE EQUIVALENT 1-131, and

b. Less than or equal to 797 microcuries/gram DOSE EQUIVALENT Xe-133.

3.1.4.2 APPLICABILITY: At all times except REFUELING SHUTDOWN and COLD SHUTDOWN.

3.1.4.3 ACTION:

MODES: At all times except REFUELING SHUTDOWN and COLD SHUTDOWN a.I With DOSE EQUIVALENT 1-131 not within limit, perform the sampiing and analysis requirements of Table 4.1.3 until the RCS DOSE EQUIVALENT 1-131 is restored to within limit, AND a.2 Verify that DOSE EQUIVALENT 1-131 is less than or equal to 60 microcuries/gram, AND a.3 Restore DOSE EQUIVALENT 1-131 to within limit within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

a.4 If the requirements of a. I, a.2 or a.3 cannot be met, be in at least HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

b.1 With DOSE EQUIVALENT Xe-133 not within limit, restore DOSE EQUIVALENT Xe-133 to within limit within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

b.2 If the requirements of b. l cannot be met, be in at least HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

LCO The iodine specific activity in the reactor coolant is limited to 0.35 µCi/gm DOSE EQUIVALENT 1-131, and the noble gas specific activity in the reactor coolant is limited to 797 µCi/gm DOSE EQUIVALENT Xe-133.

The limits on specific activity ensure that offsite and control room doses will. meet the appropriate IOCFRI00.11 (Ref. I) and 10CFR50 Appendix A GDC19 (Ref. 5) acceptance criteria.

The SLB and SGTR accident analyses (Refs. 3 and 4) show that the calculated doses are within acceptable limits. Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of a SLB or SGTR, lead to doses that exceed the 10CFRl00.11 (Ref. l) and 10CFR50 Appendix A GDC19 (Ref.

5) acceptance criteria .

-\,

3-8 Amendment No. 108, 117, 204, 272

Bases (continued)

APPLICABILITY In all MODES other than REFUELING SHUTDOWN and COLD SHUTDOWN, operation within the LCO limits for DOSE EQUIVALENT 1-13 l and DOSE EQUIVALENT Xe-133 is necessary to limit the potential consequences of a SLB or SGTR to within the IOCFRI00.11 acceptance criteria (Ref. I) and I OCFR50 Appendix A GDC 19 acceptance criteria (Ref. 5).

Jn the REFUELING SHUTDOWN and COLD SHUTDOWN MODES, the steam generators are transitioning to decay heat removal and primary to secondary leakage is minimal. Therefore, the monitoring of RCS specific activity is not required.

ACTIONS LCO 3.1.4.3.a.l, a.2, and a.3 With the DOSE EQUIVALENT 1-131 greater than the LCO limit, samples at intervals of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months must be taken to demonstrate that the specific activity is::;; 60.0 ~LCilgm. The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is required to obtain and analyze a sample. Sampling is continued every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to provide a trend.

The DOSE EQUIVALENT 1-131 must be restored to within limit within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is acceptable since it is expected that, if there were an iodine spike, the normal coolant iodine concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.

LCO 3.1.4.3.b. l With the DOSE EQUIVALENT Xe-133 greater than the LCO limit, DOSE EQUIVALENT Xe-133 must be restored to within limit within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The allowed Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is acceptable since it is expected that, if there were a noble gas spike, the. normal coolant noble gas concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.

LCO 3.1.4.3.a.4 and 3.1.4.3.b.2 If the Required Actions of 3.1.4.3.a and 3.1.4.3.b are not met, or if the DOSE EQUIVALENT 1-13 L is>

60.0 µCi/gm, the reactor must be brought to HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Coi.D SHUTDOWN within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . .The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems, SURVEILLANCE REQUIREMENTS Table 4.1-3, Item I .a Table 4.1-3, Item l .a.i requires performing a gamma isotopic analysis as a measure of the noble gas specific activity of the reactor coolant at least once every 7 days. This measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance provides an indication of any increase in the noble gas specific activity.

Trending.the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The 7-day Frequency considers the low probability of a gross fuel failure during this time.

.)

The 7-day Frequency is adequate to trend changes in the xenon activity level. The Frequency, between 2 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after a power change > 15% RTP within a I hour period; is established because the xenon levels peak during this time following iodine spike initiation~ samples at Qther times would provide inaccurate resµlts.

3-9 Amendment No. 108, 117,204, 272

Bases (Continued)

If a specific noble gas nuclide listed in the definition of DOSE EQUIVALENT Xe-133 is not detected, it should be assumed to be present at the minimum detectable activity.

Table 4. I -3, Item I .b The Table 4. 1-3, Item 1.b surveillance for isotopic analysis for DOSE EQUIVALENT 1-131 concentration is perfonned to ensure iodine specific activity remains within the LCO limit during nonnal operation and following fast power changes when iodine spiking is more apt to occur. The 14-day Frequency is adequate to trend changes in the iodine activity level, considering noble gas activity is monitored every 7 days. The Frequency, between 2 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after a power change> 15% RTP within a I hour period, is established because the iodine levels peak during this time following iodine spike initiation; samples at other times would provide inaccurate results.

REFERENCES I. 10 CFR 100.11.

2. Standard Review Plan (SRP) Section 15.1.5 Appendix A (SLB) and Section 15.6.3 (SGTR).

3. FSAR, Section 14.1.2.9.

4. FSAR, Section 14.1.2.10 .

\ 5. 10 CFR 50 Appendix A, General Design Criteria 19

.\ Amendment No. 272 3-9a

CONTAOUID COPY 3.1.5 CHEMISTRY

Appl icabi1 ity Applies to acceptable concentrations of impurities for continuous operation of the reactor.

Objective To protect the reactor coolant system from the effects of impurities.

Specification 3.1.5.1

If the concentration of oxygen in the primary coolant exceeds 0.1 ppm during power operation, corrective action shall be initiated within eight hours to return oxygen levels to~ 0.1 ppm.

3.1.5.2 If the concentration of chloride in the primary coolant exceeds 0.15 ppm during power operation, corrective action shall be initiated within eight hours to return chloride levels to~ 0.15 ppm.

3.1.5.3 If the concentration of fluorides in the primary coolant exceeds 0.10 ppm following modifications or repair to the primary system involving welding, corrective action shall be initiated within eight hours to return fluoride levels to ~ 0.10 ppm.

,:~'

3.1.5.4 If the concentration limits for oxygen, chloride or fluoride given in 3.1.5.1, 3.1.5.2, and 3.1.S.3 above are not restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of detection, the reactor shall be placed in a hot shutdown condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. If the normal operational limits are not restored within an additional 24-hour period, the reactor shall be placed in a cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter.

3.1.5.5 If the oxygen, chloride, or fluoride concentration of the primary coolant system exceeds 1.0 ppm the reactor shall be brought to the hot shutdown condition using normal shutdown procedure and action is to be taken to return the system to within normal operation specifications. If normal operating specifications have not been reached in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , the reactor will then be brought to a cold shutdown condition.

Bases By maintaining the chloride, fluoride, and oxygen concentration in the reactor coolant within the specifications, the integrity of the reactor coolant system is protected against potential stress corrosion attack (References i and 2).

3-10 Amendment No. 157

The oxygen concentration in the reactor coolant system is normally expected to be below detectable limits since dissolved hydrogen is used when the reactor is critical. The reQuirement that the oxygen concentration not exceed 0.1 ppm during power operation is added assurance that stress corrosion cracks will not occur (Reference 3).

If the oxygen, chloride, or fluoride limits ire exceeded, measures can be taken to correct the condition (e.g., switch to the spare demineralizer, replace the ion exchange resin, or increase the hydrogen concentration in the makeup tank).

Because of the time dependent nature of any adverse effects arising from chlorides, fluorides, or oxygen concentrations in excess of the limits, and because the condition can be corrected, it is unnecessary to shutdown irrmediately.

The oxygen, chloride, or fluoride limits specified are at least an order of magnitude below concentrations which could result in damage to materials found in the reactor coolant system even if maintained for an extended period of time (Reference 3). Thus, the period of eight hours to initiate corrective action and the period of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to perform corrective action to restore the concentration within the limits have been established. The eight hour period to initiate corrective action allows time to ascertain that the chemical analysis are correct and to locate the source of contamination. If corrective action has not been effective at the end of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , then the reactor coolant system will be brought to the hot shutdown condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter and corrective action will continue. If the normal operational limits are not restored within an additional 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period the reactor shall be placed in cold shutdown condiiion within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter.

The maximum limit of l ppm for the oxygen, chloride, or fluoride concentration that will not be exceeded was selected because these values have been shown to be safe at 550°F (Reference 4). It is prudent to restrict operation to hot shutdown conditions, if these limits are reached.

REFERENCES (1) UFSAR, Section 9.2 - "Chemical Addition and Sampling System" (2) UFSAR, Table 9.2 "Reactor Coolant Quality" (3) Corrosion and Wear Handbook, D.J. DePaul, Editor (4) Stress Corrosion of Metals, Logan 3-11 Amendment No. 157

3.1.6 LEAKAGE Applicability Applies to reactor coolant leakage from the reactor coolant system and the makeup and purification system.

Objective To assure that any reactor coolant leakage does not compromise the safe operation of the facility.

Specification 3.1.6.1 If the total reactor coolant leakage rate exceeds 1O gpm, the reactor shall be placed in hot shutdown within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of detection.

3.1.6.2 If unidentified reactor coolant leakage (excluding normal evaporative losses) exceeds one gpm or if any reactor coolant leakage is evaluated as unsafe, the reactor shall be placed in hot shutdown within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of detection.

3.1.6.3 If the primary-to-secondary leakage through any one ( 1) steam generator exceeds 150 GPD, the reactor shall be placed in hot shutdown within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in cold shutdown within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

3.1.6.4 If any reactor coolant leakage exists through a nonisolable fault in an RCS strength boundary (such as the reactor vessel, piping, valve body, etc., except the steam generator tubes), the reactor shall be shutdown, and a cooldown to the cold shutdown condition shall be initiated within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of detection.

3.1.6.5 If reactor shutdown is required by Specification 3.1.6.1, 3.1.6.2, 3.1.6.3, or 3.1 .6.4, the rate of shutdown and the conditions of shutdown shall be determined by the safety evaluation for each case.

3.1.6.6 Action to evaluate the safety implication of reactor coolant leakage shall be initiated within four hours of detection. The nature, as well as the magnitude, of the leak shall be considered in this evaluation. The safety evaluation shall assure that the exposure of offsite personnel to radiation is within the dose rate limits of the ODCM.

3.1.6. 7 If reactor shutdown is required per Specification 3.1.6.1, 3.1 .6.2, 3.1.6.3 or 3.1.6.4, the reactor shall not be restarted until the leak is repaired or until the problem is otherwise corrected.

3.1.6.8 When the reactor is criiical and above 2 percent power, two reactor coolant leak detection systems of different operating principles shall be in operation for the Reactor Building with one of the two systems sensitive to radioactivity. The systems sensitive to radioactivity may be out-of-service for no more than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months provided a sample is taken of the Reactor Building atmosphere every eight hours and analyzed for radioactivity and two other means are available to detect leakage.

,. Amendment No. 47, ~ . 180, 246, 2S1, 271 (12-22-78) 3-12

3.1.5.9 Loss of reactor coolant through r11ctor cool1nt pump s11ls ind system v1lv1s to connecting systems whfch vent to tht gas vent h11der ind fl"'Om wtlfch coolant e1n bt returned to the rtactor coolant system shall not be consf cltred 11 reactor coolant l111tag1 ind shill not be subJtct to the con1fdtr1tfon of Sp,cfttcatfons 3.1.6.1, l.1.6.2, 3.1.1.3, 3.1.s.,,

3.1.6.5, 3.1.6.6 or 3.1.6.7, txc1pt that such 101111 when 1ddtd to 111k1g1 shall not exceed 30 gpm. If leakage plus losses exceeds JO gpm, tht reactor shill bt placed fn HOT SHUTDOWN wt tht n 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of dttect1on.

l.1.6.10 Op1r1ttng condftfons of POWER OPERATION, STARTUP and HOT SHUTDOWN 1poly to tht optratfonal s~1tu1 of the high pressurt fsol1tfon valves blt"'ltn tht prt111ry coolant sy1t1* ind tht low pressure fnj1ct1on syst,~.

a. During 111 op1ratfng condttfons fn this speciffcatton, 111 pressu,..

isolation v1lv11 lfsttd tn Tablt 3.1.5.1 that lr"I located blt-.,n the prf1111ry coolant system ind tht LPIS shall functto" 11 pr1ssut"t fsolatfon dtvfc11 1xc1pt as specffftd fn 3.1.6.10.b. Y1lv1 leakage sti.11 not excttd the amount fndfcattd in T1bl1 l.1.6.1.(a)

b. In tht t¥tnt that fnt1grfty of any hfgh pressure isolation check valves specif fed f n T1blt 3.1.1.1 cannot bt dlmanstrated, reactor oper1tfon ..Y contir111 provfdld that at least tlllO valves in 11ch hf gll pr"tssure 11ne having a non-functional valve art f n and ,..*tn fn, ttlt IIIOdl corrtspondfng to tllt fsolatld condftfon. (b)

c. If Specfffcation l.1.5.10.a or 3.1.1.10.b cannot bl 1111t, an ardtrly shutdown shall be acco11plfshed by ach11¥fn9 HOT SHUTDOWN w1thfn 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN wt thf n an addttfonal 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

Bases Any leak of radfoactfv1 nuid, -'tether fro* the reactor coolant systea pri*ry boundary or not, can bt I serious probl .. wf th resptet to fn-plant radtoactivt contaafnatfon and required cleanup or, fn the case of reactor coolant, ft could develop into a stfll mrt sertous problt* and, thertfort, tht first fndfcatff>fts of such lukage wfll be followd up 11 soon as practical. The unit's akeup systN has the capab11fty to akeup considerably IIDl"I than 30 9PII of reactor coolant 11at1ge plus losses.

Water inventory balances, 11Dnftorfng 1qutp111nt, radfoactfvt tracing, borfc acfd crystalltne dtpostts, and physical tnsptctfons can dtsclose rtactor coolant ltats.

(1) For the purpose of thts specfffcatfon, fntegrfty ts consfdtred to have beltl dtllDllstratad by ... tfng Sptciffcatfon 4.2.7.

Cb) Motor operat.ct valves shall be plactd in the closed posftfon and

power supplfes dNntrgi zed

Amendllllnt No. Jlf, W , 141 3-13

Bases (Continued>

Although some leak rates on the order of gallons per minute may be tolerable from a dose point of view, it is recognized that leaks in the order of drops per minute through any of the barriers of the primary system could be indicative of materials failure such as by stress corrosion cracking. If depressurization, isolation, and/or other safety measures are not taken promptly, these small leaks could develop into much larger leaks, possibly into a gross pipe rupture. Therefore, the nature and location of the leak, as well as the m*gnitude of the leakage, must be considered in the safety evaluation.

When reactor coolant leakage occurs to the Reactor Building, it is ultimately conducted to the Reactor Building sump. Although the reactor coolant is safely contained, the gaseous components in it escape to the Reactor Building atmosphere. There, the gaseous components beco~e a potential hazard to plant personnel, during inspection tours within the Reactor Building, and to the general public whenever the Reactor Building atmosphere is periodically purged to the environment.

When reactor coolant leakage occurs to the Auxiliary Building, it is collected in the Auxiliary Building sump. The gases escaping from reactor coolant leakage within the Auxiliary Building will be collected in the Auxiliary and Fuel Handling Building exhaust ventilation system and discharged to the environment via the unit's Auxiliary and Fuel Handling Building vent. Since the majority of this leakage occurs within confined, separately ventilated cubicles within the Auxiliary Building, it incurs very little hazard to plant personnel .

In regard to the surveillance specification 4.2.7, the isolation valves may be tested at a reduced pressure~~ accordance with the Franklin Research Center Report tHled "Primary Coolant System Pressure Isolation Valves for TMI-1" CFRC Task 212) dated October 24, 1980, Section 2.2.2.

When reactor coolant leakage occurs to the nuclear services closed cooling water system, the leakage, both gaseous and liquid, is contained because the nuclear services closed cooling water system surge tank is a closed tank that is maintained above atmospheric pressure. The leakage would be detected by the nuclear services closed cooling water system monttor and by purge tank* liquid level, both of which alarm in the control room. Since the nuclear services closed cooling water system's only potential contact with reactor coolant is tn the sample coolers, it is considered not to be a hazard. However, if reactor coolant leakage to this receptor occurred and the surge tank's relief valve discharged, radioactive gases could be discharged to the environment via the unit's auxiliary and fuel handling building vent.

- Order dtd. 4/20/81 3-13a Amendment no 149

Bases (Continued)

When reactor coolant leakage occurs to the intermediate cooling closed cooling water system, the leakage is indicated by both the intermediate cooling water monitor (RM-L9) and the intermediate cooling closed cooling water surge tank liquid level indicator, both of which alarm in the control room. Reactor coolant leakage to this receptor ultimately could result in radioactive gas leaking to the environment via the unit1s auxiliary and fuel handling building vent by way of the atmospheric vent on the surge tank.

When reactor coolant leakage occurs to either of the decay heat closed cooling water systems, the leakage is indicated by the affected system 1s radiation monitor (RM-L2 or RM-L3 for system A and B, *respectively) and surge tank liquid level indicator, all four of which alarm in the control room. Reactor coolant leakage to this receptor ultimately could result in radioactive gas leaking to the environment via the unit1s auxiliary and fuel handling building vent by way of the atmospheric vent on the surge tank of the affected system.

Assuming the existence of the maximum allowable activity in the reactor coolant, a reactor coolant leakage rate of less than one gpm unidentified leakage within the reactor or auxiliary building or any of the closed cooling water systems indicated above, is a conservative limit on what is allowable before the dose rate limits of the ODCM would be exceeded.

When the reactor coolant leaks to the secondary sides of either steam generator, all the gaseous components and a very sniall fraction of the ionic components are carried by the steam to the main condenser. The gaseous components exit the main condenser via the unit's vacuum pump which discharges to the condenser vent past the condenser off-gas monitor. The condenser off-gas monitor will detect any radiation, above background, within the condenser vent.

However, buildup of radioactive solids in the secondary side of a steam generator and the presence of radioactive ions in the condensate can be tolerated to only a small degree.

Therefore, the appearance of activity in the condenser off-gas, or any other possible indications of primary to secondary leakage such as water inventories, condensate demineralizer activity, etc., shall be considered positive indication of primary to secondary leakage and steps shall be taken to determine the source and quantity of the leakage.

-' 3-14 Amendment No. 4-=I-, 22, 7+, .:t-a9, +49, 400, 246

Bases (Continued)

If reactor coolant leakage is to the containment, it may be

identified by one or more of the following methods:

a) The containment radiation monitor is a three channel monitor consisting of a particulate channel, an iodine channel, and a gaseous channel. All three channels read out in the Control Room and alarm to indicate an increase in containment activity.

The containment particulate channel is sensitive to the presence of Rb-88, a daughter product of Kr-88, in the containment air sample. Since this activity originates predominantly in the Reactor Coolant System, an increase in monitor readings could be indicative of increasing RCS leakage. The sensitivity of the particulate monitor is such that a leakrate of less than 1 gpm will be detected within one (1) hour under normal plant operating conditions.

b) The mass balance technique is a method of determining leakage by stabilizing the Reactor Coolant System and observing the change in water inventory over a given time period. Level decreases in the Makeup Tank may also serve as an early indication of abnormal leakage.

c) The Reactor Building Normal sump receives leakage from systems inside containment. Sump level readings are checked and recorded regularly for rate of water accumulation. High accumulation rates alert the operators to increase their surveillance of possible leak sources. One half inch of level corresponds to a volume of approximately 4% gallons .

d) Deleted.

The leakage detection capability provided by the above methods can be used to determine potential pressure boundary faults. Such leakage, while tolerable from a dose point of view, could be indicative of material degradation which if not dealt with promptly, could develop into larger leaks.

If 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is exceeded, manual samples will continue at B hour intervals and an IR will be written to determine what additional actions need to be taken based on the plant conditions at that time. The evaluation to determine additional actions will consider current RCS leakage and trends, availability of other leakage monitoring instrumentation (i.e., mass balance, flow balance, RB sump instruments) and existing NUREG-1430 guidance to appropriately limit the timeframe.

This specification is concerned with leakage from the Reactor Coolant System (RCS) and Makeup and Purification System {MUPS). The methods discussed above provide a means of detecting, as early as possible, leakage which could be the result of a fault in the reactor coolant system pressure boundary. The primary method used at TMl-1 for quantifying RCS and MUPS leakage is the mass balance technique.

3-15

Amendment No. 17, 141, EGR TM 04 00601, ECR TM 06 00206, AR 4048309 (6 18 76)

Bases (Continued)

The unidentified reactor coolant leakage limit of 1 gpm is established as a quantity which can be accurately measured while sufficiently low to ensure early detection of leakage. Leakage of this magnitude can be reasonably detected within a matter of hours, thus providing confidence that cracks associated with such leakage will not develop into a critical size before mitigating actions can be taken.

Total reactor coolant leakage is limited by this specification to 10 gpm. This limitation provides allowance for a limited amount of leakage from known sources whose presence will not interfere with the detection of unidentified leakage.

Except for primary to secondary leakage, the safety analyses do not address operational leakage. However, other operational leakage is related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes primary to secondary leakage from all steam generators (SGs) depending on the specific accident analyses. The leakage rate may increase (over that observed during normal operation) as a result of accident-induced conditions. The TS requirement to limit the primary to secondary leakage through any one (1)

SG to less than or equal to 150 gallons per day is significantly less than the conditions assumed in the safety analysis.

The limit of 150 gallons per day per SG, is based on the operational leakage performance criterion in NEI 97-06, Steam Generator Program Guidelines (Ref. 1). The Steam Generator Program operational leakage performance criterion in NEI 97-06 states, "The RCS operational

.t primary to secondary leakage through any one SG shall be limited to 150 gallons per day." The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational leakage rate criterion in conjunction with the implementation of the Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.

If reactor coolant leakage is to the auxiliary building, it may be identified by one or more of the following methods:

a. The auxiliary and fuel handling building vent radioactive gas monitor is sensitive to very low activity levels and would show an increase in activity level shortly after a reactor coolant leak developed within the auxiliary building.

b. Water inventories around the auxiliary building sump.

c. Periodic equipment inspections.

d. In the event of gross leakage, in excess of 4.53 gpm, the individual cubicle leak detectors in the makeup and decay heat pump cubicles, will alarm in the control room to backup "a", "b", and "c" above.

When the source and location of leakage has been identified, the situation can be evaluated to determine if operation can safely continue. This evaluation will be performed by TMl-1 Plant Operations.

REFERENCES (1) NEI 97-06, "Steam Generator Program Guidelines."

3-15a Amendment No. 44+, Order dtd. 4/20/81, 246, 261, ECR TM 07 00719, 271

TABLE 3 ..1.6.1 PRESSURE ISOLATION CHECK VALVES BETWEEN THE PRIMARY COOLANT SYSTEM & LPIS System Valve No. Maximum Allowable Leakage Low Pressure Injection Train A CF-VSA S5.0 GPM DH-V22A S5.0 GPM Train B CF-VSB S5.0 GPM DH-V22B S5.0 GPM 3-15b Order Dated 4/20/81 Amendment No. 444, 286

1n1~0UJ8D OOPV 3.1.7 MODERATOR TEMPERATURE COEFFICIENT OF REACTIVITY

App1icabi1ity Applies to maximum positive moderator temperature coefficient of reactivity at fu11 power conditions.

Objective To assure that the moderator temperature coefficient stays within the limits calculated for safe operation of the reactor.

Specification 3.1.7.1 The moderator temperature coefficient shall not be positive at power levels above 95% of rated power.

3.1.7.2 The moderator temperature coefficient shall be<+

0.9x10- 4 delta k/k/F at power levels< 95% of rated power:

Bases A non-positive moderator coefficient (Reference 1) at power levels above 95% of rated power is specified such that the maximum clad temperatures will not exceed the Final Acceptance Criteria based on LOCA analyses. Below 95% of rated power the Final Acceptance Criteria will not be exceeded with a positive moderator temperature

/

coefficient of +0.9 x 10- 4 delta k/k/F. All other accident analyses as reported in the UFSAR have been performed for a range of moderator temperature coefficients including +O. 9 x 10- delta 4

k/k/F.

A non-positive moderator coefficient at power levels above 95% of rated power is also required to prevent overpressurization of the reactor coolant system in the event of a feedwater line break (see Specification 2.3.l, Basis C, Reactor Coolant System Pressure).

The Final Acceptance Criteria states that post-LOCA clad temperature will not exceed 2200°F (Reference 2.)

REFERENCES (1) UFSAR, Section 3.2.2.1.5.4 - "Moderator Temperature Coefficient" (2) UFSAR, Section 14 - Tables 14.2-l, 14.2-13, 14.2-14

Amendment No.~ fjl, 157 FEB 1, 1990 3-16

CONTROUJ3J 'IY 1.1.8 Single Loop Restrictions

Applicability Applies to single loop operation of the reactor coolant system Specification 3.1.8.1 Single loop operation while the reactor is critical is prohibited.

Bases The restriction prohibiting single 1oop operation with TMI-1 may be lifted, provided that: (1) analyses of TMI-1 support single loop operation, (2) testing on TMI-1 supports the analysis of single loop operation, and (3) any additional equipment necessary for single loop operation is installed at TMI-1.

/~** ..

I'

Amendment No. 157 3*17

3.1.9 LOW POWER PHYSICS TESTING RESTRICTIONS Applicability Applies to Reactor Protection System requirements for low power physics testing.

Objective To assure an additional margin of safety during low power physics testing.

Specification

The following special limitations are placed on low power physics testing.

3.1.9.1 Reactor Protection System Requirements

a. Below 1720 psig Shutdown Bypass trip setting limits shall apply in accordance with Table 2.3-1.

b. Above 1800 psig nuclear overpower trip shall be set

\:,.

at less than 5.0 percent. Other settings shall be in accordance with Table 2.3-1.

3.1 .9.2 Startup Rate Rod Withdrawal Hold (Reference 1) Shall be operable At All Times.

3.1.9.3 Shutdown margin may not be reduced below 1% delta k/k per 3.5.2.1.

Bases The above specification provides additional safety margins during low power physics testing, as is also provided for startup (Reference 2.)

REFERENCES (1) UFSAR, Section 7.2.2.1.b - "Reactivity Rate Limits" (2) UFSAR, Section 14.1.2.2- "Startup Accident" 3-18 Amendment No. -:t-e7 278

C 3.1.10 CONTROL ROD OPERATION This page intentionally left blank i

(Page 3- I 8b deleted) 3-18a Amendment No. 211

3.1.11 Applicabilitv REACTOR INTERNALS VENT VALVES Applies to Reactor Internals Vent Valves Objective To verify that no reactor internals vent valve is stuck in the open position and that each valve continues to exhibit freedom of movement.

Specifications 3.1.11.1 The structural integrity and operability of the reactor internals vent valves shall be maintained at a level consistent with the acceptance criteria in Specification 4.16 .

f .., ..

,__/

Amendment No.~,167 (8-16-78) 3-lSc

3.1.12 Pressurizer Power Operated Relief Valve (PORV), Block Valve, and Low Temperature Overpressure Protection (LTOP)

Applicability Applies to the settings, and conditions for isolation of the PORV.

Objective To prevent the possibility of inadvertently overpressurizing or depressurizing the Reactor Coolant System.

Specification 3.1.12.1 LTOP Protection If the reactor vessel head is installed and indicated RCS temperature is s 313°F, High Pressure Injection Pump breakers shall not be racked in unless:

a. MU-V16AJB/C/D are closed with their breakers open, and MU-V217 is closed, and

b. Pressurizer level is maintained s 100 inches. If pressurizer level is> 100 inches, restore level to s 100 inches within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

3.1 .12.2 The PORV settings shall be as follows:

a. Low Temperature Overpressure Protection Setpoint

1. When indicated RCS temperature is s 313°F, the LTOP system shall be operable as defined in Specification 3.1.12.1 and

2. The PORV will have a maximum lift setpoint of 592 psig.

With the PORV setpoint above the maximum value, within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months either:

1. restore the setpoint below the maximum value, or

2. verify pressurizer level is s 100 inches indicated and satisfy the requirements of Technical Specification 3.1.12.3 allowing the PORV to be taken out of service.

b. Unless the Low Temperature Overpressure Protection Setpoint is in effect, the PORV lift setpoint will be a minimum of 2425 psig.

With the PORV setpoint below the minimum value, within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months either:

1. restore the setpoint above the minimum value, or

2. close the associated block valve, or

3. close the PORV, and remove power from PORV

4. otherwise, be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

3-18d Amendment No. 66, 78, 149, 167,186,234,281

3.1.12.3 When the indicated RCS temperature is below 313°F the PORV shall not be taken out of service, nor shall it be isolated from the system unless one of the following is in effect:

a. High Pressure Injection Pump breakers are racked out.

b. MU-V16A/B/C/D are closed with their breakers open, and MU-V217 is closed.

c. Head of the Reactor Vessel is removed.

3.1.12.4 The PORV Block Valve shall b.e OPl;RABLE during HOT STANDBY, STARTUP, and POWER OPERATION:

a. W°ith the PORV Block Valve inoperable, within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months either:

1. restore the PORV Block Valve to OPERABLE status or

2. close the PORV (verify closed) and remove power from the PORV

3. otherwise, be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

b. With the PORV block valve inoperable, restore the inoperable valve to OPERABLE status prior to startup from the next COLD SHUTDOWN unless the COLD SHUTDOWN occurs within 90 Effective Full Power Days (EFPD) of the end of the fuel cycle. If a COLD SHUTDOWN occurs within this 90 day period, restore the inoperable valve to OPERABLE status prior to startup for the next fuel cycle.

Bases If the PORV is removed from service while the RCS is below 313°F, sufficient measures are incorporated to prevent severe overpressurization by either eliminating the high pressure sources or flowpaths or assuring that the RCS is open to atmosphere.

The PORV setpoints are specified with tolerances assumed in the bases for Technical Specification 3.1.2. Above 313°F, the PORV setpoint hc1s been chosen to limit the potential for inadvertent discharge or cycling of the PORV.

Other action such as removing the. power to the PORV has the same effect as raising the setpoint which also satisfies this requirement. There is no upper limit on this setpoint as the Pressurizer Safety Valves (T.S. 3.1. t,3) provide the required overpressure relief.

Below 313°F, the PORV setpoint is reduced to provide th1;3 required low temperature overpressure relief when high pressure sources and flowpaths are in service. There is no lower limit c:i'n the pressure actuation specified as lower setpoints also provide this same protection.

3-18e Amendment No. 78,149,167,186,234,281

In both cases, the setting is specified to reflect the nominal value which allows for normal variations in the temperature setpoint while maintaining the tolerances assumed in the bas.es for T.S. 3..1.2. Either pressure actuation setpoint is acceptable above 313°F.

With RCS temperatures less than 313°F and the makeup pumps running, the high pressure injection valves are closed and pressurizer level is maintained less thari 100 inches to allow time for action to prevent severe overpressurization in the event of any single failure.

The PORV block valve is required to be OPERABLE during the HOT STANDBY, STARTUP, and POWER OPERATION in order to provide isolation of the PORV discharge line to positively control potential RCS depressurization.

For protection from severe overpressurization during HPI testing, refer to Section 4.5.2.1.c.

3-18f Amendment No. 186,234, 281

3.1.13 REACTOR COOLANT SYSTEM VENTS Applicability Provides the limiting conditions for operation of the Reactor Coolant System Vents. These limiting conditions for operation (LCO) are applicable only when Reactor is critical.

Objective To ensure that sufficient vent flow paths are operable during the plant operating modes mentioned above.

Specification 3.1.13.1 At least one reactor coolant system vent path consisting of at least two power operated valves in series, powered from em~rgency buses shall be OPERABLE and closed at each of the following locations:

a. Reactor vessel head (RC-V42 & RC-V43) b Pressurizer steam space (RC-V28 & RC-V44)

c. Reactor coolant system high point (either RC-V40A and 41 A) or (RC-408 and 418)

Action 3.1.13.2 a. With one of the above reactor coolant system vent paths inoperable, the inoperable vent path shall be maintained closed, with power removed from the valve actuators in the inoperable vent path. The inoperable vent path shall be restored to OPERABLE status within 30 days, or the plant shail be in OT SHUTDOWN within an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

b. With two or more of the above reactor coolant system vent paths inoperable, maintain the inoperable vent path closed, with power removed from the valve actu-ators in the inoperable vent paths, and restore at least two of the vent paths to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in HOT SHUTDOWN within an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

3-18g Amendment No. 97, 186 278

C COPY Bases The safety function enhanced by this venting capability is core cooling.

For events beyond the present design basis, this venting capability will substantially increase the olants abilitv to deal with larae ouantitiP~ nf noncondensible gas which could interfere.with natural circulation (i.e~, ..

core cooling).

The reactor vessel head vent (RC-V42 & RC-V43 in series) provides the capability of venting noncondensible gases from the majority of the reactor vessel head as well as the Reactor Coolant hot legs (to the elevation of the top of the outlet nozzles) and cold legs (through vessel internals leakage paths, to the elevation of the top of the inlet nozzles). This vent is routed to containment atmosphere.

Venting for the pressurizer steam space (RC-V28 and RC-V44 in series) has been provided to assure that the pressurizer is available for Reactor Coolant System pressure and volume control. This vent is routed to the Reactor Coolant Drain Tank.

Additional venting capability has been provided for the Reactor Coolant hot leg high points (RC-V40A, B, RC-41A, 8), which normally cannot be vented through the Reactor vessel head vent or pressurizer steam-space vent. These vents relieve to containment atmosphere through a rupture disk (set at low pressure).

The above vent systems are seismically designed and environmentally qualified in accordance with the May 23, 1980 Conunission Order and Memorandum per NUREG-0737, Item 11.B.l. The high point vents do not fall within the scope of 10 CFR 50.49, since the vents are not relied upon during or following any design basis event {Reference 1). The power operated valves (2 in series in each flow path} which are powered from emergency buses fail closed on loss of power. All vent valves for the reactor vessel head vent, pressurizer vent and loop B high point vent are powered from the class IE 8" bus. The vent valves for the loop A high point vent are 11 powered from the class IE "A" bus. The power operated valves are controlled in the Control Room. The individual vent path lines are sized so that an inadvertent valve opening will not constitute a LOCA as defined in 10 CFR 50.46(c}(l). These design features provide a high degree of assurance that these vent paths will be available when needed, and that inadvertent operation or failures will not significantly hamper the safe operation of the plant (Reference 2}.

REFERENCES (I) UFSAR, Section 4.2.3.9 - "Reactor Coolant System Venting" (2) UFSAR, Section 7.3.2.2.c (16) - "Reactor Coolant System Venting" 3-ISh Amendment No. 91, ((9, ts1, 186

3.2 MAKEUP AND PURIFICATION AND CHEMICAL ADDITION SYSTEMS DELETED 3-19

Amendment No. 43, 60, 98, 167, 196

THIS PAGE LEFT BLANK INTENTIONALLY

Amendment No. 50, 1a2, 167, 1e8, 196 3-20

3.3 EMERGENCY CORE COOLING, REACTOR BUILDING EMERGENCY COOLING AND REACTOR BUILDING SPRAY SYSTEMS

Applicability Applies to the operating status of the emergency core cooling, reactor building emergency cooling, and reactor building spray systems.

Objective To define the conditions necessary to assure immediate availability of the emergency core cooling, reactor building emergency cooling and reactor building spray systems.

Specification 3.3.1 The reactor shall not be made critical unless the following conditions are met:

3.3.1.1 Injection Systems

a. The borated water storage tank (BWST) shall contain a minimum of 350,000 gallons of water having a minimum concentration of 2,500 ppm boron at a temperature not less than 40°F. If the boron concentration or water temperature is not within limits, restore the BWST to OPERABLE within 8 hrs. If the BWST volume is not within limits, restore the BWST to OPERABLE within one hour. Specification 3.0.1 applies.

NOTES:

1. The BWST piping may be unisolated from seismic Class II Cleanup path piping for a total duration of not more than 720 hours0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months prior to the scheduled start of the

Fall 2015 Refueling Outage and for a total duration of not more than 1440 hours0.0167 days 0.4 hours 0.00238 weeks 5.4792e-4 months during the following Fuel Cycle 21 operation under administrative and design controls for filtration and/or demineralization of the tank contents.

2. The BWST piping may be unisolated from seismic Class II Recirculation path piping for not more than 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months per week to perform weekly (and after each makeup) BWST boron concentration surveillance testing under administrative and design controls until the end of Fuel Cycle 21 operation.

b. Two Makeup and Purification (MU)/High Pressure Injection (HPI) pumps are OPERABLE in the engineered safeguards mode powered from independent essential buses. Specification 3.0.1 applies.

c. Two decay heat removal pumps are OPERABLE. Specification 3.0.1 applies.

d. Two decay heat removal coolers and their cooling water supplies are OPERABLE.

(See Specification 3.3.1.4) Specification 3.0.1 applies.

e. Two BWST level instrument channels are OPERABLE.

f. The two reactor building sump isolation valves (DH-V-6A/B) shall be remote-manually OPERABLE. Specification 3.0.1 applies.

3-21 Amendment No. 24,.Q8,.:i+g,~,244.~.~. Correoted by letter dtd July 8, 1999 2-78, 289

3.3 EMERGENCY CORE COOLING, REACTOR BUILDING EMERGENCY COOLING AND REACTOR BUILDING SPRAY SYSTEMS (Contd.)

g. MU Tank (MUT) pressure and level shall be maintained within the Unrestricted Operating Region of Figure 3.3-1.

1) With M UT conditions outside of the Unrestricted Operating Region of Figure 3.3-1, restore MUT pressure and level to within the Unrestricted Operating Region within 72 hrs. Specification 3.0.1 applies.

2) Operation with MUT conditions within the Prohibited Region of Figure 3.3-1 is prohibited. Specification 3.0.1 applies.

3.3.1.2 Core Flooding System 3

a. Two core flooding tanks (CFTs) each containing 940 +/- 30 ft of borated water at 600 +/- 25 psig shall be available. Specification 3.0.1 applies .

3-21a

Amendment No. ~.98,478,-2-W,-244,2.2-a,-22-7,

~ . 289 Corrected by letter dtd July 8, 1999

3.3 EMERGENCY CORE COOLING, REACTOR BUILDING EMERGENCY COOLING AND REACTOR BUILDING SPRAY SYSTEMS {Contd.)

b. CFT boron concentratior:i shall not be less than 2,270 ppm boron .

Specification 3.3.2.1 applies.

c. The electrically operated discharge valves from the CFT will be assured open by administrative control and position indication lamps on the engineered safeguards status panel. Respective breakers for these valves shall be open and conspicuously marked. A one hour time clock is provided to open the valve and remove power to the valve. Specification 3.0.1 applies. *

d. DELETED

e. CFT vent valves CF-V-3A and CF-V-3B shall be closed and the breakers to the CFT vent valve motor operators shall be tagged open, except when adjusting core flood tank level and/or pressure. Specification 3.0.1 applies.

3.3.1.3 Reactor Building Spray System and Reactor Building Emergency Cooling System The following components must be OPERABLE:

a. Two reactor building spray pumps and their associated spray nozzles headers and two reactor building emergency cooling fans and associated cooling units (one in each train). Specification 3.0.1 applies.

b. The Reactor Building emergency sump pH control system shall be maintained with

~ 18,815 lbs and s 28,840 lbs of trisodium phosphate dodecahydrate (TSP) .

Specification 3.3.2.1 applies.

3.3.1.4 Cooling Water Systems - Specification 3.0.1 applies.

a. Two nuclear service closed cycle cooling water pumps must be OPERABLE.

b. Two nuclear service river water pumps must be OPERABLE.

c. Two decay heat closed cycle cooling water pumps must be OPERABLE.

d. Two decay heat river water pumps must be OPERABLE.

e. Two reactor building emergency cooling river W<;lter pumps must be OPERABLE.

3.3.1.5 Engineered Safeguards Valves and Interlocks Associated with the Systems in Specifications 3.3.1.1, 3.3.1.2, 3.3.1.3, 3.3.1.4 are OPERABLE. Specification 3.0.1 applies .

3-22 Amendment No. 33, 80, 98, 137, 174,190,211,225,227,263 278

3.3 EMERGENCY CORE COOLINGVREACTOR BUILDING EMERGENCY COOLING AND REACTOR BUILDING SPRAY s STEMS (Contd.)

3.3.2 Maintenance or testing shall be allowed during reactor operation on any component(s) in the makeup and purification, decay heat, RB emergency cooling water, RB spray, BWSl level instrumentation, or cooling water systems which wilf not remove more than one train of each system from service. Components shall not be removed from service so that the affected system train is inoperable for more than 72 consecutive hours. If the system is not restored to meet the requirements of Specification 3.3.1 within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , the reactor shall be placed in a HOT SHUTDOWN condition within six hours.

3.3.2.1 If the CFT boron concentration is outside of limits, or if the TSP baskets contain amounts of TSP outside the limits specified in 3.3.1.3.b, restore the system to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . If the system is not restored to meet the requirements of Specification 3.3.1 within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , the reactor shall be placed in a HOT SHUTDOWN condition within six hours.

3.3.3 Exceptions to 3.3.2 shall be as follows:

a. Both CFTs shall be OPERABLE at all times.

b. Both the motor operated valves associated with the CFTs shall be fully open at all times.

c. One reactor building cooling fan and associated cooling unit shall be permitted to be out-of-service for seven days.

3.3.4 Prior to initiating maintenance on any of the components, the duplicate (redundant) component shall be verified to be OPERABLE.

Bases The requirements of Specification 3.3.1 assure that, before the reactor can be made critical, adequate engineered safety features are operable. Two engineered safeguards makeup pumps, two decay heat removal pumps and two decay heat removal coolers {along witli their respective cooling water systems components) are srecified. However, only one of each is necessary to supply emergency coolant to the reactor in the even of a loss-of-coolant accident. Both CFTs are required because a single CFT has insufficient inventory to reflood the core for hot and cold line breaks (Reference 1).

For a Decay Heat Removal / Low Pressure Injection train to be OPERABLE, the system must be capable of performing automatic injection from the BWST, recirculation and cooling of the reactor building sump, and post LOCA reactor vessel boron concentration control. . Train A of post LOCA reactor vessel boron concentration control includes remote operation of the Decay Heat Pressurizer Spray Isolation Valve RC-V-4. Train B of post LOCA reactor vessel boron concentration control includes remote operation of the Decay Heat Drop Line Suction and Containment Isolation Valves DH-V-1, DH-V-2 (after closing in its breaker), DH-V-3, and DH-V-12B. DH-V-12B Is Locked Open, to allow drop line flow path to be used for post LOCA boron concentration control even if the valve is inaccessible.

Management of gas voids is important to Emergency Core Cooling System and Reactor Building Spray System OPERABILITY. .

The operability of the borated water storage tank (BWST) as part of the ECCS ensures that a sufficient supply of borated water is available for injection by the ECCS in the event of a LOCA (Reference 2).

The limits on BWST minimum volume and boron concentration ensure that 1) sufficient water is available within containment to permit recirculation cooling flow to the core, and 2) the reactor will remain at least one percent subcritical following a Loss-of-Coolant Accident {LOCA).

The contained water volume limit of 350,000 gallons includes an allowance for water not usable because of tank discharge location and sump recirculation switchover setpoint. Redundant heaters maintain the borated water supply at a temperature greater than 40°F.

The BWST can be placed on cleanup path, or recirculation path for weekly surveillance testing for boron concentratiofl, on a temporary basis, until the end of the Fuel Cycle 21 operation. A seismic evaluation has been perrormed that concluded the cleanup and recirculation seismic Class II piping paths would maintain pressure boundary integrity during a Safe Shutdown Earthquake (SSE). The seismic Class I BWST would maintain its safety functions auring an SSE. The limiting condition for operation (LCO) for BWST cleanup operation is a total duration of not more than 720 hours0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months (30 da~s) prior to Fall 2015 Refueling Outage and is a total duration of not more than 1440 hours0.0167 days 0.4 hours 0.00238 weeks 5.4792e-4 months (60 days during Fuel Cycle 21 operation. BWST Cleanup can be started and stopped at any time as long as he total durations are not exceeded. The LCO for BWST recirculation operation is limited to the time it takes to adequately recirculate the BWST volume to perform the boron sampling surveillance, which is approximately 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months per week. The temporary LCOs are in effect to allow time for a permanent solution to the issue of interconnecting seismic Class I and II piping during BWST cleanup and recirculation operation .

The Reactor Building emergency sump pH control system ensures a sump pH between 7.3 and 8.0 during the recirculation phase of a postulated LOCA. A minimum pH level of 7.3 is required to reduce the potential for chloride induced stress corrosion cracking of austenit1c stainless steel and assure the retention of elemental iodine in the recirculating fluid. A maximum pH value of 8.0 minimizes the 3-23 Amendment No. 449,4-a-7,4-ea,478,22-7,229,~.278.28§,289, ECR 14-00208

3.3 EMERGENCY CORE COOLING, REACTOR BUILDING EMERGENCY COOLING

AND REACTOR BUILDING SPRAY SYSTEMS (Contd.)

Bases (Cont'd.)

formation of precipitates that may migrate to the emergency sump and minimizes post-LOCA hydrogen generation. Trisodium phosphate dodecahydrate is used because of the high humidity that may be present in the Reactor Building during normal operation. This form is less likely to absorb large amounts of water from the atmosphere.

All TSP baskets are located outside of the secondary shield wall in the Reactor Building basement (El.

281 '-0"). Therefore, the baskets are protected from the effects of credible internal missiles inside the shield wall. The designated TSP basket locations ensure that the baskets are not impacted by the effect of potential LOCA jet impingement forces and pipe whip.

Maintaining MUT pressure and level within the limits of Fig. 3.3-1 ensures that MUT gas will not be drawn into the pumps for any design basis accident. Preventing gas entrainment of the pumps is not dependent upon operator actions after the event occurs.

The plant operating limits (alarms and procedures) will include margins to account for instrument error.

The post-accident reactor building emergency cooling may be accomplished by three emergency cooling units, by two spray systems, or by a combination of one emergency cooling unit and one spray system. The specified requirements assure that the required post-accident components are available.

The iodine removal function of the reactor building spray system requires one spray pump and TSP in baskets located in the Reactor Building Basement.

The spray system utilities common suction lines with the decay heat removal system. If a single train of equipment is removed from either system, the other train must be assured to be operable in each system .

When the reactor is critical, maintenance is allowed per Specification 3.3.2 and 3.3.3 provided requirements in Specification 3.3.4 are met which assure operability of the duplicate components.

Maintenance as described here includes preventative and corrective type activities. The specified maintenance times are a maximum. Operability of the specified components shall be based on the satisfactory completion of surveillance and inservice testing and inspection required by the INSERVICE TESTING PROGRAM and Technical Specification 4.2 and 4.5.

The allowable maintenance period of up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months may be utilized if the operability of equipment redundant to that removed from service is verified based on the results of surveillance and inservice testing and inspection required by the INSERVICE TESTING PROGRAM and Technical Specification 4.2 and 4.5.

In the event that the need for emergency core cooling should occur, operation of one makeup pump, one decay heat removal pump, and both core flood tanks will protect the core. In the event of a reactor coolant system rupture their operation will limit the peak clad temperature to less than 2,200°F and the metal-water reaction to that representing less than 1 percent of the clad.

Two nuclear service river water pumps and two nuclear service closed cycle cooling pumps are required for normal operation. The normal operating requirements are greater than the emergency requirements following a loss-of-coolant.

REFERENCES (1) UFSAR, Section 6.1- Emergency Core Cooling System" (2) UFSAR, Section 14.2.2.3 - "Large Break LOCA"

- 3-24 Amendment No. 80, 149, 157, 165, 178, 227, 263, ECR TM 09 00160, 290

V

FIGURE 3.3-1 Makeup Tank Pressure vs Level Limits (Instrument Error NOT Included).

105 + - - - - - - - - - - ~ - - " - ' *_ _ _ ; _ _ ~ * - - - ~ - - ~ - - - - - - ~ - - -

100 95 UNRESTRICTED 90 ----~ OPl::RATING -+--------_.._---+--,-----::.*

REGION

'iii' Cl) 85

.c tJ g

"iii Cl) 80 C:

I'll I-

, 75

==

70 65 :

I i

! PROHIBITED i REGION l I

60 I

55 I I I I I I I

! i 50 .. . I I

10 15 20 25 30 35 40 45 50 55 60 65 MU Tank Pressure (psig)

3-24a Amendment No. 227,

I con~TR llED COPY i 3.4 DECAY HEAT REMOVAL {OHR) CAPABILITY 11 Applicability Applies to the operating status of systems and components that function to remove decay heat when one or more fuel bundles are located in the reactor vessel.

Objective To define the conditions necessary to assure continuous capability of OHR*

Specification 3.4.1 Reactor Coolant System (RCS) temperature greater than 250 degrees F.

3.4.1.1 Three independent Emergency Feedwater (EFW) Pumps and two redundant flowpaths to each Once Through Steam Generator (OTSG) shall be OPERABLE ** with:

a. Two EFW Pumps, each capable of being powered from an OPERABLE emergency bus, and one EFW Pump capable of being powered from two OPERABLE main steam supply paths.

(1) With one main steam supply path inoperable, restore the inoperable steam supply path to OPERABLE status within 7 days or be in COLD SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

(2) With one EFW Pump or any EFW flowpath inoperable, restore the ?

inoperable pump or flowpath to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be ,.

in COLD SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

(3) With one main steam supply path to the turbine-driven EFW Pump and one motor-driven EFW Pump inoperable, restore the steam supply or the motor-driven EFW Pump to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in COLD SHUTDOWN within the following 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

(4) With more than one EFW Pump or both flowpaths to either OTSG inoperable, initiate action immediately to restore at least two EFW Pumps and one flowpath to each OTSG:

These requirements supplement the requirements of Specifications 3.1.1.1.c, 3.1.1.2, 3.3.1 .

and 3.8.3. -.

- HSPS operability is specified in Specification 3.5.1. When HSPS is not required to be OPERABLE, EFW is OPERABLE by manual control of pumps and valves from the Control Room.

3-25 Amendment No. 4,78,98,119,124,162,190,211, 242

COf~TROllED COPY 3.4 DECAY HEAT REMOVAL {OHR) CAPABILITY (Continued)

Notes:

\;__

1. Specification 3.0.1 and all other actions requiring shutdown or changes in REAQTOR OPERATING CONDITIONS are suspended until at least two EFW Pumps and one EFW flowpath to each OTSG are restored to OPERABLE status.

2. While performing surveillance testing, more than one EFW Pump or both flowpaths to a single OTSG may be inoperable for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months provided that:

(a) At least one motor-driven EFW Pump shall remain OPERABLE, and (b) With the reactor in STARTUP, HOT STANDBY, or POWER OPERATION, a designated qualified individual who is in communication with the control room shall be continuously stationed in the immediate vicinity of the affected EFW local manual valves. On instruction from the Control Room, the individual shall realign the valves from the test mode to their operational alig nmerit.

b. Four of six Turbine Bypass Valves (TBVs) OPERABLE. With more than two TBVs inoperable, restore operability of at least four TBVs within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

c. The Condensate Storage Tanks (CSTs) OPERABLE with a minimum of 150,000 gallons of condensate available in each CST.

(1) With a CST inoperable, restore the CST to operability within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and COLD SHUTDOWN within the next 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

(2) With more than one CST inoperable, restore at least one CST to OPERABLE status or be subcritical within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , in HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in COLD SHUTDOWN within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

3.4.1.2.1 With the Reactor between 250 degrees F and HOT SHUTDOWN, and having been subcritical for at least one (1) hour, two (2) Main Steam Safety Valves (MSSVs) per OTSG shall be OPERABLE. With less than two (2) MSSVs per OTSG OPERABLE, restore at least two (2) MSSVs to OPERABLE status for each OTSG within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or be in COLD SHUTDOWN within the following

/ 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

3.4.1.2.2 With the Reactor between HOT SHUTDOWN and 5% power, and having been subcritical for at least one (1) hour, two (2) MSSVs per OTSG shall be OPERABLE provided the overpower trip setpoint in the RPS is set to less than 5% full power. With less than two (2) MSSVs per OTSG OPERABLE, restore at least two (2) MSSVs to OPERABLE status for each OTSG within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or be in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

3-26 Amendment No. 4, 78, 119,125,133,242

3.4 DECAY HEAT REMOVAL (OHR) CAPABILITY (Continued) 3.4.1.2.3 Except as provided in Specificc).tipn 3.4.1.2.2 c1bove, when the Reactor is above HOT SHUTDOWN, seven (7) MSSVs per OTSG shall be OPERABLE. If either OTSG has less than seven (7) MSSVs that are OPERABLE, then reduce the power and reset the maximum overpower trip setpoint as follows:

Minimum Numqer of Maximum Overpower MSSVs Operable on Trip Setpoint Each OTSG (% of Rated Power) 7 see Table 2.3-1 .

6 85.1 5 70.1 4 55.1 With less than four (4) MSSVs OPERABLE per OTSG, restore to a condition with at least four (4) MSSVs on each OTSG to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

3.4.2 RCS temperature less than or equal to 250 degrees F.

3.4.2.1 At least two of the following means for maintaining OHR capability shall be OPERABLE and at least one shall be in operation except as allowed by Specifications 3.4.2.2, 3.4.2.3 and 3.4.2.4. *

a. OHR String (Loop "A").

b. OHR String (Loop 11 8 11 ).

c. RCS Loop "A" and its associated OTSG with an EFW Pump and a flowpath.

d. RCS Loop "B" and its associated OTSG with an EFW Pump and a flowpath.

With less than the above required means for maintaining OHR capability OPERABLE, immediately initiate corrective action to return the required loops to OPERABLE status as soon as possible.

3.4.2.2 Operation of the means for OHR may be suspended provided the core outlet temperature is maintained below saturation temperature.

3.4.2.3 The number of means for OHR required to be OPERABLE per Specification 3.4.2.1 may be reduced to one provided that the Reactor is in a REFUELING SHUTDOWN condition with the Fuel Transfer Canal water level greater than or equal to 23 feet above the Reactor Vessel flange.

3.4.2.4 Specification 3.4.2.1 does not apply when either of the following conditions exist:

a. Decay heat generation is less than 188 KW with the RCS full.

b. Decay heat generation is less than 100 KW with the RCS drained down for maintenance.

3-26a Amendment No. 119, 126, 1aa, 220, 242, 277

CONTROLLED COPY 3.4 DECAY HEAT REMOVAL (DHR)CAPABILITY (Continued)

Bases

\. A reactor shutdown following power operation requires removal of core decay heat. Normal OHR is by the OTSGs with the steam dump to the condenser when RCS temperature is above 250 degrees F and by the OHR System below 250 degrees F. Core decay heat can be continuously dissipated up to 15 percent of full power via the steam bypass to the condenser as feedwater in the OTSG is converted to steam by heat absorption. Normally, the capability to return feedwater flow to the OTSGs is provided by the main feedwater system.

The Emergency Feedwater (EFW) System supplies adequate feedwater to the OTSGs at accident pressures, removing heat from the Reactor Coolant System (RCS) to support safe shutdown of the reactor when the normal feedwater supply is unavailable. EFW is not required for normal plant startup and shutdown.

The turbine-driven EFW Pump and two motor-driven EFW Pumps take suction from the Condensate Storage Tanks (CSTs) and deliver flow to a common discharge header. Flowpath redundancy is provided for those portions of the EFW flowpath containing active components between the pumps and each of the OTSGs. Each EFW line to an OTSG includes two redundant flowpaths, each equipped with an automatic control valve (EF-V-30A/8/C/D) and a manual isolation valve (EF-V-52A/B/C/D). Each redundant flowpath is capable of providing adequate flow to the associated OTSG. Heat removed from the OTSGs returns to the Main Condenser through the Turbine Bypass Valves (TBVs) or discharges to the atmosphere through the Main Steam Safety Valves (MSSVs) and/or the Atmospheric Dump Valves (ADVs). An unlimited supply of river water to the EFW Pumps is available using either of the two Reactor Building Emergency Cooling Water (Reactor River Water) Pumps (RR-P-1A/8) .

Redundant main steam supply paths are provided to the turbine-driven EFW Pump for certain

\,.:

events involving loss of one steam supply (e.g., main steam and feedwater line breaks). An operable Main Steam supply path delivers steam to the turbine-driven EFW Pump upon HSPS actuation or by operator action from the control room when HSPS is not required. During low pressure conditions, additional steam supply paths from Main Steam (MS-V-10A/B) or Auxiliary Steam can be made available to the turbine-driven EFW Pump as necessary.

During design basis events the EFW System can withstand any single active failure and still perform its function. The limiting design basis accident for the EFW System is a loss of feedwater event with off-site power available. In the event of a loss of all AC power, which assumes multiple single failures, the turbine-driven EFW Pump alone delivers the necessary EFW flow. Consideration of additional failures in the EFW System or Heat Sink Protection System (HSPS) is not required for this event. Additionally, the EFW System capabilities are sufficient to deliver the required flow in licensing basis events (e.g., ATWS failure to trip events, Generic Letter 81-14 seismic events, and the Station Blackout event).

The most limiting EFW flow requirement is met when at least two EFW Pumps are operable and at least one EFW flowpath to each OTSG is operable. When three pumps and two flowpaths to each OTSG are operable, the EFW System can withstand any single active failure. Examples of single active failures include: failure of any one EFW Pump to actuate, failure of one HSPS train to actuate, or failure of one redundant flowpath to either OTSG. Initially after a shutdown, any two EFW Pumps are required to remove RCS heat with one pump eventually sufficing as the decay heat production rate dir;ninishes .

Amendment No. 119, 124, 125, 133,157,190,242 3-26b

3.4 .DECAY HEAT REMOVAL (DHR) CAPABILITY (Continued)

Bases (Continued)

If EFW were required during surveillance testing, minor operator action (e.g., opening a local isolation valve or manipul;:iting a control switch from the control room) may be needed to restore operability of the required punips or flowpaths. An exception to permit more than one EFW Pump or both EFW flowpaths to a single OTSG to be inoperable for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months during surveillance testing. requires 1) at least one motor-d.riven EFW Pump operabl!3, ano 2) an individual involved 'in the task of t~sting the !=FW System must be in ~ommunication With the control room and stationed in the immediate vicinity of the affected EFW flowpath valves. Thus the individual is permitted to be involved in the test activities by taking test data and 'his movement is restricted to the area of the EFW Pump and valve rooms where the testing is being conducted.

The allowed action times are reasonable, based on operating experience, to reach the required plant operating conditions from full power in an orderly manner and without challenging plant

. systems. Without at least two EFW Pumps and one EFW flowpath to each OTSG operable, the required action is to immediately restore EFW components to operable status, and all actions requiring ~hutdown or changes in Reactor Qperatirig Condition are suspended. With less than two EFW pumps or no flowpath to either OTSG operable, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown. In such a condition, the unit should not be pertwbed by any action, including a power change, which might result in a trip.

The sedousness of this condition requires that action be started immediately to restore EFW components.to.operable status. TS 3.0.1 is not applicable, as it could force the unit into a less safe condition.

The EFW system actuates on: 1) loss of all four Reactor Coolant Pumps, 2) loss of both Main Feedwater Pumps, 3) low OTSG water level, or 4) high Reactor.Building pressure. A single active failure in the HSPS will neither inadvertently initiate the EFW system nor isolate the Main Feedwater system. OTSG wa~er level is controlled automatically by the HSPS system or can be controlled manually, if necessary.

The MSSVs will be able to r~lieve to atmosphere the total steam flow if necessary.

Specification 3.4.1 . 2.3 provides limiting conditions of operation if more than two MSSVs are inoperable on a single OTSG. The power level and overpower trip setpoint must be reduced, as stated in Specification 3.4.1.2.3 such that the remaining MSSVs can prevent secondary system-overpressure on a turbine trip. The turb.ine trip event is the limiting event in terms of peak secondary system pressure. Ana_lyses have shown that overpressure wlll not occur if a turbine trip occurs with two or less MSSVs out of service on each OTSG and an initial power level less than or ~qual to 102% of 2772 MWth.

Having MSSVs out of service as allowed by Specification 3.4.1.2.3 does not adversely impact the transient progression of the remainin*g Safety Analysis events.

Below 5% power, only a minimum number of MSSVs need to be operable as stated in Specifications 3.4.1.2.1 and *3.4.1.2,2. This is to provide C>TSG overpressure protection during hot functional testing and low power physics testing. Additionally, when the Repctor is between hot shutdown and 5% full power operation, the overpower trip setpoint in the RPS shall be set to less than 5% as is specified in Specification 3.4.1.2.2. The minimum number of MSSVs required to be operable allows margin for testing without jeopardizing plant safety. Plant specific c1nalysis shows that one MSSV is Sl!fficient to relieve reactor coolant pump heat and stored energy when the reactor has been subcritical by 1% delta K/K for at least one hour.

3-26c Amendment No. 78, 119, 126, 133, 167, 220, 242, 261, 277

3.4 DECAY HEAT REMOVAL (OHR) CAPABILITY (Continued)

Bases (Continued)

Other plant analyses show that two (2) MSSVs on either OTSG are more than sufficient to relieve reactor coolant pump heat and stored energy when the reactor is below 5% full power operation but had been subcritical by 1% delta K/K for at least one hour subsequent to power operation above 5% full power. According to Specification 3.1.1.2a, both OTSGs shall have tube integrity whenever the reactor coolant average temperature is above 200 degrees F. This assures that all four (4) MSSVs are available for redundancy. During power operations at 5%

full power or above, if MSSVs are inoperable, the power level must be reduced, as stated in Specification 3.4.1.2.3 such that the remaining MSSVs can prevent overpressure on a turbine trip.

The minimum amount of water in the CSTs required by Specification 3.4.1.1.c, provides at least 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of OHR with steam being discharged to the atmosphere. This provides adequate time to align alternate water sources for RCS cooldown. After cooling to 250 degrees F, the OHR System is used to achieve further cooling.

When the RCS temperature is below 250 degrees F, a single OHR String (Loop), or single OTSG with an EFW Pump and a flowpath capable of supporting natural circulation is sufficient to provide removal of decay heat at all times following the cooldown to 250 degrees F. The OHR String (Loop) redundancy required by Specification 3.4.2.1 is achieved with independent active components capable of maintaining the RCS subcooled. A single OHR flowpath with redundant active. components is sufficient to meet the requirements of Specifications 3.4.2.1.a and 3.4.2.1.b. The requirement to maintain two operable means of OHR ensures that a single active failure does not result in a complete loss of OHR capability. The requirement to keep a

OHR Loop in operation as necessary to maintain the RCS subcooled at the core outlet provides the guidance to ensure that steam conditions which could inhibit core cooling do not occur.

Management of gas voids is important to OHR System OPERABILITY.

With the Reactor Vessel head removed and 23 feet of water above the Reactor Vessel flange, a large heat sink is available for core cooling. In this condition, only one OHR Loop is required to be operable because the volume of water above the Reactor Vessel flange provides a large heat sink which would allow sufficient time to recover active OHR means.

Following extensive outages or major core off-loading, the decay heat generation being removed from the Reactor Vessel is so low that ambient losses are sufficient to maintain core cooling and no other means of heat removal is required. The system is passive and requires no redundant or diverse backup system. Decay heat generation is calculated in accordance with ANSI 5.1-1979 to determine when this situation exists (Reference 4).

REFERENCES (1) UFSAR, Table 6.1 ECCS "Single Failure Analysis" (2) UFSAR, Section 9.5 - "Decay Heat Removal System" (3) UFSAR, Section 10.6 - "Emergency Feedwater System" (4) TMI Unit 1 Calculation C-3320-85-001, "RCS Decay Heat Removal-Ambient Losses,"

Revision 0, February 28, 1985

Amendment No.~.~. 285 3-26d

3.5 INSTRUMENTATION SYSTEMS 3.5.1 OPERATIONAL SAFETY INSTRUMENTATION Applicability Applies to unit instrumentation and control systems.

Objective To delineate the conditions of the unit instrumentation and safety circuits necessary to assure reactor safety.

Specificat i ans 3.5.1.1 The reactor shall not be in a startup mode or in a critical state unless the requirements of Table 3.5-1, Column "A" and "B" are met, except as provided in Table 3.5-1, Column "C". Specification 3.0.l applies.

3.5.1.2 The key operated channel bypass switch associated with each reactor protection channel may be used to lock the reactor trip module in

--t-he tintripped state as indicated by a light. Only one channel shal~ be locked in this untripped state at any one time. Unit operation at rated power shall be permitted to continue with Table 3.5-1, Column "A". Only one channel bypass key shall be kept in the control room .

3.5.1.3 In the event the number of protection channels operable falls below the limit given under Table 3.5~1, Column "A*, operation shall be limited as specified in Column "C". Specification 3.0.1 applies.

3.5.1.4 The key operated shutdown bypass switch associated with each reactor protection channel shall not be used during reactor power operation (except for required maintenance or testing).

3.5.1.5 During START-UP when the intermediate range instruments come on scale, the overlap between the intermediate range and the source range instrumentation shall not be less than one decade.

3.5.1.6 During START-UP, HOT STANDBY or POWER OPERATION, in the event that a control rod drive trip breaker is inop~rablei within one hour .

place the breaker in trip. Specification 3.0.1 applies.

3.5.1.7 During START-UP, HOT STANDBY or POWER OPERATION, in the event that one of the control rod drive trip breaker diverse trip features (shunt trip or undervoltage trip atta~hment) is inoperable:

a. Restore to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or

b. Within one additional hour place the breaker in trip.

Specification 3.0.1 applies

3-27 Amendment No. ~l, ~-. li~. 189

3.5.1. 7.1 Power may be restored through the breaker wi.th the failed trip feature for up to two hours for surveillance testing per T.S.

4.1.1.

3.5.1.8 Deleted 3.5.1.9 The reactor shall not be in the Startup mode or in a critical state unless both HSPS actuation logic trains associated with the Functional units listed in Table 3.5-1 are operable except as provided in Table 3.5-1,D.

3.5.1.9.1 With one HSPS actuation logic train inoperable, restore the train to OPERABLE or place the inoperable device in an actuated state within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

With both HSPS actuation logic trains inoperable, restore one train to OPERABLE within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Bases Every reasonable effort will be made to maintain all safety instrumentation in operation. The reactor trip, on loss of feedwater may be bypassed below 7%

reactor power. The bypass is autpmatically removed when reactor power is.

raised above 7%. The reactor trip, on turbine trip, may be bypassed below 45%

reactor power (Reference 1 ). The safety feature actuation system must have two analog channels functioning correctly prior to startup.

The anticipatory reactor trips on loss of feedwater pumps and turbine trip have been added to reduce the number of challenges to the safety valves and power operated relief valve but have not been credited in the safety analyses.

Operation at rated power is permitted as long as the systems have at least the redundancy requirements of Column "B" (Table 3.5-1 ). This is in agreement with redundancy and single .failure criteria of IEEE 279 as described in FSAR Section 7.

There are four reactor protection channels. Normal trip logic is two out of four. Minimum required trip logic is one out of two.

3-27a Amendment No. 123, 124, 135, 157, 189, 273

The four reactor protection channels were provided with key operated bypass switches to allow on-line testing or maintenance on only one channel at a

time during power operation. Each channel is provided alarm and lights to indicate when that channel is bypassed. There will be one reactor protection system bypass switch key permitted in the control room.

Each reactor protection channel key operated shutdown bypass switch is provided with alarm and lights to indicate when the shutdown bypass switch is being used.

Power is normally supplied to the control rod drive mechanisms from two separate parallel 460 volt sources through four AC trip breakers, designated A, B, C and D. The breaker undervottage trip coils are powered by RPS channels A, B, C and D, respectively. From these circuit breakers, the CAD power travels through voltage regulators and stepdown transformers to complete redundant power buses that feed the CAD Single Rod Power Supplies (SRPSs) A and B.

Two AC breakers (A and C) are arranged in series to feed SAPS power bus A, and the other two AC breakers (B and D) are in series to feed SAPS power bus B. Opening at least one circuit breaker in each of the two parallel paths to the SAPS will cause a reactor trip, in a one-out-of-two taken twice logic.

Either path can provide sufficient power to operate all CRDs.

Diverse trip features are provided on each breaker. These are the undervoltage relay and shunt trip attachment. Each trip feature is tested separately. Failure of one breaker trip feature does not result in toss of redundancy and a reasonable time .limit is provided for corrective action.

Failure in the untripped state of a breaker results in loss of redundancy and prompt action is required.

Failure of both trip features on one breaker is considered failure of the breaker.

Power may be restored through the failed breaker for a limited time to perform required testing.

The 4.16kv ES Bus Undervoltage Relays detect a degraded voltage or Loss of Voltage on the associated ES Bus. Detection of low voltage will separate the ES bus from the offsite power, initiate load shedding and start the associated diesel generator. The relays do not function during design basis.

events where acceptable offsite voltage is available. If the voltage relays on one train are not operable, the time permitted for repair is consistent with other safety related equipment. If both trains are affected then shutdown is initiated in accordance with Specification 3.0.1 since automatic response of the diesel generator is required to assure completion of the safety function if offsite power is degraded or lost.

Automatic initiation of EFW is provided on loss of all reactor coolant pumps, toss of both main feedwater pumps, low OTSG level, and high reactor building pressure. High reactor building pressure would be indicative of a loss of coolant accident, main steam line or feedwater line break inside the reactor building. Operability of these instruments is required in order to assure that the EFW system will actuate and control at the appropriate OTSG level without operator action for those events where timely initiation of EFW is required.

Automatic isolation of main feedwater is provided on low OTSG pressure in order to maintain appropriate RCS cooling (minimize overcooling) following a loss of OTSG integrity and minimize the energy released to the Reactor Building atmosphere .

Amendment No. 78, 123, 124, 193, 273 3-28

COH\ITROUJ8D OOPY HSPS instrument operability specified meets the single failure criterion for the EFW system. Four instrument channels are provided for automatic EFW initiation on OTSG low level and high reactor building pressure, and for automatic main feedwater isolation on low OTSG pressure. Normal trip logic is two out of four. With one of the 4 channels in bypass, a second channel may be taken out of service (placed 1n :he tripped position) and no single active failure will prevent actuation of the associated HSPS train actuation logic.

No single active failure of either HSPS train will prevent the other HSPS train from operating to supply EFW to both OTSGs.

REFERENCE (1) S&W Report No. BAW-1893, "Basis for Raising Arming Threshold for Anticipatory Reactor Trip on Turbine Trip, 11 Rev. 0, October 1985

Amendment No. !21, tt4, !~, 157 3-28a

)>

3 CD

**TABLE 3.5-1

J Cl..

3 INSTRUMENTS OPERATING CONDITIONS CD

?.

z Functional Unit (A) (B)

!=) (C)

Minimum Operable Minimum Degree Channels Operator Action if Conditions of Redundancy of Column A and B Cannot be Met A. Reactor Protection System

1. Manual pushbutton 1 0 (a)

N

~

2. Power range instrument channel 2 1 (a) 0

-...J

3. Intermediate range instrument 0 channels 1 0 (a) (b) z9

4. Source range instrument w

I\)

channels 0 (a) (c) ~

co

5. Reactor coolant temperature 0 instrument channels 2 1 (a) F F

6. Reactor Coolant 2 m Pressure-Temperature Instrument channels 1 (a)

IC

7. Flux / imbalance I flow 2 0

8. Reactor coolant pressure 1 (a) 0

~

a. High reactor coolant pressure 2 1

~

instrument channels (a)

b. Low reactor coolant pressure 2 1 (a) instrument channel$

):>>

3

'D

i TABLE 3.5-1 (Cont'd) 3

.'D INSTRUMENTS OPERATING CONDITIONS r+

z functional Unit 0 (A) (8) (C)

' Minimum Operable Minimum Degree Operator Action if Conditions ISi Channels of Redundancy of Column A and B Cannot Be Met

'9Q A. Reactor Protection System (cont'd)

,... 9. Power/number of pumps 2 1 (a) instrument channels b,I

~ 10. High reactor building 2 (a) pressure channels

())

I.O (a) Restore the conditions of Column (A) and Column (B) within one hour or place the unit in HOT SHUTDOWN within an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

w w

I (b~ When 2 of 4 power range instrument channels are greater than IO percent full power, intermediate range 0

instrumentation is not required.

(c) When 1 of 2 -intermediate range instrument channels is greater than 10* 10 amps, or 2 of 4 power range instrument channels are greater than 10 percent full power, source range instrumentation is not required.

);:,,

,, .r. ,

3 l'D TABLE 3.5-1 (Cont'd) a.

3 It) INSTRUMENTS OPERATING CONDITIONS rt z

0 Functional Unit (A} (B) . ( i:)

Minimum Operable Minimum Degree Operator Action if Conditions CD Channels of Redundancy of Column A and 8 Cannot Be Met

'° B. Other Reactor Trips I. Loss of Feedwater (c) 2 I ,(a) I 0

2. Turbine Trip (c) 2 1 ;( b) lo~'

(a) Restore the conditions of Column (A) and Column (B) within one hour or reduce indicated reactor power to less than 7% within an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

(b) Restore the conditions of Column (A) and Column (B) wi~hin one hour or reduce indicated reactor power to less w than 45% within an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

I w

0 (c) Trip may be defeated during low power physics tests.

DI

§' TABLE 3.5-1 (Cont'd)

ID

a. INSTRUMENTS OPERATING CONDITIONS 3

ID r+

z Functional Unit (A) (8) (C) 0 Minimum Operable Minimum Degree . Operator Action if Conditions Channels of Redundancy of Column A and B Cannot Be Met co C. Ingineered Safety Features I.O

1. Makeup and Purification System (high pressure injection mode)

a. Reactor Coolant Pressure 2 l(b) (a)

Instrument Channels

b. Reactor Building 4 psig 2 I ( b) (a) I Instrument Channels

/---- 0

~

c. Manual Pushbutton 2 N/A \ (g)

(also actuates Low Pressure w

I Injection) w

2. Decay Heat System (low

~

... pressure injection mode) a: Reactor Coolant Pressure 2 l(b) (a)

Instrument Channels .*~

b. Reactor Building 4 psig 2 l(b) (a)

Instrument Channel~

c. Reactor Coolant Pressure I. 0 Open circuit breaker at MCC O.H. Valve Interlock for DH-VI or DH-V2 with the Bistable affected valve in the closed position within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or maintain R.C. pres~ure less than 350 psig.

TABLE 3.5-1 (Cont'd)

INSTRUMENTS OPERATING CONDITIONS Functional Unit (A) (B) (C)

Minimum Operable Minimum Degree Operator Action if Conditions Channels of Redundancy of Column A and B Cannot Be Met C. Eneineered Safety Features Ccoot'dl

3. Reactor Building Isolation and Cooling System

a. Reactor Bldg. 4 psig Instrument .Channel 2 l(b) (a)

b. .Manual Pushbuttons

i. 4 psig feature 2 ii. 30 psig feature (g) 2 (g)

C. Deleted

d. Reactor Building 30 psig pressure switches 2 1 (c)

e. RCS Pressure less than 1600 psig 2 l(b) (a)

f. Reactor Building Purge Line Isolation 0 (AH-VIA and AH-VlD) High Radiation (t)

4. Reactor Building Spray System

a. Reactor Building 30 psig pressure switches 2 1 (d)

1 \

b. Spray Pump Manual Switches 2 .' NIA (g)

5. 4.16KV ES Bus Undervoltage Relays

a. Degraded Grid Voltage Relays 2 1 (e)

b. Loss of Voltage Relay 2 1 (e)

J>

3 ID

, TABLE 3.5-1 (Cont'd)

Q.

ffi

, INSTRUMENTS OPERATING CONDITIONS "z C. Engineered Safety Features (cont'd}

0 (a) Restore the conditions of Column (A) and Column (8) within one hour or place the reactor in HOT SHUTDOWN 151 within an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

'SI (b) The minimum degree of redundancy may be reduced to O up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing .

N

.'*" (c) The Operability requirement is two out of three pressure switches in each train, with a minimum degree of

..... redundancy of one,in each train . 0

'SI

,a I. If the ainiaua conditions are not aet on one train, restore the function to OPERABLE within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , or 0

~0

"° w

place the reactor in HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

2. If the miniaua conditions are not met on either train, then place the reactor in HOT SHUTDOWN in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

w (d) The Operability requirement is two out of three pressure switches in each train, with a minimum degree of I

w redundancy of one, in each train.

N .

a, J.. If the ainiau* conditions are not aet on one train, restore the function to OPERABLE within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or .

place the reactor in HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

2. If the mini*um conditions are not met on either train, then place the reactor in HOT SHUTDOWN in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . 8 (e) The operabi.lity requirement for the undervoltage relay, its associated auxiliary relays, and the timer ~

1. If one 4.16 kv ES Bus does not meet the minimum conditions, restore the function to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in hot shutdown within,an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . *

2. If *both 4.16 kv Buses do not meet the minimum conditions, then restore at least one 4.16 kv ES Bus to meet the minimum conditions within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or be in hot shutdown within *an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

(f) Discontinue Reactor Building purging and close AHV-lA, 18, IC, and 10 within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

l>

3 n> TABLE 3.5-1 (Cont'd)

I C.

3 I'll INSTRUMENTS OPERATING CONDITIONS

I rt

z C. Engineered Safety Features (cont'd) 0 (g) The Operability requirement is for the manual actuation switch for the specified feature on each train to be OPERABLE.

I. If the manual actuation switch on one train is inoperable, restore the switch to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

2. If both manual actuation switches for that feature are inoperable, then place the reactor in HOT SHUTDOWN in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

w I

w I\,)

r

~* ,.

~ L *

§" TABLE 3.5-1 lCont'd)

I'll

a. INSTRUMENTS OPERATING CONDITIONS 3

I'll rt' Functional Un it (A) (B) (C)

z 0

Minimum Operable Minimum Degree of Redundancy Operator Action if Conditions of Column A and B Cannot Be Met Channels co ID D. Heat Sink Protection System

1. EFW Auto Initiation (a)

a. Loss of both feedwater pumps N/A(b) -N/A(b)

N/A(~) N/A(b) (a)

b. Loss of all RC Pumps z--- 1 (a)

C* OTSG A Low Level (a)

d. OTSG B Low Level 2 I 2 1 (a)

e. High Reactor Building Pressure

2. MFW Isolation I (a)

a. OTSG A Low Pressure 2 2 1 (a)

b. OTSG B Low Pressure

3. EFW Level Control N/A(b) (a)

a. OTSG A Level Control N/A(b) w N/A(b) N/A(b) (a) w I

b. OTSG B Level Control N

n (a) Restore the conditions of Column (A) and Column (B) within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or place the unit in HOT SliUTOOWN withinf the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

(b) Operability requirements are specified in Section 3.5.1.9.

3.5.2 CONTROL ROD GROUP AND POWER DISTRIBUTION LIMITS Applicability

This specification applies to power distribution and operation of control rods during power operation.

Objective To assure an acceptable core power distribution during power operation, to set a limit on potential reactivity insertion from a hypothetical control rod ejection, and to assure core subcriticality after a reactor trip.

Specification 3.5.2.1 The available shutdown margin shall not be less than one percent delta K/K with the highest worth control rod fully withdrawn.

3.5.2.2 Operation with inoperable rods:

a. Operation with more than one inoperable rod as defined in Specification 4. 7.1 in the safety or regulating rod banks shall not be permitted. Verify SOM ~ 1% delta k/k or initiate boration to restore within limits within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The reactor shall be brought to HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

b. If a control rod in the regulating and/or safety rod banks is declared inoperable in the withdrawn position as defined in Specification Paragraph 4. 7 .1.1 and 4. 7.1.3, an evaluation shall be initiated immediately to verify the existence of one percent*

delta k/k hot shutdown margin. Boration may be initiated to increase the available rod worth either to compensate for the worth of the inoperable rod or until the regulating banks are fully withdrawn, whichever occurs first. Simultaneously a program of exercising the remaining regulating and safety rods shall be initiated to verify operability.

c. If within one hour of determination of an inoperable rod as defined in Specification 4.7.1, and once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter, it is not determined that a one percent delta k/k hot shutdown margin exists combining the worth of the inoperable rod with each of the other rods, the reactor shall be brought to the HOT SHUTDOWN condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months until this margin is established.

d. Following the determination of an inoperable rod as defined in Specification 4.7.1, alt rods shall be exercised within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and exercised weekly until the rod problem is solved.

e. If a control rod in the regulating or safety rod groups is declared inoperable per 4.7.1.2, and cannot be aligned per 3.5.2.2.f, power shall be reduced to s 60% of the thermal power allowable for the reactor coolant pump combination within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , and the overpower trip setpoint shall be reduced to s 70% of the thermal power allowable within 1O hours. Verify the potential ejected rod worth (ERW) is within the assumptions of the ERW analysis and verify peaking factor (Fa(Z) and F:H )lim.its per the COLA have not been exceeded within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

Amendment No. 4-7, -+eG, 211, 246 278 3-33

f. If a control rod in the regulating group is declared inoperable per Specification 4.7.1.2, operation may continue provided that within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months the rods in the group are positioned such that the rod that was declared inoperable is maintained within allowable group average position limits of Specification 4.7.1.2.

g. If the inoperable rod in Paragraph "e" above is in groups 5, 6, or 7, the other rods in the group may be trimmed to the same position. Normal operation of 100 percent of the thermal power allowable for the reactor coolant pump combination may then continue provided that within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months the rod that was declared inoperable is maintained within allowable group average position limits in 3.5.2.5.

3.5.2.3 The worth of single inserted control rods during criticality is limited by the restriction of Specification 3.1.3.5 and the Control Rod Position Limits defined in Specification 3.5.2.5.

3.5.2.4 Quadrant Tilt:

a. Except for physics tests, the quadrant tilt, as determined using the full incore system (FIS), shall not exceed the values in the CORE OPERATING LIMITS REPORT.

The FIS is OPERABLE for monitoring quadrant tilt provided the number of valid symmetric string individual SPND signals in any one quadrant is not less than the limit in the CORE OPERATING LIMITS REPORT.

b. When the full incore system is not OPERABLE and except for physics tests quadrant tilt as determined using the power range channels for each quadrant (out of core detector system) (OCD), shall not exceed the values in CORE OPERATING LIMITS REPORT.

c. When neither detector system ahove is OPERABLE and, except for physics tests, ..

quadrant tilt as determined using the minimum incore system (MIS), shall not exceed the values in the CORE OPERATING LIMITS REPORT .

d. Except for physics tests if quadrant tilt exceeds the tilt limit, allowable power shall be reduced 2 percent for each 1 percent tilt in excess of the tilt limit. For less than four pump operation, thermal power shall be reduced 2 percent below the thermal power allowable for the reactor coolant pump combination for each 1 percent tilt in excess of the tilt limit. _

e. If quadrant power tilt exceeds the tilt limit then within a period of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months , the quadrant power tilt shall be reduced to less than the tilt limit except for physics tests, or the following verifications and/or adjustments in setpoints and limits shall be made:

1. Verify Fa (Z) and p :H are within limits of the COLR once per 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and restore OPT to :s; steady state limit within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or perform steps 2, 3, &

4 below.

3-34 Amendment No. 17, 29, 39, 40, 60, 90, 126, 142, 160, 211, 273

2.

3.

The protection system reactor power/imbalance envelope trip setpoints shall be reduced 2 percent in power for each 1 percent tilt, in excess of the tilt limit. or when thermal power is equal to or less than 50% full power with four reactor coolant pumps running, set the nuclear overpower trip setpoint equal to or less than 60% full power.

The control rod group withdrawal limits in the CORE OPERATING LIMITS REPORT shall be reduced 2 percent in power for each 1 percent tilt in excess of the tilt limit.

4. The operational imbalance limits in the CORE OPERATING LIMITS REPORT shall be reduced 2 percent in power for each 1 percent tilt in excess of the tilt limit.

f. Except for physics or diagnostic testing, if quadrant tilt is in excess of the maximum tilt limit defined in the CORE OPERATING LIMITS REPORT and using the applicable detector system defined in 3.5.2.4.a, b, and c above, reduce thermal power to :S15% FP within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Diagnostic testing during power operation with a quadrant tilt is permitted provided that the thermal power allowable is restricted as stated in 3.5.2.4.d above.

g. Quadrant tilt shall be monitored on a minimum frequency of once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when the QPT alarm is inoperable and at the frequency specified in the Surveillance Frequency Control Program when the alarm is operable during power operation above 15 percent of rated power. When OPT has been restored to s steady state limit, verify hourly for 12 consecutive hours, or until verified acceptable at ~95% FP .

3-34a Amendment No. 29, 38, 39, 40, 46, aO, 120,126,142,160,162,211,274

3.5.2.5 Control Rod Positions

a. Operating rod group overlap shaU not exceed 25 percent +/-5 percent, between two sequential groups except for physics tests.

b. Position limits are specified for regulating control rods. Except for physics tests or exercising control rods, the regulating control rod insertion/withdrawal limits are specified in the CORE OPERATING LIMITS REPORT.

1. If regulating rods are inserted in the restricted operating region, corrective measures shall be taken immediately to achieve an acceptable control rod position. Acceptable control rod positions shall be attained within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , and FQ(Z) and ~ :H s~all be verified within limits once every 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , or power shall be reduced to s power allowed by insertion limits.

2. If regulating rods are inserted in the unacceptable operating region, initiate boration within 15 minutes to restore SOM to <!1% delta K/K, and restore regulating rods to. within restricted region within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or reduce power to s power allowed by rod insertion limits.

c. Safety rod limits are given in 3.1.3.5.

3.5.2.6 Deleted 3.5.2.7 Axial Power Imbalance:

a. Except for physics tests the axial power imbalance, as determined using the full incore system (FIS), shall not exceed the envelope defined in the CORE OPERATING LIMITS REPORT.

The FIS is operable for monitoring axial power imbalance provided the number of valid self powered neutron detector (SPND) signals in any one quadrant is not less than the limit in the CORE OPERATING LIMITS REPORT.

b. When the full incore detector system is not OPERABLE and except for physics tests axial power imbalance, as determined using the power range channels (out of core detector system)(OCD), shall not exceed the envelope defined in the CORE OPERATING LIMITS REPORT.

c. When neither detector system above is OPERABLE and, except for physics tests axial power imbalance, as determined using the minimum incore system (MIS), shall not exceed the envelope defined in the CORE OPERATING LIMITS REPORT.

d. Except for physics tests if axial power imbalance exceeds the envelope, corrective measures (reduction of imbalance by control rod movements and/or reduction in reactor power) shall be taken to maintain operation within the envelope. Verify FQ(Z) and F:H are within limits of the COLA once per 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months when not within imbalance limits .

3-35 Amendment No. 10, 17, 29, :38, :39, 60, 120, 126, 142, 150, 179, 211, 219, 273 278

e. ff an acceptable axial power imbalance is not achieved within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , reactor power shall be reduced to :540% FP within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

f. Axial power imbalance shall be monitored at the frequency specified in the Surveillance Frequency Control Program when axial power imbalance alarm is OPERABLE, and every 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months when imbalance alarm is inoperable during power operation above 40 percent of rated power.

3.5.2.8 A power map shall be taken at intervals not to exceed 31 effective full power days using the incore instrumentation detection system to verify the power distribution is within the limits shown in the CORE OPERATING LIMITS REPORT.

The axial power imbalance, quadrant power tilt, and control rod position limits are based on LOCA analyses which have defined the maximum linear heat rate. These limits are developed in a manner that ensures the initial condition LOCA maximum linear heat rate will not cause the maximum clad temperature to exceed 10 CFR 50 Appendix K. Operation outside of any one limit alone does not necessarily constitute a situation that would cause the Appendix K Criteria to be exceeded should a LOCA occur. Each limit represents the boundary of operation that will preserve the Acceptance Criteria even if all three limits are at their maximum allowable values simultaneously. Additional conservatism included in the limit development is introduced by application of:

a. Nuclear uncertainty factors

b. Thermal calibration uncertainty C. Fuel densification effects

d. Hot rod manufacturing tolerance factors

e. Postulated fuel rod bow effects

f. Peaking limits based on initial condition for Loss of Coolant Flow transients.

The incore instrumentation system uncertainties used to develop the axial power imbalance and quadrant tilt limits accounted for various combinations *of invalid Self Powered Neutron Detector (SPND) signals. If the number of valid SPND signals falls below that used in the uncertainty analysis, then another system shall be used for monitoring axial power imbalance and/or quadrant tilt.

For axial power imbalance and quadrant power tilt measurements using the incore detector system, the minimum incore detector system consists of OPERABLE detectors configured as follows:

Axial Power Imbalance

a. Three detectors in each of three strings shall lie in the same axial plane with one plane in each axial core half.

b. The axial planes in each core half shall be symmetrical aboutthe core mid-planes.

c. The detectors shall not have radial symmetry.

Quadrant Power Tilt

a. Two sets of four detectors shall lie in each core half. Each set of four shall lie in the same axial plane. The two sets in the same core half may lie in the same axial plane.

b. Detectors in the same plane shall have quarter core radial symmetry'.

3-35a Amendment No. 17, 29, :38, :39, 60, 120, 126, 142, 160, 157, 168, 211, 27:3, 274

LlEDCOPY A system of 52 incore flux detector assemblies ,.,,ith seven detectors per assembly has been provided primarily for fuel management purposes. The system includes data display and record functions and is also used for out-of-core nuclear instrumentation calibration and for core power distribution verification.

a. The out-of-core instrumentation ca:libration includes:

1. Calibrations of the split detectors at initial reactor startup, during the power escalation program, and periodically thereafter.

2. A comparison check with the incorc instrumentation in the event one of the four out-of-core power range detector assemblies gives abnormal readings during operation.

3. Confirmation that the out-of-core axial power splits arc as expected.

b. Core power distribution verification includes:

l. Measurement at low power initial reactor startup to check that power distribution is consistent with calculations.

2. Subsequent checks during operation to ensure that power distribution is consistent with calculations.

3. Indication of power distribution in the event that abnom1al situations occur during reactor operation.

c. The minimum requirement for 23 individual incore detectors is based on the following:

1. An adequate axial imbalance indication can be obtained with nine individual detectors.

Figure 3.5-1 shows a typical set of three detector strings with three detectors per string

2.

that will indicate an axial imbalance. The three detector strings arc the center one, one from the inner ring of symmetrical strings and one from the outer ring of symmetrical strings.

Figure 3.5-2 shows a typical detection scheme which will indicate the radial power distribution with 16 individual detectors. The readings from two detectors in a radial quadrant at either plane can be compared with readings from the other quadrants to measure a radial flux tilt.

3. Figure 3.5-3 combines Figures 3.5-1 and 3.5-2 to illustrate a typical set of 23 individual detectors that can be specified as a minimum for axial imbalance determination and radial tilt indication, as well as for the determination of gross core power distributions.

3-35b Amendment No. 150, 157, 21 l

The 25 +/- 5% overlap between successive control rod groups is allowed since the worth of a rod is lower at the upper and lower part of the stroke. Control rods are arranged in groups or banks defined as follows:

Group Function 1 $afety 2 Safety 3 Safety 4 Safety 5 Regulating 6 Regulc;i.ting 7 Regulating Control rod groups are withdrawn in sequence beginning with group 1. Groups 5, 6 and 7 are overlapped 25 percerit. The normal position at power is for group 7 to be partially inserted.

The rod position limits are based on the most limiting of the following three criteria: ECCS power peaking, shutdown margin, and potential ejected rod worth. As discussed above, compliance with the ECCS power peaking criterion is ensured by the rod position limits. The minimum available rod worth, consistent with the rod position limits, provides for achieving hot shutdown by reactor trip at any time, assuming the highest worth control rod that is withdrawn remains in the full out position (Reference 1). The rod position limits also ensure that in.serted rod groups will not contain single rod worths greater thar,: 0.65% delta k/k at rated power. These values have been shown to be safe by the safety ar:ialysis of the hypothetical rod ejection accident (Reference 2). A maximum single inserted control rod worth of 1.0% delta k/k is allowed by the rod position limits at hot zero power. A single inserted contra! rod worth 1.0% delta k/k at beginning of life, hot, zero power would result in a lower transient peak thermal power and, therefore, less severe environmental consequences than 0.65% delta k/k ejected rod worth at rated power.

The plant computer will scan for tilt and imbalance and will satisfy the technical specification requirements. If the computer is out of service, then manual calculation for tilt above 15 percent power and imbalance above 40 percent power must be performed as specified until the computer is returned to service.

3-36 Amendment No. 17, 29, 39, 4 0, 50, 126, 142, 150, 157, 211, ECR TM 04 01026, 273

C tluUED OOPY

Reduction of the nuclear overpower trip setpoint to 60% full power when thermal power is equal to or less than 50% full power maintains both core protection and an operability margin at reduced power similar to that at full power.

During the physics testing program, the high flux trip setpoints arc administratively set as follows to assure an additional safety margin is provided:

Test Power Test Setpoint 0 <5%

~80 90%

>80 105.1%

REFERENCES

( l) UFSAR, Section 3 .2.2.1.2 - "Reactivity Control Distribution" (2) UFSAR, Section 14.2.2.2 - "Rod Ejection Accident" 3-36a Amendment No. 39, 126, 142, 150, S-+, 211

INFORMATION ON THIS PAGE HAS BEEN DELETED

.\ 3-36b Amendment No. 142, 162, 167, 168 278

3.5.3 ENGINEERED SAFEGUARDS PROTECTION SYSTEM ACTUATION SETPOINTS 0

\ Applicability:

This specification applies to the engineered safeguards protection system actuation setpoints.

Objective:

To provide for automatic initiation of the engineered s~feguards protection system in the event of a breach of Reactor Coolant System integrity.

Specification:

3.5.3.1 The engineered safeguards protection system actuation setpoints and permissible bypasses shall be as follows:

Initiating Signal Function Setpoint High Reactor Building Reactor Building Spray s 30 psig Pressure (1) Reactor Building Isolation s 30psig High-Pressure Injection s 4 psig Low-Pressure Injection s 4 psig Start Reactor Building Cooling & Reactor Building Isolation s 4 psig Low Reactor Coolant High Pressure Injection 2: 1600(2) and System Pressure 2: 500(3) psig Low Pressure Injection ;;:: 1600(2) and

500(3) psig Reactor Building Isolation 2

1600 psig(2) 4.16 kv E.S. Buses Undervoltage Relays Degraded Voltage Switch to Onsite Power Source and load shedding 3760 volts (4)

Degraded voltage timer 10 sec (5)

Loss of voltage Switch to Onsite Power Source and load shedding 2400 Volts (6)

Loss of voltage timer 1.5 sec (7)

(1) May be bypassed for reactor building leak rate test.

(2) May be bypassed below 1775 psig on decreasing pressure and is automatically reinstated before 1800 psig on increasing pressure.

(3) May be bypassed b~low 925 psig on decreasing pressure and is automatically reinstated before exceeding 950 psig on increasing pressure.

3-37 Amendment No. 70, 73, 78, 89, 149, 159

COmROUJSO I

->-" - *, ~-

- (4) Minimum allowed setting is 3740 v. Maximum allowed setting is 3773 v.

(5) Minimum allowed time is 8 sec. maximum allowed time is 12 sec.

(6) Minimum allowed setting is 2200 volts, maximum allowed setting is 2860 volts (7) Minimum allowed time is 1.0 second, maximum allowed time is 2.0 seconds.

High Reactor Building Pressure The basis for the 30 psig and 4 psig setpoints for the high pressure signal is to establish a setting which would be reached in adequate time in the event of a LOCA, cover a spectrum of break sizes and yet be far enough above normal operation maximum internal pressures to prevent spurious initiation (Reference 1).

Low Reactor Coolant System Pressure The basis for the 1600 and 500 psig low reactor coolant pressure setpoint lur high and low pressure injection initiation is to establish a value which is

/~ -.. high enough such that protection is provided for the entire spectrum of break sizes and is far enough below normal operating pressure to prevent spurious

l initiation. Bypass of HPI below 1775 psig and LPI below 925 psig, prevents ECCS actuation during normal system cooldown (References I and 2).

4.16 KV ES Bus Undervoltage Relays The basis for the degraded grid voltage relay setpoint is to protect the safety related electrical equipment from loss of function in the event of a sustained degraded voltage condition on the offsite power system. The timer setting prevents spurious transfer to the onsite source for transient conditions.

The loss of voltage relay and timers detect loss of offsite power condition and initiate transfer to the onsite source with minimal time delay.

The minimum and maximum degraded voltage setpoint are "as found" readings.

References (I) UFSAR, Table 7.1-3 (2) UFSAR~ Section 14.1.2.10- "Steam Generator Tube Failure" 3-37a Amendment No. 7Q, 73, 78, 89, 149, 157, 159, 224

y

/'

(

3.5.4 INCORE INSTRUMENTATION This page intentionally Left Blank (Page 3-39 deleted) 3-38 Amendment No. HO, 211 i

,..---' - -- - LAC,K RADIAL SYMMETRY en w

- (

TOP AXIAL CORE HALF z

c(

..J D.

z 0

j:: -- -

~

z w AXIAL PLANE

E

.~

-....._:..:;_. J.~

w a:

0 CJ z

BOTTOM AXIAL CORE HALF

(:

INCORE INSTRUMENTATION SPEC.IFICATION AXI.AL IMBALANCE INDICATION THREE MILE ISLAND NUCLEAR STATION UNIT 1 FIGURE 3.5-1 3-39a Amendment No * .f.67., 269

J RADIAL SYMMETRY IN THIS PLANE en w

z

<C

..J D.

z -- --

0 i=

~

<C I-zw

E

-:; a:

I-en z

w a:

0 0 RADIAL SYMMETRY al: IN THIS PLANE INCORE INSTRUMENTATION SPl:CIFICATION RADIAL FLUX INDICATION THREE MILE ISLAND NUCLEAR STATION UNIT 1 FIGURE 3.5-2 3-39b Amendment No. 61, 269

en w

z

<C

..J CL 0

z j:: --

z~

w

e H8

~

-'-./::!:

w a:

0

(.)

z HS

- /

/

INCORE INSTRUMENTATION SPECIFICATION THREE MILE ISLAND NUCLEAR STATION UNIT 1 FIGURE 3.5-3 3-39c Amendment No. +61, 269

COPY This page intentionally Left Blank

,. Amendment -M+--, 211 3-40

co COPY 3 * .5.5 ACCIDENT MONilDRING IN5TRUt£NTATI0N Applicability Applies to the operability requiI'ements for the instruments .identified in Table 3.5-2 and Ta.:ils 3.5-3 ouring .STARTUP, POWER OPERATION and HOT STANDBY.

Objectives To assure operability of key instrumentation useful in diagnosing situations whi,ch could represent or lead to inadequate core cooling or evaluate and predict the course of accidents beyord the desigi basis.

Speci ficatior, 3.5.5.l The minimum nunt>er of channels identified for the instruments in Table 3.5-2, shall be OPERABLE. With the nunt>er of instrumentation channels less than the minimum required, restore the inoperable channel ( s) to OPERABLE status within seven (7) days (48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months for pressurizer level) or be in at least HOT SHU1DOWN within the next six (6) hours and in COLD SHUlDOWN within an additional 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . Prior to starti.p following a COLD SHUTDOWN, the min11lun nunt>er of channels sh:>wn in Table 3.5-2 shall be opexable.

3.5.5.2 The channels identified for the instruments specified in Table 3.5-3

shall be OPERABLE. With the nuroer of instrumentation channels less than required, restore the inq:1erable .:hannel(s) to OPERABLE in accordance with the action specified in Taole 3.5-3.

Bases The saturation Margin M:mi tor provides a quick and reliable means for determination of saturation temperature margins. Hand calculation of saturation pressure and saturation temperature margins can be easily and quickly performed as an alternate indication for the Saturation Margin t-t:Jnitors.

Discharge flow from the two (2) pressurizer code safety valves and the PORV is measured by differential pressure transmitters connected across elbow taps downstream of each valve. A delta-pressure indication from each pressure transmitter is availaole in the control room to indicate code safety or relief valve line flow. An alarm is also provided in the control room to indicate that discharge from a pressurizer code safety or relief valve is occurri~. In addition, an acoustic monitor is provided to detect flow in the PORV discharge line. An alarm is provided in the control room for the a1:0ustic monitor.

3-40a Amendment No. 7~, 100

CONTROLLED COPY j*,:.;

{ .'

3.5.5 ACCIDENT MONITORING INSTRUMENTATION (Continued)

\ I The Emergency Feedwater System (EFW) is provided with two channels of flow instrumentation on each of the two discharge lines. Local flow indication is also available for the EFW System.

Although the pressurizer has multiple level indications, the separate indications are selectable via a switch for display on a single display. Pressurizer level, however, can also be determined via the patch panel and the computer log. In addition, a second channel of pressurizer level indication.is available independent of the NNI.

Although the instruments identified in Table 3.5-2 are significant in diagnosing situations which could lead to inadequate core cooling, loss of any one of the instruments in Table 3.5-2 would not prevent continued, safe, reactor operation. Therefore, operation is justified for up to 7 days (48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months for pressurizer level). Alternate indications are available for Saturation Margin Monitors using hand calculations, the PORV/Safety Valve position monitors using discharge line thermocouple and Reactor Coolant Drain Tank indications, and for EFW flow using Ste~m Generator level and EFW Pump discharge pressure. Pressurizer level has two channels, one channel from NNI (2 D/P instrument strings through a single indicator) and one channel independent of the NNI. Operation with the above pressurizer level channels out of service is permitted for up to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

Alternate indication would be available through the plant computer.

\

\

i The operability of design basis accident monitoring instrumentation as identified in Table 3.5-3, ensures that sufficient information is available on selected plant parameters to monitor and assess the variables following an accident. (This capability is consistent with the recommendations of Regulatory Guide 1.97, "Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant Conditions During and Following an Accident," Rev. 3, May 1983.) These instruments will be maintained for that purpose.

3-40b Amendment No. 78, 100, 144,161,240,242

)>

3 TABLE 3.5-2 CD

s

a. ACCIDENT MONITORING INSTRUMENTS 3

CD

s z

~ FUNCTION INSTRUMENTS NUMBER OF CHANNELS MINIMUM NUMBER OF CHANNELS I

N

.i:,.

N 2

1 Saturation Margin Monitor Safety Valve Differential Pressure Monitor 2

1 per discharge line 1

1 per discharge line 3 PORV Position Monitor 2 1*

4 Emergency Feedwater Flow 2 per OTSG 1 per OTSG w 5

.& Pressurizer Level 2 0 1

(')

6 Backup lncore Thermocouple 4 thermocouples/core 2 thermocouples/core quadrant Display Channel quadrant

With the PORV Block Valve closed in accordance with Specification 3.1.12.4.a, the minimum number of channels is zero.

\

' ... .B~E 3.5-3 POST ACCIDENT MONITORING INSTRUMENTATION REQUIRED NUMBER MINIMUM NUMBER FUNCTION INSTRUMENTS OF CHANNELS OF CHANNELS

)> ACTION 3

en 1. High Range Noble Gas Effluent . ;

J Q. a. Condenser Vacuum Pump Exhaust (RM-.A'.5-Hi) 1 1 3 A en b. Condenser Vacuum Pump Exhaust (RM-G25) 1

-z

J 0

C. Auxiliary and Fuel Handling Building Exhaust (RM-AS-Hi) 1 1

1 A

A

d. Reactor Building Purge Exhaust (RM-A9-Hi)

e. Reactor Building Purge Exhaust (RM-G24) 1 1 A 0

-~ 1 1 A 0

_t

f. Main Steam Lines Radiation (RM-G26/RM-G27) 1 each OTSG 1

each OTSG A

z

2. Containment High Range Radiation 2 2 ~

i 3.

(RM-G22/G-23)

Containment Pressure A

,a N

Ow

4. Containment Water Level 2 1 B 0 I a. Containment Flood (LT-806/807) 2 F

.i:,.

0 a.. b. Containment Sump (LT-804/805) 1 0 1 B r

5. DELETED

C m

6.

7.

Wide R~nge Neutron Flux Reactor Cooh:1-nt System Cold Leg Water 2

2 1

1 A

A

'c 8.

Temperature (TE-959, 961; Tl-959A, 961 A)

Reactor Coolant System Hot Leg Water 0

Temperature (TE-958, 960; Tl-958A, 960A) 2 1 A 0

9. Reactor Coolant System Pressure 2 1 ~

~

A (PT-949, 963; Pl-949A, 963)

10. Steam Generator Pressure (PT-950, 951, 1180, 2/0TSG 1/0TSG 1184; Pl-950A, 951 A, 1180, 1184) A

11. Condensate Storage Tank Water Level (LT-1060, 2/Tank 1/Tank 1061, 1062, 1063; Ll-1060, 1061, 1062, 1063)

A

C COPY

TABLE 3.5-3 (Cont-inued)

ACTIONS A. With the number of OPERABLE channels less than required by the Minimum Channels OPERABLE requirements:

1. either restore the inoperable channel(s) to OPERABLE status within 7 days of the event, or

2. prepare and submit a Special Report within 30 days following the event outlining the action taken, the cause of the inoperability and the plans and schedule for restoring the system to OPERABLE status.

B. 1. With the number of OPERABLE accident monitoring instrumen-tation channels less than the Required Channels OPERABLE requirements, restore the inoperable channel(s) to OPERABLE status within 30 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

2. With the number of OPERABLE accident monitoring instrumen-tation channels less than the Minimum Channels OPERABLE requirements, restore the inoperable channel(s) to OPERABLE status within 7 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

C. Restore the inoperable sump level instrument to OPERABLE status prior to startup following the COLD SHUTDOWN subsequent to its inoperab1lity declaration. *

3-40e Amendment No. ,l,8CJ' ,166

COPY

{

__ ; 3.5.6 DELETED 3-40f Amendment No. J~~' JJ7, 182

J.5.7 REMOTE SHUTDOWN SYSTEi\'1 Applicability Applies to the operability requirements for the Remote Shutdown System Panel "B" Functions in Table 3.5-4 during STARTUP, POWER OPERATION AND HOT STANDBY.

Objectives To assure operability of the instrumentation and controls necessary to place and maintain the unit in HOT SHUTDOWN from a location other than the control room.

Specification The minimum number of functions identified in Table 3.5-4 shall be OPERABLE. With the number of functions less than the minimum required, restore the required function to OPERABLE status within 30 days or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in HOT SHUTDOWN within an additional 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

/

The Remote Shutdown System provides the control room operator with sufficient instrumentation and controls to place and maintain the unit in a safe shutdown condition from locations other than the control room. This capability is necessary to protect against the possibility that the control room becomes inaccessible. A safe shutdown condition is defined as HOT SHUTDOWN.

In the event that the control room becomes inaccessible, the operators can establish control at the remote shutdown panel and place and maintain the unit in HOT SHUTDOWN. Not all controls and necessary transfer switches are located at the remote shutdown panel. Some controls and transfer switches will have to be operated locally at the switchgear, motor control panels, or other local stations. The unit automatically reaches HOT SHUTDOWN following a unit shutdown and can be maintained safely in HOT SHUTDOWN for an exiended period of time.

3-40g Amendment No. 216

C

(

The OPERABILITY of the Remote Shutdown System control and instrumentation Functions ensures that there is sufficient infonnation available on selected unit parameters to place and maintain the unit in HOT SHUTDOWN should the control room become inaccessible.

The Remote Shutdown System is required to provide equipment at appropriate locations outside the control room with a capability to promptly shut down and maintain the unit in a safe condition in HOT SHUTDOWN.

The criteria governing the design and the specific system requirements of the Remote Shutdown System are located in IO CFR 50, Appendix A, GDC I 9.

The controls, instrumentation, and transfer switches are those required for: Reactor Coolant Inventory Control, Reactor Coolant System Pressure and Temperature Control, Decay Heat Removal, Reactivity Monitoring, OTSG Level and Pressure Control, Reactor Coolant Flow Control, and Electrical Power.

The Remote Shutdown System instruments and control circuits covered by this specification do not need to be energized to be considered OPERABLE. This specification is intended to ensure the Remote Shutdown System instruments and control circuits will be OPERABLE if unit conditions require that the Remote Shutdown System be placed in operation. The operability of components and equipment are detem1ined by their respective Technical Specification requirements. If a component required for safe shutdown is placed in its fail-safe condition, as permitted by Technical Specifications, then the safety function has been assured and the remote shutdown panel function is considered operable.

Entry into an applicable REACTOR OPERATING CONDITION while relying on the specification actions is allowed even though the specification actions may eventually require a unit shutdown. This is acceptable due to the low probability of an event requiring these instruments.

The conditions of the specification may be entered independently for each Function listed on Table 3 .5-4 and completion times of inoperable Functions v.-ill be tracked separately for each Function .

Amendment No. 216 3-40h

V

/

TABLE 3.5-4 (Sheet I of2)

REMOTE SHUTDOWN SYSTE~v! JNSTRU:V1ENTATION AND CONTROLS Function/Instrument Required Number or Control Parameter of Functions I. Reactor Coolant Coolant Temperature Inlet Temperature Coolant Pressure Pressurizer Level RC-Y-2 RC-Y-3

2. Emergency Feedwater Controls EFW A Flow Indicator EFW B Flow Indicator

/

OTSG A Level OTSG B Level EF-Y-30B EF-V-30D

3. OTSG "B" Pressure Control Outlet Pressure MS-Y-4B MS-V-8B MS-V-8A 3-40i Amendment No. 216

COPY

Function/Instrument TABLE J.:'i-4 (Sheet 2 of2)

Required Number or Control Parameter of Functions

4. Decay Heat Removal Cooler Outlet Temperature Pump Inlet Temperature Flow

5. Reactor Neutron Power Source Range Flux

6. Makeup Control and Status MU-P-IB MU-P-IC MU-P-3B MU-P-3C

/

MU-V-2A MU-Y-2B MU-V-8 MU-Y-14B MU-V-16C MU-V-16D MU-Y-18 MU-V-20.

MU-Y-32 Indicator MU-Y-37 DH-T-1 BWST Level Makeup Tank Level

7. Decay Heat Closed Cycle Cooling Water DC-P-1 B (Auxiliary "B" Panel)

8. Diesel Generator EG-Y-IB

- Amendment No. 216 3-40j

3.6 REACTOR BUILDING

- Applicability Applies to the CONTAINMENT INTEGRITY of the reactor building as specified below.

Objective To assure CONTAINMENT INTEGRITY.

Specification 3.6.1 Except as provided in Specifications 3.6.6, 3.6.8, and 3.6.12, CONTAINMENT INTEGRITY (Section 1.7) shall be maintained whenever all three of the following conditions exist:

a. Reactor coolant pressure is 300 psig or greater.

b. Reactor coolant temperature is 200 degrees For greater.

c. Nuclear fuel is in the core.

3.6.2 Except as provided in Specifications 3.6.6, 3.6.8, and 3.6.12, CONTAINMENT INTEGRITY shall be maintained when both the reactor coolant system is open to the containment atmosphere and a shutdown margin exists that is less than that for a refueling shutdown.

3.6.3 Positive reactivity insertions which would result in a reduction in shutdown margin to less than 1% delta k/k shall not be made by control rod motion or boron dilution unless CONTAINMENT INTEGRITY is being maintained.

3.6.4

The reactor shall not be critical when the reactor building internal pressure exceeds 2.0 psig or 1.0 psi vacuum.

3.6.5 Prior to criticality following refueling shutdown, a check shall be made to confirm that all manual Containment Isolation Valves (CIVs) which should be closed are closed and are conspicuously marked.

3.6.6 When CONTAINMENT INTEGRITY is required, if a CIV (other than a purge valve) is determined to be inoperable:

a. For lines isolable by two or more CIVs, the CIV(s)* required to isolate the penetration shall be verified to be OPERABLE. If the inoperable valve is not restored within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , at least one CIV* in the line will be closed or the reactor shall be brought to HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to the COLD SHUTDOWN condition within an additional 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

b. For lines isolable by one CIV, where the other barrier is a closed system, the line shall be isolated by at least one closed and de-activated automatic valve, closed.

manual valve, or blind flange within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or the reactor shall be brought to HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to the COLD SHUTDOWN condition within an additional 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

All CIVs required to isolate the penetration .

3-41 Amendment No. 87, +02, +00, +90, .:t-98, 240, 246 278 I

CONTROLLED COPY 3.6 REACTOR BUILDING (Continued)

3.6. 7 3.6.8 DELETED While CONTAINMENT INTEGRITY is required (see Specification 3.6.1 ), if a 48" reactor building purge valve is found to be inoperable perform either 3.6.8.1 or 3.6.8.2 below.

3.6.8.1 If inoperability is due to reasons other than excessive combined leakage, close the associated valve and within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months verify that the associated valve is OPERABLE.

Maintain the associated valve closed until the faulty valve can be declared OPERABLE. If neither purge valve in the penetration can be declared OPERABLE within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

3.6.8.2 If inoperabilify is due to excessive combined leakage (see Specification 6.8.5), within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months restore the leaking valve to OPERABILITY or perform either a orb below.

a. Manually close both associated reactor building isolation valves and meet the leakage criteria of Specification 6.8.5 and perform either (1) or (2) below:

(1) Restore the leaking valve to OPERABILITY within the following-72 hours.

\

.\

(2) Maintain both valves closed by administrative controls, verify both valves are closed at least once per 31 days and perform the interspace pressurization test in accordance with the Reactor Building Leakage Rate Testing Program. In order to accomplish repairs, one .containment purge valve may be opened for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months following successful completion of an interspace pressurization test.

b. Be in HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

3.6.9 Except as specified in 3.6.11 below, the Reactor Building purge isolation valves (AH-V-1A&D) shall be limited to less than 31 degrees and (AH-V-1B&C) shall be limited to less than 33 degrees open; by positive means, while purging is conducted.

3.6.10 During STARTUP, HOT STANDBY and POWER OPERATION:

a. Containment purging shall not be performed for temperature or humidity control.

b. Containment purging is permitted to reduce airborne activity in order to facilitate containment entry for the following reasons.

(1) Non-routine safety-related corrective maintenance.

(2) Non-routine safety-related surveillance.

3-41a Amendment No. S7, .:t-GS, +e7, +98, 20+, 246

r 3.6 REACTOR BUILDING {Continued)

(3) Perfonnance of Technical Specification required surveillances.

(4) Radiation Surveys.

(5) Engineering support of safety-related modifications for pre-outage planning.

(6) Purging prior to shutdown to prevent delaying of outage commencement (24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months prior to shutdown).

c. Containment purging is pennitted for Reactor Building pressure control.

d. To the extent practicable the above containment entries shall be scheduled to coincide, in order to minimize instances of purging.

3.6. l I When the reactor is in COLD. SHUTDOWN or REFUELING SHUTDOWN, continuous purging is pennitted with the Reactor Building purge isolation valves opened fully.

3.6.12 Personnel or emergency air locks:

a. At least one door in each of the personnel or emergency air locks shall be closed and sealed during personnel passage through these air locks.

b. One door of the personnel or emergency air lock may be open for maintenance, repair or modification provided the other door of the air lock is verified closed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , locked within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , and verified to be locked closed monthly.

Air lock doors in high radiation areas may be verified locked closed by administrative means.

c. Entry and exit is pennissible to perfonn repairs on the affected personnel or emergency air lock components. Wi~h both air locks inoperable due to inoperability of only one door in ~ch airlock, entry and exit is permissible for 7 days under administrative contro.s. With the personnel or emergency air lock door interlock mechanism inoperable, entry and exit is permissible under the control of a dedicated individual.

d. With one or more air locks inoperable for reasons other than "b" or "c" above, initiate action immediately to evaluate the overall containment leakage rate with respect to the requirements of Specification 6.8.5, verify a door is closed in the affected air lock within I hour, and restore the affected air lock(s) to operable status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or the reactor shall be brought to HOT SHU1DOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

- - Amendment 87, 108, 167, 198 201 3-4Ib

CONTROLLED C PY

_?-_'.-6-... REACTOR BUILDING (Continued)

.{>/' '-,\

\.BASES The Reactor Coolant System conditions of COLD SHUTDOWN assure that no steam will be formed and hence no pressure will build up in the containment if the Reactor Coolant System ruptures. The selected shutdown conditions are based on the type of activities that are being carried out and will preclude criticality in any occurrence.

A condition requiring integrity of containment exists whenever the Reactor Coolant System is open to the atmosphere and there is insufficient soluble poison in the reactor coolant to maintain the core one percent subcritical in the event all -control rods are withdrawn. The Reactor Building is designed for an internal pressure of 55 psig, and an external pressure 2.5 psi greater than the internal pressure.

The primary Containment Isolation Valves (CIVs) are identified in UFSAR Table 5.3-2.

Additional vent, drain, test and other manually operated valves which complete the containment boundary are identified in the containment integrity checklist. *For the purpose of this specification, check valves and relief valves identified in the containment integrity checklist are defined to be active valves.

The loss of redundant capability for containment isolation is limited for all penetrations after which the containment penetration must be isolated. Isolation of certain penetrations may require the closure of multiple CIVs due to piping branches.

1. When one of two CIVs in a line is inoperable, the capability to isolate the penetration using the other CIV in the line is promptly verified and at least one valve in the line must be closed within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or the plant must commence shut down.

2. For those CIVs where the second barrier is a closed system within the Reactor Building, there is no other CIV to isolate the penetration. If operability cannot be regained, the valve must be closed within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or the plant must commence shut down. An action time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is reasonable considering the relative stability of the closed system (hence, reliability) to act as a containment isolation boundary and the relative importance of supporting containment integrity.

The definition of Containment Integrity permits normally closed CIVs, except for the 48 inch purge valves, to be unisolated intermittently or manual control to be substituted for automatic control under administrative control. Administrative control includes the following considerations: (1) stationing an operator, who is in constant communication with the control room, at the valve controls, (2) instructing this operator to close these valves in an accident situation, and (3) assuring that environmental conditions will not preclude access to close the valves and that this action will prevent the release of radioactivity outside the containment (Reference 1). The dedicated individual can be responsible for closing more than one valve provided that the valves are in close vicinity and can be closed in a timely manner. Due to the size of the containment purge line penetration and the fact that those penetrations exhaust directly from the containment atmosphere to the environment, the containment penetrations containing these valves may not be opened under administrative control.

An analysis of the impact of purging on ECCS performance and an evaluation of the radiological consequences of a design basis accident while purging have been completed and

accepted by the NRC staff. Analysis has demonstrated that a purge isolation valve is capable Amendment No. 87, +00, +e-7, 4-98, ~ . 24-G, 246 3-41c

CONTROLLED COPY 3.6 REACTOR BUILDING {Continued)

~ '. _.., . ....

(sA-SES {Co~d)

} \

'*,, /

)

olclosing-agairlst the dynamic forces associated with a LOCA when the valve is limited to a nominal 30 degree open position.

Allowing purge operations during STARTUP, HOT STANDBY and POWER OPERATION.

(T.S. 3.6.10) is more beneficial than requiring a cooldown to COLD SHUTDOWN from the standpoint of (a) avoiding unnecessary thermal stress cycles on the reactor coolant system and its components and (b) reducing the potential for causing unnecessary challenges to the reactor trip and safeguards systems.

The hydrogen mixing is provided by the reactor building ventilation system to ensure adequate mixing of the containment atmosphere following a LOCA. This mixing action will prevent localized accumulations of hydrogen from exceeding the flammable limit.

Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of 10 CFR 50, Appendix J (Reference 2), and the Reactor Building Leakage Rate Testing Program. Each air lock door has been designed and is tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (OBA) in containment. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. '

Entry and exit is allowed to perform repairs on the affected air lock component. If the outer door is inoperable, then it may be easily accessed to repair. If the inner door is the one that is inoperable, however, then a short time exists when the containment boundary is not intact (during access through outer door). The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit the OPERABLE door must be immediately closed. If ALARA conditions permit, entry and exit should be via an OPERABLE air lock. With

'both air locks inoperable due to inoperability of one door in each of the two air locks, entry and exit is allowed for use of the air locks for 7 days under administrative controls. Containment entry may be required to perform Technical Specifications-(TS) Surveillance and Required Actions, as well as other activities on equipment inside containment that are required by TS or activities on equipment that support TS-required equipment. This is not intended to preclude performing other activities (i.e., non-TS-required activities) if the'containment was entered, using the inoperable air lock, to perform an allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize the containment during the short time that the OPERABLE door is expected to be open.

With one or more air locks inoperable for reasons other than those described in 3.6.12 "b" or "c," Section 3.6.12.d requires action to be immediately initiated to evaluate previous combined leakage rates using current air lock test results. An evaluation is acceptable since it is overly conservative to immediately declare the containment inoperable if both doors in an air lock have failed a seal test or the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), containment remains OPERABLE, yet only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months would otherwise be provided to restore the air lock to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.

3-41d Amendment No. +98, 2G+, 246

CONTROllED COPY 3.6 REACTOR BUILDING (Continued)

,/,,,,.

.-*---- '\

~ASES (Continued)

Section 3.6.12.d requires that one door in the affected containment air locks(s) must be verified to be closed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Additionally, the affected air lock(s) must be restored to OPERABLE status within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is considered reasonable for restoring an inoperable air lock to OPERABLE status assuming that at least one door is maintained closed in each affected air lock.

lffeferences

~..... ........ __

(1) NRC Generic Letter 91-08 (2) 10 CFR 50, Appendix J .

Amendment No. 246 3-41e

3.7 UNIT ELECTRIC POWER SYSTEM Applicability Applies to the availability of electrical power for operation of the unit auxiliaries.

Objective To define those conditions of electrical power availability necessary to ensure:

a. Safe unit operation

b. Continuous availability of engineered safeguards Specification 3.7.1 The reactor shall not be made critical unless all of the following requirements are satisfied:

a. All engineered safeguards buses, engineered safeguards switchgear, and engineered safeguards load shedding systems are operable.

b. One 7200 volt bus is energized.

c. Two 230 kV lines are in service.

re)>_,

,*--~.. ' ..

d. One 230 kV bus is in service.

1 * ~

e. Engineered safeguards diesel generators are operable and at least 25,000 gallo*ns of fuel oil are available in the *storage tank.

f. Station batteries are charged and in service. Two battery chargers per battery are in service.

3.7.2 The reactor shall not remain critical unless all of the following requirements are satisfied:

a. Offsite Sources:

(i.) Two 230 kV lines are in service to provide auxiliary power to Unit 1, except as specified in Specification 3.7.2e below.

(ii.) The voltage on the 230 kV grid is sufficient to power the safety related ES loads, except as specified in Specification 3.7.2.h below.

b. Both 230/4.16 kV unit auxiliary transformers shall be in operation except that within a period not to exceed eight hours in duration from and after the time one Unit 1 auxiliary transformer is made or found inoperable, two diesel generators shall be operable, and one of the operable diesel generator will be started and run continuously until both unit auxiliary transformers are in operation. This mode of operation may continue for a period not exceeding 30 days.

3-42 Amendment No. 188,212, 224

C. Both diesel generators shall be operable except that from the date that one of the diesel generators is made or found to be inoperable for any reason, reactor operation is permissible for the succeeding seven days provided that the redundant diesel generator is:

1. verified to be operable immediately;

2. within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , either:

a. determine the redundant diesel generator is not inoperable due to a common mode failure; or,

b. test redundant diesel generator in accordance with surveillance requirement 4.6.1.a.

In the event two diesel generators are inoperable, the unit shall be placed in HOT SHUTDOWN in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . If one diesel is not operable within an additional 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period the plant shall be placed in COLD SHUTDOWN within an additional 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter.

With one diesel generator inoperable, in addition to the above, verify that:

All required systems, subsystems, trains, components and devices that depend on the remaining OPERABLE diesel generator as a source of emergency power are also OPERABLE or follow specifications 3.0.1.

d. If one Unit Auxiliary Transformer is inoperable and a diesel generator becomes inoperable, the unit will be placed in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . If one of the above sources of power is not made operable within an additional 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months the unit shall be placed in COLD SHUTDOWN within an additional 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter.

e. If Unit 1 is separated from the system while carrying its own auxiliaries, or if only one 230 kV line is in service, continued reactor operation is permissible provided one emergency diesel generator shall be started and run continuously until two transmission lines are restored.

f. The engineered safeguards electrical bus, switchgear, load shedding, and automatic diesel start systems shall be operable except as provided in Specification 3.7.2c above and as required for testing.

g. One station battery may be removed from service for not more than eight hours.

h. If it is determined that a trip of the Unit 1 generator, in conjunction with LOCA loading, will result in a loss of offsite power to Engineered Safeguards buses, the plant shall begin a power reduction within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and be in HOT SHUTDOWN in an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , except as provided in Specification 3.7.2.e above.

3-43 Amendment No. 98, 188, 212, 224, 258 278

)

":;:i Bases The Unit Electric Power System is designed to provide a reliable source of power for balance of plant auxiliaries and a continuously available power supply for the engineered safeguards equipment. The availability of the various components of the Unit Electric Power System dictates the operating mode for the station.

Verification of emergency diesel generator and station battery operability normally consists of verifying that the surveillance is* current, and that other available information does not indicate inoperability.

It is recognized that while testing the redundant emergency diesel generator (EOG) in accordance with surveillance requirement 4.6.1.a, the EOG will not respond to an.

automatic initiation signal. In this situation, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months time clock will not be entered per the provisions of section 3.7.2.f. due to the low probability of an event occurring while the EOG is being tested.

Trip of TMl-1 could result in a change in the 230 kV system (Grid) voltage at the TMI substation. The predicted voltage following a loss of the unit is referred to as the Post-Contingency voltage for trip of TMl-1. The transmission system operator monitors 230 kV system conditions for Post Contingency voltages. If the Post-Contingency voltage is less than the value required to support safety related ES loads, the transmission system operator will notify the TMI Unit 1 control room. The required voltage setpoint values for dual or single auxiliary transformer operation are specified by degraded grid calculations.

The appropriate setpoint for the current plant condition(s) is provided to the Grid operator.

The required voltage setpoint is based on the Large Break LOCA loading which results in the greatest ES loads.

Upon receipt of a valid Post-Contingency voltage Alarm for Loss of TMl-1, TMI will implement the Low System (Grid) Voltage Procedure. An allowed.action time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months provides the transmission system operator time to take actions to reconfigure the 230 kV system for improved voltage support. The time allowed has been evaluated for the level of risk associated with the increased reliance on use of the onsite sources.

\,.!<'

( < '< 3-43a Amendment No. 488 , 224

3.8 FUEL LOADING AND REFUELING

', Applicability: Applies to fuel loading and refueling operations.

Objective: To assure that fuel loading and refueling operations are performed in a responsible manner.

Specification 3.8.1 DELETED 3.8.2 Core subcritical neutron flux shall be continuously monitored by at least two neutron flux monitors; each with continuous indication available, whenever core geometry is being changed. When core geometry is not being changed, at least one neutron flux monitor shall be in service.

3.8.3 At least one decay heat removal pump and cooler shall be operable.

3.8.4 During reactor vessel head removal and while loading and unloading fuel from the reactor, the boron concentration shall be maintained at not less than that required for refueling shutdown.

3.8.5 Direct communications between the *control room and the refueling personnel in the Reactor Building shall exist whenever changes in core geometry are taking place.

3.8.6 During the handling of irradiated fuel in the Reactor Building at least one door in each of the personnel and emergency air locks shall be capable of being closed.* The equipment hatch cover shall be in place with a minimum of four bolts securing the cover to the sealing surfaces.

NOTE----------------------------

The equipment hatch may be open if all of the following conditions are met:

1) The Reactor Building Equipment Hatch Missile Shield Barrier is capable of being closed within 45 minutes, *

2) A designated crew is available to close the Reactor Building Equipment Hatch Missile Shield Barrier, and

3) Reactor Building Purge Exhaust System is in service.

3.8.7 During the handling of irradiated fuel in the Reactor Building, each penetration providing direct access from the containment atmosphere to the outside atmosphere shall be either:

1. Closed by an isolation valve, blind flange, manual valve, or equivalent, or capable of being closed,* or

2. Be capable of being closed by an operable automatic containment purge and exhaust isolation valve.

Administrative controls shall ensure that the Reactor Building Purge Exhaust System is in service, appropriate personnel are aware that air lock doors and/or other penetrations are open, a specific individual(s) is designated and available to close the air lock doors and other penetrations as part of a required evacuation of containment. Any obstruction(s) {e.g., cable and hoses) that could prevent closure of an air lock door or other penetration will be capable of being quickly removed .

Amendment No. 27, 198, 236, 2§7, 260 3-44

3.8.8 If any of the above specified limiting conditions for fuel loading and refueling are not met, movement of fuel into the reactor core shall cease; action shall be initiated to correct the conditions so that the specified limits are met, and no operations which may increase the

reactivity of the core shall be made .

3.8.9 The reactor building purge isolation valves, and associated radiation monitors which initiate purge isolation, shall be tested and verified to be operable no more than 7 days prior to initial fuel movement in the reactor building.

3.8.10 Irradiated fuel shall not be removed from the reactor until the unit has been subcritical for at least 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

3.8.11 During the handling of irradiated fuel in the Reactor Building at least 23 feet of water shall be maintained above the level of the reactor pressure vessel flange, as determined by a shiftly check and a daily verification. If the water level is less than 23 feet above the reactor pressure vessel flange, place the fuel assembly(s) being handled into a safe position, then cease fuel handling until the water level has been restored to 23 feet or greater above the reactor pressure vessel flange.

Detailed written procedures will be available for use by refueling personnel. These procedures, the above specifications, and the design of the fuel handling equipment as described in Section 9.7 of the UFSAR incorporating built-in interlocks and safety features, provide assurance that no incident could occur during the refueling operations that would result in a hazard to public health and safety. If no change is being made in core geometry, one flux monitor is sufficient. This permits maintenance on the instrumentation. Continuous monitoring of neutron flux provides immediate indication of an unsafe condition. The decay heat removal pump is used to maintain a uniform boron concentration. The shutdown margin indicated in Specification 3.8.4 will keep the core subcritical, even with all control rods withdrawn from the core (Reference 1). The boron concentration will be sufficient to maintain the core k011

S 0.99 if all the control rods were removed from the core, however only a few control rods will be removed at any one time during fuel shuffling and replacement. The k011 with all rods in the core and with refueling boron concentration is approximately 0.9. Specification 3.8.5 allows the control room operator to inform the reactor building personnel of any impending unsafe condition detected from the main control board indicators during fuel movement.

Per Specification 3.8.6 and 3.8.7, the personnel and emergency air lock doors, and penetrations may be open during movement of irradiated fuel in the containment provided a minimum of one door in each of the air locks, and penetrations are capable of being closed in the event of a fuel handling accident, and the plant is in REFUELING SHUTDOWN or REFUELING OPERATION with at least 23 feet of water above the fuel seated within the reactor pressure vessel. The minimum water level specified is the basis for the accident analysis assumption of a decontamination factor of 200 for the release to the containment atmosphere from the postulated damaged fuel rods located on top of the fuel core seated in the reactor vessel. Should a fuel handling accident occur inside containment, a minimum of one door in each personnel and emergency air lock, and the open penetrations will be closed following an evacuation of containment. Administrative controls will be in place to assure closure of at least one door in each air lock, as well as other open containment penetrations, following a containment evacuation.

Specification 3.8.6 is modified by a NOTE:

NOTE - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

The equipment hatch may be open if all of the following conditions are met:

1) The Reactor Building Equipment Hatch Missile Shield Barrier is capable of being closed within 45 minutes,

2) A designated crew is available to close the Reactor Building Equipment Hatch Missile Shield Barrier, and

3) Reactor Building Purge Exhaust System is in service.

3-45 Amendment No. 167, 178, 2as, 246, 26Q, 267,260

CONTR llEDCOPY These restrictions include administrative controls to allow the opening of the reactor building equipment hatch during the handling of irradiated fuel in the Reactor Building provided that 1) The Reactor Building Equipment Hatch Missile Shield Barrier is capable of being closed within 45 minutes, 2) A designated crew is available to close the Reactor Building Equipment Hatch Missile Shield Barrier, and 3) Reactor Building Purge Exhaust System is in service. The Reactor Building Equipment Hatch Missile Shield Barrier includes steel plating on the bottom of the shield structure, which acts to restrict a release of post-accident fission products. The capability to close the reactor building missile shield barrier includes requirements that the barrier is capable of being closed and that any cables or hoses across the opening have quick disconnects to ensure the barrier is capable of being closed within 45 minutes. The 45-minute closure time for the reactor building missile shield barrier starts when the control room communicates the need to shut the Reactor Building Equipment Hatch Missile Shield Barrier. This 45-minute requirement is significantly less than the fuel handling accident analysis assumption that the reactor building remains open to the outside environment for a two-hour period subsequent to the accident. Placing reactor building purge exhaust in service will ensure any release from the reactor building will be monitored, and ensure continued air flow into the Reactor Building in the event of a fuel handling accident. The Reactor Building purge valve high radiation interlock will be bypassed to ensure continued air flow into the Reactor Building in the event of a Fuel Handling Accident.

The administrative controls will also include the responsibility to be able to communicate with the control room, and the responsibility to ensure that the reactor building missile shield barrier is capable of being closed in the event of a fuel handling accident. These administrative controls will ensure reactor building closure would be established in the event of a fuel handling accident inside containment.

Provisions for equivalent isolation methods in Technical Specification 3.8.7 include use of a material

/----._ (e.g. temporary sealant) that can provide a temporary, atmospheric pressure ventilation barrier for

other containment penetrations during fuel movements.

Specification 3.8.9 requires testing of the reactor building purge isolation system. This system consists of the four reactor building purge valves and the associated reactor building purge radiation monitor(s). The test verifies that the purge valves will automatically close when they receive initiation signals from the radiation detectors that monitor reactor building purge exhaust, and the valves remain open when the isolation system is bypassed. The test is performed no more than 7 days prior to the start of fuel movement in the reactor building to ensure that the monitors, purge valves, and associated interlocks are functioning prior to operations that could result in a fuel handling accident within the reactor building. The Fuel Handling Accident analysis assumes that the four purge valves remain open.

Specification 3.8.10 is required as the safety analysis for the fuel handling accident was based on the assumption that the reactor had been shutdown for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (Reference 2).

REFERENCES (1) UFSAR, Section 14.2.2.1 - "Fuel Handling Accident

(2) UFSAR, Section 14.2.2.1 (2) - "FHA Inside Containment

Amendment No. 2aG, 245, 257 3-45a

3.9 3.10 DELETED MISCELLANEOUS RADIOACTIVE MATERIALS SOURCES Applicability Applies to byproduct, source, and special nuclear radioactive material sources.

Objective To assure that leakage from byproduct, source, and special nuclear radioactive material sources does not exceed allowable limits.

Specification 3.10.1.1 The source leakage test performed pursuant to Specification 4.13 shall be capable of detecting the presence of 0.005 µCi of radioactive material on the test sample. If the test reveals the presence of 0.005 µCi or more of removable contamination, it shall immediately be withdrawn from use, decontaminated, and repaired, or be disposed of in accordance with Commission regulations.

Sealed sources are exempt from such leak tests when the source contains 100 µCi or less of beta and/or gamma emitting material or 5 µCi or less of alpha emitting material.

3.10.1.2 Bases A complete inventory of licensed radioactive materials in possession shall be maintained current at all times.

. The limitations on removable contamination for sources* requiring leak testing, including alpha emitters, are based on 10 CFR 70.39(c) limits for plutonium.

This limitation will ensure that leakage from byproduct, source, and special nuclear material sources will not exceed allowable intake values.

3-46 (Pages 3-47 to 3-54 deleted)

Amendment No. e4, .t29, 284 (3-31-81)

3.11 Handling of Irradiated Fuel Applicability Applies to the operation of the fuel handling building crane when within the

confines of Uijit 1 and there is any spent fuel in storage in the Unit 1 fuel handling building.

Objective To define the lift conditions and allowable areas of travel when loads to be lifted and transported with the fuel handling building crane are in excess of 15 tons or between 1.5 tons and 15 tons or consist of irradiated fuel elements.

Speci fica ti on 3.11.1 Spent fuel elements having less than 120 days for decay of their irradiated fuel shall not be loaded into a spent fuel transfer cask in the shipping cask area.

3.11.2 The key operated travel interloc~ system for automatically limiting the travel area of the fuel handling building crane shall be imposed whenever loads in excess of 15 tons are to be lifted and transported with the exception of fuel handling bridge maintenance.

3.11.3 The lowest surface of all loads in excess of 15 tons shall be administratively limited to an elevation one foot or less above the

' concrete surface at the nominal 348 ft-0 in. elevation in the fuel handling building.

3.11.4 Loads in excess of hook capacity shall not be lifted, except for load testing.

3.11.5 Following modifications or repairs to any of the load bearing members, the crane shall be subjected to a test lift of 125 percent of its rated load.

3.11.6

Administrative controls shall require the use of an approved procedure with an identified safe load path for loads in excess of 3,000 lbs. handled above the Spent Fuel Pool Operating Floor (348' elevation).

3.11.7 During transfer of the cask to and from the cask loading pit, the cask will be restricted to the transfer path shown in Figure 3. 11-1.

Administrative controls will be usea to ensure that all lateral movements of the cask are performed at slow bridge and trolley speeds. During this transfer the cask lifting yoke shall be oriented in the East-West direction.

Amendments No. J~. JJ, 103 3-55

co ,~JJED OOPY Bases This specification will limit activity releases to unrestricted areas resulting from damage to spent fuel stored in the spent fuel storage pools in the postulated event of the dropping of a heavy load from the fuel handling building crane. A Fuel Handling accident analysis was performed assuming that the cask and its entire contents of ten fuel assemblies are sufficiently damaged as a result of dropping the cask, to ~11ow the escape of all noble gases and iodine in the gap (Reference 1). This release was assumed to be directly to the atmosphere and to occur ihstantaneously. The site boundary doses resulting from this accident are 5.25 R whole body and 1.02 R to thyroid, and are within the limits specified in 10 CFR 100.

Specification 3.11.1 requires that spent fuel, having less than 120 days decay post-irradiation, not be loaded in a spent fuel transfer cask in order to ensure that the doses resulting from a highly improbable spent fuel transfer cask drop would be within those calculated above.

Specification 3.11.2 requires the key operated interlock system, which automatically limits the travel area of the fuel handling crane while it is lifting and transporting the spent fuel shipping cask, to be imposed whenever loads in excess of 15 tons are to be lifted and transported while there.is any spent fuel in storage in the spent fuel storage pools in Unit 1. This automatically ensures that these heavy loads travel in areas where, in the unlikely event of a load i drop accident, there would be no possibility of this event resulting in any damage to the spent fuel stored in the pools, any unacceptable structural* damage to the spent fuel pool structure, or damage to redundant trains of safety related components. The shipping cask area is designed to withstand the drop of the spent fuel shipping cask from the 349 ft-0 in. elevation without unacceptable damage to the spent fuel pool structure (Reference 2).

Specification 3.11.3 ensures that the lowest surface of any heavy 1oad never gets higher than one foot above the concrete surface of the 348 ft-0 in. elevation in the fuel handling building (nominal

-elevation 349 ft-0 in.) thereby keeping any impact force from an unlikely load drop accident within acceptable limits.

Specification 3.11.4 ensures that the proper capacity crane hook is used for lifting and transporting loads thus reducing the probability of a load drop accident.

Following modification or repairs, specification 3.11.5 confirms the load rating of the crane.

I ~eferences (1) UFSAR, Section 14.2.2.l - "Fuel Handling Accident" (2) UFSAR, Section 14.2.2.8 - "Fuel Cask Drop Accident" 3-56 Amendment No. 2C, 48, i01, 157

CONTROUEO OOPY

~pecification 3.11.6 imposes administrative limits on handling loads weighing in excess of 3000 lbs. to minimize the potential for heavy loads, if dropped, to impact irradiated fuel in the spent fuel pool, or to impact redundant safe shutdown equipment. The safe load path shall follow, to the extent practical, structural floor members, beams, etc., such that if the load is dropped, the structure is more likely to withstand the impact. Handling loads of less than 3000 lbs. without these restrictions is acceptable because the consequences of dropping loads in this weight range are comparable to those produced by the fuel handling accident considered in the FSAR and found acceptable.

Specification 3.11.7 in combination with 3.11.3 ensures the spent fuel cask is handled in a manner consistent with the load drop analysis (Reference 3).

(

Reference (3) GPU Evaluation of Heavy Load Handling Operations at TMI-1 February 21, 1984, as transmitted to the NRC in GPUN Letter No. 5211-84-2013.

3-56a Amendment Nos. 1(, is, !OS, 157

.,,..,_....,...,... z s

-~-----,

1

-0" - - -.... l'-0" J*-ou ____ *1'*'"

r.rYP)

_____ , _ _ _ _ l'-0" - - - - - - -

Cask Loading Pit

.. **-0 11 i

(

.rl'-0'"

6 11 CTYP) 2*-**

L------------...::S~O:.:UTH~::..W...:.:A:.aa.._-----------------

1.1:GZM>:

r*ow JlAILCAJl W#ff#A TJlAJISJ'D PATH

Amendment No. 109 Uo\lfVII P6Tff IA M!P [llOM 1 CEL 341 -0"1 riavaz J.ll-1 3-56b CASK LQADINC PIT

3.12

REACTOR BUILDING POL.AR CRANE Applicability Applies to the use of the reactor building polar crane hoists over the steam generator compartments and the fuel transfer canal, Objective To identify those conditions for which the operation of-the reactor building polar crane hoists are restricted.

Suecification 3,12.l The reactor building polar crane hoists *s-bali not be operated over the fuel transfer canal vhen 8II.Y" fuel assembly is being moved.

3.12.2 During the period when the reactor vessel head is removed and irradiated fuel is in the reactor building and fuel is not being moved, the reactor building.polar crane hoist shall be operated over the fuel transfer canal only vhere necess8.l7 and in accordance with approved operating procedures stating the purpose of such use, 3,12.3 During the period when the reactor coolant system is pressurized r above 300 psig, and is above 200 F, and fuel is in the core, the t react.or building polar crane hoists shall not be operated over

-*c' the ste*am generator compartments.

Bases Restriction of use of the reactor building polar crane hoists over the fuel transfer canal when the reactor vessel head is removed to pen:d.t those operations necessary for the fuel handling and core internals operations is to preclude the dropping of materials or equipment into the reactor vessel and possibly damaging the fuel to the extent that any escape of fission products would result.

Restriction of use of the reactor building polar crane hoists over the steam generator compartments during the time when steam could be formed from dropping a load on the steam generator or reactor coolant piping resulting in rupture of the system is required to protect against a loss-of-coolant accident.

Amendment No. 115 3-57

y 3.13 S£C0NDARY COOLANT SYSTEM ACTIVITY

Applicability Applies to the 11m1t1ng conditions for operation when reactor coolant system pressure is greater than 300 psfg or Tavg fs greater than 200°F.

Objective To limit the inventory of activity in the secondary system.

Specification J.13.l The specific activity of the secondary coolant system shall be

< 0.10 ~ Cf/gram DOSE EQUIVALENT I-131.

J.13.2 With the specific activity of the secondary coolant system > 0.10µ Cf/gram DOSE EQUIVALENT I-131, be in at least HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

Bases The 11mftatfons on secondary system specific activity ensure that the resultant off-site radiation dose will be limited to a small *fraction of 10 CFR Part 100 limits in the event of a steam line rupture. This dose includes the effects of a coincident 1.0 GPM primary-to-secondary tube leak in the steam generator of the affected steam line.

(

- Amendment No. 115 3-58

3.14 FLOOD 3.14.1 PERIODIC INSPECTION OF THE DIKES AROUND TMI Applicability Applies to inspection of the dikes surrounding the site.

Objective To specify the minimum frequency for inspection of the dikes and to define the flood stage after which the dikes will be inspected.

Specification 3.14.1.1 The dikes shall be inspected at the frequency specified in the Surveillance Frequency Control Program and after the river has returned to normal, following the condition defined below:

a. The level of the Susquehanna River exceeds flood stage; flood stage is defined as elevation 307 feet at the Susquehanna River Gage at Harrisburg.

Bases The earth dikes are compacted to provide a stable impervious embankment that protects the site from inundation during the design flood of 1,100,000 cfs.

The rip-rap, provided to protect the dikes from wave action and the flow of the river, continues downward into natural ground for a minimum depth of two feet to prevent undermining of the dike (References 1 and 2).

Periodic inspection, and inspection of the dikes and rip-rap after the river has returned to normal from flood stage, will assure proper maintenance of the dikes, thus assuring protection of the site during the design flood.

References (1) UFSAR, Section 2.6.5 - "Design of Hydraulic Facilities" (2) UFSAR, Figure 2.6 "Typical Dike Section" 3-59 Amendment No. 167,182, 274

3.14.2 FLOOD CONDITION FOR PLACING THE UNIT IN HOT STANDBY

-- App1icabi1ity Applies to the river stage for placing the unit in hot standby.

Objective To define the action taken in the event river elevation reaches 302 feet at the intake structure.

Specification 3.14.2.l If the river stage reaches elevation 302 feet at the River Water Intake Structure, corresponding to 1,000,000 cfs river flow, the unit wi11 be brought to the hot standby condition.

Bases The dikes provided protect the plant site during the design flood of 1,100,000 cfs. The design flood corresponds to an elevation of approximate1y 303 feet at the River Water Intake Structure (Reference 1). The dike elevation at the intake structure is 305 feet. The minimum freeboard is at the downstream end of the plant site where the dike elevation is 304 feet providing a freeboard of approximately one foot. Adequate freeboard is provided to protect the plant site from flooding due to wave action during the design flood (Reference 2).

P1acing the unit in hot standby when the river stage reaches 302 feet elevation provides an additional margin of conservatism by assuring that adequate freeboard exists during operation of the unit.

References (1) UFSAR, Figure 2.6 "Dike Freeboard - Design Flood" (2) UFSAR, Section 2.6.4 - "Flood Studies" 3-60 Amendment No. 157

3.15 AIR TREATMENT SYSTEMS

3.15.1 . EMERGENCY CONTROL ROOM AIR TREATMENT SYSTEM Applicability Applies to the emergency control room air treatment system and its associated filters and to the Control Room Envelope Boundary.

Note The Control Room Envelope (CRE) boundary may be opened intermittently under administraiive control.

Objective To specify minimum availability and efficiency for the emergency control room air treatment system and its associated filters.

Specifications 3.15.1.1 Except as specified in Specification 3.15.1.3 below, both emergency treatment systems, AH-E18A fan and associated filter AH-F3A and AH-E18B fan and associated filter AH-F3B shall be operable at all times, per the requirements of Specification 3.15.1.2 below; when containment integrity is required and when irradiated fuel handling operations are in progress.

3.15.1.2 a. The results of the in-place DOP and halogenated hydrocarbon tests at design flows on HEPA filters and charcoal absorber banks shall show< 0.05% DOP penetration and < 0.05% halogenated hydrocarbon penetration, except that the DOP test will be conducted with prefilters installed.

b. The results of laboratory carbon sample analysis shall show ~ 95% radioactive methyl iodide decontamination efficiency when tested in accordance with ASTM 03803-1989 at 30°C, 95% R.H.

c. The fans AH-E18A and B shall each be shown to operate within +/- 4000 CFM of design flow (40,000 CFM).

d. The Control Room Envelope boundary shall be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequences analyses for DBA's and that CRE occupants are protected from hazardous chemicals and smoke.

3.15.1.3 From and after the date that one control room air treatment system is made or found to be inoperable for reason other than 3.15. 1 .2d, reactor operation or irradiated fuel handling operations are permissible only during the succeeding 7 days .provided the redundant system is verified to be OPERABLE.

3 .15.1.4 From the date that both control room air treatment systems are made or found to be inoperable for a reason other than 3.15.1.2d, or if the inoperable system of 3.15.1.3 cannot be made operable in 7 days, irradiated fuel handling operations shall be terminated in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and reactor shutdown sha!! be initiated and the rnactor shaii be in COLD SHUTDOWN within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

, 3-61 A.rnendment No. 55, 67, 76, 149, 190, 226, 264

3.15.1.5 From the date that one or both control room air treatment systems are made or found to be inoperable due to an inoperable Control Room Envelope boundary, actions to .

implement mitigating actions shall be initiated immediately, verification that the mitigating actions ensure CRE occupant exposures to radiological, chemical, and smoke hazards will not exceed limits shall be performed within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , and the CRE boundary shall be restored to OPERABLE status within 90 days. Irradiated fuel handling operations shall be terminated immediateiy. if the CRE boundary cannot be made OPERABLE in 90 days, reactor shutdown shall be initiated and the reactor shall be in HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

Bases The emergency control room air treatment systems AH-E1 BA and 188 and their associated filters are two independent systems designed to filter the control room atmosphere for intake air and/or for recirculation during control room isolation conditions. Air is recirculated and filtered in the Control Room Envelope (CRE) and within a CRE boundary that limits the inleakage of unfiltered air. Ductwork, valves or dampers, doors, barriers, and instrumentation also form part of the systems. The control building is designed to be automatically placed in the recirculation mode upon an RM-A 1 high radiation alarm, air tunnel device actuation, ESAS actuation or station blackout condition. The emergency control room air treatment fan and filter AH-E1 BA or B and AH-F3A or B is designed to be manually started by the operator if a high radiation alarm from RM-A 1 is indicated.

Prefilters and high efficiency particulate absolute (HEPA) filters are installed before the charcoal absorbers to prevent clogging of the iodine adsorbers and remove particulate activity. The charcoal adsorbers are installed to reduce the potential intake of radioiodine to the control room.

If the efficiencies of the HEPA filters and charcoal adsorbers are as specified, the resulting doses will be less than the allowable levels stated in Criterion 19 of the General Design Criteria for Nuclear Power Plants, Appendix A to 10 CFR Part 50. Operation of the fans significantly different from the design flow will change the removal efficiency of the HEPA filters and charcoal adsorbers.

If one system is found to be inoperable, for reasons other than an inoperable control room envelope boundary, there is no immediate threat to the control room and reactor operation or refueling may continue for a limited period of time while repairs are being made. If the system cannot be repaired within 7 days, the reactor is shut down and brought to cold shutdown within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months and irradiated fuel handling operations are terminated within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

If both systems are found to be inoperable, for reasons other than an inoperable control room envelope boundary, reactor shutdown shall be initiated and the reactor will be brought to cold shutdown in 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months and irradiated fuel handling operations will be stopped within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

In-place testing for penetration and system bypass shall be performed in accordance with ANSI N510-1980. Charcoal samples shall be obtained in accordance with ANSI N509-1980. Any HEPA filters found defective shall be replaced with filters qualified according to Regulatory Guide 1.52, Revision 2. Any lot of charcoal. adsorber which fails the laboratory test criteria shall be replaced with new adsorbent qualified according to ASTM 03803-1989 .

Amendment No. 55 June 3, 19BO, 226. 264 3-62

Laboratory testing of charcoal samples will be performed in accordance with the methods prescribed by ASTM 03803-1989. Design basis accident analyses assume the carbon adsorber is 90% efficient in its total radioiodine removal. Therefore, using a Safety Factor of 2 (Ref. 3), the acceptance criteria for the laboratory test of carbon adsorber is set at greater than or equal to 95% [(100 - 90) / 2 = 5% penetration].

The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the in leakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (OBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.

In order for the Emergency Control Room Air Treatment trains to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.

The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release. This is because there are no credible hazardous chemical releases that exceed toxicity limits in the CRE (Ref. 4). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the CRE occupants to control the reactor either from the control room or from the remote shutdown panels (Ref. 1).

The control room envelope (CRE) boundary may be opened intermittently under administrative control. This only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.

If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of OBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days .

- 3-62a Amendment No. 55, 67, 76, 108, 149, 167, 226, 246, 264

During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazard$

of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to verify that in the event of a OBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of OBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable based on the low probability of a OBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a OBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.

In the event that irradiated fuel handling operations shall be terminated immediately, this does not preclude the movement of fuel to a safe position.

References (1) FSAR Section 9.8 (2) DELETED (3) NRC Generic Letter 99-02, dated June 3, 1999.

(4) FSAR Section 7.4.5

Amendment No. 66 dune a, 1980, 226, 264 3-62b

3.15.2 REACTOR BUILDING PURGE AIR TREATMENT SYSTEM Deleted

3-62c Amendment No. 66, 67, 76,108,149,167, 22e, 245, ,._*7 54

3.15.3 AUXILIARY AND FUEL HANDLING BUILDING AIR TREATMENT SYSTEM Deleted

3-62d Amendment No. 66, 76,122, 167, 1n, 216,248, 264

3.15.4 Fuel Handling Building ESF Air Treatment System

. Applicability Applies to the Fuel Handling Building (FHB) ESF Air Treatment System and its associated filters.

Obiective To specify minimum availability and efficiency for the FHB ESF Air Treatment System and its associated filters for irradiated fuel handling operations.

Specifications 3.15.4.1 Prior to fuel movement each refueling outage, two trains shall be operable. One train shall be operating continuously whenever TMl-1 irradiated fuel handling operations in the FHB are in progress.

a. With one train inoperable, irradiated fuel handling operations in the Fuel Handling Building may continue provided the redundant train is operating.

b. With both trains inoperable, handling of irradiated fuel in the Fuel Handling Building shall be suspended until such time that at least one train is operable and operating.

Any fuel assembly movement in progress may be completed .

3.15.4.2 A FHB ESF Air Treatment System train is operable when *its surveillance requirements are met and: *

a. The results of the in-place DOP and halogenated hydrocarbon tests at design flows

. on HEPA filters and carbon absorber banks shall show < 0.05% DOP penetration and < 0.05% halogenated hydrocarbon penetration.

b. The results of laboratory carbon sample analysis shall show~ 95% radioactive methyl iodide decontamination efficiency when tested in accordance with ASTM 03803-1989 at 30°C, 95% R.H.

c. The fans AH-E-137A and B shall each be shown to operate within+/- 10% of design flow (6,000 SCFM).

Bases Compliance with these specifications satisfies the condition of operation imposed by the Licensing Board as described in NRC's letter dated October 2, 1985, item 1.c.

The FHB ESF Air Treatment System contains, controls, mitigates, monitors and records radiation release resulting from a TMl-1 postulated spent fuel accident in the Fuel Handling Building as described in the FSAR. Offsite doses will be less than the 10 CFR 100 guidelines for accidents analyzed in Chapter 14 (Reference 1). *

Amendment No. 122, 157, 226 278 3-62e

COPY Bases {Continued)

Normal operation of the FHB ESF Air Treatment System will be during TMl-1 irradiated fuel movements in the Fuel Handling Building. The system includes air filtration and exhaust capacity to ensure that any radioactive release to atmosphere will be filtered and monitored.

Effluent radiation monitoring and sampling capability are provided.

The in-plant testing for penetration and system bypass shall be performed in accordance with ANSI N510-1980. Charcoal samples shall be obtained in accordance with ANSI N509-1980. Any HEPA filters found defective shall be replaced with filters qualified according to Regulatory Guide 1.52, Revision 2. Any lot of charcoal adsorber which fails*

the laboratory test criteria shall be replaced with new adsorbent qualified in accordance with ASTM 03803-1989 .

. Laborato~y testing of charcoal samples will be performed in accordance with the test methods prescribed by ASTM D3803-1989. Testing of charcoal at 95% relative humidity will be required until such time that a surveillance to demonstrate operability of the heaters is incorporated by amendment into the specification. The accident analysis in FSAR Chapter 14 (Reference 1) assumes the charcoal adsorber is 90% efficient in its total radioiodine removal. Therefore, using a Safety Factor of 2 (Ref. 2), the acceptance criteria for the laboratory test of charcoal adsorber is set at greater than or equal to 95%

[(100 - 90) / 2 = 5% penetration].

References (1) UFSAR, Section 14.2.2.1 - "Fuel Handling Accident" (2) NRC Generic Letter 99-02, dated June 3, 1999.

(

- Amendment No. 122, 157, 226 3-62f

OOPY.

,1:

t

3.16 SHOCK SLIPPRESSCRS (SNUBBERS)

LIMITING CONDITION FOR OPERATION 3.16.l Each saf~ty related snubber shall be OPERABLE.

APPLICABILITY:

Whenever the system protected*by the snubber is required to be OPERABLE.

ACTION:

With one or more snubbers inoperable, within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months replace or restore the inoperable snubber(s) to OPERABLE status and perform an engineering evaluaticr.

per Specification 4.17.1.g.2 on the attached* compon~nt or declare the attached syste~ inoperable and follow the appropriate action statement for that system.

BASES Snubbers are designed to prevent unrestrained pipe motion under dynamic loads as might occur during an earthquake or severe transient, while allowing normal thermal motion during startup and shutdown. The consequence of an inoperable snubber due to failure to activate (lockup) is an increase in the probability of structural damage to piping as a result of a seismic or other event initiating dynamic loads. The consequence of snubber inoperability due to failure to extend or retract is an increase in the probability of structural damage to piping as a result of thermal motion. It is therefore required that all snubbers required to protect the primary coolant system or any other safety system- or component which is required to be operable must also be ooerable. During plant conditions other than operating, snubbers on those systems that are required to be operable during that plant condition are also required to be operable *

A~endment No. i~, 106 3-63

C

INTENTIONALLY BLANK PAGES 3-64 through 3-79

Ar.iendment No.

105 11Zl, f;!, jl, 3-64

3 17 REACTOR BUILDING AIR TEMPERATURE

_ / Applicability This specification applies to the average air temperature of the primary containment during power operations.

Objective To assure that the temperatures assumed in the structural analysis of the Reactor Building are *not exceeded.

Specification 3 .17 .1 Primary containment average air temperature above Elev. 320 shall not exceed 130°F and average air temperature b~low Elev. 320 shall not exceed 120°F.

3.17.2

If, while the reactor is critical, the above stated temperature limits are exceeded, the average temperature shall be reduced to the above limits within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , or be in at least HOT STANDBY within the next six (6) hours and in COLD SHUTDOWN within the following thirty (30) hours.

3.17 .3 The primary containment average air temperature shall be calculated as follows:

(

a) b)

The average temperature above elevation 320 will be calculated by taking the arithmetic average of the temperatures from at least 13 locations above elevation 320. A list of locations is given below.

The average temperatures below elevation 320 will be calculated by taking the arithmetic average of the temperatures from at least 4 locations below Elev. 320 A list of locations is given below.

Location Location SE Wall Elev. 352 1 NE Wall Elev 314'*

NW Sec Shield Elev 352 1 S Wall Elev 3'i"4'1"*

NE Sec Shield Elev 352 1 NW Wall E1ev~4'*

E Wall Elev 382 1 ~ E Sec Shield E1ev 352 1 NE Sec Shield Elev 352 1 S Rx Wall Elev 321 1 NW Sec Shield Elev 352 1 NE Wall Elev 287'*

NE Sec Shield Elev 352 1 S Wall Elev 287 1

NW Sec Shield Elev 352 1 NW Wa11 Elev 287 1

NW Wall Elev 352 ~1 E Sec Shield Elev 352' E Wall Elev 400 1 NW Sec Shield Elev 287'*

S Sec Shield--rrev 352 1 NE Sec Shield Elev 364' NW Sec Shield Elev 352 1 N Sec Shield Elev 364 1 NOTE: (1)

Detectors located below elev 320 1 3-80

Amendment No. 4t, 75, 157

cot

~ases The specified temperature 1imits assure that the containment design temperature and pressure vill not be exceeded in the event of a design basis loss of coolant accident. The limits also assure the maintenance of acceptable ambient environmental conditions for safety-related components located inside the containment.

(

/

lunendmcnt No. 41 3-81 (5-24-78)

CO~OlliSD OOPY

(

PAGES 3-82 THROUGH 3-85

/

INTENTIONALLY BLIOOC

.Amendment No. 111 (5-21,_73)

CONl1ROllJ~==o COPY

/*

\

i THIS PAGE LEFT BLANK INTENTIONALLY 3-86 (Pages 3-87 through 3-94 deleted)

.:. Anendnent No. 32., 101 , 11.6

~um OOPY 3.19 CONTAINMENT SYSTEMS 3.19.1 CONTAINMENT STRUCTURAL INTEGRITY Applicability:

Applies to the structural integrity of the reactor building.

OBJECTIVE:

To verify containment structural integrity in accordance with the inservice tendon surveillance program for the reactor building prestressing system.

Specification 3.19.1.1 With the structural integrity of the containment not conforming to the inservice tendon surveillance program requirements of 4.4.2.1 for the tendon lift off forces, perform an engineering evaluation of the structural integrity of the containment to determine if COLD SHUTDOWN is required. The margins available in the containment design may be considered during the investigation. If the acceptability of the containment tendons cannot be established within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , restore the structural integrity to within the limits within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

(~

3.19.1.2 DELETED l

3-95 Amendment No. ,,, Ji,, 187

\,

. - 3.20 (DELETED)

/

J; :.*,

~ "

Arrendrrent No. ~ 139 3-95a

CONTROtJJED OOPY

,* 3.21 RADIOACTIVE EFFLUENT INSTRUMENTATION

/

Deleted 3.21.1 Radioactive Liquid Effluent Instrumentation Deleted 3.21.2 Radioactive Gaseous Process and Effluent Monitoring Instrumentation Deleted 3.22 RADIOACTIVE EFFLUENTS Deleted 3.22.1 Liquid Effluents Deleted 3.22.2 Gaseous Effluents Deleted 3.22.3 Solid Radioactive Waste Deleted e: /-****.

3.22.4 Total Dose Deleted 3.23 RADIOLOGICAL ENVIRONMENTAL MONITORING Deleted 3.23.I Monitoring Program Deleted 3.23 .2

Land Use Census Deleted 3.23.3 Interlaboratory Comparison Program Deleted 3-96 (3-97 thru 3-127 deleted)

Amendment No. 7i, 7J, JJ, JJ, 1J1, pi,-JJJ, JJi, 197.

i,,. iii, ii,. 117,* i,,. JJ7, 1,J, 171,

3.24 Reactor Vessel Water Level Indication Aoplicabili ty Applies to the operability requirements for the Reactor Vessel Water Level Indication when the reactor is critical.

Objectives To assure operability of the Reactor Vessel Water Level instrumentation which may be useful in diagnosing situations which could represent or lead to inadequate core cooling.

Specification Two channels of the Reactor Vessel Water Level Instrumentation System shall be OPERABLE.

If one channel becomes INOPERABLE that channel shall be returned to OPERABLE within 30 days. If the channel is not restored within 30 days, within 14 days, submit a special report to the NRC providing the details of the inoperability, to include cause, action being taken and projected date for return to OPERABLE status.

With no channels OPERABLE, one channel shall be restored to OPERABLE status within 7 days. If at least one channel is not restored within 7 days, within 14 days, submit a special report to the NRC providing the details of the inoperability, to include cause, action being taken and projected date for return to OPERABLE status.

Bases The Reactor Vessel Water Level Indication (Reference 1) provides indication of the trend in water inventory in the hot legs and reactor vessel during the approach to inadequate core cooling (ICC). In this manner additional information may be available to the operator to diagnose the approach of ICC and to assess the adequacy of responses taken to restore core cooling.

Each Reactor Vessel Water Level channel is comprised of a hot leg level indication and a reactor vessel level indication.

The system is required to be operable (as defined previously) when the plant is critical.

The system is an information system to aid the operator during the approach to inadequate core cooling. There is not regulatory limit for this system.

Inoperability of the system removes the availability of an information system. Other useful instrumentation for inadequate core cooling will be available. The Subcooling Margin Indication System is relied upon to determine subcooling margin when the reactor coolant pumps are operating or when natural circulation can be verified. When natural or forced circulation cannot be verified, the margin to saturation is determined by manual calculation, based on reactor coolant temperature (incore thermocouples) and pressure indications available in the control room and steam tables. See Tech. Spec. 3.5.5 .

3-128 Amendment No. 147, 157, -l--9+/-, 254

i *.

The system is not a required system to mitigate evaluated accidents. It may be useful to have the system operable but there will be no adverse impact if it is not operable.

The LCO action statement provides the level of emphasis required for an information system.

The Reactor Vessel Water Level is a Regulatory Guide 1.97 Category 1 variable.

Reference (1) UFSAR, Update Section 7.3.2.2{c)10(d) - "Reactor Coolant Inventory Trending System".

(2) USNRC Regulatory Guide 1.97.

3-129 Amendment No. 147, 157, 191, 251

SECTION 4.0 SURVEILLANCE STANDARDS

4. SURVEILLANCE STANDARDS

4.0.1 During Reactor Operational Conditions for which a Limiting Condition for Operation (LCO} does not require a system/component to be operable, the associated surveillance requirements do not have to be performed. Prior to declaring a system/

component operable, the associated surveillance requirement must be current.

Failure to perform a surveillance within the specified Frequency shall be failure to meet the LCO.except as provided in_4.0.2.

4.0.2 If it is discovered that a surveillance was not performed within its specified frequency, then compliance with the requirement to declare the LCO not met may be delayed, from the time of discovery, up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or up to the limit of the specified frequency, whichever is greater. This delay period is permitted to allow performance of the Surveillance. The delay period is only applicable when there is a reasonable expectation the surveillance will be met when performed. A risk evaluation shall be performed for any surveillance delayed greater than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and the risk impact shall be managed.

If the surveillance is not performed within the delay period, the LCO must immediately be declared not met, and the applicable condition(s} must be entered.

When the surveillance is performed within the delay period and the surveillance is not met, the LCO must immediately be declared not met, and the applicable condition(s}

must be entered.

Bases

SR 4.0.1 establishes the requirement that SRs must be met during the REACTOR OPERATING CONDITIONS or other specified conditions in the SRs for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This specification is to ensure that surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a surveillance within the specified frequency, in accordance with definition 1.25, constitutes a failure to meet an LCO.

Surveillances may be performed by means of any series of sequential, overlapping, or total steps provided the entire Surveillance is performed within the specified frequency.

Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when: *

a. The system or components are known to be inoperable, although still meeting the SRs or

b. The requirements of the Surveillance(s} are known to be not met between required Surveillance performances.

Surveillances do not have to be performed when the unit is in a REACTOR OPERATING CONDITION or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. Unplanned events may satisfy the requirements (including applicable acceptance criteria} for a given SR. In this case, the unplanned event may be credited as fulfilling the performance of the SR. This allowance includes those SRs whose performance is normally precluded in a given REACTOR OPERATING CONDITION or other specified condition .

Amendment No. 46, 99,100,124,138, 181, 2W, 292 4-1

Surveillances, including surveillances invoked by LCO required actions, do not have to be performed on inoperable equipment because the actions define the remedial measures that apply. Surveillances have to be met and performed in accordance with the specified frequency, prior to returning equipment to OPERABLE status.

Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable surveillances are not failed and their most recent performance is in accordance with the specified frequency. Post maintenance testing may not be possible in the current REACTOR OPERATING CONDITION or other specified conditions in the SRs due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a REACTOR OPERATING CONDITION or other specified condition where other necessary post maintenance tests can be completed.

Some examples of this process are:

a. Emergency feedwater (EFW) pump maintenance during refueling that requires testing at steam pressures greater than 750 psi. However, if other appropriate testing is satisfactorily completed, the EFW System can be considered OPERABLE. This allows startup and other necessary testing to proceed until the plant reaches the steam pressure required to perform the EFW pump testing.

b. High pressure injection (HPI) maintenance during shutdown that requires system

functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with HPI considered OPERABLE. This allows operation to reach the specified pressure to complete the necessary post maintenance testing.

SR 4.0.2 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a surveillance has not been performed within the specified frequency. A delay period of up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or up to the limit of the specified frequency, whichever is greater, applies from the point in time that it is discovered that the required surveillance has not been performed in accordance with Surveillance Standard 4.0.2 and not at the time that the specified frequency was not met.

The delay period provides an adequate time to perform surveillances that have been missed. This delay period permits the performance of a surveillance before complying with required actions or other remedial measures that might preclude performance of the surveillance.

The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the surveillance, the safety significance of the delay in completing the required surveillance, and the recognition that the most probable result of any particular surveillance being performed is the verification of conformance with the requirements .

Amendment No. 46, 99, 100, 124, 138,181,256,292 4-1a

Bases (Contd.}

When a surveillance with a frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering power operation after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, Surveillance Standard 4.0.2 allows for the full delay period of up to the specified frequency to perform the surveillance. However, since there is not a time interval specified, the missed surveillance should be performed at the first reasonable opportunity. When a Section 6.8, "Procedures and Programs," specification states that the provisions of TS 4.02 are applicable, a 25% extension of the testing interval, whether stated in the specification or incorporated by reference, is permitted.

Surveillance Standard 4.0.2 provides a time limit for, and allowances for the performance of, surveillances that become applicable as a consequence of operating condition changes imposed by required LCO actions.

SR 4.0.2 is only applicable if there is a reasonable expectation the associated equipment is OPERABLE or that variables are within limits, and it is expected that the Surveillance will be met when performed. Many factors should be considered, such as the period of time since the Surveillance was last performed, or whether the Surveillance, or a portion thereof, has ever been performed, and any other indications, tests, or activities that might support the expectation that the Surveillance will be met when performed. An example of the use of SR 4.0.2 would be a relay contact that was not tested as required in accordance with a particular SR, but previous successful performances of the SR included the relay contact; the adjacent, physically connected relay contacts were tested during the SR performance; the subject relay contact has been tested by another SR; or historical operation of the subject relay contact has been successful. It is not sufficient to infer the behavior of the associated equipment from the a

performance of similar equipment. The rigor of determining whether there is reasonable expectation a Surveillance will be met when performed should increase based on the length of time since the last performance of the Surveillance. If the Surveillance has been performed recently, a review of the Surveillance history and equipment performance may be sufficient to support a reasonable expectation that the Surveillance will be met when performed. For Surveillances that have not been performed for a long period or that have never been performed, a rigorous evaluation based on objective evidence should provide a high degree of confidence that the equipment is OPERABLE. The evaluation should be documented in sufficient detail to allow a knowledgeable individual to understand the basis for the determination.

Failure to comply with specified surveillance frequencies is expected to be an infrequent occurrence. Use of the delay period established by Surveillance Standard 4.0.2 is a flexibility which is not intended to be used repeatedly to extend surveillance intervals. While up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or the limit of the specified frequency is provided to perform the missed surveillance, it is expected that the missed surveillance will be performed at the first reasonable opportunity.

The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the surveillance as well as any plant configuration changes required or shutting the plant down to perform the surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the surveillance. This risk impact should be managed through the program

Amendment No. 181, 256, 2QO, 292 4-1b

Bases (Contd.)

in place to implement 10 CFR 50.65 (a)(4) and its implementation guidance, NRG Regulatory Guide 1.182, 'Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants'. This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed surveillances will be placed in the licensee's Corrective Action Program.

If a surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the completion times of the required actions for the applicable LCO conditions begin immediately upon expiration of the delay period. If a surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the completion times of the required actions for the applicable LCO conditions begin immediately upon failure of the surveillance.

Completion of the surveillance within the delay period allowed by this specification, or within the completion time of the actions, restores compliance .

Amendment No. 181, 256, 290, 292 4-1c

4. 1 OPERATIONAL SAFETY REVIEW Applicability

Applies to items directly related to safety limits and lim'iting conditions for operation.

Objective To specify t_he minimum frequency and type of surveillance to be applied to unit equipment and conditions.

Specification 4.1.1 The type of surveillance required for reactor protection system, engineered safety feature protection system, and heat sink protection system instrumentation when the reactor is critical shall be as stated in Table 4.1-1. The frequency of surveillance required for the instrumentation shown in Table 4.1-1 is specified in the Surveillance Frequency Control Program unless otherwise noted in Table 4.1-1.

4.1.2 Equipment and sampling test shall be performed as detailed in Tables 4.1-2, 4.1-3, and 4.1-5 at the frequencies specified in the Surveillance Frequency Control Program unless otherwise noted in Tables 4.1-2, 4.1-3, and 4.1-5.

4.1 .3 Each post-accident monitoring instrumentation channel shall be demonstrated OPERABLE by the performance of the check, test and calibration at the frequencies specified in the Surveillance Frequency Control Program unless otherwise noted in Table 4.1-4 .

4.1.4 Each remote shutdown system function shown in Table 3.5-4 shall be demonstrated OPERABLE by the performance of the following check, test, and calibration at the frequencies specified in the Surveillance Frequency Control Program:

a) Perform CHANNEL CHECK for each required instrumentation channel that is normally energized.

b) Verify each required control circuit and transfer switch is capable of performing the intended function.

c) Perform CHANNEL CALIBRATION for each required instrumentation channel (excludes source range flux).

Bases Check Failures such as blown instrument fuses, defective indicators, or faulted amplifiers which result in "upscale" or "downscale" indication can be easily recognized by simple observation of the functioning of an instrument or system. Furthermore, such failures are, in many cases, revealed by alarm or annunciator action. Comparison of output and/or state of independent channels measuring the same variable supplements this type of built-in surveillance. The acceptance criteria for the daily check of the Makeup Tank pressure instrument will be maintained within the error used to develop the plant operating limit. Based on experience in operation of both conventional and nuclear systems, when the unit is in operation, the minimum checking frequency stated in the Surveillance Frequency Control Program is deemed adequate for reactor system instrumentation.

4-2 Amendment No. 78,123,138,156, 167,158,181,216, 2213, 227,274

Bases (Cont'd)

The 600 ppmb limit in Item 4, Table 4.1-3 is used to meet the requirements of Section 5.4. Under other circumstances the minimum acceptable boron concentration would have been zero ppmb.

Calibration Calibration shall be performed to assure the presentation and acquisition of accurate information.

The nuclear flux (power range) channels amplifiers shall be checked at the frequency specified in the Survei_llance Frequency Control Program against a heat balance standard and calibrated if necessary. The frequency of heat balance checks will assure that the diffe*rence*between the out-of-core instrumentation and the heat balance remains less than 4%.

Channels subject only to "drift" errors induced within the instrumentation itself can tolerate longer intervals between calibrations. Process system instrumentation errors induced by drift can be expected to remain within acceptance tolerances if recalibration is performed at the frequency specified in the Surveillance Frequency Control Program_.

Substantial calibration shifts within a channel (essentially a channel failure) will be revealed during routine checking and testing procedures.

Thus, minimum calibration frequencies set forth* in the Surveillance Frequency Control Program are considered acceptable.

Testing On-line testing of reactor protection channels is required at the frequency specified in the Surveillance Frequency Control Program on a rotational basis. The rotation scheme is designed to reduce the probability of an undetected failure existing within the system and to minimize the likelihood of the same systematic test errors being introduced into each redundant channel (Reference 1).

Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

Upon detection of a failure that prevents trip action in a channel, the instrumentation associated with the protection parameter failure will be tested in the remaining channels. If actuation of a safety channel occurs, assurance will be required that actuation was within the limiting safety system setting.

The protection channels coincidence logic, the control rod drive trip breakers and the regulating control rod power SCRs electronic trips, are trip tested at the frequency specified in the Surveillance Frequency Control Program. The trip test checks all logic combinations and is to be performed on a rotational basis.

Discovery of a failure that prevents trip action requires the testing of the instrumentation associated with the protection parameter failure in the remaining channels.

For purposes of surveillance, reactor trip on loss of feedwater and reactor trip on turbine trip are considered reactor protection system channels.

4-2a Amendment No. 78,167,181,200,216,266,274

Bases (Cont'd)

The equipment testing and system sampling frequencies specified in the Surveillance Frequency Control Program are considered adequate to maintain the equipment and systems in a safe operational status.

The primary to secondary leakage surveillance in TS Table 4.1-2, Item 12, verifies that primary to secondary leakage is less than or equal to 150 gallons per day through any one (1) SG.

Satisfying the primary to secondary leakage limit ensures that the operational leakage performance criterion in the Steam Generator Program is met. If this surveillance is not met, compliance with TS 3.1.1.2, "Steam Generator (SG) Tube Integrity," and TS 3.1.6.3, should be evaluated. The 150 gallons per day limit is measured at room temperature as described in Reference 5. The operational leakage rate limit applies to leakage through any one SG. If it is not practical to assign the leakage to an individual SG, all the primary to secondary leakage should be conservatively assumed to be from one SG.

The TS Table 4.1-2 primary to secondary leakage surveillance is modified by a Note, which states that the initial surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after establishment of steady state operation.

The TS Table 4.1-2 primary to secondary leakage surveillance frequency specified in the Surveillance Frequency Control Program is a reasonable interval to trend primary to secondary leakage and recognizes the importance of early leakage detection in the prevention of accidents. The primary to secondary leakage is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRI guidelines (Ref. 5) .

The surveillance test procedures for the Variable Low Pressure Trip Setpoint do not compare the as-found Trip Setpoint (TSP) to the previous surveillance test as-left TSP. Basing operability determinations for the as-found TSP on the Nominal Setpoint (NSP) is acceptable because:

1. The NSP as-left tolerance specified in the surveillance test procedures is less than or equal to the calculated NSP as-left tolerance.

2. The NSP as-left tolerance is not included in the Total Loop Uncertainty (TLU) calculation. This is acceptable because the NSP as-left tolerance specified in the surveillance test procedures is less than half of the calculated NSP as-left tolerance.

This prevents masking of excessive drift from one side of the tolerance band to the other.

3. The pre-defined NSP as-found tolerance is based on the square root of the sum of the square of the instrument accuracy, M&TE accuracy and drift. The NSP as-left tolerance is not included in this calculation.

Credible uncertainties for the Variable Low Pressure Trip Setpoint include instrument uncertainties during normal operation including drift and measurement and test equipment uncertainties. In no case shall the pre-defined as-found acceptance criteria band overlap the Allowable Value. If one end of the pre-defined as-found acceptance criteria band is truncated due to its proximity to the Allowable Value, this does not affect the other end of the pre-defined as-found acceptance criteria band. If equipment is replaced, such that the previous as-left value is not applicable to the current configuration, the as-found acceptance criteria band is not applicable to calibration activities performed immediately following the equipment replacement.

4-2b Amendment No. 181,225,255, ¢61, 262,271,274

Bases (Cont'd)

The TSP is stored in wire mesh baskets placed inside the containment at the 281 ft elevation.

Any quantity of TSP between 18,815 lb and 28,840 lb. will result in a pH in the desired range.

If it is discovered that the TSP in the containment building is not within limits, action must be taken to restore the TSP to within limits. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed for restoring the TSP within limits, where possible, because 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is the same time allowed for restoration of other ECCS components.

Surveillance Testing Periodic determination of the mass of TSP in containment must be performed due to the possibility of leaking valves and components in the containment building that could cause dissolution of the TSP during normal operation. The surveillance is required to determine that ~

18,815 lbs ands 28,840 lbs are contained in the TSP baskets. This requirement ensures that there is an adequate mass of TSP to adjust the pH of the post LOCA sump solution to a value ~

7 .3 and s 8.0. The periodic verification is required at the frequency specified in the Surveillance Frequency Control Program.

Periodic testing is performed to ensure the solubility and buffering ability of the TSP after exposure to the containment environment. Satisfactory completion of this test assures that the TSP in the baskets is "active." Adequate solubility is verified by submerging a representative sample, taken via a sample thief or similar instrument, of TSP from one of the baskets in containment in un-agitated borated water heated to a temperature representing post-LOCA

conditions; the TSP must completely dissolve within a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months period. The test time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is to allow time for the dissolved TSP to naturally diffuse through the un-agitated test solution.

Agitation of the test solution during the solubility verification is prohibited, since an adequate standard for the agitation intensity (other than no agitation) cannot be specified. The agitation due to flow and turbulence in the containment sump during recirculation would significantly decrease the time required for the TSP to dissolve. Adequate buffering capability is verified by a measured pH of the sample solution, following the solubility verification, between7.3 and 8.0.

The sample is cooled and thoroughly mixed prior to measuring pH. The quantity of the TSP sample, and quantity and boron concentration of the water are chosen to be representative of post-LOCA conditions.

REFERENCE (1) UFSAR, Section 7.1.2.3(d) - "Periodic Testing and Reliability" (2) NRC SER for BAW-10167A, Supplement 1, December 5, 1988.

(3) BAW-10167, May 1986.

(4) BAW-10167A, Supplement 3, February 1998.

(5) EPRl,."Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."

Amendment No. 261, 263, 274 4-2d

l /-\oLE 4.1-1 INSTRUMENT SURVEILLANCE REQUIREMENTS

)>

3 Cl)

a. CHANNEL DESCRIPTION CHECK{c) TEST(c) CALIBRATE(c) REMARKS 3

-z Cl)

1. Protection Channel NA NA p Coincidence Logic

2. Control Rod Drive Trip NA NA (1) Includes independent testing of shunt Breaker trip and undervoltage trip features.

3. Power Range Amplifier (1) NA (2) (1) When reactor power is greater than 15%.

(2) When above 15% reactor power run a heat balance check at the frequency specified in the Surveillance Frequency Control Program. Heat balance calibration shall be performed whenever heat balance exceeds indicated neutron power by more than two percent.

4. Power Range Channel (1 )(2) (1) When reactor power is greater than 60% verify imbalance using incore instrumentation.

~

. I w (2) When above 15% reactor power calculate axial offset upper I\)

~

.i:.

and lower chambers after each startup if not done within the previous seven days.

5. Intermediate Range Channel (1) NA (1) When in service.

6. Source Range Channel , (1) NA (1) When in service.

7. Reactor Coolant Temperature Channel

)>

TABLE 4.1-1 (Continued) 3 (1)

, CHANNEL DESCRIPTION CHECK(c) TEST(c) CALlBRATE(c) REMARKS a.

3

8. High Reactor Coolant

-z (1)

Pressure Channel p

9. Low Reactor Coolant Pressure Channel

10. Flux-Reactor Coolant Flow Comparator

11. Reactor Coolant Pressure-Temperature See Notes (a) and (b).

Comparator

12. Pump Flux Comparator

13. High Reactor Building Pressure Channel

+:-

J:. 14. High Pressure Injection NA NA Logic Channels

15. High Pressure Injection N

....., Analog Channels

+'a

a. Reactor Coolant (1) (1) When reactor coolant system is pressurized Pressure Channel above 300 psig or Tave is greater than 200°F

16. Low Pressure Injection NA NA Logic Channel

17. Low Pressure Injection Analog Channels

a. Reactor Coolant (1) (1) When reactor coolant system is pressurized Pressure Channel above 300 psig or Tave is greater than 200°F

18. Reactor Building Emergency NA NA Cooling and lsolcttion System Logic Channel

TABLE 4.1-1 (Continued)

CHANNEL DESCRIPTION CHECK(c) TEST(c) CALIBRATE(c) REMARKS

)> 19. Reactor Building Emergency 3 Cooling and Isolation CD

, System Analog Channels a.

3

-z CD a. Reactor Building ( 1)

, (1) (1) When CONTAINMENT INTEGRITY is 4 psig Channels required.

~ b. RCS Pressure 1600 psig (1) (1) NA ( 1) When RCS Pressure > 1800 psig.

C. Deleted

d. Reactor Bldg. 30 psi (1) (1) (1) When CONTAINMENT INTEGRITY is pressure switches required.

e. Reactor Bldg. Purge (1) (1) (1) When CONTAINMENT INTEGRITY is Line High Radiation required.

(AH-V-1A/D)

f. Line Break Isolation (1) (1) (1) When CONTAINMENT INTEGRITY is Signal (ICCW & NSCCW) required.

20. Reactor Building Spray NA NA System Logic Channel

.p.

. I C11 21. Reactor Building Spray NA 30 psig pressure switches

22. Pressurizer Temperature NA Channels I\) 23. Control Rod Absolute Position (1) NA (1) Check with Relative Position Indicator OJ

24. Control Rod Relative Position (1) NA (1) Check with Absolute Position Indicator

25. Core Flooding Tanks

a. Pressure Channels NA NA

b. Level Channels NA NA I

26. Pressurizer Level Channels NA

TABLE 4.1-1 (Continued)

~~ (I)

J NO. CHANNEL DESCRIPTION CHECK(c) TEST(c) CALIBRATE(c) REMARKS

"-I 3

.j:::, (I)

-z 0

J 27. Makeup Tank Instrument Channels:

a. Level (1) NA (1) When Makeup and Punfication System is

~*

in operation.

b. Pressure ( 1) NA

28. Radiation Monitoring Systems*

a. DELETED (1) Using the installed check source when background is less than twice the expected

b. DELETED increase in cpm which would result from the check source alone. Background readings

c. DELETED greater than this value are sufficient in themselves to show that the monitor is

d. RM-A2P (AB Atmosphere particulate) (1)(4) (4) (4) functioning ..

e. RM-A21 (RB Atmosphere iodine) (1 )(4) (4) (4) (2) DELETED

f. RM-A2G (RB Atmosphere gas) (1 )(4) (4) (4) (3) DELETED (4) RM-A2 operability requirements are given in T.S. 3.1.6.8

29. High and Low Pressure NIA NIA Injection Systems:

Flow Channels

Includes only monitors indicated under this item. Other T.S. required radiation monitors are included in specifications 3.5.5.2, 4.1.3, Table3.5-1 item C.3.f, andTable4.1-1 item 19e.

TABLE 4.1-1 (Continued) l> CHANNEL DESCRIPTION CHECK(c) TEST(c} CALIBRATE(c} REMARKS 3

1)

s 30. Borated Water Storage NA i Tank Level Indicator 3

t>

...::s 31. DELETED z

n 32. DELETED

~

33. Containment Temperature NA NA i,J 34. lncore Neutron Detectors (1) NA NA (1) Check functioning; including functioning of

,.J computer readout or recorder readout u when reactor power is greater than n

.) 15% .

.)

.J "U DJ I.Q 35. Emergency Plant Radiation (1) NA (1) Battery Check.

(1) r:,,. ~

I Instruments 0)

36. (DELETED)

37. Reactor Building Sump NA NA Level

TABLE 4.1-1 (Continued) l>

3 CHANNEL DESCRIPTION CHECK(c) TEST(c} CALIBRATE(c) REMARKS

ll

]

i..

3 38. OTSG Full Range Level NA

ll

-z

]

39. Turbine Overspeed Trip NA NA

40. Deleted

41. Deleted

42. Diesel Generator NA NA Protective Relaying

43. 4 KV ES Bus Undervoltage Relays (Diesel Start)

a. Degraded Grid NA (1) {1) Relay operation will be checked by local test pushbuttons.

n n

.J

b. Loss of Voltage NA (1) (1) Relay operation will be checked by

.,r, .i:,.

..:., local test pushbuttons.

'V

...J

,, 44 . Reactor Coolant Pressure (1) (1) When reactor coolant system is DH Valve Interlock Bistable pressurized above 300 psig or Tave is greater than 200°F.

45. Loss of Feedwater Reactor Trip (1) (1) (1) When reactor power exceeds 7%

power.

46. Turbine Trip/Reactor Trip (1) (1) (1) When reactor power exceeds 45%

power.

47. a. Pressurizer Code Safety Valye (1) NA (1) When Tave is greater than 525°F.

and PORV Tailpipe Flow Monitors

b. PORV - Acoustic/Flow NA (1) (1) When Tave is greater than 525°F.

48. PORV Setpoints NA (1) (1) Per Specification 3.1.12 excluding valve operation.

)>

CHANNEL DESCRIPTION CHECK(c) TEST(c)

TABLE 4. 1-1 \..... ..intinued)

CALIBAATE(c) REMARKS 3

(I)

i 49. Saturation Margin Monitor (1) (1) (1) When Ta,a is greater than 525°F.

a.

3 (1)

J 50. Emergency Feedwater Flow NA (1) ( 1) When Tave is greater than 250°F.

r+

Instrumentation z

p

51. Heat Sink Protection System

a. EFW Auto Initiation (1) Includes logic test only.

Instrument Channels

1. Loss of both Feedwater NA (1)

Pumps

2. Loss of All RC Pumps NA (1)

3. Reactor Building NA Pressure

4. OTSG Low Level

~

I

--.J b. MFW Isolation OTSG Low NA Ill Pressure C. EFW Control Valve Control System

1. OTSG Level Loops

2. Controllers NA

d. HSPS Train Actuation Logic NA (1)

52. Backup lncore Thermocouple (1) NA (1) When Tave is greater than 250°F.

Display

53. Deleted

54. Reactor Vessel Water Level NA NA Notes (a) If the as-found channel setpoint is conservative with respect to the Allowable Value but outside its predefined as-found tolerance then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service. Enter condition into Corrective Action Program.

(b) The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the Nominal Trip Setpoint (NSP) at the completion of the surveillance; otherwise, the channel shall be declared inoperable. Setpoints more conversative than the NSP are acceptable provided that the as-found and as-left tolerances apply to the actual setpoint implemented in the surveillance procedures to confirm channel performance. The NSP and the methodologies used to determine the as-found and the as-left tolerances are specified in a document incorporated by reference into the UFSAR.

(c) Surveillance Frequencies are specified in the Surveillance Frequency Control Program unless otherwise noted in the table.

TABLE 4.1-2 MINIMUM EQUIPMENT TEST FREQUENCY Item Test Freauency

1. Control Rods Rod drop times of all Note 1 full length rods

2. Control Rod Movement of each rod Note 1, when reactor is Movement critical

3. Pressurizer Setpoint In accordance with the Safety Valves INSERVlCE TESTING PROGRAM

4. Main Steam Setpoint In accordance with the Safety Valves INSERVICE TESTING PROGRAM

5. Refueling System Functional Start of each Interlocks refueling period

6. (Deleted)

7. Reactor Coolant Evaluate Note 1, when reactor System Leakage coolant system temperature is greater than 525 degrees F (Not applicable to primary-to-secondary leakage.)

8. (Deleted)

9. Spent Fuel Functional Each refueling period Cooling System prior to fuel handling 1o. Intake Pump (a) Silt Accumulation - Note 1 House Floor Visual inspection (Elevation of Intake Pump 262 ft. 6 in.) House Floor (b) Silt Accumulation Note 1 Measurement of Pump House Flow 11 . Pressurizer Block .Functional* Note 1 Valve (RC-V2)

12. Primary to Secondary Evaluate Note 1 (Note: Not required .

Leakage to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after establishment of steady state operation.)

Function shall be demonstrated by operating the valve through one complete cycle of full travel.

Note 1: Surveillance Frequencies are specified in the Surveillance Frequency Control Program unless otherwise noted in the table.

4-8 AmendmentNo.aa,e8,+8,+49,+7a,.:t-98,2+.:J.,246,26i,~.290

TABLE4.I-J MlNHvlUM SAMPLING FREQUENCY Frc::gui:ncy I. Rt:uccor Coolunt u. Verify rellctur coolunL DOSE EQUIVALENT Xe-133 i) Note I (during all plant conditions except REFUELING specific activity is less than or equal tu 797 SHUTDOWN and COLD SHUTDOWN).

microcuries/gram.

ii) One Sample between 2 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months fuUowing a THERMAL POWER chllnge exceeding 15'k uf the RATED THERMAL POWER within a one hour period during all plant conditions except REFUEUNG SHUTDOWN and COLD SHUTDOWN.

b. Isotopic Analysis fur DOSE EQUIV Al.ENT iJ Nute l (during power operations).

1-131 Concentration ii) Om: Sample between 2 und 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months folluwing a THERMAL POWER change excet!ding I 5'k of the RA TED THERMAL POWER within a one hour period during all plant conditions except REFUELING SHUTDOWN and COLD SHUTDOWN.

iii) # Once per 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , whenever the specific activity exceeds 0.35 µCi/gram DOSE EQUIVALENT 1-131 during all plane conditions except REFUELING SHUTDOWN and COLD SHUTDOWN.

c. Deleted cl. Chemistry (Cl, F and 02) Note I (\\hen Tavg is greater thun 20u~FJ.

e. Boron concentration Note I

f. Tritium Radioactivity Note I l

2. Borated WuLer Boron concentration Nole I and ufter each makeup when rea..:tur coolant Stornge Tunk system pressure is greatt!r than 300 psig ur Tavg is greater Water Sample than 200°F.

3. Core Flooding Tank Boron com.:entration Nott! I and ailt!r each makeup when RCS pressure! is Water Sumple greater than 700 psig.

TABLE 4.1-3 Cont'd Frequency J>

3 CD

l 4. Spent Fuel Pool Boron Concentration greater than Note 1 a.

3 Water Sample or equal to 600 ppmb ct>

a 5. Secondary Coolant Isotopic analysis for DOSE Note 1 (when reactor coolant system z

9 EQUIVALENT 1-131 concentration pressure is greater than 300 psig or T~v is greater than 200°F.

6. Deleted

7. Deleted

8. Deleted

9. Deleted

10. Deleted

11. Deleted

12. Deleted

Until the specific activity of the primary coolant system is restored within its limits.

Sample to be taken after a minimum of 2 EFPD and 20 days of POWER OPERATION have elapsed since the reactor was last sub critical for 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or longer.

.. Deleted

- - Deleted Note 1: Surveillance Frequencies are specified in the Surveillance Frequency Control Program unless otherwise noted in the table.

TABLE 4.1-4 POST ACCIDENT MONITORING INSTRUMENTATION

)>

3 FUNCTION INSTRUMENTS CHECK(a} TEST(a) CALIBRATE(a) REMARKS (1)

J C.

3 1 Noble Gas Effluent (1) 3.

zp a. Condenser Vacuum Pump Exhaust (AM-A5-Hi) ( 1) Using the installed check source when background is less than twice the expected increase in cpm which would result from the check source alone.

Background readings greater than this value are sufficient in themselves to show that this monitor is functioning.

b. Condenser Vacuum Pump (1)

Exhaust (RM-G25)

c. Auxiliary and Fuel Handling Building Exhaust (RM-AB-Hi)

.j:s.

I d. Reactor Building Purge 0 Exhaust (RM-A9-Hi)

Ill

e. Reactor Building Purge (1)

Exhaust (RM-G24)

f. Main Steam Lines (1)

Radiation (RM-G26IRM-G27)

2. Containment High Range I Radiation (RM-G22/G23)

3. Containment Pressure NIA

4. Containment Waler Level N/A

5. DELETED

6. Wide Range Neutron Flux NIA

TABLE 4.1-4 (Continued}

)> POST ACCIDENT MONITORING INSTRUMENTATION 3

CD

J FUNCTION INSTRUMENTS CHECK(a) TEST(a) CALIBRATE(a) REMARKS a.

3 CD 7. Reactor Coolant System Cold Leg NIA

?.

z Water Temperature 9 (TE-959, 961; Tl-959A, 961 A}

a. Reactor Coolant System Hot Leg NIA (TE-958, 960; Tl-958A, 960A)

9. Reactor Coolant System Pressure NIA (PT-949, 963; Pl-949A, 963)

N

10. Steam Generator Pressure NIA

-...J (PT-950, 951, 1180, 1184;

.i::,.

Pl-950A, 951A, 1180, 1184)

+:-

I

11. Condensate Storage Tank Water NIA 0

CT Level(LT-1060, 1061, 1062, 1063; Ll-1060, 1061, 1062, 1063)

(a} Surveillance Frequencies are specified in the Surveillance Frequency Control Program unless otherwise noted in the table.

Item

1. Core Flood Tank TABLE 4.1-5 SYSTEM SURVEILLANCE REQUIREMENTS Test Frequency

a. Verify two core flood tanks Note 1 each contain 940 +/- 30 ft3 borated water.

b. Verify that two core flood Note 1 tanks each contain 600 +/- 25 psig.

c. Verify CF-V-1A&B are fully open. Note 1

d. Verify power is removed from Note 1 CF-V-1A&B and CF-V-3A&B valve operators

2. Reactor Building a. Verify the TSP baskets Note 1 Emergency Sump contain ~ 18,815 lbs and pH Control :s; 28,840 lbs of TSP.

System

b. Verify that a sample from Note 1 the TSP baskets provides adequate pH adjustment of borated water.

Note 1: Surveillance Frequencies are specified in the Surveillance Frequency Control Program unless otherwise noted in the table .

Amendment No. 22e, 26:3, 274 4-10c

4.2 REACTOR COOLANT SYSTEM INSERVICE AND TESTING Applicability This technical specification applies to the inservice inspection (ISi) of the reactor coolant system pressure boundary and portions of other safety oriented system pressure boundaries.

Objective The objective of the ISi program is to provide assurance of the continuing integrity of the reactor coolant system while at the same time minimizing radiation exposure to personnel in the performance of inservice inspections.

Specification 4.2.1 ISi of ASME Code Class 1, Class 2, and Class 3 components shall be performed in accordance with Section XI of the ASME Boiler and Pressure Vessel Code and applicable Addenda as required by 10 CFR 50, Section 50.55a, except where specific written relief has been granted by the NRC.

4.2.2 DELETED.

4.2.3 (Deleted) 4.2.4 The accessible portions of one reactor coolant pump motor flywheel assembly will be

ultrasonically inspected within the first ISi period, two reactor coolant pump motor flywheel assemblies within the first two ISi periods and all four by the end of the 1O year inspection interval. However, the U.T. procedure is developmental and will be used only to the extend that it is shown to be meaningful. The extent of coverage will be limited to those areas of the flywheel which are accessible without motor disassembly, i.e., can be reached through the access ports. Also, if radiation levels at the lower access ports are prohibitive, only the upper access ports will be used.

4-11

Amendment No. 15, 29, 54, 60, 71, 118, 172, 266, 290

CONTROU.ID OOF\f

! 4.2.5 (Deleted) 4.2.6 (Deleted) 4.2.7 A surveillance program for the pressure isolation valves between the primary coolant system and the low pressure injection system shall be as follows:

1. Periodic leakage testing(a) at test differential pressure greater than 150 psid shall be accomplished for the valves listed in Table 3.1.6.1 for the following conditions:

(a) prior to achieving hot shutdown after returning the valve to service following maintenance repair or replacement work, and (b) prior to achieving hot shutdown following a cold shutdown of greater than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months duration u~less testing has been performed within the previous 9 months.

2. Whenever integrity of a pressure isolation valve listed in Table 3.1.6.1 cannot be demonstrated, the integrity of the other remaining valve in each high pressure line having a leaking valve shall be determined and recorded daily. In addition, the position of one other valve located in the high pressure piping shall ~e recorded daily.

(

(a)

To satisfy ALARA requirements, leakage may be measured indirectly (as from the perfonr.ance of pressure indicators) if accomplished in accordance with approved procedures and supported by computations showing that the method is capable of demonstrating valve compliancf with the leakage criteria.

Amendment No. Z9, !~, ~"' -91"d~1 dtd. 4/Z0781, X, Cgrr. Lt1. dtd. 1172781., 118 4-12

Specifications 4.2.1 and 2 ensure that inservice inspection of ASME Code Class 1, 2 and 3 components and inservice testing of ASME Code Class 1, 2 and 3 pumps and valves will be performed in accordance with a periodically updated version of the ASME Code and Addenda as required by 10 CFR 50.55a. Relief from any of the above requirements has been provided in writing by the NRC and is not a part of these technical specifications. The provisions of SR 4.0.2 are only applicable to those SRs that reference usage of the INSERVICE TESTING PROGRAM.

4.3 DELETED 4-13 (Pages 4-14 through 4-28 deleted)

Amendment No. 29, 54, 60, Order dtd, 4/20/81, 71, Gorr. Ur. dtd. 11/2/81, Reissued 3/20/Ba,118,1 a?,172,198, 266, 290

4.4 REACTOR BUILDING 4.4.1 CONT Al NM ENT LEAKAGE TESTS Applicability Applies to containment leakage.

Objective To verify that leakage from the Reactor Building is maintained within allowable limits.

Specification 4.4.1.1 Integrated Leakage Rate Testing (ILRT) shall be conducted in accordance with the Reactor Building Leakage Rate Testing Program at test frequencies established in accordance with the Reactor Building Leakage Rate Testing Program.

4.4.1.2 Local Leakage Rate Testing (LLRT) shall be conducted in accordance with the Reactor Building Leakage RateTesting Program. LLRT shall be performed at a pressure not less than peak accident pressure Pac with the exception that the airlock door seal tests shall normally be performed at 1O psig and the periodic containment airlock tests shall be performed at a pressure not less than Pac. LLRT frequencies shall be in accordance with the Reactor Building Leakage Rate Testing Program.

4.4.1.3 Operability of the personnel and emergency air lock door interlocks and the associated control room annunciator circuits shall be determined at the frequency specified in the

Bases c1i Surveillance Frequency Control Program. If the interlock permits both doors to be open at the same time or does not provide accurate status indication in the control room, the interlock shall be declared inoperable, except as provided in Technical Specification Section 3.8.6.

The Reactor Building is designed to limit the leakage rate to 0.1 percent by weight of contained atmosphere in 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at the design internal pressure of 55 psig with a coincident temperature of 281 °F at accident conditions. The peak calculated Reactor Building pressure for the design basis loss of coolant accident, Pac, is 50.6 psig. 50.6 psig is a historical value. The current design basis loss of coolant accident peak reactor building pressure is less than 50.6 psig (Reference 5). The maximum allowable Reactor Building leakage rate, La, shall be 0.1 weight percent of containment atmosphere per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at Pac*

Containment Isolation Valves are addressed in the UFSAR (Reference 2).

4-29 Amendment No. 63,167,201,236, ECR TM OQ 00703, 274

4.4 REACTOR BUILDING (Continued)

The Reactor Building will be periodically leakage tested in accordance with the Reactor Building Leakage Rate Testing Program (See Section 6.8.5). This program is contained in the surveillance procedures for Reactor Building inspection, Integrated Leak Rate Testing, and Local Leak Rate Testing. These periodic testing requirements verify that Reactor Building leakage rate does not exceed the assumptions used in the safety analysis. At s1 .O La the offsite dose consequences are bounded by the assumptions of the safety analysis.

During the first unit startup following testing in accordance with this program, the leakage rate acceptance criteria are s 0,60 La for the combined Type B and Type C leakage, and s 0.75 La for overall Type A leakage. At all other times between required leakage tests, the acceptance criteria is based on an overall Type A leakage limit of s 1.0 La.

Periodic surveillance of the airlock interlock systems (Reference 4) assures continued operability and precludes instances where one or both doors are inadvertently left open.

When an airlock is inoperable and containment integrity is required, local supervision of airlock operation is specified.

References (1) UFSAR, Chapter 5.7.4- "Post Operational Leakage Rate Tests" (2) UFSAR, Tables 5.7-1 and 5.7-3 (3) DELETED (4) UFSAR, Table 5.7-2 (5) C-1101-823-5450-001 "TMl-1 LBLOCA EQ Temperature Profile Using Gothic Computer Code."

4-30 (Pages 4-31 through 4-34, 4-34a, and 4-34b deleted)

Amendment No. 27,167,201, ECRTM 09 00703, 274

COn~TROllED COPY

4.4.2 Structural Integrity Specification 4.4.2.1 lnservice Tendon Surveillance Requirements The surveillance program for structural integrity and corrosion protection conforms to the requirements of Subsection IWL of Section XI of the ASME Boiler and Pressure Vessel Code, as incorporated by reference into 10 CFR 50.55a. The detailed surveillance program for the prestressing system tendons shall be based on periodic inspection and mechanical tests to be performed on selected tendons.

4.4.2.1.1 DELETED

/

4-35 Amendment No. 59, 95, 129, 157, 187, 251

/

4.4.2.1.2 DELETED 4.4.2.1.3 DELETED 4.4.2.1.4 Tendon Surveillance Previous Inspections The tendon surveillance shall include the reexamination of all abnormalities (i.e., concrete scaling, cracking, grease leakage, etc.} discovered in the previous inspection to determine whether conditions have stabilized. The inspection program shall be modified accordingly if obvious deteriorating conditions are observed.

4.4.2.1.5 Inspection for Crack Growth at Dome Tendons in the Ring Girder Anchorage Areas Concrete around the dome tendon anchorage areas shall be inspected for crack growth during ten and 15 year inspections by monitoring cracks greater than 0.005 inch in width. Select as a minimum nine dome tendon anchoring areas having concrete cracks with crack .

widths 0.005 inch. In the selection of dome tendon anchoring areas*

to be monitored, preference shall be given to those areas having cracks greater than 0.005 inch in width. The width, depth (if depths can be measured with simple existing plant instruments, (i.e., feeler gauges, wires} and length of the selected cracks shall be measured and mapped by charting. This inspection may be discontinued, if the concrete cracks show no sign of growth. If, however, these inspections indicate crack growth, an investigation of the causes and safety impact should be performed .

- - 4-36 Amendment No. ,,, Ji,, 187

co~~TfROllfED COPY

4.4.2.1.6 Reports

a. Within 3 months after the completion of each tendon surveillance a special report shall be submitted to the NRC Region I Administrator. This Report will include a section dealing with trends for the rate of prestress loss as compared to the predicted rate for the duration of the plant life (after an adequate number of surveillances have been completed).

b. Reports submitted in accordance with 10 CFR 50.73 shall include a description of the tendon condition, the condition of the concrete (especially at tendon anchorages), the inspection procedures, the tolerances on cracking, and any corrective actions taken.

4.4.3 DELETED BASES For ungrouted, post-tensioned tendons, this surveillance requirement ensures that the structural integrity of the containment will be maintained in accordance with the provisions of the TMl-1 Reactor Building Structural Integrity Tendon Surveillance Program. Testing and frequency are consistent with the requirements of Subsection IWL of Section XI of the ASME Boiler and Pressure Vessel Code, as incorporated by reference into 10 CFR 50.55a, and as described in the FSAR .

The modified visual inspection requirements pertaining to the dome tendons in the ring girder were implemented as a result of: 1) discovery of ring girder voids in 1977 and the potential that more undetected voids in the ring girder could exist, and 2) the number of dome tendon bearing areas having cracks appeared to be growing with time (Reference Amendment No. 59).

REFERENCES (1) UFSAR, Section 5.7.5 -Tendon Stress Surveillances

Amendment No. 108, 129, 158, 187, 251.

4-37

4.4.4 DELETED 4-38 (Page 4-38a deleted)

Amendment No. 87-, 4-W, 4-7§, 4-98, 22§, 24.G, 246

4.5 EMERGENCY LOADING SEQUENCE AND POWER TRANSFER, EMERGENCY CORE COOLING SYSTEM & REACTOR BUILDING COOLING SYSTEM PERIODIC TESTING 4.5.1 Emergency Loading Sequence Applicability: Applies to periodic testing requirements for safety actuation systems.

Objective: To verify that the emergency loading sequence and automatic power transfer is operable.

. Specifications:

4.5.1.1 Sequence and Power Transfer Test

a. At the frequency specified in the Surveillance Frequency Control Program, a test shall be conducted to demonstrate that the emergency loading sequence and power transfer is operable.

b. The test will be considered satisfactory if the permanently connected loads and auto-connected emergency loads have been successfully energized on preferred power using the load sequencer and transferred to emergency power.

c. Following successful transfer to the emergency diesel, the diesel generator breaker will be opened to simulate trip of the generator then re-closed to verify block load on the reclosure.

4.5.1.2 Sequence Test

a. At the frequency specified_ in the Surveillance Frequency Control Program, a test shall be conducted to demonstrate that the emergency loading sequence is operable, this

b.

test shall be performed on either preferred power or emergency power.

The test will be considered satisfactory if the auto-connected emergency loads have been successfully energized using the load sequencer.

Amendment No. 70, 78, 14 9, 167, 212, 274, 276 4-39

Bases

The Emergency loading sequence and automatic power transfer controls the operation of the pumps associated with the emergency core cooling system and Reactor Building cooling system.

The requirement to verify the connection and power supply of permanent and auto connected loads (Reference 1) is intended to satisfactorily show the relationship of these loads to the Emergency Diesel Generator (EDG) loading logic. In certain circumstances, many of these, loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, high pressure injection systems are not capable of being operated at full flow, or decay heat removal (DHR) systems performing a DHR function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the EDG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

Automatic start and loading of the emergency diesel generator to meet the requirements of 4.5.1.1 b/c above is described in Technical Specification 4.6.1.b.

Reference (1) UFSAR, Table 8.2-11, "Engineered Safeguards Loading Sequence" 4-40

Amendment No. 70, 149, 167, ECR TM 13-00306

4.5.2 EMERGENCY CORE COOLING SYSTEM

Applicability:

systems.

Applies to periodic testing requirement for emergency core cooling Objective: To verify that the emergency core cooling systems are operable.

Specification 4.5.2.1 High Pressure Injection

a. At the frequency specified in the Surveillance Frequency Control Program and following maintenance or modification that affects system flow characteristics, system pumps and system high point vents shall be vented, and a system test shall be conducted to demonstrate that the system is operable.

b. The test will be considered satisfactory if the valves (MU-V-14A/B

& 16A/B/C/D) have completed their travel and the make-up pumps are running as evidenced by system flow. Minimum acceptable injection flow must be greater than or equal to 431 gpm per HPI pump when pump discharge pressure is 600 psig or greater (the pressure between the pump and flow limiting device) and when the RCS pressure is equal to or less than 600 psig.

c. Testing which requires HPI flow thru MU-V16A/B/C/D shall be conducted oniy under either of the following conditions:

1) Indicated RCS temperature shall be greater than 313°F .

2) Head of the Reactor Vessel shall be removed.

d. At the frequency specified in the Surveillance Frequency Control Program, verify High Pressure Injection locations susceptible to gas accumulation are sufficiently filled with water.

4.5.2.2 Low Pressure Injection

a. At the frequency specified in the Surveillance Frequency Control Program and following maintenance or modification that affects system flow characteristics, system pumps and high point vents shall be vented, and a system test shall be conducted to demonstrate that the system is operable. The auxiliaries required for low pressure injection are all included in the emergency loading sequence test specified in 4.5.1.

b. The test will be considered satisfactory if the decay heat pumps have been successfully started and the decay heat injection valves and the decay heat supply valves have completed their travel as evidenced by the control board component operating lights. Flow shall be verified to be equal to or greater than the flow assumed in the Safety Analysis for the single corresponding RCS pressure used in the test.

4-41 Amendment No. 4-9,.s+,gg,449,~.~.2-M.~.-276.~. 285

c. When the Decay Heat System is required to be operable, the correct position of DH-V-19A/B shall be verified by observation within four hours of each valve stroking operation or valve maintenance which affects the position indicator.

d. At the frequency specified in the Surveillance Frequency Control Program, verify Low Pressure Injection locations susceptible to gas accumulation are sufficiently filled with water.

4.5.2.3 Core Flooding

a. At the frequency specified in the Surveillance Frequency Control Program, a system test shall be conducted to demonstrate proper operation of the system. Verification shall be made that the check and isolation valves in the core cooling flooding tank discharge lines operate properly.

b. The test will be considered satisfactory if control board indication of core flooding tank level verifies that all valves have opened.

c. At the frequency specified in the Surveillance Frequency Control Program, verify Core Flooding locations susceptible to gas accumulation are sufficiently filled with water.

4.5.2.4 Component Tests

a. At the frequency specified in the Surveillance Frequency Control Program, the components required for emergency core cooling will be tested.

b. The test will be considered satisfactory if the pumps and fans have been successfully started and the valves have completed their travel as evidenced by the control board component operating lights, and a second means of verification, such as: the station computer, verification of pressure/flow, or control board indicating lights initiated by separate limit switch contacts.

Bases The emergency core cooling systems (Reference 1) are the principal reactor safety features in the event of a loss of coolant accident. The removal of heat from the core provided by these systems is designed to limit core damage.

The low pressure injection pumps are tested singularly for operability by opening the borated water storage tank outlet valves and the bypass valves in the borated water storage tank fill line. This allows water to be pumped from the borated water storage tank through each of the injection lines and back to the tank.

The minimum acceptable HPI/LPI flow assures proper flow and flow split between injection legs.

With the reactor shutdown, the valves in each core flooding line are checked for operability by reducing the reactor coolant system pressure until the indicated level in the core flood tanks verify that the check and isolation valves have opened.

ECCS piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the ECCS and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.

4-42 Amendment No. -a-7,-98,449,4-a-7,4-e-7,~.-2-74. 285

Bases (Continued)

Selection of ECCS locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

With regard to 4.5.2.1.d, 4.5.2.2.d, and 4.5.2.3.c, the ECCS is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that t~e ECCS is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.

ECCS locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety.

For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

Reference (1) UFSAR, Section 6.1 :.. "Emergency Core Cooling System"

4:..42a Amendment No. a-7,88,449,4-a-7,4&7,22-a,2-74, 285

4.5.3 REACTOR BUILDING COOLING AND ISOLATION SYSTEM Applicability Applies to testig of the reactor building cooling and isolation systems.

Objective To verify that the reactor building cooling systems are operable.

Specification 4.5.3.1 System Tests

a. Reactor Building Spray System

1. At the frequency specified in the Surveillance Frequency Control Program and simultaneously with the test of the emergency loading sequence, a Reactor Building 30 psi high pressure test signal will start the spray pump. Except for the spray pump suction valves, all engineered safeguards spray valves will be closed.

Water will be circulated from the borated water storage tank through the reactor building spray pumps and returned through the test line to the borated water storage tank.

The operation of the spray valves will be verified during the component test of the R. B. Cooling and Isolation System.

The test will be considered satisfactory if the spray pumps have been successfully started.

2. Compressed air will be introduced into the spray headers to verify each spray nozzle is unobstructed at the frequency specified in the Surveillance Frequency Control Program.

3. At the frequency specified in the Surveillance Frequency Control Program, verify Reactor Building Spray locations susceptible to gas accumulation are sufficiently filled with water.

b. Reactor Building Cooling and Isolation Systems

1. At the frequency specified in the Surveillance Frequency Control Program, a sy~tem test shall be conducted to demonstrate proper operation of the system.

2. The test will be considered satisfactory if measured system flow is greater than accident design flow rate .

Amendment No. 4e7,498,-242,~.-2-74.-2+8, 285 4-43

4.5.3.2 Component Tests

a. At the frequency specified in the Surveillance Frequency Control Program, the components required for Reactor Building Cooling and Isolation will be tested.

b. The test will be considered satisfactory if the valves have completed their expected travel as evidenced by the control board component operating lights, and a second means of verification, such as: the station computer, local verification, verification of pressure/flow, or control board component operating lights initiated by separate limit switch contacts.

Bases The Reactor Building Cooling and Isolation Systems and Reactor Building Spray System are designed to remove the heat in the containment atmosphere to prevent the building pressure from exceeding the design pressure (References 1 and 2).

The delivery capability of one Reactor Building Spray Pump at a time can. be tested by opening the valve in the line from the borated water storage tank, opening the corresponding valve in the test line, and starting the corresponding pump.

With the pumps shut down and the Borated Water Storage Tank outlet valve closed, the Reactor Building spray injection valves can each be opened and closed by the operator action. With the Reactor Building spray inlet valves closed, low pressure air can be blown through the test connections of the Reactor Building spray nozzles to demonstrate that the flow paths are open .

Reactor Building Spray System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the required Reactor.Building Spray trains and may also prevent water hammer and pump cavitation.

Selection of Reactor Building Spray System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

With regard to 4.5.3.1.a.3 the Reactor Building Spray System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of

Amendment No. -88,449,4&7,4&7,-2+4, 285 4-44

Bases accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the Reactor Building Spray System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brol!ght within the acceptance criteria limits.

Reactor Building Spray System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditiO!lS, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation .

The equipment, piping, valves and instrumentation of the Reactor Building Cooling System are arranged so that they can be visually inspected. The cooling units and associated piping are loc~ted outside the secondary concrete shield.

Personnel can enter the Reactor Building during power operations to inspect and maintain this equipment.

The Reactor Building fans are normally operating periodically, constituting the test that these fans are operable.

Reference (1) UFSAR, Section 6.2 - "Reactor Building Spray System" (2) UFSAR, Section 6.3 - "Reactor Building Emergency Cooling System"

,. 4-44a Amendment No. -e8,449,4a-7,4-e-7,274, 285

4.5.4 ENGINEERED SAFEGUARDS FEATURE (ESF) SYSTEMS LEAKAGE Applicability Applies to those portions of the Decay Heat, Building Spray, and Make-Up Systems, which are required to contain post accident sump recirculation fluid, when these systems are required to be operable in accordance with Technical Specification 3.3.

I Objective . I To maintain a low leakage rate from the ESF systems in order to prevent significant off-site exposures and dose consequences.

Specification 4.5.4.1 The total maximum allowable leakage into the Auxiliary Building from the applicable portions of the Decay Heat, Building Spray and Make-Up System components as measured during tests in Specification 4.5.4.2 shall not exceed 15 gallons per hour.

4.5.4.2 At the frequency specified in the Surveillance Frequency Control Program the following tests of the applicable portions of the Decay Heat Removal, Building Spray and Make-Up Systems shall be conducted to determine leakage:

a. The applicable portion of the Decay Heat Removal System that is outside containment shall be leak tested with the Decay Heat pump operating, except as specified in "b".

b. Piping from the Reactor Building Sump to the Building Spray pump and Decay Heat Removal System pump suction isolation valves shall be pressure tested at no less than 55 psig.

/

C. The applicable portion of the Building Spray system that is outside

d.

containment shall be leak tested with the Building Spray pumps operating and BS-V-1NB closed; except as specified in "b" above.

The applicable portion of the Make-Up system on the suction side of the Make-Up pumps shall be leak tested with a Decay Heat pump operating and DH-V-7NB open.

e. The applicable portion of the Make-Up system from the Make-Up pumps to the containment boundary valves (MU-V-16ND, 18, and 20) shall be leak tested with a Make-Up pump operating.

f. Visual inspection shall be made for leakage from components of these systems. Leakage shall be measured by collection and weighing or by another equivalent method.

Bases The leakage rate limit of 15 gph (measured in standard room temperature gallons) for the accident recirculation portions of the Decay Heat Removal (OHR), Building Spray (BS), and Make-Up (MU) systems is based on ensuring that potential leakage after a loss-of-coolant accident will not result in off-site dose consequences in excess of those calculated to comply with the 10 CFR 50.67 limits (Reference 1 and 2). The test methods prescribed in 4.5.4.2 above for the applicable portions of the DH, BS and MU systems ensure that the testing results account for the highest pressure within that system during the sump recirculation phase of a design basis accident.

References (1) UFSAR, Section 6.4.4 - "Design Basis Leakage" (2) UFSAR, Section 14.2.2.5(d) - "Effects of Engineered Safeguards Leakage During Maximum Hypothetical Accident" 4-45 Amendment No. 157, 206, 216, Correotod by letter dated: 9/24/QQ, 235, 274 .

4.6 EMERGENCY POWER SYSTEM PERIODIC TESTS Applicability: Applies to periodic testing and surveillance requirement of the emergency power system.

Obiective: To verify that the emergency power system will respond promptly and properly when required.

Specification:

The following tests and surveillance shall be performed as stated:

4.6.1 Diesel Generators *

a. Manually-initiate start of the diesel generator, followed by manual synchronization with other power sources and assumption of load by the diesel generator up to the name-plate rating (3000 kw). This test will be conducted at the frequency specified in the Surveillance Frequency Control Program on each diesel generator. Normal plant operation will not be effected.

b. Automatically start and loading the emergency diesel generator in accordance with Specification 4.5.1.1.b/c including the following. This test will be conducted at the frequency specified in the Surveillance Frequency Control Program on each diesel generator.

(1) Verify that the diesel generator starts from ambient condition upon receipt of the ES signal and is ready to load in s 1O seconds.

(2) Verify that the diesel block loads upon simulated loss of offsite power in s 30 seconds.

(3)

(4)

The diesel operates with the permanently connected and auto connected load for 2: 5 minutes.

The diesel engine does not trip when the generator breaker is opened while carrying emergency loads.

(5) The diesel generator block loads and operates for 2: 5 minutes upon reclosure of the diesel generator breaker.

C. Deleted.

4.6.2 Station Batteries

a. The voltage, specific gravity, and liquid level of each cell will be measured and recorded:

(1) at the frequency specified in the Surveillance Frequency Control Program (2) once within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a battery discharge < 105 V (3) once within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a battery overcharge > 150 V (4) If any cell parameters are not met, measure and record the parameters on each connected cell every 7 days thereafter until all battery parameters are met.

b. The voltage and specific gravity of a pilot cell will be measured and recorded at the frequency specified in the Surveillance Frequency Control Program. If any pilot cell parameters are not met, perform surveillance 4~6.2.a on each connected cell within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and every 7 days thereafter until all battery parameters are

C.

met.

Each time data is recorded, new data shall be compared with old to detect signs of abuse or deterioration.

Amendment No.70, 149, 167, 200, 232, 243, 274 4-46

d. The battery will be subjected to a load test at the frequency specified in the Surveillance Frequency Control Program.

( 1)

(2)

Verify battery capacity exceeds that required to meet design loads.

Any battery which is demonstrated to have less than 85% of manufacturers ratings during a capacity discharge test shall be replaced during the subsequent refueling outage.

4.6.3 Pressurizer Heaters

a. The following tests shall be conducted at the frequency specified in the Surveillance Frequency Control Program:

(1) Pressurizer heater groups 8 and 9 shall be transferred from the normal power bus to the emergency power bus and energized. Upon completion of this test, the heaters shall be returned to their normal power bus.

(2) Demonstrate that the pressurizer heaters breaker on the emergency bus cannot be closed until the safeguards signal is bypassed and can be closed following bypass.

(3) Verify that following input of the Engineered Safeguards Signal, the circuit breakers, supplying power to the manually transferred loads for pressurizer heater groups 8 and 9, have been tripped.

Bases The tests specified are designed to demonstrate that one diesel generator will provide power for operation of safeguards equipment. They also assure that the emergency generator control system and the control systems for the safeguards equipment will function automatically in the event of a loss of normal a-c station service power or upon the receipt of an engineered safeguards Actuation

Signal. The intent of the periodic tests is to demonstrate the diesel capability to carry design basis accident (LOOP/LOCA) load. The test should not exceed the diesel 2000-hr. rating of 3000 kW. The automatic tripping of manually transferred loads, on an Engineered Safeguards Actuation Signal, protects the diesel generators from a potential overload condition. The testing frequency specified is intended to identify and permit correction of any mechanical or electrical deficiency before it can result in a system failure. The fuel oil supply, starting circuits, and controls are continuously monitored and any faults are alarmed and indicated. An abnormal condition in these systems would be signaled without having to place the diesel generators on test.

Precipitous failure of the station battery is extremely unlikely. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

The PORV has a remotely operated block valve to provide a positive shutoff capability should the relief valve become inoperable. The electrical power for both the relief valve and the block valve is supplied from an ESF power source to ensure the ability to seal this possible RCS leakage path.

The requirement that a minimum of 107 kw of pressurizer heaters and their associated controls be capable of being supplied electrical power from an

emergency bus provides assurance that these heaters can be energized during a loss of offsite power condition to maintain natural circulation.

4-47 Amendment No. 78, 167, 167, 176, ECR TM 07 00110, 27 4

4.7 REACTOR CONTROL ROD SYSTEM TESTS

4.7.1 CONTROL ROD DRIVE SYSTEM FUNCTIONAL TESTS Applicability Applies to the surveillance of the control rod system.

Objective To assure operability of the control rod system.

Specification 4.7.1.1 The control rod trip insertion Ume shall be measured for each control rod at either full flow or no flow conditions following each refueling outage prior to return to power. The maximum control rod trip insertion time for an *operable control rod drive mechanism from the fully withdrawn position to % insertion (104 inches travel) shall not exceed 1.66 seconds at hot reactor coolant full flow conditions or 1.40 seconds for the hot no flow conditions (Reference 1). If the trip insertio_n time above is not met, the rod shall be declared inoperable.

4.7.1.2 If a control rod is misaligned with its group average by more than an indicated nine inches, the rod shall be declared inoperable and the limits of Specification 3.5.2.2 shall apply. The rod with the greatest misalignment shall be evaluated first. The position of a rod declared inoperable due to misalignment shall not be included in computing the average position of the group for determining the operability of rods with lesser misalignments.

4.7.1.3 If a control rod cannot be exercised, or if it cannot be located with absolute or relative position indications, in or out limit indication, or zone reference switch indication, the rod shall be declared to be inoperable.

The control rod trip insertion time is the total elapsed time from power interruption at the control rod drive breakers until the control rod has actuated the 25% withdrawn reference switch during insertion from the fully withdrawn position. The specified trip time is based upon the safety analysis in UFSAR, Chapter 14 and the Accident Parameters as specified therein.

Each control rod drive mechanism shall be exercised by a movement of a minimum of 3%

of travel at the frequency specified in the Surveillance Frequency Control Program. This requirement shall apply to either a partial or fully withdrawn control rod at reactor operating conditions. Exercising the drive mechanisms in this manner provides assurance of reliability of the mechanisms.

.4-48 Amendment No. 167,211, 27a, 274

P. ,*od is considered inoperable if it cannot be exercised, if the trip insertion time is greater than the specified allowable time, or if the rod deviates from its group average position by more than nine inches. Conditions for operation with an inoperable rod are specified in Technical Specification 3.5.2.

REFERENCE (1) UFSAR, Section 3.1.2.4.3 - "Control Rod Drive Mechanism"

/

4-49 Amendment No. 157

4. 7.2 CONTROL ROD PROGRAM VERIFICATION (Group vs. Core Positions)

The page intentionally left blank 4-50 Amendment No. lj'.7, 211

CONTROLLlED COPY 4.8 DELETED e>

4-51 Amendment No. Sa-, +e7, 246

4.9 DECAY HEAT REMOVAL (DHR) CAPABILITY- PERIODIC TESTING Applicability Applies to the periodic testing of systems or components which function to remove decay heat.

Objective To verify that systems/components required for OHR are capable of performing their design function.

Specification 4.9.1 Reactor Coolant System (RCS) Temperature greater than 250 degrees F.

4.9.1.1 Verify each Emergency Feedwater (EFW) Pump is tested in accordance with the requirements and acceptance criteria of the INSERVICE TESTING PROGRAM.

Note: This surveillance is not required to be performed for the turbine-driven EFW Pump (EF-P-1) until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after exceeding 750 psig.

4.9.1.2 DELETED 4.9.1.3 At the frequency specified in the Surveillance Frequency Control Pogram, each EFW System flowpath valve from both Condensate Storage Tanks (CSTs) to the OTSGs via the motor-driven pumps and the turbine-driven pump shall be verified to be in the required status.

4.9.1.4 At the frequency specified in the Surveillance Frequency Control Program:

a) Verify that each EFW Pump starts automatically upon receipt of an EFW test signal.

b) Verify that each EFW control valve responds upon receipt of an EFW test signal.

c) Verify that each EFW control valve responds in manual control from the control room and remote shutdown panel.

4.9.1.5 Prior to STARTUP, following a REFUELING SHUTDOWN or a COLD SHUTDOWN greater than 30 days, conduct a test to demonstrate that the motor driven EFW Pumps can pump water from the CSTs to the Steam Generators.

4-52 Amendment No. 78,119,124,172,242,266, 2-74,290

4.9 DECAY HEAT REMOVAL (OHR) CAPABILITY-PERIODIC TESTING (Continued) 4.9.1.6 Acceptance Criteria These tests shall be considered satisfactory if control board indication and visual observation of the equipment demonstrates that all components have operated properly except for the tests required by Specification 4.9.1.1.

4.9.2 RCS Temperature less than or equal to 250 degrees F.*

4.9.2.1 At the frequency specified in the Surveillance Frequency Control Program, verify operability of the means for OHR required by Specification 3.4.2 by observation of console status indication.

*-------------------------NOTE----------------------------------------------

Entry into 4.9.2.2. below is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after RCS temperature is less than or equal to 250 degrees F.

4.9.2.2 At the frequency specified in the Surveillance Frequency Control Program, verify required OHR loop locations susceptible to gas accumulation are sufficiently filled with water.

These requirements supplement the requirements of Specifications 4.5.2.2 and 4.5.4.

Bases The ASME Code specifies requirements and acceptance standards for the testing of nuclear safety related pumps. The EFW Pump test frequency specified by the ASME Code will be sufficient to verify that the turbine-driven and both motor-driven EFW Pumps are operable.

Compliance with the normal acceptance criteria assures that the EFW Pumps are operating as expected. The surveillance requirements ensure that the overall EFW System functional capability is maintained.

Deferral of the requirement to perform 1ST on the turbine-driven EFW Pump is necessary to assure sufficient OTSG pressure to perform the test using Main Steam.

Periodic verification of the operability of the required means for OHR ensures that sufficient OHR capability will be maintained.

OHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the required OHR loop(s) and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.

Selection of DHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the*

Amendment No. -78,449,424,472,242,~.~. 285 4-52a

4.9 DECAY HEAT REMOVAL (OHR) CAPABILITY-PERIODIC TESTING (Continued)

Bases (Continued) location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

With regard to 4.9.2.2 the OHR System is OPERABLE when it is sufficiently filled with water.

Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the OHR System is not rendered inoperable by the accumulateq gas (i.e:, the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.

OHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations.

Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations. and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

SR 4.9.2.2 is modified by a Note that states the SR is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after RCS temperature is less than or equal to 250 degrees F. In a rapid shutdown, there may be insufficient time to verify all susceptible locations prior to RCS temperature reaching less than or equal to 250 degrees F.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

4-52b Amendment No. 285

C.

f )

4.10 REACTIVITY ANOMALIES Applicability Applies to potential reactivi~y anomalies.

Objective To.require the evaluation of reactivity anomalies of a specified .magnitude occurring during the operation of the _unit.

Specification 4.10.1 -Following a normalization of the computed boron concentration as a :f'unction of' burnup, the actuaJ. boron concentration of the coolant shall be periodically compared with the predicted value. If the difference between the observed and predicted steady-state concentrations reaches the equivalent of one percent in reactivity, an evaluati'on vill be made to determine the cause of' the discrepancy.

Bases To eliminate possible errors in the calculations of the initial reactivity of the core and the reactivity depletion rate, the predicted relation be"tween fuel burnup and the boron concentration, necessary to maintain adequate con-trol characteristics, JD.Ust be adjusted {nor.ma.J..ized) to accurately reflect actual core conditions. When :f'ull power is reached initially, and with the control rod groups in the desired positions, the boron concentration is measured and the predicted curve is adjusted to this point. As powe.r opera.-

ti on proceeds, the measured boron concentration is compared 'With the predicted concentration and the slope of the curve relating burn:up snd reactivity is compared with that predicted. This process of normalization should be com-pleted after about 10 percent of the total core burnup. Thereafter, actual boron concentration csn be compared vith prediction, and the reactivity status of the core can "be continuously evaluated. Any reactivity anomaly greater than one percent would be unexpecteJi,, and its occurrence would be thoroughly investigated and evaluated.

The value of one percent is considered a sa~e J.ilni~ since a shutdown margin of at least one percent vi.th the most reactive rod in the .fully vithdra'Wll position is always maintained *

j li-53

4.11 REACTOR COOLANT SYSTEM VENTS Applicability Applies to Reactor Coolant System Vents.

Objective To ensure that Reactor Coolant System vents are able to perform their design function.

Specification 4.11.1 Each reactor coolant system vent path shall be demonstrated OPERABLE .

at the frequency specified in the Surveillance Frequency Control Program by cycling each power operated valve in the vent path through at least one complete cycle of full travel from the control room during COLD SHUTDOWN or REFUELING.

BASES Tests specified above are necessary to ensure that the individual Reactor Coolant System Vents will perform their functions. It is not advisable to perform these tests during Plant Power Operation, or when there is significant pressure in the Reactor Coolant System. Tests are, therefore, to be performed during either Cold Shutdown or Refueling .

Amendment No. 96, .

07, 274.

4-54

4.12 AIR TREATMENT SYSTEM 4.12.1 EMERGENCY CONTROL ROOM AIR TREATMENT SYSTEM Applicability Applies to the emergency control room air treatment system and associated components.

Objective To verify that this system and associated components will be able to perform its design functions.

Specification 4.12.1.1 At the frequency specified in the Surveillance Frequency Control Program, the pressure drop across the combined HEPA filters and charcoal adsorber banks of AH-F3A and 38 shall be demonstrated to be less than 6 inches of water at system design flow rate (+/-10%).

4.12.1.2

a. The tests and sample analysis required by Specification 3.15.1.2 shall be performed initially and at the frequency specified in the Surveillance Frequency Control Program for standby service or after every 720 hours0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months of system operation and following significant paintin_g, st~am, fire or chemical release in any ventilation zone communicating with the system that could contaminate the HEPA filters or charcoal adsorbers.

b. DOP testing shall be performed after each complete or partial replacement of the HEPA filter bank or after any structural maintenance on the system housing which could affect the HEPA filter bank bypass leakage.

c. Halogenated hydrocarbon testing shall be performed after each complete or partial replacement of the charcoal adsorber oank or after any structural maintenance on the system housing which could effect the charcoal adsorber bank bypass leakage.

d. Each AH-E1 SA and B (AH-F3A and B) fan/filter circuit shall be operated for ~ 15 continuous minutes at the frequency specified in the Surveillance Frequency Control Program.

4.12.1.3 At the frequency specified in the Surveillance Frequency Control Program, automatic initiation of the required Control Building dampers for isolation and recirculation shall be demonstrated as operable.

4.12.1.4 An air distribution test shall be performed on the HEPA filter bank initially, and after any maintenance or testing that could aff,ect the air distribution within the system. The air distri_bution across the HEPA filter bank shall qe uniform within

+/-20%. The test shall be performed at 40,000 cfm (+/-10%) flow rate.

4.12.1.5 Control Room Envelope unfiltered air inleakage testing shall be performed in accordance with the Control Room Envelope Habitability Program.

4-55 Amendment No.66, 68, 149,176,223,264,274,282

BASES Pressure drop across the combined HEPA filters and charcoal adsorbers of less than 6 inches of water at the system design flow rate will indicate that the filters and adsorbers are not clogged by excessive amounts of foreign matter. Pressure drop should be determined at the frequency specified in the Surveillance Frequency Control Program to show system performance capability.

The frequency of tests and sample analysis are necessary to show that the HEPA filters and charcoal adsorbers can perform as evaluated. Tests of the charcoal adsorbers with halogenated hydrocarbon shall be performep in accordance with approved test procedures.

Replacement adsorbent should be qualified according to ASTM D3803-1989. The charcoal adsorber efficiency test procedures should allow for the removgl of one c;tdsorber tray, emptying

of one bed from the tray, mixing the adsorbent thoroughly and obtaining at least two samples.

Each sample should be at least two inches in diameter and a length equal to the thickness of the bed. If test results are unacceptable all adsorbent in the system shall be replaced. Tests of the HEPA filters with DOP aerosol shall also be performed in accordance with approved test procedures. Any HEPA filters found defective should be replaced with filters qualified according to Regulatory Guide 1.52 March 1978.

Operation for ~ 15 continuous minutes at the frequency specified in the Surveillance Frequency Control Program demonstrates OPERABILITY of the system. Periodic operation ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action.

If significant painting, steam, fire or chemical release occurs such that the HEPA filter or charcoal adsorber could become contaminated from the fumes, chemicals or foreign materials, the same tests and sample analysis shall be performed as req1,1ired for operational use. The determination of significance shall be made by the Vice President-TMI Unit 1.

Demonstration of the automatic initiation of the recirculation mode of operation is necessary to assure system performance capability. Dampers required for control building isolation and recirculation are specified in UFSAR Sections 7.4.5 and 9.8.1.

Control Room Envelope unfiltered air inleakage testing verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of th_e testing are specified in the Control Room Envelope Hc:ibitability Program.

The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of OBA consequences is no more than 5 rem TEDE and the CRE occupants are protected from hazardous chemicals and smoke. Air inleaka'ge testing verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licen§ing basis analyses of Di3A consequences. When unfiltered air inleakage is greater than the assumed flow rate, Section 3.15.1.5 must be entered. The required actions allow time to restore the CRE boundary to OPERABLE status provided mitigating acti9ns can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref. 1) which endorses, with exceptions, NEI 99~03, Section 8.4 and Appendix F (Ref. 2).

These compensatory measures may also be used as mitigating actions as required by Section 3.15.1.5. Temporary analytical methods may also be used as compensatory measures to 4-55a Amendment No. 65, 179, 218, 223, 226, 264, 274, 282

restore OPERABILITY (Ref. 3). Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis OBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.

References

1. Regulatory Guide 1.196.

2. NEI 99-03, "Control Room Habitability Assessment Guidance", June 2001.

3. Letter from Eric J. Leeds (NRG) to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." (ADAMS Accession No. ML040300694).

4-55b Amendment No. 264

4.12.2 REACTOR BUILDING PURGE AIR TREATMENT $YSTEM Deleted

4-55c AmendmentNo.55,68, 108,149,157,170,176,218,226,240,245,264

4.12.3 AUXILIARY AND FUEL HANDLING BUILDING AIR TREATMENT SYSTEM DELETED

Amendment No. 55, 76, 122, 177, 248 4-55d

THIS PAGE LEFT BLANK INTENTIONALLY

Amendment No. 55, 122, 157, 179, 218, 248 4-55e

4.12.4 FUEL HANDLING BUILDING ESF AIR TREATMENT SYSTEM Applicability Applies to Fuel Handling Building (FHB) ESF Air Treatment System and associated components.

Objective To verify that this system and associated components will be able to perform its design functions.

Specification 4.12.4.1 Each refueling interval prior to movement of irradiated fuel:

a. The pressure drop across the entire filtration unit shall be demonstrated to be less than 7.0 inches of water at 6,000 cfm flow rate (+/-10%).

b. The tests and sample analysis required by Specification 3.15.4.2 shall be performed.

4.12.4.2 Testing necessary to demonstrate operability shall be performed as follows:

a. The tests a.nd sample analysis required by Specification 3.15.4.2 shall be performed following significant painting, steam, fire, or chemical release in any ventilation zone communicating with the system that could contaminate the HEPA filters or charcoal adsorbers.

b. DOP testing shall be perfprmed after each complete or partial replacement of a HEPA filter barik, and after any structural maintenance on the system housing that could affect the HEPA filter bank bypass leakage.

c. Halogenated hydrocarbon testing shall be performed ~fter ea.ch complete or partial replacement of a charcoal adsorber bank, and after any structural maintenance on the system housing that could affect charcoal adsorber bank bypass leakage.

4.12.4.3 Each filter train shall be operated for ~15 continuous minutes at the frequency specified in the Surveillance Frequency Control Program.

4.12.4.4 An air flow distribution test shall be performed on the HEPA filter bank initially and after any maintenance or testing that could affect the air flow distribution within the system. The distribution across the HEPA filter bank shall be uniform within

+/-20%. The test shall be performed at 6,000 cfm +/- 10% flow rate.

4-55f Amendment No. 122,, 274, 282

The FHB ESF Air Treatment System is a system which is normally kept in a "standby" operating status.

Tests and sample analysis assure that the HEPA filters and charcoal adsorbers can perform as evaluated.*

The charcoal adsorber efficiency test procedure should allow for the removal of a sample from one adsorb~r test canister. Each sample should be at least two inc.hes in diameter and a length equal to the thickness of the bed. The in-place test criteria for activated charcoal will meet the guidelines of ANS1-N510-1980. The laboratory test of charcoal will be performed in accordance with ASTM 03803-198.9. If laboratory test results are unacceptable, all adsorbent in the system shall be replaced with an adsorbent qualified in accordance with ASTM D3803-1989. Any HEPAfilters found defective will be replaced with filters qualified in accordance with ANS1-N509-1980.

Pressure drop across the entire filtration unit of less than 7.0 inches of water at the system design flow rate will indicate that the filters and adsorbers are not clogged by excessive amounts of foreigri matter.

Operation for<!: 15 continuous minutes at the frequency specified in the Surveillance Frequency Control Program demonstrates OPERABILITY of the system. Periodic operation ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action.

If significant painting, steam, fire, or chemical release occurs such that the HEPA filter or charcoal adsorber could become contaminated from the fumes, chemicals or foreign material, the same tests and sample analysis shall be performed as required for operational movement of irradiated fuel. The determination of what is significant shail be made by the Vice President-TM! Unit 1.

\

Amendment No. 122, Hi7, 179,218, 22'6, 274,282 4-55g

r

4.13 RADIOACTIVE MATERIALS SOURCES SURVEILLANCE Applicability Applies to leakage testing of byproduct, source, and special nuclear radioactive material sources.

Objective To assure that leakage from byproduct, source, and special nuclear radioactive material sources does not exceed allowable limits.

Specification Tests for leakage and/or contamination shall be performed by the licensee or by other persons specifically authorized by the Commission or an agreement State, as follows:

1. Each sealed source, except startup sources previously subject to core flux, containing radioactive material, other than Hydrogen 3, with a half-life greater than 30 days and in any form other than gas shall be tested for leakage and/or contamination at intervals not to. exceed six months.

{

2. The periodic leak test required does not apply to sealed sources that are stored and not being used. The sources excepted from this test shall be tested for leakage prior to any use or transfer to another user unless they have been leak tested within six rronths prior to the date of use or transfer. In the absence of a certificate from a transferor indicating that a test has been made within six rronths prior to the transfer, sealed sources shall not be put into use until tested.

3. Each sealed source shall be tested within 31 days prior to being subjected to core flux and following repair or maintenance to the source.

4.14 DELETED 4-56 (page 4-57 deleted)

I Amendment No. ,9. 129 3-31-81

4.15 Appl icabil it:,:

MAIN STEAM SYSTEM INSERVICE INSPECTION This technical specification applies to the inservice inspection of four welds in the Main Steam System identified as HS-0001, MS-0002, HS-0003, and MS-0004L of the THl-1 Inservice Inspection Program.

Objective The objective of the Inservice Inspection Program is to provide assurance of the continuing integrity of that portion of the Hain Steam System in which a postulated failure would produce pressures in excess of the compartment wall and/or slab capacities.

Specification 4.15.1. The four weld joints identified above shall be 100 percent inspected in accordance with the ASHE Code, Section XI, Rules for Inservice Inspection of Nuclear Power Plant components, defined in the THI-I Inservice Inspection Program. Inspections are to be performed at a frequency of once every 3-1/2 years (or during the nearest refueling outage).

Prior to initial plant operation, a preoperational inspection of the identified weld joints will be performed and any data acquired will be recorded to form a baseline on which to compare results of subsequent inspections.

Calculations (Reference 1) postulated that breaks in the main steam lines at the containment penetrations in small compartments No. 2 and No. 5 could produce pressures in excess of wall and/or slab capacities.

Inspections are conducted at an inspection frequency of 3 1/2 year intervals following initial plant startup. These inspections have revealed that no degradation of the welds has occurred during the inspection cycles up to and including the 9R outage inspection. Consequently, as further degradation is not expected to occur, justification to extend the inspection frequency to once every ten (10) years is being developed. The conclusions of the technical benefit review will be submitted to the NRC for evaluation in a Technical Specification change request.

Reference (1) UFSAR, Appendix 14A, Section 7.2.l

[

Amendment No. J.H",167 4-58

4.16 REACTOR INTERNALS VENT VALVES SURVEILLANCE Applicability

Applies to Reactor Internals Vent Valves.

Objective To verify that no reactor internals vent valve is stuck in the open position and that each valve continues to exhibit freedom of movement.

Specification Item Test Frequency 4.16.1 Reactor Internals Demonstrate Operability At the frequency specified Vent Valves By: in the Surveillance Frequency Control

a. Conducting a remote Program visual inspection of visually accessible sur-faces of the valve body and disc sealing faces and evaluating any observed surface irregu-larities.

b. Verifying that the valve is not stuck in an open position, and

c. Verifying through manual actuation that the valve is fully open with a force of s 400 lbs. (applied vertically upward).

Bases Verifying vent valve freedom of movement insures that coolant flow does not bypass the core through reactor internals vent valves during operation a11d therefore insures the conservatism of Core Protection Safety limits as delineated in Figures 2.1-1 and 2.1-3, and the tlu.x/f low trip setpoint.

Amendment No. 65, 149, 274 4-59

-l.17 SHOCK SUPPRESSORS (SNUBBER~~

SURVEILLANCE REQUIREMENTS 4.17.1 Each snubber shall be demonstrated OPERABLE by performance of the fol!o,,ing inspection program.

a. Snubber Tvpes As used in this specification, type of snubber shall mean snubbers of the same design and manufacturer, irrespective of capacity.

b. Visual Inspections Snubbers are categorized as inaccessible or accessible during reactor operation and may be treated independently. The Director-Radiological Health and Safety, \\ill ensure that a review is performed for ALARA considerations on all snubbers which are located in radiation areas for the determination of their accessibility. This review shall be in accordance \Vith the recommendations of Regulatory Guides 8. 8 and 8 .10. The determination shall be based upon the knov.n or projected radiation levels at each snubber location v.,foch would render the area inaccessible during reactor operation and based upon the expected time to perform the visual inspection. Snubbers may also be determined to be inaccessible because of their physical location due to an existing industrial safety hazard at the specific snubber location. This determination shall be reviewed and approved by the management position responsible for occupational safety.

Snubbers accessible during reactor operation shall be inspected in accordance v,ith the schedule stated below. Snubbers scheduled for inspection that are inaccessible during reactor operation because of physical location or radiation levels shall be inspected during the next reactor shutdo\rn greater than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months \'-,'here access is restored* unless pre\iously inspected in accordance \\ith the schedule stated belov,'.

Visual inspections shall include all safety related snubbers and shall be performed in accordance

\\ith the following schedule:

No. Inoperable Snubbers of Each Subsequent Visual Tvpe per Inspection Period Inspection Period**#

0 24 months +/- 25%

l 16 months +/- 25%

2 6 months +/-25%

3,4 124 days +25%

5, 6, 7 62 days +25%

8 or more 31 days +/-25%

Snubbers may continue to be inaccessible during reactor shutdov.n greater than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months (e.g. if purging of the reactor building is not permitted).

The inspection interval for each type of snubber shall not be lengthened more than one step at a time unless a generic problem has been identified and corrected: in that event the inspection interval may be lengthened one step the first time and two steps thereafter if no inoperable snubbers of that type are found .

-~-.

The provisions of Table 1.2 are not applicable.

4-60 Amendment No. 30, 106, 110, 175, 179 219

SHOCK SUPPRESSORS <SNUBBERS>

SURVEILLANCE REQUIREMENTS <Continued>

c. Refueling Outage Inspections At least once each refueling cycle during shutdown, a visual inspection shall be performed of all safety related snubbers attached to sections of safety systems piping that have experienced unexpected, potentially damaging transients as determined from a review of operational data and a visual inspection of the systems.

d. Visual Insp-ction Acceptance Criteria Visual inspections shall verify: (1) that there are no visible indications of damage or impaired operability and

<2> attachments to the foundation or supporting structure are secure. Snubbers which appear inoperable as a result of visual inspections may be determined OPERABLE for the purpose of establishing the next visual inspection in-terval, provided that: (1) the cause of the rejection is clearly established and remedied for that particular snubber and for other snubbers that may be generically susceptible, and <2> the affected snubber is functionally tested in the as found condition and determined OPERABLE per Specification 4. 17-lf. Hhen the reservoir outlet port of a snubber is found to be uncovered by fluid, the

snubber shall only be declared operable if functional testing in both extension and retraction directions is satisfactory and an engineering evaluation concludes that this snubber is operable.

e. Functional Tests*

At least once each refueling interval during shutdown, a representative sample of snubbers shall be tested using one of the following ~ample plans. The sample plan shall be selected prior to the test period and cannot be changed during the test period. The NRC Regional Administrator shall be notified in writing of the sample plan selected prior to the test period, or the sample plan used in the prior test period shall be used:

l) At least 101 of the total each type of snubber in use in the plant shall be functionally tested either in-place or 1n a bench test. For each snubber of a type that does not meet the functional test acceptance criteria of Specification 4.17.lf, an additional 101 of that type of snubber shall be functionally tested until no more failures are found or until all snubbers of that type have been functionally tested; or The four 550,000 lb reactor coolant pump snubbers are not Included. The functional test program for reactor coolant pump snubbers is implemented in accordance with the schedule and other requirements of the snubber testing program.

4-61 Amendment No. )IY. )Rl6. ~ 149

/.,._ ,,_-<

- SHOO< SUPPRESSORS (SNUBBERS)

SURVEILLANCE RECUIREMENTS (Continued)

2) A xepresentative sample of each type of snubber shall be functionally tested in accordance with Figure 4.17-1. 11 C11 is the total number of snubbers of a type found not meeting the acceptance requirements of Specification 4.17.lf *. The cunulative number of snubbers of a type tested is Denoted by "N". At the end of each day's testing, the new values of "N" and "C" (previous day's total plus current day's increments) stall be plotted on Figure 4.17-1. l f at any time tne point plotted falls in the "Rejectu region all snubbers of that type shall be functionally tested. lf at any time the point plotted falls in the "Accept" region testing of that type of snubber may tie tenninated. When the point plotted lies in the "Continue Testing" region, additional snubbers of that type shall be tested until the point falls in the "Accept" region or the "Reject" region, or all the snubbers of that type have been tested. Testing equipment failure during functional testing may invalidate that day's testing and allow that day's testing to resune anew at a later time, provided all snubbers tested with the failed equipment during the day of equipment failure are

( retested.

The representative ~mple selected for functional test sample plans shall be randomly selected from the snubbers of each type and reviewed before beginning the testing. The review. shall ensure as far as practicable that they are representative of the various configurations, operating environments, and the range of size and capacity of snubbers of each type. Snubbers placed in the same location as snubbers which failed the previous functional test shall be retested at the time of the next functional test but shall not be included in the sample plan. If, during-the functional test, additional sampling is required due to failure of only one type of snubber, the functional test results srall be reviewed at that time to determine if additional samples should be limited tu the type of snubber which has failed the functional testing.

f. Functional Test Accectance Criteria 1he snubber functional test shall verify that!

1) Snubber activation (restraining action or lockup) is achieved within the specified velocity range in beth tension and compression.

2) Snubber release rate (bleed) is achieved in both tension and compression, within the specified range.

Fasteners for attachnent of the snubber tc ttie component and to 3) the snubber anchorage, are secure.

4-62 Ar..endment No. 1m, 106

SHOCK SUPPRESSORS (SNUBBERS)

SURVEILLANCE REQUIREMENTS (Continued)

Testing methods may be used to measure parameters indirectly, or parameters other than those specified, if those results can be correlated to the specified parameters through established methods.

g. Functional Test Failure Analysis

1. Cause of Failure Evaluation An engineering evaluation shall be made of each failure to meet the functional test acceptance criteria to determine the cause of the failure. The results of this evaluation shall be used, if applicable, in selecting snubbers to be tested in an effort to determine the operability of other snubbers, irrespective of type, which may be subject to the same failure mode.

2. Damage Evaluation For the snubbers found inoperable, an engineering evaluation shall be performed on the components to which the inoperable snubbers are attached. The purpose of this engineering

/'

evaluation shall be to determine if the components to which the

inoperable snubbers are attached were adversely affected by the inoperability of the snubbers in order to ensure that the component remains capable of meeting the designed service.

If any snubber selected for functional testing either fails to activate (loekup) or fails'to extend or retract, i.e.,

frozen-in-place, the cause will be evaluated and, if caused by manufacturer or design deficiency, all snubbers of the same type which are subject to the same defect shall be evaluated in a manner to ensure ope~abi!ity. This testing requirement shall be independent of the requirements stated in Specification 4.17.le fox snubbers not meeting the functional test acceptance c~iteria.

h. Functional Testina of Reoaired and Reolaced Snubbers

SnubbeTs which fail the visual inspection or the functional test acceptance criteria shall be repaired or replaced. Replacement snubbexs and snubbers which have repairs which might affect the functional test result shall have been tested to meet the functional test criteria before installation in the unit.

Amendment No. l OG 4-63

SHOCK SUPPRESSORS CSNUBBERS>

t SURVEILLANCE REQUIREMENTS <Continued)

i. Snubber Seal Service Program A snubber seal service life program shall be developed whereby the seal service life of hydraulic snubbers is monitored to ensure that the service life is not exceeded between surveillance inspections. The designated service life for the various seals shall be established based on engineering information. The seals shall be replaced so that the indicated service life will not be exceeded during a period when the snubber 1s required to be OPERABLE. The seal replacements shall be documented and the documentation shall be retained 1n accordance with Specification 6. 10.2.m.

(

Amendment No. ~ ~. 149 4-64

y

.; Bases

All safety related hydraulic snubbers are visually inspected for overall integrity and operability. The inspection includes verification of proper orientation, adequate hydraulic fluid level, and proper attachment of snubber to piping and structures.

The visual inspection frequency is based upon maintaining a constant level of snubber protection. Thus, the required inspection interval varies inversely with the observed snubber failures. The number of inoperable snubbers found during a required inspection determines the time interval for the next required inspection. Inspections performed before that interval has e!apsed may be used as a new reference point to determine the next inspection.

However, the results of such early inspections performed before the original required time interval has elapsed (nominal time less 25%) may not be used to lengthen the required inspection interval. Any inspection whose results require a shorter inspection interval will override the previous schedule.

Those snubbers which are inaccessible during reactor operation are not required to be inspected in accordance with the indicated inspection interval but must be inspected during the next shutdown when access is restored.

When the cause of the rejection of a snubber by visual inspection is clearly established and remedied for that snubber and for any other snubbers that may be generically susceptible, that snubber may be exempted from being counted as inoperable if it is determined operable by functional testing. Generically

(

susceptible snubbers are those snubbers which are of a specific make or ~odel and have the same design features directly related to rejection of the snubbers by visual inspection, or are similiarly located or exposed to the same environmental conditions such as temperature, radiation, and vibration.

When a snubber is found inoperable, an engineering evaluation is performed, in addition to the determination of the snubber mode of failure, in orde~ to determine if any safety-related component or system has been adversely affected by the inoperability of the snubber. The engineering evaluation shall determine whether or not the snubber mode of failure has imparted a significant effect or degradation on the supported co~ponent or syste~.

To provide assurance of snubber functional reliability, one of tr1e two sampling and acceptance criteria methods are used:

1. Functionally test 10% of a type of snubber with an additional 10%

tested for each functional testing failure, or

2. Functionally test a sample size and determine sample acceptance or rejection using Figure 4.17-1.

Figure 4.17-1 was developed using "Wald's Sequential Probability Ratio Plan" as described in "Quality Control and Industrial Statistics" by Acheson J.

Duncan

4-65 Amentlrhent No. l 06

.snubber seal service life fs evaluated via 'IDB'nufacturer input aJ'ld infortaation *through consideration of the snubber service conditions and associated installation and maintenance records.

The requirement to mnitor the snubber seal service life is incl uded to ensure 'tha t the sea 1s period i ca 11 y undergo a-~-

pe rfonnance evaluation in view of their age and operating conditions. These records will provide statistical bases for future consideration nf snubber seal service life. The requirements for the maintenance of records and the snubber seal service life are not intended to affect plant oper~tion.

A technique and method for functional testing of the 550,000 lb.

reactor coolant pump snubbers is current1y under development. The functional test program shall be developed by Cycle 6 refueling or July 1. 1985, whichever is earlier. The functional test program shall be implemented in accordance with the schedule and other requirements of 'the .program.

A list of individual snubbers with appropriate detailed J information is maintained at the plant site. As a basis for -

pennanent deletion of a snubber from the list of safety related snubbers 1 an engineering analysis must be performed to verify that the original safety analysis design criteria are either met or exceeded. Snubber additions and deletions are reported to the NRC in accordance with 10 CFR 50.59 requirements.

-*- Amendment No. *1,i. 110 4-66

l lO 0..,

8

---1

~ 7 /

u REJECT /

E ~

C

/ -

i t..:.J lo-I ~~1 ' / - -

e,.-, ~ '1.*/

L....

1-- C 5

/ :..u c... t~~~ /

>- -/ I

'r- 4 w..

0

/ COiHINUE CJ")

c:::

w 3

~/ TESTING I

/.

=

~

z V'J w..

2/

/

.. f;~

., '~V

'1..

0

. ~ IACCEPT

"~

I 0

z: 1 V

/ Iso

~

--1

/ , -

~

E 0 10, 20 30 40 50 60 70 80

~

...)

N CUMULATIVE NO. OF srrnBBERS OF TYPE TESTED

(

FIGURE 4.17-1 SNUBBER FUNCTIONAL TEST - S~.I*:?LE PLAN 2 Amendment No. ~ , 167

THIS PAGE INTENTIONALLY LEFT BLANK

(Pages 4-69 through 4-76A deleted) 4-68

4.19 STEAM GENERATOR (SG) TUBE INTEGRITY Applicability: Whenever the reactor coolant average temperature is above 200°F Surveillance Requirements (SR):

Each steam generator shall be determined to have tube integrity by performance of the following:

4.19.1 Verify SG tube integrity in accordance with the Steam Generator Program.

4.19.2 Verify that each inspected SG tube that satisfies the tube plugging criteria is plugged in accordance with the Steam Generator Program prior to exceeding an average reactor coolant temperature of 200°F following an SG tube inspection.

BASES:

BACKGROUND Steam generator (SG) tubes are small diameter, thin walled tubes that carry primary coolant through the primary to secondary heat exchangers.

The SG tubes have a number of important safety functions. Steam generator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary system's pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by TS Section 3.4.

SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements.

Steam generator tubing is subject to a variety of degradation mechanisms. Steam generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along wit.h other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively.

The SG performance criteria are used to manage SG tube degradation.

Specification 6.19, "Steam Generator (SG) Program," requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 6.19, tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria: structural integrity, accident induced leakage, and

Amendment No. 47, 261, 279 (12 22 78) 4-77

BACKGROUND (continued) operational leakage. The SG performance criteria are described in Specification 6.19. Meeting the SG performance criteria provides reasonable assurance of maintaining tube integrity at normal and accident conditions.

The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Ref. 1).

APPLICABLE The steam generator tube rupture*(SGTR) accident is the limiting design SAFETY basis event for SG tubes and avoiding an SGTR is the basis for this ANALYSES Specification. The analysis of a SGTR event assumes a bounding primary to secondary leakage rate associated with a double-ended rupture of a single tube. The accident analysis for a SGTR assumes the contaminated secondary fluid is only briefly released to the atmosphere via safety valves and the majority is discharged to the main condenser.

The analysis for design basis accidents and transients other than a SGTR assume the SG tubes retain their structural integrity (i.e.; they are assumed not to rupture.) In these analyses, the steam discharge to the atmosphere is based on the total primary to secondary leakage from all SGs of 1 gallon per minute or is assumed to increase to 1 gallon per minute as a result of accident-induced conditions. For accidents that do not involve fuel damage, the prim'ary coolant activity level of DOSE EQUIVALENT 1-131 is conservatively assumed to be equal to, or greater than, the TS 3.1.4, "Reactor Coolant System Activity," limits. For

accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of GDC 19 (Ref.

2), 10 CFR 100 (Ref. 3) or the NRC approved licensing basis (e.g., a small fraction of these limits).

Steam generator tube integrity satisfies Criterion 2 of 10 CFR

" 50.36(c)(2)(ii).

LCO TS 3.1.1.2.a The LCO requires that SG tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the plugging criteria be plugged in

, accordance with the Steam Generator Program.

During a SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed from service by plugging.

If a tube was determined to satisfy the plugging criteria but was not plugged, the tube may still have tube integrity.

In the context of this Specification, a SG tube is defined as the entire length of the tube, including*the tube wall between the tube-to-tuQesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet.

The tube-to-tubesheet weld is not considered part of the tube.

4-78 Amendment No. 47,163,237,261,271,279 (12 22 78)

LCO (continued)

A SG tube has tube integrity when it satisfies the SG performance criteria.

The SG performance criteria are defined in Specification 6.19, "Steam Generator Program," and describe acceptable SG tube performance. The

Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria.

There are three SG performance criteria: structural integrity, accident induced leakage, and operational leakage. Failure to meet any one of these criteria is considered failure to meet the LCO.

The structural integrity performance criterion provides a margin of safety against tube burst or collapse under normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Tube burst is defined as, The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement {e.g., opening area increased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero." The structural integrity performance criterion provides guidance on assessing loads that have a significant effect on burst or collapse. In that context, the term "significant is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established." For tube integrity evaluations, except for circumferential degradation, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primary or secondary loads will be evaluated on a case-by-case basis. The division between primary and secondary classifications will be based on detailed analysis and/or testing.

Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all ASME Code, Section Ill, Service Level A (normal operating conditions) and Service Level B {upset or abnormal conditions) transients included in the design specification. This includes safety factors and applicable design basis loads based on ASME Code, Section Ill, Subsection NB (Ref. 4) and Draft Regulatory Guide 1.121 {Ref. 5).

The accident induced leakage performance criterion ensures that the primary to secondary leakage caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions. The accident analysis assumes that accident induced leakage does not exceed 1 gpm per SG.

4-79 Amendment No. 47, 163, 208, 209, 281, 271

LCO (continued) The accident induced leakage rate includes any primary to secondary leakage existing prior to the accident in addition to primary to secondary

leakage induced during the accident.

The operational leakage performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational leakage is contained in TS 3.1.6.3, "LEAKAGE," and limits primary to secondary leakage through any one SG to 150 gallons per day. This .limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of leakage is due to more than one crack, the cracks are very small, and the above assumption is conservative.

APPLICABILITY Steam generator tube integrity is challenged when the pressure differential across the tubes is large. Large differential pressures across SG tubes can only be experienced when the reactor coolant system average temperature is above 200°F.

RCS conditions are far less challenging when average temperature is at or below 200°F; primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for leakage.

ACTIONS The ACTIONS are modified by a Note clarifying that the Conditions may be entered independently for each SG tube. This is acceptable because the Required Actions provide appropriate compensatory actions for each affected SG tube. Complying with the Required Actions may allow for continued operation, and subsequent affected SG tubes are governed by subsequent Condition entry and application of associated Required Actions.

3.1.1.2.a.(3.)a. and 3.1.1.2.a.(3.)b.

3.1.1.2.a.(3.) applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube plugging criteria but were not plugged in accordance with the Steam Generator Program as required by Surveillance Requirement 4.19.2. An evaluation of SG tube integrity of the affected tube(s) must be made. Steam generator tube integrity is based on meeting the SG performance criteria described in the Steam Generator Program. The SG plugging criteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the time the situation is discovered and the estimated growth of the degradation prior to the next SG tube inspection. If it is determined that tube integrity is not being maintained, 3.1.1.2.a.(4.) applies .

4-80 Amendment No 116, 1 4 9, 153, 206, 237, 261, 271, 279

ACTIONS (continued)

A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with a SG tube that may not have tube integrity.

If the evaluation determines that the affected tube(s) have tube integrity, Required Action 3.1.1.2.a.(3.)b. allows plant operation to continue until the next refueling outage or SG inspection provided the inspection interval continues to be supported by an operational assessment that reflects the affected tubes. However, the affected tube(s) must be plugged prior to exceeding a reactor coolant average temperature of 200°F following the next refueling outage or SG inspection. This Completion Time is acceptable since operation until the next inspection is supported by the operational assessment.

3.1.1.2.a.(4.)

If the Required Actions and associated Completion Times of Condition 3.1.1.2.a.(3.) are not met or if SG tube integrity is not being maintained, the reactor must be brought to HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems .

SURVEILLANCE REQUIREMENT SR 4.19.1:

During shutdown periods the SGs are inspected as required by this SR and the Steam Generator Program. NEI 97-06, "Steam Generator Program Guidelines" (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices.

During SG inspections a condition monitoring assessment of the SG tubes is performed. The condition monitoring assessment determines the "as found" condition of the SG tubes. The purpose of the condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.

The Steam Generator Program determines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube plugging criteria. Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing and potential degradation locations. The Steam Generator Program also

4-81 Amendment No. 47, 83, 91, 103, 129, 149, 153, 157, 206, 209, 237, 261, 279

SURVEILLANCE REQUIREMENTS (continued)

specifies the inspection methods to be used to find potential degradation .

Inspection methods are a function of degradation morphology, non-destructive examination (NOE) technique capabilities, and inspection locations.

The Steam Generator Program defines the frequency of SR 4.19.1. The frequency is determined by the operational assessment and other limits in the SG examination guidelines (Ref. 6). The Steam Generator Program uses information on existing degradations and growth rates to determine an inspection frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 6.19 contains prescriptive requirements concerning inspection intervals to provide added assurance that the SG performance criteria will be met between scheduled inspections. If crack indications are found in any SG tube, the maximum inspection interval for all affected and potentially affected* SGs is restricted by Specification 6.19 until subsequent inspections support extending the inspection interval.

SURVEILLANCE REQUIREMENT SR 4.19.2:

During an SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed from service by plugging.

The tube plugging criteria delineated in Specification 6.19 are intended to ensure that tubes accepted for continued service satisfy the SG performance criteria with allowance for error in the flaw size measurement and for future flaw growth. In addition, the tube plugging criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s). Reference 1 provides guidance for performing operational assessments to verify that the tubes remaining in service will continue to meet the SG performance criteria .

4-82 AmendmentNo.47,86, 116,149,163,206,209,237,261,271,279

The frequency of "prior to exceeding an average reactor coolant

temperature of 200°F following an SG tube inspection" ensures that the Surveillance has been completed and all tubes meeting the plugging criteria are plugged prior to subjecting the SG tubes to significant primary to secondary pressure differential.

REFERENCES

1. NEI 97-06, "Steam Generator Program Guidelines".

2. 10 CFR 50 Appendix A, GDC 19.

3. 10 CFR 1.00.

4. ASME Boiler and Pressure Vessel Code, Section Ill, Subsection NB.

5. Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam Generator Tubes,"

August 1976.

6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines" .

4-83 (Pages 4-84 through 4-85 deleted)

Amendment No. 47,129,206,209,237,261,271,279

4.20 REACTOR BUILDING AIR TEMPERATURE Applicability This specification applies to the average air temperature of the primary containment during power operations.

Objective To assure that the temperatures used in the safety analysis of the reactor building are not exceeded.

Specification 4.20.1 When the reactor is critical, the reactor building temperature will be checked at the frequency specified in the Surveillance Frequency Control Program. If any detector exceeds 130°F (120°F below elevation 320) the arithmetic average will be computed to assure compliance with Specification 3.17.1. *

Amendment No. 4-t,-47, 27 4 4-86

4.21 RADIOACTIVE EFFLUENT INSTRUMENTATION 4.21.1 Deleted Radioactive Li_quid Effluent Instrumentation Deleted 4.21.2 Radioactive Gaseous Process &Effluent Monitoring Instrumentation Deleted 4.22 RADIOACTIVE EFFLUENTS Deleted 4.22.1 Liquid Effluents Deleted 4.22.2 Gaseous Effluents Deleted 4.22.3 Solid Radioactive Waste

,. Deleted

4.22.4 Total Dose Deleted 4.23 RADIOLOGICAL ENVIRONMENTAL MONITORING Deleted 4.23.1 Monitoring Program Deleted

4. 23. 2* Land Use Census Deleted 4.23.3 Interlaboratory Comparison Program Deleted 4-87

{4-88 thru 4-122 deleted)

Amendment No. 7h ea, JIJI, JU, U~. 1n, JJJ, J71, J77, 197

ML18108A176

Text

Subject:

Enclosure:

Navigation menu

Search