Text

Transmittal of Revision 7 to Clinton Power Station Technical Specification Bases
	ML023430450
Person / Time
Site:	Clinton
Issue date:	11/27/2002
From:	Iliff W; AmerGen Energy Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	U-603588
	Download: ML023430450 (133)
	v • d • e

Amer@

An Exelon/British Energy Company Clinton Power Station R R 3 Box 228 Clinton, IL 61727-9351 10CFR50.36 U-603588 November 27, 2002 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Clinton Power Station, Unit 1 Facility Operating License No. NPF-62 NRC Docket No. 50-461

Subject:

Transmittal of Revision 7 to the Clinton Power Station Technical Specification Bases In accordance with Clinton Power Station (CPS) Technical Specification 5.5.11, "Technical Specification (TS) Bases Control Program," AmerGen Energy Company, LLC (i.e.,

AmerGen) is transmitting the revised pages constituting Revision 7 to the CPS TS Bases.

The changes associated with this revision were processed in accordance with CPS TS 5.5.11 which became effective with Amendment No. 95 to the CPS Operating License.

Compliance with CPS TS 5.5.11 requires updates to the TS Bases to be submitted to the NRC at a frequency consistent with 1 OCFR50.71 (e).

Should you have any questions concerning this letter, please contact Mr. Jim Peterson at (217) 937-2810.

Respectfully, William 4li S.

Regulatory Assurance Manager Clinton Power Station JLP\blf Attachment

- Attachment A: Revision 7 of the CPS Technical Specification Bases

November 27, 2002 U. S. Nuclear Regulatory Commission Page 2 of 2 cc: Regional Administrator- NRC Region III NRC Senior Resident Inspector - Clinton Power Station Office of Nuclear Facility Safety - Illinois Department of Nuclear Safety

Attachment A Clinton Power Station, Unit 1 Revision 7 to the CPS Technical Specification Bases B 2.0-3 B 3.3-69 B 3.5-14a B 3.8-46 B 3.0-12 B 3.3-71 B 3.5-25 B 3.8-48a B 3.0-13 B 3.3-73 B 3.6-8 B 3.8-50 B 3.0-14 B 3.3-98 B 3.6-12 B 3.8-51 B 3.0-15 B 3.3-99 B 3.6-13 B 3.8-52 B 3.1-18 B 3.3-107 B 3.6-22 B 3.8-53 B 3.1-23 B 3.3-124 B 3.6-22a B 3.8-54 B 3.1-34 B 3.3-126 B 3.6-25 B 3.8-55 B 3.1-35 B 3.3-140 B 3.6-27 B 3.8-56 B 3.1-36 B 3.3-144 B 3.6-28a B 3.8-57 B 3.2-2 B 3.3-145 B 3.6-28b B 3.8-58 B 3.2-3 B 3.3-146a B 3.6-37 B 3.8-59 B 3.2-4 B 3.3-148 B 3.6-38 B 3.8-60 B 3.2-6 B 3.3-152 B 3.6-39 B 3.8-61 B 3.2-7 B 3.3-152a B 3.6-40 B 3.8-62 B 3.2-8 B 3.3-152b B 3.6-43 B 3.8-63 B 3.2-10 B 3.3-153 B 3.6-85 B 3.8-64 B 3.2-11 B 3.3-157 B 3.6-86 B 3.8-65 B 3.3-7 B 3.3-158 B 3.6-87 B 3.8-66 B 3.3-13 B 3.3-169 B 3.6-90 B 3.8-67 B 3.3-16 B 3.3-179 B 3.6-91 B 3.8-68 B 3.3-17 B 3.3-180 B 3.6-93 B 3.8-68a B 3.3-18 B 3.4-3 B 3.6-98 B 3.8-68b B 3.3-22 B 3.4-4 B 3.6-99 B 3.9-3 B 3.3-23 B 3.4-6 B 3.6-100 B 3.9-4 B 3.3-24 B 3.4-16 B 3.6-105a B 3.3-29 B 3.4-21 B 3.6-129 B 3.3-41 B 3.4-22 B 3.6-130 B 3.3-42 B 3.4-53a B 3.7-26 B 3.3-43 B 3.4-56 B 3.8-6 B 3.3-54 B 3.4-61 B 3.8-9 B 3.3-55 *-B 3.4-61b B 3.8-10 B 3.3-66 B 3.5-12 B 3.8-15 B 3.3-67 B 3.5-13 B 3.8-32a B 3.3-68 B 3.5-14 B 3.8-45

Reactor Core SLs B 2.1.1 BASES APPLICABLE 2.1.1.1 Fuel Cladding Integrity (continued)

SAFETY ANALYSES indicate that the fuel assembly critical power at this flow is approximately 3.35 MWt. With the design peaking factors, this corresponds to a THERMAL POWER

> 41.7% RTP. Thus, a THERMAL POWER limit of 21.6% RTP for reactor pressure < 785 psig is conservative.

2.1.1.2 MCPR The fuel cladding integrity SL is set such that no significant fuel damage is calculated to occur if the limit is not violated. Since the parameters that result in fuel damage are not directly observable during reactor operation, the thermal and hydraulic conditions that result in the onset of transition boiling have been used to mark the beginning of the region in which fuel damage could occur.

Although it is recognized that the onset of transition boiling would not result in damage to BWR fuel rods, the critical power at which boiling transition is calculated to occur has been adopted as a convenient limit. However, the uncertainties in monitoring the core operating state and in the procedures used to calculate the critical power result in an uncertainty in the value of the critical power.

Therefore, the fuel cladding integrity SL is defined as the critical power ratio in the limiting fuel assembly for which more than 99.9% of the fuel rods in the core are expected to avoid boiling transition, considering the power distribution within the core and all uncertainties.

The MCPR SL is determined using a statistical model that combines all the uncertainties in operating parameters and the procedures used to calculate critical power. The probability of the occurrence of boiling transition is determined using the approved General Electric critical power correlations. Details of the fuel cladding integrity SL calculation are given in Reference 2. Reference 2 also includes a tabulation of the uncertainties used in the determination of the MCPR SL and of the nominal values of the parameters used in the MCPR SL statistical analysis.

(continued)

CLINTON B 2.0-3 Revision No. 7-5

SR Applicability B 3.0 BASES SR 3.0.2 The 25% extension does not significantly degrade the (continued) reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply. These exceptions are stated in the individual Specifications. The requirements of regulations take precedence over the TS. Therefore, when a test interval is specified in the regulations, the test interval cannot be extended by the TS, and the TS will then include a Note stating, "SR 3.0.2 is not applicable." An example of an exception when the test interval is not specified in the regulations is the Note in the Primary Containment Leakage Rate Testing Program, "SR 3.0.2 is not applicable." This exception is provided because the program already includes extension of test intervals.

As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a "once per..." basis. The 25%

extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25%

extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.

The provisions of SR 3.0.2 are not intended to be used repeatedly merely as an operational convenience to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.

SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified Frequency. A delay period of up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or up to the limit of the specified Frequency, whichever is greater , applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time (continued)

CLINTON B 3.0-12 Revision No. 7-5

SR Applicability B 3.0 BASES SR 3.0.3 that the specified Frequency was not met. This delay period (continued) provides adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with Required Actions or other remedial measures that might preclude completion of the Surveillance.

The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.

When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the surveillance.

However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity. SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions.

Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals. While up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a) (4) and its implementation guidance, NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management actions up to an including plant shutdown. The (continued)

CLINTON B 3.0-13 Revision No. 7-5

SR Applicability B 3.0 BASES missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component.

Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the Clinton Power Station Corrective Action Program.

If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable then is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.

Completion of the Surveillance within the delay period (continued) allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.

SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.

This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit.

However, in certain circumstances failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change. When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency, on equipment that is inoperable, does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions in the Applicability. However, since the LCO is (continued)

CLINTON B 3.0-14 Revision No. 7-5

SR Applicability B 3.0 BASES SR 3.0.4 not met in this instance, LCO 3.0.4 will govern any (continued) restrictions that may (or may not) apply to MODE or other specified condition changes.

The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.

The provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown.

The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCO Applicability would have its Frequency specified such that it is not "due" until the specific conditions needed are met. Alternately, the Surveillance may be stated in the form of a Note as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.

SR 3.0.4 is only applicable when entering MODE 3 from MODE 4, MODE 2 from MODE 3 or 4, or MODE 1 from MODE 2.

Furthermore, SR 3.0.4 is applicable when entering any other specified condition in the Applicability only while operating in MODE 1, 2, or 3. The requirements of SR 3.0.4 do not apply in MODES 4 and 5, or in other specified conditions of the Applicability (unless in MODE 1, 2, or 3) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.

CLINTON B 3.0-15 Revision No. 7-5

Control Rod OPERABILITY B 3.1.3 BASES ACTIONS C.1 and C.2 (continued)

The allowed Completion Times are reasonable, considering the small number of allowed inoperable control rods, and provide time to insert and disarm the control rods in an orderly manner and without challenging plant systems.

D.1 and D.2 Out of sequence control rods may increase the potential reactivity worth of a dropped control rod during a CRDA. At

< 16.7% RTP, the generic banked position withdrawal sequence (BPWS) analysis (Ref. 8) requires inserted control rods not in compliance with BPWS to be separated by at least two OPERABLE control rods in all directions, including the diagonal. Therefore, if two or more inoperable control rods are not in compliance with BPWS and not separated by at least two OPERABLE control rods, action must be taken to restore compliance with BPWS or restore the control rods to OPERABLE status. A Note has been added to the Condition to clarify that the Condition is not applicable when

> 16.7% RTP since the BPWS is not required to be followed under these conditions, as described in the Bases for LCO 3.1.6. The allowed Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is acceptable, considering the low probability of a CRDA occurring.

E.1 If any Required Action and associated Completion Time of Condition A, C, or D are not met or nine or more inoperable control rods exist, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This ensures all insertable control rods are inserted and places the reactor in a condition that does not require the active function (i.e., scram) of the control rods. The number of control rods permitted to be inoperable when operating above 16.7% RTP (i.e., no CRDA considerations) could be more than the value specified, but the occurrence of a large number of inoperable control rods could be indicative of a generic problem, and investigation and resolution of the potential problem should be undertaken. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

CLINTON B 3.1-18 Revision No. 7-5

Control Rod Scram Times B 3.1.4 BASES APPLICABLE The scram function of the CRD System protects the MCPR SAFETY ANALYSES Safety Limit (SL) (see Bases for SL 2.1.1, "Reactor Core (continued) SLs," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"),

and the 1% cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "'AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), which ensure that no fuel damage will occur if these limits are not exceeded. Above 950 psig, the scram function is designed to insert negative reactivity at a rate fast enough to prevent the actual MCPR from becoming less than the MCPR SL during the analyzed limiting power transient. Below 950 psig, the scram function is assumed to perform during the control rod drop accident (Ref. 7) and, therefore, also provides protection against violating fuel damage limits during reactivity insertion accidents (see Bases for LCO 3.1.6, "Control Rod Pattern"). For the reactor vessel overpressure protection analysis, the scram function, along with the safety/relief valves, ensure that the peak vessel pressure is maintained within the applicable ASME Code limits.

Control rod scram times satisfy Criterion 3 of the NRC Policy Statement.

LCO The scram times specified in Table 3.1.4-1 (in the accompanying LCO) are required to ensure that the scram reactivity assumed in the DBA and transient analysis is met.

To account for single failure and "slow" scramming control rods, the scram times specified in Table 3.1.4-1 are faster than those assumed in the design basis analysis. The scram times have a margin to allow up to 7.5% of the control rods (i.e., 145 x 7.5% = 10) to have scram times that exceed the specified limits (i.e., "slow" control rods) assuming a single stuck control rod (as allowed by LCO 3.1.3, "Control Rod OPERABILITY") and an additional control rod failing to scram per the single failure criterion. The scram times are specified as a function of reactor steam dome pressure to account for the pressure dependence of the scram times. The scram times are specified relative to measurements based on reed switch positions, which provide the control rod position indication. The reed switch closes ("pickup") when the index tube passes a specific location and then opens

("dropout") as the index tube travels upward. Verification of the specified scram times in Table 3.1.4-1 is accomplished through measurement of the "pickup" times.

(continued)

CLINTON B 3.1-23 Revision No. 7-2

Control Rod Pattern B 3.1.6 BASES APPLICABLE Control rod patterns analyzed in Reference 2 follow the SAFETY ANALYSES banked position withdrawal sequence (BPWS) described in (continued) Reference 8. The BPWS is applicable from the condition of all control rods fully inserted to 16.7% RTP (Ref. 9). For the BPWS, the control rods are required to be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions (e.g.,

between notches 08 and 12). The banked positions are defined to minimize the maximum incremental control rod worths without being overly restrictive during normal plant operation. The generic BPWS analysis (Ref. 8) also evaluated the effect of fully inserted, inoperable control rods not in compliance with the sequence, to allow a limited number (i.e., eight) and distribution of fully inserted, inoperable control rods.

Rod pattern control satisfies the requirements of Criterion 3 of the NRC Policy Statement.

LCO Compliance with the prescribed control rod sequences minimizes the potential consequences of a CRDA by limiting the initial conditions to those consistent with the BPWS.

This LCO only applies to OPERABLE control rods. For inoperable control rods required to be inserted, separate requirements are specified in LCO 3.1.3, "Control Rod OPERABILITY," consistent with the allowances for inoperable control rods in the BPWS.

I APPLICABILITY In MODES 1 and 2, when THERMAL POWER is < 16.7% RTP, the CRDA is a Design Basis Accident (DBA) and, therefore, compliance with the assumptions of the safety analysis is required. When THERMAL POWER is > 16.7% RTP, there is no credible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA (Ref. 9). In MODES 3, 4, and 5, since the reactor is shut down and only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will remain subcritical with a single control rod withdrawn.

(continued)

CLINTON B 3.1-34 Revision No. 7-5

Control Rod Pattern B 3.1.6 BASES (continued)

ACTIONS A.1 and A.2 With one or more OPERABLE control rods not in compliance with the prescribed control rod sequence, action may be taken to either correct the control rod pattern or declare the associated control rods inoperable within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

Noncompliance with the prescribed sequence may be the result of "double notching," drifting from a control rod drive cooling water transient, leaking scram valves, or a power reduction to < 16.7% RTP before establishing the correct control rod pattern. The number of OPERABLE control rods not in compliance with the prescribed sequence is limited to eight to prevent the operator from attempting to correct a control rod pattern that significantly deviates from the prescribed sequence. When the control rod pattern is not in compliance with the prescribed sequence, all control rod movement should be stopped except for moves needed to correct the control rod pattern, or scram if warranted.

Required Action A.1 is modified by a Note, which allows control rods to be bypassed in Rod Action Control System (RACS) to allow the affected control rods to be returned to their correct position. This ensures that the control rods will be moved to the correct position. A control rod not in compliance with the prescribed sequence is not considered inoperable except as required by Required Action A.2.

OPERABILITY of control rods is determined by compliance with LCO 3.1.3; LCO 3.1.4, "Control Rod Scram Times"; and LCO 3.1.5, "Control Rod Scram Accumulators." The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is reasonable, considering the restrictions on the number of allowed out of sequence control rods and the low probability of a CRDA occurring during the time the control rods are out of sequence.

B.1 and B.2 If nine or more OPERABLE control rods are out of sequence, the control rod pattern significantly deviates from the prescribed sequence. Control rod withdrawal should be suspended immediately to prevent the potential for further deviation from the prescribed sequence. Control rod insertion to correct control rods withdrawn beyond their allowed position is allowed since, in general, insertion of control rods has less impact on control rod worth than (continued)

CLINTON B 3.1-35 Revision No. 7-5

Control Rod Pattern B 3.1.6 BASES ACTIONS B.1 and B.2 (continued) withdrawals have. Required Action B.1 is modified by a Note that allows the affected control rods to be bypassed in RACS in accordance with SR 3.3.2.1.9 to allow insertion only.

With nine or more OPERABLE control rods not in compliance with BPWS, the reactor mode switch must be placed in the shutdown position within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . With the reactor mode switch in Shutdown, the reactor is shut down, and therefore does not meet the applicability requirements of this LCO.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable to allow insertion of control rods to restore compliance, and is appropriate relative to the low probability of a CRDA occurring with the control rods out of sequence.

SURVEILLANCE SR 3.1.6.1 REQUIREMENTS The control rod pattern is verified to be in compliance with the BPWS at a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency, ensuring the assumptions of the CRDA analyses are met. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency of this Surveillance was developed considering that the primary check of the control rod pattern compliance with the BPWS is performed by the RPC (LCO 3.3.2.1). The RPC provides control rod blocks to enforce the required control rod sequence and is required to be OPERABLE when operating at

< 16.7% RTP.

REFERENCES 1. USAR, Section 15.0

2. USAR, Section 15.4.9.

3. NUREG-0979, "NRC Safety Evaluation Report Related to the Final Design Approval of the GESSAR II BWR/6 Nuclear Island Design, Docket No. 50-447,"

Section 4.2.1.3.2, April 1983.

4. NUREG-0800, "Standard Review Plan," Section 15.4.9, "Radiological Consequences of Control Rod Drop Accident (BWR)," Revision 2, July 1981.

5. 10 CFR 100.11, "Determination of Exclusion Area, Low Population Zone, and Population Center Distance."

(continued)

CLINTON B 3.1-36 Revision No. 7-5

APLHGR B 3.2.1 BASES APPLICABLE to initial core flow levels at power levels below those at SAFETY ANALYSES which turbine stop valve closure and turbine control valve (continued) fast closure scram signals are bypassed, both high and low core flow MAPFACp limits are provided for operation at power levels between 21.6% RTP and the previously mentioned bypass power level. The exposure dependent APLHGR limits are reduced by MAPFACp and MAPFACf at various operating conditions to ensure that all fuel design criteria are met for normal operation and AOOs. A complete discussion of the analysis code is provided in Reference 6.

LOCA analyses are then performed to ensure that the above determined APLHGR limits are adequate to meet the PCT and maximum oxidation limits of 10 CFR 50.46. The analysis is performed using calculational models that are consistent with the requirements of 10 CFR 50, Appendix K. A complete discussion of the analysis code is provided in Reference 7.

The PCT following a postulated LOCA is a function of the average heat generation rate of all the rods of a fuel assembly at any axial location and is not strongly influenced by the rod to rod power distribution within an assembly. The APLHGR limits specified are equivalent to the LHGR of the highest powered fuel rod assumed in the LOCA analysis divided by its local peaking factor. A conservative multiplier is applied to the LHGR assumed in the LOCA analysis to account for the uncertainty associated with the measurement of the APLHGR.

For single recirculation loop operation, the MAPFAC multiplier is limited to a maximum value which is specified in the COLR. This multiplier is due to the conservative analysis assumption of an earlier departure from nucleate boiling with one recirculation loop available, resulting in a more severe cladding heatup during a LOCA.

The APLHGR satisfies Criterion 2 of the NRC Policy Statement.

LCO The APLHGR limits specified in the COLR are the result of fuel design, DBA, and transient analyses. For two recirculation loops operating, the limit is determined by multiplying the smaller of the MAPFACf and MAPFACp factors times the exposure dependent APLHGR limits. With only one (continued)

CLINTON B 3.2-2 Revision No. 7-5

APLHGR B 3.2.1 BASES LCO recirculation loop in operation, in conformance with the (continued) requirements of LCO 3.4.1, "Recirculation Loops Operating,"

the limit is determined by multiplying the exposure dependent APLHGR limit by the smallest of MAPFACf, MAPFACp, and the limiting value specified for single recirculation loop operation in the COLR, which has been determined by a specific single recirculation loop analysis (Ref. 2).

APPLICABILITY The APLHGR limits are primarily derived from fuel design evaluations and LOCA and transient analyses that are assumed to occur at high power levels. Design calculations and operating experience have shown that as power is reduced, the margin to the required APLHGR limits increases. This trend continues down to the power range of 5% to 15% RTP when entry into MODE 2 occurs. When in MODE 2, the intermediate range monitor (IRM) scram function provides prompt scram initiation during any significant transient, thereby effectively removing any APLHGR limit compliance concern in MODE 2. Therefore, at THERMAL POWER levels

< 21.6% RTP, the reactor operates with substantial margin to the APLHGR limits; thus, this LCO is not required.

ACTIONS A.1 If any APLHGR exceeds the required limit, an assumption regarding an initial condition of the DBA and transient analyses may not be met. Therefore, prompt action is taken to restore the APLHGR(s) to within the required limit(s) such that the plant will be operating within analyzed conditions and within the design limits of the fuel rods.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is sufficient to restore the APLHGR(s) to within its limit and is acceptable based on the low probability of a transient or DBA occurring simultaneously with the APLHGR out of specification.

B.1 If the APLHGR cannot be restored to within its required limit within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL (continued)

CLINTON B 3.2-3 Revision No. 7-5

APLHGR B 3.2.1 BASES ACTIONS B.1 (continued)

POWER must be reduced to < 21.6% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 21.6% RTP in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.2.1.1 REQUIREMENTS APLHGRs are required to be initially calculated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is Ž 21.6% RTP and then every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. They are compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on both engineering judgment and recognition of the slowness of changes in power distribution under normal conditions. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after THERMAL POWER ' 21.6% RTP is achieved is acceptable given the large inherent margin to operating limits at low power levels.

With regard to APLHGR values obtained pursuant to this SR, as determined from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).

(continued)

CLINTON B 3.2-4 Revision No. 7-5

MCPR B 3.2.2 BASES APPLICABLE The MCPR operating limits derived from the transient SAFETY ANALYSES analysis are dependent on the operating core flow and power (continued) state (MCPRf and MCPRp, respectively) to ensure adherence to fuel design limits during the worst transient that occurs with moderate frequency (Refs. 3, 4, and 5).

Flow dependent MCPR limits (MCPRf) are determined by steady state thermal hydraulic methods using the three dimensional BWR simulator code (Ref. 7) and the multichannel thermal hydraulic code. MCPRf curves are provided based on the maximum credible flow runout transient. The result of a single failure or single operator error is the runout of only one loop because both recirculation loops are under independent control.

Power dependent MCPR limits (MCPRp) are determined by the three dimensional BWR simulator code and the one dimensional transient code (Ref. 8). Due to the sensitivity of the transient response to initial core flow levels at power levels below those at which the turbine stop valve closure and turbine control valve fast closure scram trips are bypassed, high and low flow MCPRp operating limits are provided for operating between 21.6% RTP and the previously mentioned bypass power level.

The MCPR satisfies Criterion 2 of the NRC Policy Statement.

LCO The MCPR operating limits specified in the COLR are the result of the Design Basis Accident (DBA) and transient analysis. The MCPR operating limits are determined by the larger of the MCPRf and MCPRp limits.

APPLICABILITY The MCPR operating limits are primarily derived from transient analyses that are assumed to occur at high power l levels. Below 21.6% RTP, the reactor is operating at a slow l recirculation pump speed and the moderator void ratio is small. Surveillance of thermal limits below 21.6% RTP is unnecessary due to the large inherent margin that ensures that the MCPR SL is not exceeded even if a limiting transient occurs.

(continued)

CLINTON B 3.2-6 Revision No. 7-5

MCPR B 3.2.2 BASES APPLICABILITY Studies of the variation of limiting transient behavior have (continued) been performed over the range of power and flow conditions.

These studies encompass the range of key actual plant parameter values important to typically limiting transients.

The results of these studies demonstrate that a margin is expected between performance and the MCPR requirements, and that margins increase as power is reduced to 21.6% RTP.

This trend is expected to continue to the 5% to 15% power range when entry into MODE 2 occurs. When in MODE 2, the intermediate range monitor (IRM) provides rapid scram initiation for any significant power increase transient, which effectively eliminates any MCPR compliance concern.

Therefore, at THERMAL POWER levels < 21.6% RTP, the reactor is operating with substantial margin to the MCPR limits and this LCO is not required.

ACTIONS A. I If any MCPR is outside the required limit, an assumption regarding an initial condition of the design basis transient analyses may not be met. Therefore, prompt action should be taken to restore the MCPR(s) to within the required limit(s) such that the plant remains operating within analyzed conditions. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is normally sufficient to restore the MCPR(s) to within its limit and is acceptable based on the low probability of a transient or DBA occurring simultaneously with the MCPR out of specification.

B.1 If the MCPR cannot be restored to within the required limit within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 21.6% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 21.6% RTP in an orderly manner and without challenging plant systems.

(continued)

CLINTON B 3.2-7 Revision No. 7-5

MCPR B 3.2.2 BASES (continued)

SURVEILLANCE SR 3.2.2.1 REQUIREMENTS The MCPR is required to be initially calculated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is > 21.6% RTP and then every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. It is compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on both engineering judgment and recognition of the slowness of changes in power distribution during normal operation. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after THERMAL POWER reaches Ž 21.6% RTP is acceptable given the large inherent margin to operating limits at low power levels.

With regard to MCPR values obtained pursuant to this SR, as determined from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).

REFERENCES 1. NUREG-0562, "Fuel Rod Failures As A Consequence of Nucleate Boiling or Dryout," June 1979.

2. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, GESTAR-II," (latest approved revision).

3. USAR, Section 15.0.

4. USAR, Appendix 15B.

5. USAR, Appendix 15C.

6. NEDC-31546-P, "Maximum Extended Operating Domain and Feedwater Heater Out-of-Service Analysis for Clinton Power Station," August 1988.

7. NEDE-30130-P-A, "Steady State Nuclear Methods," April 1985.

8. NEDO-24154-A, "Qualification of the One-Dimensional Core Transient Model for Boiling Water Reactors,"

General Electric Company, August 1986.

9. Calculation IP-0-0002.

CLINTON B 3.2-8 Revision No. 7-5

LHGR B 3.2.3 BASES APPLICABLE includes allowances for short term transient operation above SAFETY ANALYSES the operating limit to account for AQOs, plus an allowance (continued) for densification power spiking.

LHGR limits are developed as a function of exposure and the various operating core flow and power states to ensure adherence to fuel design limits during the limiting AOOs (Ref. 2). Flow dependent LHGR limits are determined using the three dimensional BWR simulator code (Ref. 5) to analyze slow flow runout transients. The flow dependent multiplier, MAPFACf, is dependent on the maximum core flow runout capability. MAPFACf curves are provided based on the maximum credible flow runout transient. The result of a single failure or single operator error is the runout of only one loop because both recirculation loops are under independent control.

Based on analyses of limiting plant transients (other than core flow increases) over range of power and flow conditions, power dependent multipliers, MAPFACp, are also generated. Due to the sensitivity of the transient response to initial core flow levels at power levels below those at which turbine control valve fast closure scram signals are bypassed, both high and low core flow MAPFACp limits are provided for operation at power levels between 21.6% RTP and the previously mentioned bypass power level. The exposure dependent LHGR limits are reduced by MAPFACp and MAPFACf at various operating conditions to ensure that all fuel design criteria are met for normal operation and AOOs. A complete discussion of the analysis code is provided in Reference 6.

The LHGR satisfies Criterion 2 of the NRC Policy Statement.

LCO The LHGR is a basic assumption in the fuel design analysis.

The fuel has been designed to operate at rated core power with sufficient design margin to the LHGR calculated to cause a 1% fuel cladding plastic strain. The operating limit to accomplish this objective is specified in the COLR.

The LHGR limits specified in the COLR are the result of fuel design and transient analyses. The limit is determined by multiplying the small of the MAPFACf and MAPFACp factors times the exposure dependent LHGR limits.

APPLICABILITY The LHGR limits are derived from fuel design analysis that is limiting at high power level conditions. At core thermal power levels < 21.6% RTP, the reactor is operating with a substantial margin to the LHGR limits and, therefore, the Specification is only required when the reactor is operating at Ž 21.6% RTP.

(continued)

CLINTON B 3.2-10 Revision No. 7-5

LHGR B 3.2.3 BASES ACTIONS A.l If any LHGR exceeds its required limit, an assumption regarding an initial condition of the fuel design analysis is not met. Therefore, prompt action should be taken to restore the LHGR(s) to within its required limit(s) such that the plant is operating within analyzed conditions and within the design limits of the fuel rods. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is normally sufficient to restore the LHGR(s) to within its limit and is acceptable based on the low probability of a transient or Design Basis Accident occurring simultaneously with the LHGR out of specification.

B.1 If the LHGR cannot be restored to within its required limit within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 21.6% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 21.6% RTP in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.2.3.1 REQUIREMENTS The LHGRs are required to be initially calculated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is Ž 21.6% RTP and then every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. They are compared with the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on both engineering judgment and recognition of the slowness of changes in power distribution under normal conditions. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after THERMAL POWER Ž 21.6% RTP is achieved is acceptable given the large inherent margin to operating limits at lower power levels.

With regard to LHGR values obtained pursuant to this SR, as determined from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).

REFERENCES 1. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, GESTAR-II," (latest approved revision).

2. USAR, Section 15.0.

3. NUREG-0800, "Standard Review Plan," Section 4.2, II.A.2(g), Revision 2, July 1981.

(continued)

CLINTON B 3.2-11 Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.a. Average Power Range Monitor Neutron Flux-High, SAFETY ANALYSES, Setdown (continued)

LCO, and APPLICABILITY With the IRMs at Range 9 or 10, it is possible that the Average Power Range Monitor Neutron Flux-High, Setdown Function will provide the primary trip signal for a corewide increase in power.

No specific safety analyses take direct credit for the Average Power Range Monitor Neutron Flux-High, Setdown Function. However, this Function indirectly ensures that, before the reactor mode switch is placed in the run position, reactor power does not exceed 21.6% RTP (SL 2.1.1.1) when operating at low reactor pressure and low core flow. Therefore, it indirectly prevents fuel damage during significant reactivity increases with THERMAL POWER

< 21.6% RTP.

The APRM System is composed of four channels, each providing an input to each of the four RPS trip logic divisions. All four Average Power Range Monitor Neutron Flux-High, Setdown channels are required to be OPERABLE to ensure that no single failure will preclude a scram from this Function on a valid signal. In addition, to provide adequate coverage of the entire core, at least 16 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the four axial levels at which the LPRMs are located.

The Allowable Value is based on preventing significant increases in power when THERMAL POWER is < 21.6% RTP.

The Average Power Range Monitor Neutron Flux-High, Setdown Function must be OPERABLE during MODE 2 when control rods may be withdrawn since the potential for criticality exits.

In MODE 1, the Average Power Range Monitor Neutron Flux-High Function provides protection against reactivity transients and the RWL and RPC protect against control rod withdrawal error events.

2.b. Average Power Range Monitor Flow Biased Simulated Thermal Power-High The Average Power Range Monitor Flow Biased Simulated Thermal Power-High Function monitors neutron flux to approximate the THERMAL POWER being transferred to the reactor coolant. The APRM neutron flux is electronically filtered with a time constant representative of the fuel (continued)

CLINTON B 3.3-7 Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 5. Reactor Vessel Water Level-High, Level 8 (continued)

SAFETY ANALYSES, LCO, and initiated at Level 8 to ensure that MCPR is maintained above APPLICABILITY the MCPR SL. The Reactor Vessel Water Level-High, Level 8 Function is one of the many Functions assumed to be OPERABLE and capable of providing a reactor scram during transients analyzed in Reference 3. It is directly assumed in the analysis of feedwater controller failure, maximum demand (Ref. 4).

Reactor Vessel Water Level-High, Level 8 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Water Level-High, Level 8 Allowable Value is specified to ensure that the MCPR SL is not violated during the assumed transient. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

One channel of the Reactor Vessel Water Level-High, Level 8 Function associated with each of the four trip logic divisions is required to be OPERABLE when THERMAL POWER is

> 21.6% RTP to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. With THERMAL POWER < 21.6% RTP, this Function is not required since MCPR is not a concern below 21.6% RTP.

6. Main Steam Isolation Valve-Closure MSIV closure results in loss of the main turbine and the condenser as a heat sink for the Nuclear Steam Supply System and indicates a need to shut down the reactor to reduce heat generation. Therefore, a reactor scram is initiated on a Main Steam Isolation Valve-Closure signal before the MSIVs are completely closed in anticipation of the complete loss of the normal heat sink and subsequent overpressurization transient. However, for the overpressurization protection analysis of Reference 2, the Average Power Range Monitor Fixed Neutron Flux-High Function, along with the S/RVs, limits the peak RPV pressure to less than the ASME Code limits. That is, the direct scram on position switches for MSIV closure events is not assumed in the overpressurization analysis. Additionally, MSIV closure is assumed in the transients analyzed in Reference 4 (e.g., low steam line pressure, manual closure of MSIVs, high steam line flow).

(continued)

CLINTON B 3.3-13 Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 8.a, b. Scram Discharge Volume Water Level-High SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY One channel of each type of Scram Discharge Volume Water Level-High Function associated with each of the four trip logic divisions is required to be OPERABLE to ensure that no single instrument failure will preclude a scram from these Functions on a valid signal. These Functions are required in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn. At all other times, this Function may be bypassed.

9. Turbine Stop Valve Closure Closure of the TSVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated at the start of TSV closure in anticipation of the transients that would result from the closure of these valves. The Turbine Stop Valve Closure Function is the primary scram signal for the turbine trip event analyzed in Reference 4. For this event, the reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the End of Cycle Recirculation Pump Trip (EOC-RPT) System, ensures that the MCPR SL is not exceeded.

Turbine Stop Valve Closure signals are initiated by valve stem position switches mounted on the four turbine stop valves. Each trip logic division receives an input from one Turbine Stop Valve Closure position switch. The logic for the Turbine Stop Valve Closure Function is such that two or more TSVs must be closed to produce a scram.

This Function must be enabled at THERMAL POWER > 33.3% RTP.

This is normally accomplished automatically by pressure transmitters sensing turbine first stage pressure. Because an increase in the main turbine bypass flow can affect this function nonconservatively (THERMAL POWER is derived from turbine first stage pressure), the main turbine bypass valves must not cause the trip Function to be bypassed when THERMAL POWER is Ž 33.3% RTP. The setpoint is feedwater temperature dependent as a result of the subcooling changes that affect the turbine first stage pressure/reactor power relationship.

The Turbine Stop Valve Closure Allowable Value is selected to be low enough to detect imminent TSV closure thereby (continued)

CLINTON B 3.3-16 Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 9. Turbine Stop Valve Closure SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY reducing the severity of the subsequent pressure transient.

One channel of Turbine Stop Valve Closure Function associated with each of the four trip logic divisions is required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function if any two TSVs should close. This Function is required, consistent with analysis assumptions, whenever THERMAL POWER is

> 33.3% RTP. This Function is not required when THERMAL POWER is < 33.3% RTP since the Reactor Vessel Steam Dome Pressure-High and the Average Power Range Monitor Fixed Neutron Flux-High Functions are adequate to maintain the necessary safety margins.

10. Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Fast closure of the TCVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated on TCV fast closure in anticipation of the transients that would result from the closure of these valves. The Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Function is the primary scram signal for the generator load rejection event analyzed in Reference 4. For this event, the reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the EOC-RPT System, ensures that the MCPR SL is not exceeded.

Turbine Control Valve Fast Closure, Trip Oil Pressure-Low signals are initiated by the electrohydraulic control (EHC) fluid pressure at each control valve. There is one pressure transmitter associated with each control valve, the signal from each transmitter being assigned to a separate RPS trip logic division. This Function must be enabled at THERMAL POWER > 33.3% RTP. This is normally accomplished automatically by pressure transmitters sensing turbine first stage pressure. Because an increase in the main turbine bypass flow can affect this function nonconservatively (THERMAL POWER is derived from turbine first stage pressure), the main turbine bypass valves must not cause the trip Function to be bypassed when THERMAL POWER is

> 33.3% RTP. The basis for the setpoint of this automatic bypass is identical to that described for the Turbine Stop Valve Closure Function.

(continued)

CLINTON B 3.3-17 Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 10. Turbine Control Valve Fast Closure, Trip Oil SAFETY ANALYSES, Pressure-Low (continued)

LCO, and APPLICABILITY The Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Allowable Value is selected high enough to detect imminent TCV fast closure.

One channel of Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Function associated with each of the four trip logic divisions is required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. This Function is required, consistent with the analysis assumptions, whenever THERMAL POWER is > 33.3% RTP. This Function is not required when THERMAL POWER is < 33.3% RTP since the Reactor Vessel Steam Dome Pressure-High and the Average Power Range Monitor Fixed Neutron Flux-High Functions are adequate to maintain the necessary safety margins.

11. Reactor Mode Switch-Shutdown Position The Reactor Mode Switch-Shutdown Position Function provides signals, via the manual scram logic channels, that are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Function was not specifically credited in the accident analysis, but it is retained for the RPS as required by the NRC approved licensing basis.

The reactor mode switch is a single switch with four channels, each of which inputs into one of the RPS trip logic divisions.

There is no Allowable Value for this Function since the channels are mechanically actuated based solely on reactor mode switch position.

One channel of Reactor Mode Switch-Shutdown Position Function, associated with each of the four trip logic divisions, is required to be OPERABLE. The Reactor Mode-Switch Shutdown Position Function is required to be OPERABLE in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.

(continued)

CLINTON B 3.3-18 Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES ACTIONS E.1, F.1, G.1, and H.l (continued)

If the channel(s) is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. With respect to Required Action E.l, inoperability of Turbine Stop Valve Closure and Turbine Control Valve Fast Closure Functions could impact the MCPR SL in the event of a design basis transient. Thus, prompt action should be taken to reduce THERMAL POWER to

< 33.3% RTP within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The Completion Times are reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems.

I.1 If the channel(s) is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies.

Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are, therefore, not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each RPS REQUIREMENTS instrumentation Function are located in the SRs column of Table 3.3.1.1-1.

The Surveillances are modified by a Note to indicate that, when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the RPS reliability analysis (Ref. 9) assumption of the average time required to perform channel surveillance. That (continued)

CLINTON B 3.3-22 Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does REQUIREMENTS not significantly reduce the probability that the RPS will (continued) trip when necessary.

SR 3.3.1.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift on one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based upon operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.1.1.2 To ensure that the APRMs are accurately indicating the true core average power, the APRMs are calibrated to the reactor power calculated from a heat balance. The Frequency of once per 7 days is based on minor changes in LPRM sensitivity, which could affect the APRM reading between performances of SR 3.3.1.1.8.

A restriction to satisfying this SR when < 21.6% RTP is provided that requires the SR to be met only at > 21.6% RTP because it is difficult to accurately maintain APRM indication of core THERMAL POWER consistent with a heat balance when < 21.6% RTP. At low power levels, a high degree (continued)

CLINTON B 3.3-23 Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.2 (continued)

REQUIREMENTS of accuracy is unnecessary because of the large inherent margin to thermal limits (MCPR and APLHGR). At > 21.6% RTP, the Surveillance is required to have been satisfactorily performed within the last 7 days in accordance with SR 3.0.2. A Note is provided which allows an increase in THERMAL POWER above 21.6% if the 7 day Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching or exceeding 21.6% RTP.

Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.

With regard to core thermal power values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).

SR 3.3.1.1.3 The Average Power Range Monitor Flow Biased Simulated Thermal Power-High Function uses the recirculation loop drive flows to vary the trip setpoint. This SR ensures that the APRM Function accurately reflects the required setpoint as a function of flow.

The Frequency of 7 days is based on engineering judgment, operating experience, and the reliability of this instrumentation.

SR 3.3.1.1.4 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

As noted, SR 3.3.1.1.4 is not required to be performed when entering MODE 2 from MODE 1 since testing of the MODE 2 required IRM and APRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable (continued)

CLINTON B 3.3-24 Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.15 (continued)

REQUIREMENTS (continued) The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. Those portions of the solid-state logic not monitored by the Self Test System may be tested at the frequency recommended by the manufacturer, rather than at the specified 18-month Frequency. The frequencies recommended by the manufacturer are based on mean time between failure analysis for the components in the associated circuits.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency.

SR 3.3.1.1.16 This SR ensures that scrams initiated from the Turbine Stop Valve Closure and Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Functions will not be inadvertently I bypassed when THERMAL POWER is > 33.3% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument setpoint methodology are incorporated into the actual setpoint.

If any bypass channel setpoint is nonconservative such that the Functions are bypassed at > 33.3% RTP (e.g., due to open main steam line drain(s), main turbine bypass valve(s) or other reasons), then the affected Turbine Stop Valve Closure and Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Functions are considered inoperable.

Alternatively, the bypass channel can be placed in the conservative condition (nonbypass) . If placed in the nonbypass condition, this SR is met and the channel is considered OPERABLE.

The Frequency of 18 months is based on engineering judgment and reliability of the components.

(continued)

CLINTON B 3-3-29 Revision No. 7-5

Control Rod Block Instrumentation B 3.3.2.1 BASES BACKGROUND The purpose of the RPC is to ensure control rod patterns (continued) during startup are such that only specified control rod sequences and relative positions are allowed over the operating range from all control rods inserted to 16.7% RTP.

The sequences effectively limit the potential amount and rate of reactivity increase during a CRDA. The RPC, in con3unction with the RCIS, will initiate control rod withdrawal and insert blocks when the actual sequence deviates beyond allowances from the specified sequence. The rod block logic circuitry is the same as that described above. The RPC also uses the turbine first stage pressure to determine when reactor power is above the power at which the RPC is automatically bypassed (Ref. 1).

With the reactor mode switch in the shutdown position, a control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained. This function prevents criticality resulting from inadvertent control rod withdrawal during MODE 3 or 4, or during MODE 5 when the reactor mode switch is required to be in the shutdown position. The reactor mode switch has two channels, with each providing inputs into a separate rod block circuit. A rod block in either circuit will provide a control rod block to all control rods.

APPLICABLE l.a. Rod Withdrawal Limiter SAFETY ANALYSES LCO, and The RWL is designed to prevent violation of the MCPR SL APPLICABILITY and the cladding 1% plastic strain fuel design limit that may result from a single control rod withdrawal error (RWE) event. The analytical methods and assumptions used in evaluating the RWE event are summarized in Reference 2. A statistical analysis of RWE events was performed to deter mine the MCPR response as a function of withdrawal distance and initial operating conditions. From these responses, the fuel thermal performance was determined as a function of RWL allowable control rod withdrawal distance and power level.

The RWL satisfies Criterion 3 of the NRC Policy Statement.

Two channels of the RWL are available and are required to be OPERABLE to ensure that no single instrument failure can preclude a rod block from this Function. The RWL high power function channels are considered OPERABLE when control rod withdrawal is limited to no more than two notches from the original position of the selected control rod. The RWL low (continued)

CLINTON B 3.3-41 Revision No. 7-5

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE l.a. Rod Withdrawal Limiter (continued)

SAFETY ANALYSES, LCO, and power function channels are considered OPERABLE when APPLICABILITY control rod withdrawal is limited to no more than four notches from the original position of the selected control rod. (By design, a single control rod that has been inserted for scram time testing, for example, can be continuously withdrawn to its previous position without establishing a new withdrawal limit.)

Nominal trip set points are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Values between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor power), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,

analog trip module) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drive, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

The RWL is assumed to mitigate the consequences of an RWE event when operating > 29.2% RTP. Below this power level, the consequences of an RWE event will not exceed the MCPR, and therefore the RWL is not required to be OPERABLE (Ref. 3).

l.b. Rod Pattern Controller The RPC enforces the banked position withdrawal sequence (BPWS) to ensure that the initial conditions of the CRDA analysis are not violated. The analytical methods and assumptions used in evaluating the CRDA are summarized in References 4 and 5. The BPWS requires that control rods be moved in groups, with all control rods assigned to a (continued)

CLINTON B 3.3-42 Revision No. 7-5

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE l.b. Rod Pattern Controller (continued)

SAFETY ANALYSES, LCO, and specific group required to be within specified banked APPLICABILITY positions. Requirements that the control rod sequence is in compliance with BPWS are specified in LCO 3.1.6, "Control Rod Pattern."

The Rod Pattern Controller Function satisfies Criterion 3 of the NRC Policy Statement. Since the RPC is a backup to operator control of control rod sequences, only a single channel would be required to be OPERABLE to satisfy Criterion 3 (Ref. 5). However, the RPC is designed as a dual channel system and will not function without two OPERABLE channels. Required Actions of LCO 3.1.3, "Control Rod OPERABILITY," and LCO 3.1.6 may necessitate bypassing individual control rods in the Rod Action Control System (RACS) to allow continued operation with inoperable control rods or to allow correction of a control rod pattern not in compliance with the BPWS. The individual control rods may be bypassed as required by the conditions, and the RPC is not considered inoperable provided SR 3.3.2.1.9 is met.

Compliance with the BPWS, and therefore OPERABILITY of the RPC, is required in MODES 1 and 2 with THERMAL POWER

< 16.7% RTP. When THERMAL POWER is > 16.7% RTP, there is no possible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA. In MODES 3 and 4, all control rods are required to be inserted in the core. In MODE 5, since only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will be subcritical.

2. Reactor Mode Switch-Shutdown Position During MODES 3 and 4, and during MODE 5 when the reactor mode switch is required to be in the shutdown position, the core is assumed to be subcritical; therefore, no positive reactivity insertion events are analyzed. The Reactor Mode Switch-Shutdown Position control rod withdrawal block ensures that the reactor remains subcritical by blocking control rod withdrawal, thereby preserving the assumptions of the safety analysis.

The Reactor Mode Switch-Shutdown Position Function satisfies Criterion 3 of the NRC Policy Statement.

(continued)

CLINTON B 3.3-43 Revision No. 7-5

PAM Instrumentation B 3.3.3.1 BASES LCO 8. Drywell and Containment Hydrogen and Oxygen Analyzer (continued)

Two gas chromatograph hydrogen and oxygen analyzers are provided. Each of these monitors automatically takes samples from five locations in the drywell and containment.

Gas chromatograph techniques are then utilized to separate the gaseous sample mixture into its individual components.

A thermal conductivity cell analyzes each component to determine its concentration with respect to total sample volume. The results of the analysis are indicated and printed out in the main control room. The indicators provide the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

9. Primary Containment Pressure Primary containment pressure is a Category I variable provided to verify RCS and containment integrity and to verify the effectiveness of ECCS actions taken to prevent containment breach. Four wide range primary containment pressure signals are transmitted from separate pressure transmitters and are continuously recorded and displayed on four control room recorders. Two of these instruments monitor containment pressure from -5 psig to 10 psig (low range). The remaining two instruments monitor containment pressure from 5 psig to 45 psig (high range). These recorders are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

10. Suppression Pool Water Bulk Average Temperature Suppression pool water bulk average temperature is a Type A variable provided to detect a condition that could potentially lead to containment breach, and to verify the effectiveness of ECCS actions taken to prevent containment breach. The suppression pool water temperature instrumentation allows operators to detect trends in suppression pool water temperature in sufficient time to take action to prevent steam quenching vibrations in the suppression pool. Eight temperature sensors are arranged in two channels (i.e., divisions), located such that there is one sensor from each channel (division) within each quadrant of the suppression pool. These instruments provide the capability to monitor suppression pool water temperature (continued)

CLINTON B 3.3-54 Revision No. 7-6

PAM Instrumentation B 3.3.3.1 BASES LCO 10. Suppression Pool Water Bulk Average Temperature (continued) when pool water level is below the instruments addressed by the Operational Requirements Manual.

The outputs for the PAM sensors are recorded on two independent recorders in the control room. These recorders average the output from the four Division 1 sensors and the four Division 2 sensors. Both of these recorders must be OPERABLE to furnish two channels of PAM suppression pool water bulk average temperature. These recorders are the primary indication used by the operator during an accident.

Therefore, the PAM Specification deals specifically with this portion of the instrument channels(Reference 4).

APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1 and 2.

These variables are related to the diagnosis and preplanned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1 and 2. In MODES 3, 4, and 5, plant conditions are such that the likelihood of an event that would require PAM instrumentation is extremely low; therefore, PAM instrumentation is not required to be OPERABLE in these MODES.

ACTIONS Note 1 has been added to the ACTIONS to exclude the MODE change restriction of LCO 3.0.4. This exception allows entry into the applicable MODE while relying on the Actions even though the Actions may eventually require plant shutdown. This exception is acceptable due to the passive function of the instruments, the operator's ability to diagnose an accident using alternate instruments and methods, and the low probability of an event requiring these instruments.

A Note has also been provided to modify the ACTIONS related to PAM instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for (continued)

CLINTON B 3.3-55 Revision No. 7-6

EOC-RPT Instrumentation B 3.3.4.1 BASES (continued)

APPLICABLE The TSV Closure and the TCV Fast Closure, Trip Oil SAFETY ANALYSES, Pressure-Low Functions are designed to trip the LCO, and recirculation pumps from fast speed operation in the event APPLICABILITY of a turbine trip or generator load rejection to mitigate the neutron flux, heat flux, and pressure transients, and to increase the margin to the MCPR SL. The analytical methods and assumptions used in evaluating the turbine trip and generator load rejection, as well as other safety analyses that assume EOC-RPT, are summarized in References 2, 3, 4, and 5.

To mitigate pressurization transient effects, the EOC-RPT must trip the recirculation pumps from fast speed operation after initiation of initial closure movement of either the TSVs or the TCVs. The combined effects of this trip and a scram reduce fuel bundle power more rapidly than does a scram alone, resulting in an increased margin to the MCPR SL. The EOC-RPT function is automatically disabled when turbine first stage pressure is < 33.3% RTP.

EOC-RPT instrumentation satisfies Criterion 3 of the NRC Policy Statement.

The OPERABILITY of the EOC-RPT is dependent on the OPERABILITY of the individual instrumentation channel Functions. Each Function must have a required number of OPERABLE channels with their setpoints within the specified Allowable Value of SR 3.3.4.1.2. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Channel OPERABILITY also includes the associated EOC-RPT breakers. Each channel (including the associated EOC-RPT breakers) must also respond within its assumed response time.

Allowable Values are specified for each EOC-RPT Function specified in the LCO. Nominal trip setpoints are specified in the setpoint calculations. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The nominal setpoints are selected to ensure the setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., TSV (continued)

CLINTON B 3.3-66 Revision No. 7-5

EOC-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE position), and when the measured output value of the process SAFETY ANALYSES, parameter exceeds the setpoint, the associated device (e.g.,

LCO, and limit switch) changes state. The analytic limits are APPLICABILITY derived from the limiting values of the process parameters (continued) obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

The specific Applicable Safety Analysis, LCO, and Applicability discussions are listed below on a Function by Function basis.

Turbine Stop Valve Closure Closure of the TSVs and a main turbine trip result in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited.

Therefore, an EOC-RPT is initiated on TSV Closure in anticipation of the transients that would result from closure of these valves. EOC-RPT decreases reactor power and aids the reactor scram in ensuring the MCPR SL is not exceeded during the worst case transient. Closure of the TSVs is determined by use of limit switches on each stop valve. There is one limit switch associated with each stop valve, each assigned to a separate channel. The logic for the TSV Closure is such that two or more TSVs must be closed to produce an EOC-RPT. This Function must be enabled at THERMAL POWER > 33.3% RTP. This is normally accomplished automatically by pressure transmitters sensing turbine first stage pressure. Because an increase in the main turbine bypass flow can affect this function nonconservatively (THERMAL POWER is derived from turbine first stage pressure), the main turbine bypass valves must not cause the trip Function to be bypassed when THERMAL POWER is

> 33.3% RTP. Four channels of TSV Closure, arranged in a I

two-out-of-four logic, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an EOC-RPT from this Function on a valid signal.

The TSV Closure Allowable Value is selected low enough to detect imminent TSV closure.

(continued)

CLINTON B 3.3-67 Revision No. 7-5

EOC-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE Turbine Stop Valve Closure (continued)

SAFETY ANALYSES, LCO, and This protection is required, consistent with the safety APPLICABILITY analysis assumptions, whenever THERMAL POWER is > 33.3% RTP with any recirculating pump in fast speed. Below 33.3% RTP or with the recirculation in slow speed, the Reactor Vessel Steam Dome Pressure-High and the Average Power Range Monitor (APRM) Fixed Neutron Flux-High Functions of the Reactor Protection System (RPS) are adequate to maintain the necessary safety margins.

The automatic enable setpoint is feedwater temperature dependent as a result of the subcooling changes that affect the turbine first stage pressure/reactor power relationship.

TCV Fast Closure, Trip Oil Pressure-Low Fast closure of the TCVs during a generator load re3ection results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, an RPT is initiated on TCV Fast Closure, Trip Oil Pressure-Low in anticipation of the transients that would result from the closure of these valves. The EOC-RPT decreases reactor power and aids the reactor scram in ensuring that the MCPR SL is not exceeded during the worst case transient.

Fast closure of the TCVs is determined by measuring the electrohydraulic control (EHC) fluid pressure at each control valve. There is one pressure switch associated with each control valve, and the signal from each switch is assigned to a separate channel. The logic for the TCV Fast Closure, Trip Oil Pressure-Low Function is such that two or more TCVs must be closed (pressure switch trips) to produce an EOC-RPT. This Function must be enabled at THERMAL POWER

> 33.3% RTP. This is normally accomplished automatically by pressure transmitters sensing turbine first stage pressure.

Because an increase in the main turbine bypass flow can affect this function nonconservatively (THERMAL POWER is derived from turbine first stage pressure), the main turbine bypass valves must not cause the trip Function to be bypassed when THERMAL POWER is Ž 33.3% RTP. Four channels of TCV Fast Closure, Trip Oil Pressure-Low, arranged in a two-out-of-four logic, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an EOC-RPT from this Function on a valid signal.

The TCV Fast Closure, Trip Oil Pressure-Low Allowable Value is selected high enough to detect imminent TCV fast closure.

(continued)

CLINTON B3 3.3-68 Revision No. 7-5

EOC-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE TCV Fast Closure, Trip Oil Pressure-Low (continued)

SAFETY ANALYSES, LCO, and This protection is required consistent with the analysis, APPLICABILITY whenever the THERMAL POWER is Ž 33.3% RTP with any recirculating pump in fast speed. Below 33.3% RTP or with recirculation pumps in slow speed, the Reactor Vessel Steam Dome Pressure-High and the APRM Fixed Neutron Flux-High Functions of the RPS are adequate to maintain the necessary safety margins. The turbine first stage pressure/reactor power relationship for the setpoint of the automatic enable is identical to that described for TSV closure.

ACTIONS A Note has been provided to modify the ACTIONS related to EOC-RPT instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable EOC-RPT instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable EOC-RPT instrumentation channel.

A.1 and A.2 With one channel for one or both Functions inoperable, but with EOC-RPT trip capability maintained (refer to Required Action B.1 Bases), the EOC-RPT System is capable of performing the intended function. However, the reliability and redundancy of the EOC-RPT instrumentation is reduced.

Therefore, a limited time is allowed to restore compliance with the LCO. Because of the diversity of sensors available to provide trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of an EOC-RPT, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed to restore the inoperable channels (Required Action A.1). Alternately, the inoperable channels may be placed in trip (Required Action A.2) since this would conservatively compensate for the inoperability, (continued)

CLINTON B 3.3-69 Revision No. 7-5

EOC-RPT Instrumentation B 3.3.4.1 BASES ACTIONS B.1 (continued)

Alternately, if it is not desired to place one inoperable channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an EOC-RPT),

Condition D must be entered and its Required Action taken.

C.1 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not being able to accommodate a single failure and maintain EOC-RPT trip capability. A Function is considered to be maintaining EOC-RPT trip capability when sufficient channels are OPERABLE or in trip, such that the EOC-RPT System will generate a trip signal from the given Function on a valid signal and both recirculation pumps can be tripped from fast speed operation. This requires three channels of the Function to be OPERABLE or in trip, and the associated EOC-RPT fast speed breakers to be OPERABLE or in trip.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is sufficient for the operator to take corrective action, and takes into account the likelihood of an event requiring actuation of the EOC-RPT instrumentation during this period. It is also consistent with the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time provided in LCO 3.2.2, Required Action A.1, since this instrumentation's purpose is to preclude a MCPR violation.

D.1 and D.2 With any Required Action and associated Completion Time not met, THERMAL POWER must be reduced to < 33.3% RTP within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Alternately, the associated recirculation pump fast speed breaker may be removed from service since this performs the intended function of the instrumentation. The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is reasonable, based on operating experience, to reduce THERMAL POWER to < 33.3% RTP from full power conditions in an orderly manner and without challenging plant systems. In addition, this time is consistent with the shutdown time limits in LCO 3.3.1.1 for these Functions.

(continued)

CLINTON B 3.3-71 Revision No. 7-5

EOC-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE SR 3.3.4.1.3 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers is included as a part of this test, overlapping the LOGIC SYSTEM FUNCTIONAL TEST, to provide complete testing of the associated safety function. Therefore, if a breaker is incapable of operating, the associated instrument channels would also be inoperable.

The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. Those portions of the solid-state logic not monitored by the Self Test System may be tested at the frequency recommended by the manufacturer, rather than at the specified 18-month Frequency. The frequencies recommended by the manufacturer are based on mean time between failure analysis for the components in the associated circuits.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance test when performed at the 18 month Frequency.

SR 3.3.4.1.4 This SR ensures that an EOC-RPT initiated from the TSV Closure and TCV Fast Closure, Trip Oil Pressure-Low Functions will not be inadvertently bypassed when THERMAL POWER is > 33.3% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument setpoint methodologies are incorporated into the actual setpoint. If any bypass channel's setpoint is nonconservative such that the Functions are bypassed at

> 33.3% RTP (e.g., due to open main steam line drain(s),

main turbine bypass valve(s) or other reasons), the affected TSV Closure and TCV Fast Closure, Trip Oil Pressure-Low Functions are considered (continued)

CLINTON B 3.3-73 Revision No. 7-5

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.a. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES, LCO, and Low RPV water level indicates that the capability to cool APPLICABILITY the fuel may be threatened. Should RPV water level decrease (continued) too far, fuel damage could result. Therefore, the HPCS System and associated DG are initiated at Level 2 to maintain level above the top of the active fuel. The Reactor Vessel Water Level-Low Low, Level 2 is one of the Functions assumed to be OPERABLE and capable of initiating HPCS during the transients analyzed in References 1 and 3.

The Reactor Vessel Water Level-Low Low, Level 2 Function associated with HPCS is directly assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value is chosen such that for complete loss of feedwater flow, the Reactor Core Isolation Cooling (RCIC) System flow with HPCS assumed to fail will be sufficient to avoid initiation of low pressure ECCS at Reactor Vessel Water Level-Low Low Low, Level 1. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are only required to be OPERABLE when HPCS is required to be OPERABLE to ensure that no single instrument failure can preclude HPCS initiation. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases.

3.b. Drywell Pressure-High High pressure in the drywell could indicate a break in the RCPB. The HPCS System and associated DG are initiated upon receipt of the Drywell Pressure-High Function in order to I

minimize the possibility of fuel damage.

(continued)

CLINTON B 3.3-98 Revision No. 7-5

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.b. Drywell Pressure-High (continued)

SAFETY ANALYSES, LCO, and The core cooling function of the ECCS, along with the scram APPLICABILITY action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Drywell Pressure-High signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.

The Drywell Pressure-High Function is required to be OPERABLE when HPCS is required to be OPERABLE. Thus, four channels of the HPCS Drywell Pressure-High Function are required to be OPERABLE in MODES 1, 2, and 3, to ensure that no single instrument failure can preclude ECCS initiation.

In MODES 4 and 5, the Drywell Pressure-High Function is not required since there is insufficient energy in the reactor to pressurize the drywell to the Drywell Pressure-High Function's setpoint. Refer to LCO 3.5.1 for the Applicability Bases for the HPCS System.

3.c. Reactor Vessel Water Level-High, Level 8 High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Level 8 signal is used to close the HPCS injection valve to prevent overflow into the main steam lines (MSLs). The Reactor Vessel Water Level-High, Level 8 Function is not assumed in the accident and transient analyses. It was retained since it is a potentially significant contributor to risk.

Reactor Vessel Water Level-High, Level 8 signals for HPCS are initiated from two level transmitters from the wide range water level measurement instrumentation. Both Level 8 signals are required in order to close the HPCS injection valve. This ensures that no single instrument failure can preclude HPCS initiation. The Reactor Vessel Water Level-High, Level 8 Allowable Value is chosen to isolate flow from the HPCS System prior to water overflowing into the MSLs. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

(continued)

CLINTON B 3.3-99 Revision No. 7-5

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 4.e, 4.f, 5.e. Low Pressure Core Spray and Low Pressure SAFETY ANALYSES, Coolant Injection Pump Discharge Pressure-High (continued)

LCO, and APPLICABILITY discharge pressure condition. The Pump Discharge Pressure-High Allowable Value is less than the pump discharge pressure when the pump is operating in a full flow mode, and high enough to avoid any condition that results in a discharge pressure permissive when the LPCS and LPCI pumps are aligned for injection and the pumps are not running.

The actual operating point of this Function is not assumed in any transient or accident analysis.

Eight channels of LPCS and LPCI Pump Discharge Pressure High Function (two LPCS and two LPCI A channels input to ADS trip system 1, while two LPCI B and two LPCI C channels input to ADS trip system 2) are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation.

Refer to LCO 3.5.1 for ADS Applicability Bases.

4.g, 5.f. ADS Drywell Pressure Bypass Timer One of the signals required for ADS initiation is Drywell Pressure-High. However, if the event requiring ADS initiation occurs outside the drywell (for example, main steam line break outside primary containment), a high drywell pressure signal may never be present. Therefore, the ADS Bypass Timer is used to bypass the Drywell Pressure-High Function after a certain time period has elapsed.

There are four solid state ADS Bypass Timers, two in each of the two ADS trip systems. The Allowable Value for the ADS Timer is chosen to be short enough so that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling.

Four channels of the ADS Bypass Timer Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can (continued)

CLINTON B 3.3-107 Revision No. 7-5

RCIC System Instrumentation B 3.3.5.2 BASES BACKGROUND suppression pool (one-out-of-two logic similar to the RCIC (continued) Storage Tank water level logic). To prevent losing suction to the pump, the suction valves are interlocked so that one suction path must be open before the other automatically closes.

The RCIC System provides makeup water to the reactor until the reactor vessel water level reaches the high water level (Level 8) trip (two-out-of-two logic), at which time the RCIC steam supply, and cooling water supply valves close (the injection valve also closes due to the closure of the steam supply valve). The RCIC System restarts if vessel level again drops to the low level initiation point (Level 2).

APPLICABLE The function of the RCIC System is to provide makeup SAFETY ANALYSES, coolant to the reactor in response to transient events.

LCO, and The RCIC System is an Engineered Safety Feature System APPLICABILITY for the control rod drop accident described in Reference 1.

The RCIC System, and therefore its instrumentation, satisfies Criterion 3 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the RCIC System instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.2-1. Each Function must have a required number of OPERABLE channels with their setpoints within the specified Allowable Values, where appropriate. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each RCIC System instrumentation Function specified in the table. Nominal trip setpoints are specified in the setpoint calculations.

The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less (continued)

CLINTON B 3.3-124 Revision No. 7-8

RCIC System Instrumentation B 3.3.5.2 BASES APPLICABLE 1. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY core spray assumed to fail) will be sufficient to avoid initiation of low pressure ECCS at Level 1. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation.

Refer to LCO 3.5.3 for RCIC Applicability Bases.

2. Reactor Vessel Water Level-High, Level 8 High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Level 8 signal is used to close the RCIC steam supply, and cooling water supply valves to prevent overflow into the main steam lines (MSLs).

(The in3ection valve also closes due to the closure of the steam supply valve.)

Reactor Vessel Water Level-High, Level 8 signals for RCIC are initiated from two level transmitters from the narrow range water level measurement instrumentation, which sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level-High, Level 8 Allowable Value is high enough to preclude isolating the injection valve of the RCIC during normal operation, yet low enough to trip the RCIC System prior to water overflowing into the MSLs. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

Two channels of Reactor Vessel Water Level-High, Level 8 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases.

(continued)

CLINTON B 3.3-126 Revision No. 7-8

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE l.a. Reactor Vessel Water Level-Low Low Low, Level 1 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY RPV water level decrease too far, fuel damage could result.

Therefore, isolation of the MSIVs and other interfaces with the reactor vessel occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water Level-Low Low Low, Level 1 Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals. The Reactor Vessel Water Level-Low Low Low, Level 1 Function associated with isolation is assumed in the analysis of the recirculation line break (Ref. 1). The isolation of the MSL on Level 1 supports actions to ensure that offsite dose limits are not exceeded for a DBA.

Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low Low, Level 1 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to be the same as the ECCS Level 1 Allowable Value (LCO 3.3.5.1) to ensure that the MSLs isolate on a potential loss of coolant accident (LOCA) to prevent offsite doses from exceeding 10 CFR 100 limits. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

l.b. Main Steam Line Pressure-Low Low MSL pressure indicates that there may be a problem with the turbine pressure regulation, which could result in a low reactor vessel water level condition and the RPV cooling down more than 100OF/hour if the pressure loss is allowed to continue. The Main Steam Line Pressure-Low Function is directly assumed in the analysis of the pressure regulator failure (Ref. 2). For this event, the closure of the MSIVs ensures that the RPV temperature change limit (100OF/hour) is not reached. In addition, this Function supports actions to ensure that Safety Limit 2.1.1.1 is not exceeded. (This Function closes the MSIVs prior to pressure decreasing below 785 psig, which results in a scram due to MSIV closure, thus reducing reactor power to < 21.6% RTP.)

(continued)

CLINTON B 3.3-140 Revision No. 7-5

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2. Primary Containment and Drywell Isolation SAFETY ANALYSES, LCO, and 2.a, and 2.e. Reactor Vessel Water Level-Low Low, APPLICABILITY Level 2 (continued)

Low RPV water level indicates the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 2 supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded.

The Reactor Vessel Water Level-Low Low, Level 2 Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA. In addition, Function 2.a provides an isolation signal to certain drywell isolation valves. The isolation of drywell isolation valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.

In addition to providing automatic isolation capability for primary containment and drywell isolation valves, Function 2.b provides signals for automatic actuation of the Division 1 and 2 SX subsystems, including automatic start of the Division 1 and 2 SX pumps and automatic actuation of the associated subsystem isolation valves (as required to support automatic operation of the SX subsystems). The equipment involved with the SX subsystems is described in LCO 3.7.1, "Division 1 and 2 SX Subsystems."

Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available and are required to be OPERABLE to ensure no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level-Low Low, Level 2 Allowable Value (LCO 3.3.5.1),

(continued)

CLINTON B 3 .3-144 Revision No. 7-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.a, and 2.e. Reactor Vessel Water Level-Low Low, SAFETY ANALYSES, Level 2 (continued)

LCO, and APPLICABILITY since isolation of these valves is not critical to orderly (continued) plant shutdown. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

Function 2.a is also required to be OPERABLE during operations with a potential for draining the reactor vessel (OPDRVs). This Function initiates isolation of valves which isolate primary containment penetrations which bypass secondary containment. Thus, this Function is also required under those conditions in which a low reactor water level signal could be generated when secondary containment is required to be OPERABLE.

2.b, 2.d, 2.f. Drywell Pressure-High High drywell pressure can indicate a break in the RCPB. The isolation of some of the PCIVs on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded. The Drywell Pressure-High Function associated with isolation of the primary containment is implicitly assumed in the USAR accident analysis as these leakage paths are assumed to be isolated post LOCA. In addition, Functions 2.b and 2.d provide isolation signals to certain drywell isolation valves. The isolation of drywell isolation valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.

In addition to providing automatic isolation capability for primary containment and drywell isolation valves, Function 2.b provides signals for automatic actuation of the Division 1 and 2 SX subsystems, including automatic start of the Division 1 and 2 SX pumps and automatic actuation of the associated subsystem isolation valves (as required to support automatic operation of the SX subsystems). The equipment involved with the SX subsystems is described in LCO 3.7.1, "Division 1 and 2 SX Subsystems."

(continued)

CLINTON B 3.3-145 Revision No. 7-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.g., 2.h and 2.i. Containment Building Fuel Transfer Pool SAFETY ANALYSES, Ventilation Plenum, Containment Building, and Containment LCO,and Building Continuous Containment Purge (CCP) Exhaust APPLICABILITY Radiation-High (continued)

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding and to ensure offsite doses remain below 10 CFR 20 and 10 CFR 100 limits.

These Functions are required to be OPERABLE during OPDRVs and movement of recently irradiated fuel assemblies (i.e.,

fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary or secondary containment because the capability of detecting radiation releases due to fuel failures (due to fuel uncovery or dropped fuel assemblies must be provided to ensure offsite dose limits are not exceeded.

2.j. Reactor Vessel Water Level-Low Low Low, Level 1 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of the primary containment occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water Level-Low Low Low, Level 1 Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals. The Reactor Vessel Water Level-Low Low Low, Level 1 Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA. In addition, this Function provides an isolation signal to certain drywell isolation valves. The isolation of drywell isolation (continued)

CLINTON B 3.3-146a Revision No. 7-3

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.k. Containment Pressure-High (continued)

SAFETY ANALYSES, LCO, and The Allowable Value was chosen to prevent opening of the APPLICABILITY containment ventilation supply and exhaust isolation bypass valves when excessive differential pressure could result in damage to the associated ductwork.

Two channels of the Containment Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

2.1. Manual Initiation The Manual Initiation push button channels introduce signals into the primary containment and drywell isolation logic that are redundant to the automatic protective instrumentation and provide manual isolation capability.

There is no specific USAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in the plant licensing basis.

There are two push buttons for the logic, one manual initiation push button per trip system (i.e., IB21H-S25A and IB21H-S25B). There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.

Two channels of the Manual Initiation Function are available and are required to be OPERABLE. This Function is also required to be OPERABLE during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in primary or secondary containment, or OPDRVs. This Function initiates isolation of valves which isolate primary containment penetrations which bypass secondary containment.

Thus, this Function is also required under those conditions in which secondary containment is required to be OPERABLE.

3. Reactor Core Isolation Cooling System Isolation 3.a. Auxiliary Building RCIC Steam Line Flow-High Auxiliary Building RCIC Steam Line Flow-High Function is provided to detect a break of the RCIC steam lines and initiates closure of the steam line isolation valves. If the steam is allowed to continue flowing out of the break, (continued)

CLINTON B 3.3-148 Revision No. 7-3

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.g. Main Steam Line Tunnel Temperature Timer SAFETY ANALYSES, LCO, and The Main Steam Line Tunnel Temperature Timer is provided to APPLICABILITY allow all the other systems that may be leaking in the main (continued) steam tunnel (as indicated by the high temperature) to be isolated before RCIC is automatically isolated. This ensures maximum RCIC System operation by preventing isolations due to leaks in other systems. This Function is not assumed in any USAR transient or accident analysis; however, maximizing RCIC availability is an important function.

Two channels for RCIC Main Steam Line Tunnel Timer Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are based on maximizing the availability of the RCIC System; that is, providing sufficient time to isolate all other potential leakage sources in the main steam tunnel before RCIC is isolated.

3.h. Reactor Vessel Water Level - Low Low, Level 2 Low RPV water level indicates the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 2 supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded.

The Reactor Vessel Water Level - Low Low, Level 2 Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA. The Function isolates the following RCIC valves:

IE51F031 (RCIC suppression pool suction valve) and 1E51F064 (RCIC steam supply outboard isolation valve).

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level - Low Low, Level 2 Allowable Value (LCO 3.3.5.1), since isolation of these valves is not critical to orderly plant shutdown.

3.i. Drywell RCIC Steam Line Flow-High Drywell RCIC high steam line flow is provided to detect a break of the common steam line of RCIC and RHR and initiates closure of the isolation valves for both systems. If the steam were allowed to continue flowing out of the break, the reactor would depressurize and the core could uncover.

Therefore, the isolation is initiated at high flow to prevent or minimize core damage. Specific credit for this Function is not assumed in any USAR accident or transient analysis since the bounding analysis is performed for large breaks such as recirculation and MSL breaks.

(continued)

CLINTON B 3.3-152 Revision No. 7-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.i. Drywell RCIC Steam Line Flow-High (continued)

SAFETY ANALYSES, LCO, and However, these instruments prevent the Drywell RCIC steam APPLICABILITY line break from becoming bounding.

(continued)

The Drywell RCIC steam line flow signals are initiated from two transmitters that are connected to the steam line in the drywell. Two channels are available and required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Allowable Value is selected to ensure that the trip occurs to prevent fuel damage and maintains the MSLB as the boundary event.

(continued)

CLINTON B 3.3-152a Revision No. 7-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 This Page Intentionally Blank CLINTON B 3-3-152b Revision No. 7-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.j. Drywell Pressure-High SAFETY ANALYSES, LCO, and High drywell pressure can indicate a break in the RCPB. The APPLICABILITY RCIC isolation of the turbine exhaust is provided to prevent communication with the drywell when high drywell pressure exists. A potential leakage path exists via the turbine exhaust. The isolation is delayed until the system becomes unavailable for injection (i.e., low steam line pressure).

The isolation of the RCIC turbine exhaust by Drywell Pressure-High is indirectly assumed in the USAR accident analysis because the turbine exhaust leakage path is not assumed to contribute to offsite doses.

High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell.

Isolation of the RCIC vacuum breaker isolation valves requires RCIC Steam Supply Line Pressure-Low coincident with Drywell Pressure-High signals. Two channels of RCIC Drywell Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be the same as the ECCS Drywell Pressure-High Allowable Value (LCO 3.3.5.1), since this is indicative of a LOCA inside primary containment.

3.k. Manual Initiation The Manual Initiation push button channel introduces a signal into the RCIC System isolation logic that is redundant to the automatic protective instrumentation and provide manual isolation capability if an initiation signal is present. There is no specific USAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in the plant licensing basis.

There is only one push button for RCIC, in a single trip II system. There is no Allowable Value for this Function since the channel are mechanically actuated based solely on the position of the push button.

I One channel of RCIC Manual Initiation is required to be OPERABLE.

(continued)

CLINTON B 3.3-153 Revision No. 7-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 4.f. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY containment. Thus, this Function is also required under those conditions in which a low reactor water level signal could be generated when secondary containment is required to be OPERABLE.

4.g. SLC System Initiation The isolation of the RWCU System is required when the SLC System has been initiated to prevent dilution and removal of the boron solution by the RWCU System (Ref. 4). SLC System initiation signals, are initiated from the two SLC pump start signals.

There is no Allowable Value associated with this Function since the channels are mechanically actuated based solely on the position of the SLC System initiation switch.

Two channels (one from each pump) of SLC System Initiation Function are available and are required to be OPERABLE only in MODES 1 and 2, since these are the only MODES where the reactor can be critical, and these MODES are consistent with the Applicability for the SLC System (LCO 3.1.7).

4.h. Manual Initiation The Manual Initiation push button channels introduce signals into the RWCU System isolation logic that are redundant to the automatic protective instrumentation and provide manual isolation capability. There is no specific USAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in plant licensing basis.

There are two push buttons for the logic, one manual initiation push button per trip system. There is no Allowable Value for this Function, since the channels are mechanically actuated based solely on the position of the push buttons.

Two channels of the Manual Initiation Function are available and are required to be OPERABLE. This Function is also required to be OPERABLE during movement of recently (continued)

CLINTON B 3 .3-157 Revision No. 7-3

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 4.h. Manual Initiation (continued)

SAFETY ANALYSES, LCO, and irradiated fuel assemblies (i.e., fuel that has occupied APPLICABILITY part of a critcal reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in primary or secondary containment, or OPDRVs. This Function initiates isolation of valves which isolate primary containment penetrations which bypass secondary containment.

Thus, this Function is also required under those conditions in which secondary containment is required to be operable.

5. RHR System Isolation 5.a. Ambient Temperature-High Ambient Temperature-High is provided to detect a leak from the associated system steam piping. The isolation occurs when a very small leak has occurred and is diverse to the high flow instrumentation. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. This Function is not assumed in any USAR transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.

Ambient Temperature-High signals are initiated from thermocouples that are appropriately located to protect the system that is being monitored. Two instruments monitor each area. Four channels for RHR Ambient Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are set low enough to detect a leak equivalent to 25 gpm.

The RHR Equipment Room Ambient Temperature-High Function is only required to be OPERABLE in MODES 1, 2, and 3. In MODES 4 and 5, insufficient pressure and temperature are available to develop a significant steam leak in this piping and significant water leakage is protected by the Reactor Vessel Water Level-Low, Level 3 Function.

5.b, 5.c. Reactor Vessel Water Level-Low, Level 3 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some reactor or vessel interfaces occurs to begin isolating the (continued)

CLINTON B 3.3-158 Revision No. 7-3

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES ACTIONS M.1, M.2, M.3.1, M.3.2, M.3.3, and M.3.4 (continued) radioactivity releases. This may be performed as an administrative check, by examining logs or other information, to determine if the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the Surveillances may need to be performed to restore the component to OPERABLE status. In addition, at least one door in the upper containment personnel air lock must be closed. The closed air lock door completes the boundary for control of potential radioactive releases. With the appropriate administrative controls however, the closed door can be opened intermittently for entry and exit. This allowance is acceptable due to the need for containment access and due to the slow progression of events which may result from a reactor vessel draindown event. Reactor vessel draindown events would not be expected to result in the immediate release of appreciable fission products to the containment atmosphere. Actions must continue until all requirements of this Condition are satisfied.

N.1, N.2.1, N.2.2, 0.1, and 0.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path(s) should be isolated (Required Action N.1 or 0.1). Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable instrumentation. Alternately, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) must be immediately suspended.

Suspension of these activities shall not preclude completion of movement of a component to a safe condition. Also, if applicable, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission production release.

Actions must continue until OPDRVs are suspended.

(continued)

CLINTON B 3.3-169 Revision No. 7-3

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 3, 4, 5, 6. Containment Building Fuel Transfer Pool SAFETY ANALYSES, Ventilation Plenum, Containment Building, Containment LCO, and Building Continuous Containment Purge (CCP), and Fuel APPLICABILITY Building Exhaust Radiation-High (continued) detector is input to an individual monitor whose trip outputs are assigned to an isolation channel. Four channels of each of these Exhaust Radiation-High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding.

The Exhaust Radiation-High High Functions are required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, these Functions are not required. In addition, the Functions are required to be OPERABLE during OPDRVs and movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary containment or fuel building, as applicable, because the capability of detecting radiation releases due to fuel failures (due to fuel uncovery or dropped fuel assemblies) must be provided to ensure that offsite dose limits are not exceeded.

7. Manual Initiation The Manual Initiation push button channels introduce signals into the secondary containment isolation logic that are redundant to the automatic protective instrumentation channels, and provide manual isolation capability. There is no specific USAR safety analysis that takes credit for this Function. It is retained for the secondary containment isolation instrumentation as required by the NRC approved licensing basis.

There are two push buttons for the logic, one manual initiation push button per trip system. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.

(continued)

CLINTON B 3.3-179 Revision No. 7-3

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 7. Manual Initiation (continued)

SAFETY ANALYSES, LCO, and Two channels of the Manual Initiation Function are APPLICABILITY available and are required to be OPERABLE in MODES 1, 2, and 3 and during OPDRVs and movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary containment or Fuel Building, since these are the MODES and other specified conditions in which the Secondary Containment Isolation automatic Functions are required to be OPERABLE.

ACTIONS A Note has been provided to modify the ACTIONS related to secondary containment isolation instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.

Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable secondary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable

,secondary containment isolation instrumentation channel.

A.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Refs. 3 and 4) to permit restoration of any inoperable channel to OPERABLE status.

This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.I.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the (continued)

CLINTON B 3.3-180 Revision No. 7-3

Recirculation Loops Operating B 3.4.1 BASES APPLICABLE operating at the lower flow rate), a small mismatch has been SAFETY ANALYSES determined to be acceptable based on engineering judgement.

(continued) The recirculation system is also assumed to have sufficient flow coastdown characteristics to maintain fuel thermal margins during abnormal operational transients (Ref. 2),

which are analyzed in Chapter 15 of the USAR.

A plant specific LOCA analysis has been performed assuming only one operating recirculation loop. This analysis has demonstrated that, in the event of a LOCA caused by a pipe break in the operating recirculation loop, the Emergency Core Cooling System response will provide adequate core cooling, provided the APLHGR requirements are modified accordingly (Ref. 3).

The transient analyses of Chapter 15 of the USAR have also been performed for single recirculation loop operation (Ref. 3) and demonstrate sufficient flow coastdown characteristics to maintain fuel thermal margins during the abnormal operational transients analyzed provided the MCPR requirements are modified. During single recirculation loop operation, modification to the Reactor Protection System average power range monitor (APRM) instrument setpoints is also required to account for the different relationships between recirculation drive flow and reactor core flow. The APLHGR and MCPR limits for single loop operation are specified in the COLR. The APRM flow biased simulated thermal power setpoint is in LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation."

Recirculation loops operating satisfies Criterion 2 of the NRC Policy Statement.

LCO Two recirculation loops are normally required to be in operation with their flows matched within the limits specified in SR 3.4.1.1 to ensure that during a LOCA caused by a break of the piping of one recirculation loop the assumptions of the LOCA analysis are satisfied. In addition, the total core flow must be Ž 45% of rated core flow or total core flow expressed as a function of THERMAL POWER must be in Region C as identified in Figure 3.4.1-1, "THERMAL POWER/Core Flow Stability Regions." Alternatively, with only one recirculation loop in operation, THERMAL POWER I must be

58% RTP, total core flow must be Ž 45% of rated (continued)

CLINTON B 3.4-3 Revision No. 7-5

Recirculation Loops Operating B 3.4.1 BASES LCO core flow or total core flow expressed as a function of (continued) THERMAL POWER must be in Region C of Figure 3.4.1-1, and modifications to the required APLHGR limits (LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)"), MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"),

and APRM Flow Biased Simulated Thermal Power-High setpoint (LCO 3.3.1.1) must be applied to allow continued operation consistent with the assumptions of Reference 3.

The LCO is modified by a Note which allows up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months before having to put in effect the required modifications to required limits and setpoints after a change in the reactor operating conditions from two recirculation loops operating to single recirculation loop operation. If the required limits and setpoints are not in compliance with the applicable requirements at the end of this period, the associated equipment must be declared inoperable or the limits "not satisfied," and the'ACTIONS required by nonconformance with the applicable Specifications implemented. This time is provided due to the need to stabilize operation with one recirculation loop, including the procedural steps necessary to limit flow (to less than the volumetric recirculation loop flow) in the operating loop, monitor for excessive APRM and local power range monitor (LPRM) neutron flux noise levels; and the complexity and detail required to fully implement and confirm the required limit and setpoint modifications.

APPLICABILITY In MODES 1 and 2, requirements for operation of the Reactor Coolant Recirculation System are necessary since there is considerable energy in the reactor core and the limiting design basis transients and accidents are assumed to occur.

In MODES 3, 4, and 5, the consequences of an accident are reduced and the coastdown characteristics of the recirculation loops are not important.

ACTIONS A.1 With both recirculation loops operating but the flows not matched, the recirculation loops must be restored to operation with matched flows within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . If the flow mismatch cannot be restored to within limits within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , one recirculation loop must be shut down.

(continued)

CLINTON B 3.4-4 Revision No. 7-5

Recirculation Loops Operating B 3.4.1 BASES ACTIONS B.1, C.l, and D.l (continued) subsequent neutron flux noise levels during operation in this region.

A determination of APRM and LPRM neutron flux noise levels every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months provides frequent periodic information relative to established baseline noise levels (see Condition C) that indicate stable steady state operation. A determination of these noise levels within 30 minutes after an increase of Ž 5% RTP provides a more frequent indication of the stability of operation following any significant potential for change of the thermal hydraulic properties of the system. These Frequencies provide early detection of neutron flux oscillations due to core thermal hydraulic instabilities. Action must be initiated to restore the plant to a more stable power/flow ratio if such indications of limit cycle neutron flux oscillations are detected.

E.1 Should a LOCA occur with THERMAL POWER > 58% RTP, the core response may not be bounded by the LOCA analyses.

Therefore, only a limited time is allowed to reduce THERMAL POWER TO 5 58% RTP.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is based on the low probability of an accident occurring during this time period, on a reasonable time to complete the Required Action, and on frequent core monitoring by the operators allowing changes in THERMAL POWER conditions to be quickly detected.

F.1 If the required limit or setpoint modifications are not performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after transition from two recirculation loop operation to single recirculation loop operation, the required limits and setpoints which have not been modified must be immediately declared not met. The Required Actions for the associated limits and instrument channels must then be taken.

(continued)

CLINTON B 3.4-6 Revision No. 7-5

Jet Pumps B 3.4.3 BASES SURVEILLANCE SR 3.4.3.1 (continued)

REQUIREMENTS Individual jet pumps in a recirculation loop typically do not have the same flow. The unequal flow is due to the drive flow manifold, which does not distribute flow equally to all risers. The flow (or jet pump diffuser to lower plenum differential pressure) pattern or relationship of one jet pump to the loop average is repeatable. An appreciable change in this relationship is an indication that increased (or reduced) resistance has occurred in one of the jet pumps. This may be indicated by an increase in the relative flow for a jet pump that has experienced beam cracks.

The deviations from normal are considered indicative of a potential problem in the recirculation drive flow or jet pump system (Ref. 2). Normal flow ranges and established jet pump flow and differential pressure patterns are established by plotting historical data as discussed in Reference 2.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency has been shown by operating experience to be adequate to verify jet pump OPERABILITY and is consistent with the Frequency for recirculation loop OPERABILITY verification.

This SR is modified by two Notes. Note 1 allows this Surveillance not to be performed until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the associated recirculation loop is in operation, since these checks can only be performed during jet pump operation. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is an acceptable time to establish conditions appropriate for data collection and evaluation.

Note 2 allows this SR not to be performed when THERMAL POWER is ! 21.6% RTP. During low flow conditions, jet pump noise approaches the threshold response of the associated flow instrumentation and precludes the collection of repeatable and meaningful data.

With regard to drive flow and differential pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).

(continued)

CLINTON B 3.4-16 Revision No. 7-5

S/RVs B 3.4.4 BASES SURVEILLANCE SR 3.4.4.2 (continued)

REQUIREMENTS The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes valve actuation.

This prevents an RPV pressure blowdown.

SR 3.4.4.3 A manual actuation of each required S/RV (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can be demonstrated-by one of two methods. If performed by Method 1, plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements (Ref. 6), prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 'after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SR. If performed by Method 2, valve OPERABILITY has been demonstrated for all installed S/RVs based upon the successful operation of a test sample of S/RVs.

1. Manual actuation of the S/RV with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g.,

tailpipe temperature or acoustic monitoring).

Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the S/RVs divert steam flow upon opening. Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test. Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.

(continued)

CLINTON B 3.4-21 Revision No. 7-2

S/RVs B 3.4.4 BASES SURVEILLANCE SR 3.4.4.3 (continued)

REQUIREMENTS

2. The sample population of S/RVs tested to satisfy SR 3.4.4.1 will also be stroked in the relief mode during "as-found" testing to verify proper operation of the S/RV. The successful performance of the test sample of S/RVs provides reasonable assurance that the remaining installed S/RVs will perform in a similar fashion. After the S/RVs are replaced, the relief mode actuator of the newly-installed S/RVs will be uncoupled from the S/RV stem, and cycled to ensure that no damage has occurred to the S/RV during transportation and installation. Following cycling, the relief-mode actuator is recoupled and the proper positioning of the stem nut is independently verified.

This verifies that each replaced S/RV will properly perform its intended function. If the valve fails to actuate due only to the failure of the solenoid but is capable of opening on overpressure, the safety function of the S/RV is considered OPERABLE.

The 18 month Frequency was developed based on the S/RV tests required by the ASME Boiler and Pressure Vessel Code, Section XI (Ref. 1). Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. ASME, Boiler and Pressure Vessel Code, Section III and XI.

2. USAR, Section 5.2.2.

3. USAR, Section 15.

4. NEDC-32202P, "SRV Setpoint Tolerance and Out-of Service Analysis for Clinton Power Station, "August 1993."

5. Calculation IP-0-0032.

6. ASME/ANSI OM-1987, Operation and Maintenance of Nuclear Power Plants, Part 1.

CLINTON B 3.4-22 Revision No. 7-2

RCS P/T Limits B 3.4.11 BASES (continued)

BACKGROUND 10 CFR 50, Appendix G (Ref. 1), requires the establishment (continued) of P/T limits for material fracture toughness requirements of the RCPB materials. Reference 1 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME) Code, Section III, Appendix G (Ref. 2).

The actual shift in the RT= of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 3) and 10 CFR 50, Appendix H (Ref. 4).

The operating P/T limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of Reference 5.

Withdrawal of the first surveillance capsule has been deferred from a vessel exposure of 10 Effective Full Power Years (EPFY) to 10.4 EFPY (Ref. 20).

With regard to the reactor vessel material specimen capsule withdrawal schedule, NRC staff review and approval of any change to this schedule is required prior to implementation.

Furthermore, changes to the capsule removal schedule that do not conform with ASTM E-185 (Ref. 3) require NRC approval in the form of a license amendment as described in NRC Administrative Letter 97-04 (Ref. 10).

(continued)

CLINTON B 3.4-53a Revision No. 7-2

RCS P/T Limits B 3.4.11 BASES LCO hydrostatic testing P/T limit curves. Thus, the LCO for the (continued) rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves. In addition, limits have been imposed to restrict the rate of temperature changes to

20'F in any one hour period when operating between Figure 3.4.11-1 limits and Figures 3.4.11-2/3.4.11-3 limits, as applicable.

This additional limitation on temperature changes is imposed to ensure margin to the limits and the desire to maintain RCS temperature essentially constant during pressurization for hydrostatic testing.

Violation of the limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCS components. The consequences depend on several factors, as follows:

a. The severity of the departure from the allowable operating pressure temperature regime or the severity of the rate of change of temperature;

b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and

c. The existences, sizes, and orientations of flaws in the vessel material.

APPLICABILITY The potential for violating a P/T limit exists at all times.

For example, P/T limit violations could result from ambient temperature conditions that result in the reactor vessel metal temperature being less than the minimum allowed temperature for boltup. Therefore, this LCO is applicable even when fuel is not loaded in the core.

ACTIONS A.1 and A.2 Operation outside the P/T limits while in MODE 1, 2, or 3 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.

The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.

(continued)

CLINTON B 3.4-56 Revision No. 7-8

RCS P/T Limits B 3.4.11 BASES SURVEILLANCE SR 3.4.11.5, SR 3.4.11.6, and SR 3.4.11.7 (continued)

REQUIREMENTS The 30 minute Frequency reflects the urgency of maintaining the temperatures within limits, and also limits the time that the temperature limits could be exceeded. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable based on the rate of temperature change possible at these temperatures.

With regard to reactor vessel flange and head flange temperature values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 15).

SR 3.4.11.8 and SR 3.4.11.9 Differential temperatures within the applicable limits ensure that thermal stresses resulting from increases in THERMAL POWER or recirculation loop flow during single recirculation loop operation will not exceed design allowances. Performing the Surveillance within 15 minutes before beginning such an increase in power or flow rate provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the change in operation.

An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.11.9 is to compare the temperatures of the operating recirculation loop and the idle loop.

Plant specific test data has determined that the bottom head is not subject to temperature stratification with natural circulation at power levels as low as 25% of RTP and with any single loop flow rate greater than or equal to 30% of rated loop flow. Therefore, SR 3.4.11.8 and SR 3.4.11.9 have been modified by a Note that requires the Surveillance to be met only when THERMAL POWER or loop flow is being increased when the above conditions are not met. The Note for SR 3.4.11.9 further limits the requirement for this Surveillance to exclude comparison of the idle loop temperature if the idle loop is isolated from the RPV since the water in the loop cannot be introduced into the remainder of the Reactor Coolant System.

(continued)

CLINTON B 3.4-61 Revision No. 7-5

RCS P/T Limits B 3t4.11 BASES REFERENCES 15. Calculation IP-0-0040.

(continued)

16. Calculation IP-0-0041.

17. Calculation IP-0-0042.

18. GE-NE-BI3-02084-00-01, Rev. 0, "Pressure-Temperature Curves for AmerGen, Clinton Power Station Using the K1 c Methodology," August 2000.

19. Deleted

20. License Amendment 143 dated March 8, 2002.

CLINTON B 3.4-61b Revision No. 7-8

BASES SURVEILLANCE SR 3.5.1.5 (continued)

REQUIREMENTS was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

SR 3.5.1.6 The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals.

A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,

solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.7 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes valve actuation.

This prevents an RPV pressure blowdown.

SR 3.5.1.7 A manual actuation of each required ADS valve (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by Method 1, plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements (Ref. 21), prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steani pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable (continued)

CLINTON B 3.5-12 Revision No. 7-2

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.7 (continued)

REQUIREMENTS Conditions for testing and provides a reasonable time to complete the SR. If performed by Method 2, valve OPERABILITY has been demonstrated for all installed ADS valves based upon the successful operations of a test sample of S/RVs.

1. Manual actuation of the ADS valve, with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g.,

tailpipe temperature or acoustic monitoring). Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the ADS valves divert steam flow upon opening. Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test. Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.

2. The sample population of S/RVs tested to satisfy SR 3.4.4.1 will also be stroked in the relief mode during "as-found" testing to verify proper operation of the S/RV. The successful performance of the test sample of S/RVs provides reasonable assurance that all ADS valves will perform in a similar fashion. After the S/RVs are replaced, the relief-mode actuator of the newly installed S/RVs will be uncoupled from the S/RV stem, and cycled to ensure that no damage has occurred to the S/RV during transportation and installation. Following cycling, the relief-mode actuator is recoupled and the proper positioning of the stem nut is independently verified. This verifies that each replaced S/RV will properly perform its intended function.

SR 3.5.1.6 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function. The STAGGERED TEST BASIS Frequency ensures that both solenoids for each ADS valve relief-mode actuator are alternately tested. The Frequency of the required relief-mode actuator testing is based on the tests required by ASME OM, Part 1, (Ref. 21) as implemented by the Inservice Testing Program of Specification 5.5.6. The testing Frequency required by the Inservice Testing Program is based on operating experience and valve performance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

(continued)

CLINTON B 3.5-13 Revision No. 7-2

BASES (continued)

SURVEILLANCE SR 3.5.1.8 REQUIREMENTS This SR ensures that the ECCS RESPONSE TIMES are within limits for each of the ECCS injection and spray subsystems.

The response time limits (i.e., <42 seconds for the LPCI subsystems, <41 seconds for the LPCS subsystem, and <27 seconds for the HPCS system) are specified in applicable surveillance test procedures. This SR is modified by a Note which identifies that the associated ECCS actuation instrumentation is not required to be response time tested.

This is supported by Reference 15.

Response time testing of the remaining subsystem components is required. However, of the remaining subsystem components, the time for each ECCS pump to reach rated speed is not directly measured in the response time tests. The time(s) for the ECCS pumps to reach rated speed is bounded, in all cases, by the time(s) for the ECCS injection valve(s) to reach the full-open position. Plant-specific calculations show that all ECCS motor start times at rated voltage are less than two seconds. In addition, these calculations show that under degraded voltage conditions, the time to rated speed is less than five seconds.

ECCS RESPONSE TIME tests are conducted every 18 months. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

With regard to ECCS RESPONSE TIME values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 20).

CLINTON B 3.5-14 Revision No. 7-2

ECCS -- Operating B 3.5.1 BASES (continued)

REFERENCES 1. USAR, Section 6.3.2.2.3.

2. USAR, Section 6.3.2.2.4.

3. USAR, Section 6.3.2.2.1.

4. USAR, Section 6.3.2.2.2.

5. USAR, Section 15.2.8.

6. USAR, Section 15.6.4.

7. USAR, Section 15.6.5.

8. 10 CFR 50, Appendix K.

9. USAR, Section 6.3.3.

10. 10 CFR 50.46.

11. USAR, Section 6.3.3.3.

12. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.

(NRC), "Recommended Interim Revisions to LCO's for ECCS Components," December 1, 1975.

13. USAR, Table 6.3-8.

14. USAR, Section 7.3.1.1.1.4.

15. NEDO-32291-A, "System Analyses for Elimination of Selected Response Time Testing Requirements," January 1994.

16. Calculation IP-0-0044.

17. Calculations 01HP09/10/lI, IP-C-0042.

18. Calculations O1LP08/ll/14, IP-C-0043.

19. Calculations O1RH19/20/23/24, IP-C-0041.

20. Calculation IP-0-0024.

21. ASME/ANSI OM-1987, Operation and Maintenance of Nuclear Power Plants, Part 1.

CLINTON B 3.5-14a Revision No. 7-2

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.3 and SR 3.5.3.4 REQUIREMENTS (continued) The RCIC pump flow rates ensure that the system can maintain reactor coolant inventory during pressurized conditions with the RPV isolated. The flow tests for the RCIC System are performed at two different pressure ranges such that system capability to provide rated flow is tested both at the higher and lower operating ranges of the system. Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the RCIC System diverts steam flow. Since the required reactor steam pressure must be available to perform SR 3.5.3.3 and SR 3.5.3.4, sufficient time is allowed after adequate pressure and flow are achieved to perform these SRs. Reactor startup is allowed prior to performing the low pressure Surveillance because the reactor pressure is low and the time to satisfactorily perform the Surveillance is short. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure test has been satisfactorily completed and there is no indication or reason to believe that RCIC is inoperable. Therefore, these SRs are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the reactor steam pressure and flow are adequate to perform the test.

A 92 day Frequency for SR 3.5.3.3 is consistent with the Inservice Testing Program requirements. The 18 month Frequency for SR 3.5.3.4 is based on the need to perform this Surveillance under the conditions that apply just prior to or during startup from a plant outage. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

With regard to RCIC steam supply pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 5).

With regard to measured reactor pressure and flow rate values obtained pursuant to these SRs, when test values are obtained with test equipment meeting the accuracy requirements for ASME Section XI or NUREG-1482, the specified limits are considered to be nominal values and therefore do not require compensation for instrument indication uncertainties. (Ref. 5)

(continued)

CLINTON B 3.5-25 Revision No. 7-7

Primary Containment Air Locks B 3.6.1.2 BASES LCO The primary containment air locks are required to be (continued) OPERABLE. For each air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door to be open at a time. This provision ensures that a gross breach of primary containment does not exist when primary containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into and exit from primary containment.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining OPERABLE primary containment air locks in MODE 4 or 5 to ensure a control volume is only required during situations for which significant releases of radioactive material can be postulated; such as during operations with a potential for draining the reactor vessel (OPDRVs) or during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary containment.

ACTIONS The ACTIONS are modified by Note 1, which allows entry and exit to perform repairs of the affected air lock component.

If the outer door is inoperable, then it may be easily accessed for most repairs. It is preferred that the air lock be accessed from inside primary containment by entering through the other OPERABLE air lock. However, if this is not practicable, or if repairs on either door must be performed from the barrel side of the door, then it is permissible to enter the air lock through the OPERABLE door, which means there is a short time during which the primary containment boundary is not intact (during access through the OPERABLE door). The ability to open the OPERABLE door, even if it means the primary containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the primary containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed.

(continued)

CLINTON B 3.6-8 Revision No. 7-3

Primary Containment Air Locks B 3.6.1.2 BASES ACTIONS C.1, C.2 and C.3 (continued) both doors failing the seal test, the overall containment leakage rate can still be within limits.

Required Action C.2 requires that one door in the affected primary containment air locks must be verified closed. This Required Action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1.1, which require that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, the air lock must be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable for restoring an inoperable air lock to OPERABLE status considering that at least one door is maintained closed in each affected air lock.

D.1 and D.2 If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time while operating in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.1 and E.2 If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time during OPDRVs, during movement of recently irradiated fuel assemblies (i.e.-, fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary or secondary containment, action is required to immediately suspend activities that represent a potential for releasing radioactive material, thus placing the unit in a Condition that minimizes risk. If applicable movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe (continued)

CLINTON B 3.6-12 Revision No. 7-3

Primary Containment Air Locks B 3.6.1.2 BASES ACTIONS E.1 and E.2 (continued) position. Also, if applicable, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Action must continue until OPDRVs are suspended.

The Required Actions of Condition E are modified by a Note indicating that LCO 3.0.3 does not apply. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.

Therefore, inability to suspend movement of recently irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.6.1.2.1 REQUIREMENTS Maintaining primary containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Primary Containment Leakage Rate Testing Program when in MODES 1, 2, and 3. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and primary containment OPERABILITY testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall primary containment leakage rate. The Frequency is required by the Primary Containment Leakage Rate Testing Program.

The SR has been modified by three Notes. Note 1 provides an exception to the specific leakage requirements for the primary containment air locks in other than MODES 1, 2, and

3. When not operating in MODES 1, 2, or 3, primary containment pressure is not expected to significantly increase above normal, and therefore specific testing at elevated pressure is not required. Note 2 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test.

This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 3 has been added to this SR, requiring the results to be evaluated against the acceptance criteria applicable to SR 3.6.1.1.1, i.e., the acceptance criteria (continued)

CLINTON B 3.6-13 Revision No. 7-3

PCIVs B 3.6.1.3 BASES ACTIONS E.1 and E.2 (continued)

Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

F.1, G.1 and G.2 If any Required Action and associated Completion Time cannot be met, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary and secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe condition. Also, if applicable, action must be immediately initiated to suspend operations with a potential for draining the reactor vessel (OPDRVs) to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended. If suspending the OPDRVs would result in closing the residual heat removal (RHR) shutdown cooling isolation valves, an alternative Required Action is provided to immediately initiate action to restore the valves to OPERABLE status. This allows RHR to remain in service while actions are being taken to restore the valve.

The Required Actions of Condition F are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.

Therefore, inability to suspend movement of recently irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.6.1.3.1 REQUIREMENTS I This SR verifies that the 36-inch primary containment purge valves are closed as required or, if open, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed, it is not considered to have leakage (continued)

CLINTON B 3.6-22 Revision No. 7-3

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.1 (continued)

REQUIREMENTS outside of the limits. If the open valve is known to have excessive leakage, Condition D applies.

The SR is also modified by a Note (Note 1) stating that primary containment purge valves are only required to be closed in MODES 1, 2, and 3. If a LOCA inside primary containment occurs in these MODES, the primary containment purge valves are capable of closing before the pressure pulse affects systems downstream of the purge valves and the release of radioactive material will not exceed limits prior to the purge valves closing. At times other than MODE 1, 2, or 3 when the purge valves are required to be capable of closing (e.g., during movement of recently irradiated fuel assemblies) pressurization concerns are not present and the purge valves are allowed to be open (automatic isolation (continued)

CLINTON B 3.6-22a Revision No. 7-3

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.4 (continued)

REQUIREMENTS in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program.

With regard to isolation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).

SR 3.6.1.3.5 For primary containment purge valves with resilient seals, additional leakage rate testing beyond the test requirements of the Primary Containment Leakage Rate Testing Program is required to ensure OPERABILITY. The acceptance criterion for this test is

0.01 La when pressurized to Pa, 9.0 psig.

Since cycling these valves may introduce additional seal degradation (beyond that which occurs to a valve that has not been opened), this SR must be performed within 92 days after opening the valve. However, operating experience has demonstrated that if a valve with a resilient seal is not stroked during an operating cycle, significant increased leakage through the valve is not observed. Based on this observation, a normal Frequency in accordance with the Primary Containment Leakage Rate Testing Program was established.

The SR is modified by a Note stating that the primary containment purge valves are only required to meet leakage rate testing requirements in MODES 1, 2, and 3. If a LOCA inside primary containment occurs in these MODES, purge valve leakage must be minimized to ensure offsite radiological release is within limits. At other times when the purge valves are required to be capable of closing (e.g., during handling of recently irradiated fuel),

pressurization concerns are not present and the purge valves are not required to meet any specific leakage criteria.

With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).

(continued)

CLINTON B 3.6-25 Revision No. 7-3

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.8 (continued)

REQUIREMENTS leakage through the isolation device. If both isolation valves in the penetration are closed, the actual leakage rate is the lesser leakage rate of the two valves. This method of quantifying maximum pathway leakage is only to be used for this SR.

The Frequency is consistent with the Primary Containment Leakage Rate Testing Program. This SR simply imposes additional acceptance criteria. Secondary containment bypass leakage is considered part of La A Note is added to this SR which states that these valves are only required to meet this leakage limit in MODES 1, 2 and 3. In the other conditions, the Reactor Coolant System is not pressurized and specific primary containment leakage limits are not required.

With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).

SR 3.6.1.3.9 The analyses in References 1, 2, and 3 are based on leakage that is less than the specified leakage rate. Leakage through all four main steamlines must be

112 scfh when tested at Pa (9.0 psig). [Note: A more conservative main steamline leakage rate (27 scfh per steamline) is being administratively imposed in the applicable plant implementing procedures as an interim resolution to a minor discrepancy issue associated with the containment and drywell design and licensing basis. (CR 1-98-08-325)) The MSIV leakage rate must be verified to be in accordance with the assumptions of References 1, 2, and 3. A Note is added to this SR which states that these valves are only required to meet this leakage limit in MODES 1, 2, and 3. In the other conditions, the Reactor Coolant System is not pressurized and primary containment leakage limits are not required. The Frequency is required by the Primary Containment Leakage Rate Testing Program.

(continued)

CLINTON B 3.6-27 Revision No. 7-2

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.11 REQUIREMENTS This SR ensures that the combined leakage rate of the primary containment feedwater penetrations is less than the specified leakage rate. The leakage rate is based on water as the test medium since these penetrations are designed to be sealed by the FWLCS. The 3 gpm leakage limit has been shown by testing and analysis to bound the condition following a DBA LOCA where, for a limited time, both air and water are postulated to leak through this pathway. The leakage rate of each primary containment feedwater penetration is assumed to be the maximum pathway leakage, i.e., the leakage through the worst of the two isolation valves [either 1B21-F032A(B) or IB21-FO65A(B)] in each penetration. This provides assurance that the assumptions in the radiological evaluations of References 1 and 2 are met (Ref. 15).

Dose associated with leakage (both air and water) through the primary containment feedwater penetrations is considered to be in addition to the dose associated with all other secondary containment bypass leakage paths.

The Frequency is in accordance with the Primary Containment Leakage Rate Testing Program.

A Note is added to this SR which states that the primary containment feedwater penetrations are only required to meet this leakage limit in Modes 1, 2, and 3. In other conditions, the Reactor Coolant System is not pressurized and specific primary containment leakage limits are not required.

SR 3.6.1.3.12 This SR requires a demonstration that each instrumentation line excess flow check valve (EFCV) which communicates to the reactor coolant pressure boundary (Ref. 16) is OPERABLE by verifying that the valve activates within the required flow range. For instrument lines connected to reactor coolant pressure boundary, the EFCVs serve as an additional flow restrictor to the orifices that are installed inside the drywell (Ref. 14). The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. (continued)

CLINTON B 3.6-28a Revision No. 7-8

PCIVs B 3.6.1.3 BASES SR 3.6.1.3.12 (continued)

The operating limit or process parameter value associated with this SR, as read from plant indication instrumentation, is considered nominal. Instrument indications that are considered nominal do not require compensation for instrument indication uncertainties (Ref. 13).

Instrument lines that connect to the containment atmosphere, such as those which measure drywell pressure, or monitor the containment atmosphere or suppression pool water level, are considered extensions of primary containment. A failure of one of these instrument lines during normal operation would not result in the closure of the associated EFCV, since normal operating containment pressure is not sufficient to operate the valve. Such EFCVs will only close with a downstream line break concurrent with a LOCA. Since these conditions are beyond the plant design basis, EFCV closure is not needed and containment atmospheric instrument line EFCVs need not be tested (Ref. 16).

REFERENCES 1. USAR, Chapter 15.6.5.

2. USAR, Section 15.6.4.

3. USAR, Section 15.7.4.

4. USAR, Section 6.2.

5. USAR, Table 6.2-47.

6. 10 CFR 50, Appendix J, Option B.

7. Regulatory Guide 1.11.

8. Calculation IP-0-0059.

9. Calculation IP-0-0056.

10. Calculation IP-0-0028.

11. Calculation IP-0-0063.

12. Calculation IP-0-0064.

13. Calculation IP-0-0065.

14. Calculation IP-M-0506

15. License Amendment 127

16. NEDO 32977-A, "Excess Flow Check Valve Testing Relaxation" CLINTON B 3.6-28b Revision No. 7-8

LLS Valves B 3.6.1.6 BASES ACTIONS B.1 and B.2 (continued) power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.6.1 REQUIREMENTS A manual actuation of each required LLS valve (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by Method 1, plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements (Ref. 2), prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SR. If performed by Method 2, valve OPERABILITY has been demonstrated for all installed LLS valves based upon the successful operation of a test sample of S/RVs.

1. Manual actuation of the LLS valve, with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g.,

tailpipe temperature or acoustic monitoring). Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the LLS valves divert steam flow upon opening.

Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test.

Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.

2. The sample population of S/RVs tested to satisfy SR 3.4.4.1 will also be stroked in the relief mode during "as-found" testing to verify proper operation of the S/RV. The successful performance of the test sample of S/RVs provides reasonable assurance that all LLS valves will perform in similar fashion. After the S/RVs are replaced, the relief-mode actuator of the newly installed S/RVs will be uncoupled from the S/RV stem, and cycled to ensure that no damage has occurred to the

'S/RV during transportation and installation. Following cycling, the relief-mode actuator is recoupled and the (continued)

CLINTON B 3.6-37 Revision No. 7-2

LLS Valves B 3.6.1.6 BASES SURVEILLANCE SR 3.6.1.6.1 (continued)

REQUIREMENTS (continued) proper positioning of the stem nut is independently verified. This verifies that each replaced S/RV will properly perform its intended function.

The Frequency of the required relief-mode actuator testing is based on the tests required by ASME OM Part 1 (Ref. 2),

as implemented by the Inservice Testing Program of Specification 5.5.6. The testing Frequency required by the Inservice Testing Program is based on operating experience and valve performance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.1.6.2 The LLS designed S/RVs are required to actuate automatically upon receipt of specific initiation signals. A system functional test is performed to verify that the mechanical portions (i.e., solenoids) of the automatic LLS function operate as designed when initiated either by an actual or simulated automatic initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.5.4 overlaps this SR to provide complete testing of the safety function.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance when performed at the 18 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes valve actuation.

This prevents a reactor pressure vessel pressure blowdown.

REFERENCES 1. USAR, Section 5.2.2.2.3.

2. ASME/ANSI OM-1987, Operation and Maintenance of I Nuclear Power Plants, Part 1.

CLINTON B 3.6-38 Revision No. 7-2

RHR Containment Spray System B 3.6.1.7 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.7 Residual Heat Removal (RHR) Containment Spray System BASES BACKGROUND The primary containment is designed with a suppression pool so that, in the event of a loss of coolant accident (LOCA),

steam released from the primary system is channeled through the suppression pool water and condensed without producing significant pressurization of the primary containment. The primary containment is designed so that with the pool initially at the minimum water volume and the worst single failure of the primary containment heat removal systems, suppression pool energy absorption combined with subsequent operator controlled pool cooling will prevent the primary containment pressure from exceeding its design value.

However, the primary containment must also withstand a postulated drywell bypass leakage pathway that allows the passage of steam from the drywell directly into the primary containment airspace, bypassing the suppression pool. The primary containment also must withstand a low energy steam release into the primary containment airspace. The RHR Containment Spray System is designed to mitigate the effects of bypass leakage and low energy line breaks.

There are two redundant, 100% capacity RHR containment spray subsystems. Each subsystem consists of a suction line from the suppression pool, an RHR pump, a heat exchanger, and two spray headers inside the primary containment (outside of the drywell) above the refueling floor. Dispersion of the spray water is accomplished by 249 nozzles in the Division 1 subsystem and 251 nozzles in the Division 2 subsystem.

The RHR containment spray mode will be automatically initiated, if required, following a LOCA.

APPLICABLE Reference 1 contains the results of analyses that predict SAFETY ANALYSES the primary containment pressure response for a LOCA with the maximum allowable bypass leakage area.

The equivalent flow path area for drywell bypass leakage has 2

been specified to be 1.0 ft .

I (continued)

CLINTON B 3.6-39 Revision No. 7-5

RHR Containment Spray System B 3.6.1.7 BASES I APPLICABLE The analysis demonstrates that with containment spray SAFETY ANALYSES operation the containment pressure remains within design (continued) limits.

The RHR Containment Spray System satisfies Criterion 3 of the NRC Policy Statement.

LCO In the event of a Design Basis Accident (DBA), a minimum of one RHR containment spray subsystem is required to mitigate potential bypass leakage paths and maintain the primary containment peak pressure below design limits. To ensure that these requirements are met, two RHR containment spray subsystems must be OPERABLE. Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR containment spray subsystem is OPERABLE when the pump, the heat exchanger, and associated piping, valves, instrumentation, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining RHR containment spray subsystems OPERABLE is not required in MODE 4 or 5.

ACTIONS A.1 With one RHR containment spray subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE RHR containment spray subsystem is adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced primary containment cooling capability. The 7 day Completion Time was chosen in light of the redundant RHR containment capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.

(continued)

CLINTON B 3.6-40 Revision No. 7-5

RHR Containment Spray System B 3.6.1.7 BASES SURVEILLANCE SR 3.6.1.7.3 (continued)

REQUIREMENTS the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.1.7.4 This Surveillance is performed following activites that could result in nozzle blockage to verify that the spray nozzles are not obstructed and that flow will be provided when required. Such activities may include a loss of foreign material control (of if it cannot be assured),

following a major configuration change, or following an inadvertent actuation of containment spray. This Surveillance is normally performed by an air or smoke flow test. The Frequency is adequate due to the passive nozzle design and its normally dry state and has been shown to be acceptable through operating experience.

REFERENCES 1. USAR, Section 6.2.1.1.5.

2. ASME, Boiler and Pressure Vessel Code, Section XI.

3. USAR, Section 5.4.7 CLINTON B 3 .6-43 Revision No. 7-2

Secondary Containment B 3.6.4.1 BASES APPLICABLE Secondary containment satisfies Criterion 3 of the NRC SAFETY ANALYSES Policy Statement.

(continued)

LCO An OPERABLE secondary containment provides a control volume into which fission products that bypass or leak from primary containment, or are released from the reactor coolant pressure boundary components located in secondary containment, can be diluted and processed prior to release to the environment. For the secondary containment to be considered OPERABLE, it must have adequate leak tightness to ensure that the required vacuum can be established and maintained.

APPLICABILITY In MODES 1, 2, and 3, a LOCA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, secondary containment OPERABILITY is required during the same operating conditions that require primary containment OPERABILITY.

In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining secondary containment OPERABLE is not required in MODE 4 or 5 to ensure a control volume, except for other situations for which significant releases of radioactive material can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs) or during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary or secondary containment.

ACTIONS A.1 If secondary containment is inoperable, it must be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary (continued)

CLINTON B 3.6-85 Revision No. 7-3

Secondary Containment B 3.6.4.1 BASES ACTIONS A.1 (continued) containment during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring secondary containment OPERABILITY) occurring during periods where secondary containment is inoperable is minimal.

B.1 and B.2 If the secondary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1, and C.3 Movement of recently irradiated fuel assemblies in the primary or secondary containment and OPDRVs can be postulated to cause fission product release to the secondary containment. In such cases, the secondary containment is the only barrier to release of fission products to the environment. Movement of recently irradiated fuel assemblies must be immediately suspended if the secondary containment is inoperable.

Suspension of these activities shall not preclude completing an action that involves moving a component to a safe position. Also, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

Required Action C.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend (continued)

CLINTON B 3.6-86 Revision No. 7-3

I Secondary Containment B 3.6.4.1 BASES ACTIONS C.1 and C.2 (continued) movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.6.4.1.1 REQUIREMENTS This SR ensures that the secondary containment boundary is sufficiently leak tight to preclude exfiltration under expected wind conditions. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .Frequency of this SR was developed based on operating experience related to secondary containment vacuum variations during the applicable MODES and the low probability of a DBA occurring between surveillances.

Furthermore, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal secondary containment vacuum condition.

With regard to secondary containment vacuum values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).

SR 3.6.4.1.2 and SR 3.6.4.1.3 Verifying that secondary containment equipment hatches and access doors are closed ensures that the infiltration of outside air of such a magnitude as to prevent maintaining the desired negative pressure does not occur. Verifying that all such openings are closed provides adequate assurance that exfiltration from the secondary containment will not occur. In this application the term "sealed" has no connotation of leak tightness. Maintaining secondary containment OPERABILITY requires verifying one door in the access opening is closed, except when the access opening is being used for entry and exit. The 31 day Frequency for these SRs has been shown to be adequate based on operating experience, and is considered adequate in view of the other controls on secondary containment access openings.

(continued)

CLINTON B 3.6-87 Revision No. 7-3

SCIDs B 3.6.4.2 BASES APPLICABLE the boundary established by SCIDs is required to ensure that SAFETY ANALYSES leakage from the primary containment is processed by the (continued) Standby Gas Treatment (SGT) System before being released to the environment.

Maintaining SCIDs OPERABLE with isolation times within limits ensures that fission products will remain trapped inside secondary containment so that they can be treated by the SGT System prior to discharge to the environment.

SCIDs satisfy Criterion 3 of the NRC Policy Statement.

LCO SCIDs form a part of the secondary containment boundary. The SCID safety function is related to control of offsite radiation releases resulting from DBAs.

The power operated isolation dampers and valves are considered OPERABLE when their isolation times are within limits. Additionally, power operated automatic dampers and valves are required to actuate on an automatic isolation signal.

The normally closed isolation dampers, valves, or blind flanges are considered OPERABLE when manual dampers or valves are closed or open in accordance with appropriate administrative controls, automatic dampers are de-activated and secured in their closed position, or blind flanges are in place. The SCIDs covered by this LCO, along with their associated stroke times, if applicable, are listed in applicable plant procedures.

APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to the primary containment that leaks to the secondary containment. Therefore, OPERABILITY of SCIDs is required.

In MODES 4 and 5, the probability and consequences of these events are reduced due to pressure and temperature limitations in these MODES. Therefore, maintaining SCIDs OPERABLE is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as during operations with a I potential for draining the reactor vessel (OPDRVs)

(continued)

CLINTON B 3.6-90 Revision No. 7-3

SCIDs B 3.6.4.2 BASES APPLICABILITY or during movement of recently irradiated fuel (continued) assemblies. (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ). Moving recently irradiated fuel assemblies in the secondary containment may also occur in MODES 1, 2, and 3.

ACTIONS The ACTIONS are modified by three Notes. The first Note allows penetration flow paths to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated individual, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when the need for secondary containment isolation is indicated.

The second Note provides clarification that for the purpose of this LCO separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SCID. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SCIDs are governed by subsequent Condition entry and application of associated Required Actions.

The third Note ensures appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable SCID.

A.1 and A.2 In the event that there are one or more penetration flow paths with one SCID inoperable, the affected penetration flow path(s) must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criteria are a closed and de-activated automatic damper, a closed manual damper or valve, or a blind flange. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available device to secondary containment. This Required Action must be completed within the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time. The specified time period is reasonable considering the time required to isolate the penetration and the low probability of a DBA, which requires the SCIDs to close, occurring during this short time.

(continued)

CLINTON B 3.6-91 Revision No. 7-3

SCIDs B 3.6.4.2 BASES ACTIONS C.1 and C.2 (continued) brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1 and D.2 If any Required Action and associated Completion Time cannot be met, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies in the primary and secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, action must be immediately initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and the subsequent potential for fission product release.

Actions must continue until OPDRVs are suspended.

Required Action D.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3,-the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.6.4.2.1 REQUIREMENTS This SR verifies each secondary containment isolation manual valve, damper, and blind flange that is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the secondary containment boundary is within design limits. This SR does not require any testing or valve or damper manipulation. Rather, it involves verification that those SCIDs in secondary containment that are capable of being mispositioned are in the correct position.

(continued)

CLINTON B 3.6-93 Revision No. 7-3

SGT System B 3.6.4.3 BASES APPLICABILITY In MODES 4 and 5, the probability and consequences of these (continued) events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the SGT System OPERABLE is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs) or during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary or secondary containment.

ACTIONS A.1 With one SGT subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE SGT subsystem is adequate to perform the required radioactivity release control function. However, the overall system reliability is reduced because a single failure in the OPERABLE subsystem could result in the radioactivity release control function not being adequately performed. The 7 day Completion Time is based on consideration of such factors as the availability of the OPERABLE redundant SGT subsystem and the low probability of a DBA occurring during this period.

B.1 and B.2 If the SGT subsystem cannot be restored to OPERABLE status within the required Completion Time in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1, C.2.1 and C.2.2 During movement of recently irradiated fuel assemblies in the primary or secondary containment or during OPDRVs, when Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE SGT subsystem should be immediately placed in operation. This Required Action ensures that the remaining subsystem is OPERABLE, (continued)

CLINTON B 3.6-98 Revision No. 7-3

SGT System B 3.6.4.3 BASES ACTIONS C.1, C.2.1 and C.2.2 (continued) that no failures that could prevent automatic actuation have occurred, and that any other failure would be readily detected.

An alternative to Required Action C.1 is to immediately suspend activities that represent a potential for releasing radioactive material to the secondary containment, thus placing the unit in a Condition that minimizes risk. If applicable, movement of recently irradiated fuel assemblies must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. This action should be chosen if the OPDRVs could be impacted by a loss of offsite power. Action must continue until OPDRVs are suspended.

The Required Actions of Condition C have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

D.1 If both SGT subsystems are inoperable in MODE 1, 2, or 3, the SGT System may not be capable of supporting the required radioactivity release control function. Therefore, LCO 3.0.3 must be entered immediately.

E.1 and E.2 When two SGT subsystems are inoperable, if applicable, movement of recently irradiated fuel assemblies in the primary and secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe (continued)

CLINTON B 3.6-99 Revision No. 7-3

SGT System B 3.6.4.3 BASES ACTIONS E.1 and E.2o(continued) position. Also, if applicable, actions must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Action must continue until OPDRVs are suspended.

SURVEILLANCE SR 3.6.4.3.1 REQUIREMENTS Operating each SGT subsystem from the main control room for

> 10 continuous hours ensures that both subsystems are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. Operation with the heaters on (automatic heater cycling to maintain temperature) for Ž 10 continuous hours every 31 days eliminates moisture on the adsorbers and HEPA filters. The 31 day Frequency was developed in consideration of the known reliability of fan motors and controls and the redundancy available in the system.

With regard to operating time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).

SR 3.6.4.3.2 This SR verifies that the required SGT filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber bypass leakage and efficiency, minimum system flow rate, combined HEPA filter and charcoal adsorber pressure drop, and heater dissipation.

The frequencies for performing the SGT System filter tests are in accordance with Regulatory Guide 1.52 (Ref. 4) and include testing initially, after 720 hours0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months of system operation, once per 18 months, and following painting, fire, or chemical release in any ventilation zone communicating with the system. The laboratory test results will be (continued)

CLINTON B 3.6-100 Revision No. 7-3

Drywell B 3.6.5.1 BASES SURVEILLANCE SR 3.6.5.1.3 REQUIREMENTS The analyses in Reference 1 are based on a maximum drywell bypass leakage. This Surveillance ensures that the actual drywell bypass leakage is less than or equal to the 2

acceptable A/IJdesign value of 1.0 ft assumed in the safety analysis. As left drywell bypass leakage, prior to the first startup after performing a required drywell bypass leakage test, is required to be

10% of the drywell bypass leakage limit. At all other times between required drywell leakage rate tests, the acceptance criteria is based on the design A/IJ. At the design A/j the containment temperature and pressurization response are bounded by the assumptions of the safety analysis. One drywell air lock door is left open during each drywell bypass leakage test such that each drywell air lock door is leak tested during at least every other drywell bypass leakage test. This ensures that the leakage through the drywell air lock is properly accounted for in the measured bypass leakage and that each air lock door is tested periodically.

This Surveillance is performed at least once every 10 years (120 months) on a performance based frequency. The Frequency is consistent with the difficulty of performing the test, risk of high radiation exposure, and the remote possibility that sufficient component failures will occur such that the drywell bypass leakage limit will be exceeded.

If during the performance of this required Surveillance the drywell bypass leakage is determined to be greater than the leakage limit, the Surveillance Frequency is increased to at least once every 48 months. If during the performance of the subsequent consecutive Surveillance the drywell bypass leakage is determined to be less than or equal to the drywell bypass leakage limit, the 10-year Frequency may be resumed. If during the performance of the subsequent consecutive Surveillance the drywell bypass leakage is determined to be greater than the drywell bypass leakage limit, the Surveillance Frequency is increased to at least once every 24 months. The 24-month Frequency must be maintained until the drywell bypass leakage is determined to (continued)

CLINTON B 3.6-105a Revision No. 7-5

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 BASES APPLICABLE The drywell post-LOCA vacuum relief subsystems are required SAFETY ANALYSES to assist in hydrogen dilution but not to protect the (continued) structural integrity of the drywell following a large break LOCA. Their passive operation (remaining closed and not leaking during drywell pressurization) is implicit in all of the LOCA analyses (Ref. 1).

The Drywell Post-LOCA Vacuum Relief System satisfies Criterion 3 of the NRC Policy Statement.

LCO The LCO ensures that in the event of a LOCA, four drywell post-LOCA vacuum relief subsystems are available to support operation of the hydrogen mixing system and to reduce suppression pool drag and impact loads in the event of a large break LOCA. Each vacuum relief subsystem is OPERABLE when capable of opening at the required setpoint but is maintained in the closed position during normal operation.

APPLICABILITY In MODES 1, 2, and 3, a Design Basis Accident could cause pressurization of primary containment. Therefore, drywell post-LOCA vacuum relief subsystem OPERABILITY is required during these MODES. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the drywell post-LOCA vacuum relief subsystem OPERABLE is not required in MODE 4 or 5.

ACTIONS The ACTIONS are modified by a Note, which ensures appropriate remedial actions are taken, if necessary, if the drywell is rendered inoperable by inoperable drywell post-LOCA vacuum relief subsystems.

A.1 With one or more drywell post-LOCA vacuum relief subsystems open, the affected penetration flow path must be closed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . This assures that drywell leakage would not result if a postulated LOCA were to occur. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is acceptable, since the drywell design II bypass leakage (A/iik) of 1.0 ft 2 is maintained, and is considered a reasonable length of time needed to complete the Required Action.

(continued)

CLINTON B 3.6-129 Revision No. 7-5

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 BASES ACTIONS A.1 (continued)

A Note has been added to provide clarification that separate Condition entry is allowed for each vacuum relief subsystem not closed.

B.l With one drywell post-LOCA vacuum relief subsystem inoperable for reasons other than Condition A, the inoperable subsystem must be restored to OPERABLE status within 30 days. In these Conditions, the remaining OPERABLE vacuum relief subsystems are adequate to perform the depressurization mitigation function since three 10-inch lines remain available. The 30 day Completion Time takes into account the redundant capability afforded by the remaining subsystems, a reasonable time for repairs, and the low probability of an event requiring the vacuum relief subsystems to function occurring during this period.

C.1 With two or more drywell post-LOCA vacuum relief subsystems inoperable for reasons other than Condition A, the inoperable subsystems must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account a reasonable time for repairs, and the low probability of an event requiring the vacuum relief subsystems to function occurring during this period.

D.1 and D.2 If the inoperable drywell post-LOCA vacuum relief subsystem(s) cannot be closed or restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating (continued)

CLINTON B 3.6-130 Revision No. 7-5

Main Turbine Bypass System B 3.7.6 BASES LCO An OPERABLE Main Turbine Bypass System requires the bypass (continued) valves to open in response to increasing main steam line pressure. This response is within the assumptions of the applicable analysis (Ref. 2).

APPLICABILITY The Main Turbine Bypass System is required to be OPERABLE at

> 21.6% RTP to ensure that the fuel cladding integrity Safety Limit and the cladding 1% plastic strain limit are not violated during the feedwater controller failure, maximum demand event. As discussed in the Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)," sufficient margin to these limits exists

< 21.6% RTP. Therefore, these requirements are only necessary when operating at or above this power level.

ACTIONS A.1 If the Main Turbine Bypass System is inoperable (one or more bypass valves inoperable), the assumptions of the design basis transient analysis may not be met. Under such circumstances, prompt action should be taken to restore the Main Turbine Bypass System to OPERABLE status. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is reasonable, based on the time to complete the Required Action and the low probability of an event occurring during this period requiring the Main Turbine Bypass System.

B.1 If the Main Turbine Bypass System cannot be restored to OPERABLE status within the associated Completion Time, THERMAL POWER must be reduced to < 21.6% RTP. As discussed I in the Applicability section, operation at < 21.6% RTP results in sufficient margin to the required limits, and the Main Turbine Bypass System is not required to protect fuel integrity during the feedwater controller failure, maximum demand event. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

CLINTON B 3.7-26 Revision No. 7-5

AC Sources -Operating B 3.8.1 BASES ACTIONS A.2 (continued)

The second Completion Time for Required Action A.2 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition A is entered while, for instance, a DG is inoperable and that DG is subsequently returned OPERABLE, the LCO may already have been not met for up to 14 days. This situation could lead to a total of 17 days, since initial failure to meet the LCO, to restore the offsite circuit. At this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional 14 days (for a total of 31 days) allowed prior to complete restoration of the LCO. The 17-day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector between the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 17-day Completion Times for Required Action A.2 means that both Completion Times apply simultaneously, and the more restrictive must be met.

The Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

This exception results in establishing the "time zero" at the time the LCO was initially not met, instead of at the time that Condition A was entered.

B.1 To ensure a highly reliable power source remains, it is necessary to verify the availability of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions must then be entered.

(continued)

CLINTON B 3.8-6 Revision No. 7-1

AC Sources--Operating B 3.8.1 BASES ACTIONS B.4 i (continued) In Condition B, the remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E distribution system. Although Condition B applies to a single inoperable DG, several Completion Times are specified for this Condition.

The first Completion Time applies to an inoperable Division 3 DG. The 72-hour Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA during this period. This Completion Time begins only "upon discovery of an inoperable Division 3 DG" and, as such, provides an exception to the normal "time zero" for beginning the allowed outage time "clock" (i.e., for beginning the clock for an inoperable Division 3 DG when Condition B may have already been entered for another equipment inoperability and is still in effect).

The second Completion Time (14 days) applies to an inoperable Division 1 or 2 DG and is a risk-informed allowed out-of-service time (AOT) based on a plant-specific risk analysis performed to establish this AOT for the Division 1 and 2 DGs.

The risk analysis that supported the request assumed that a full, extended completion time (i.e., 14 days) is allowed once per DG per cycle. To mitigate increased risk during the extended DG AOT, the following actions will be performed.

"* Verification that the RAT and ERAT are operable.

"* Verification of the correct breakers alignment and indicated power availability for each offsite circuit.

"* The DG extended Completion Time will not be entered for scheduled maintenance purposes if severe weather conditions are expected.

"* Additional elective equipment maintenance or testing that/requires the equipment to be removed from service will be evaluated and activities that yield unacceptable results will be avoided.

"* The condition of the offsite power supply and switchyard, including transmission lines and ring bus breakers, will be evaluated.

"* No elective maintenance will be scheduled within the switchyard that would challenge the RAT connection or offsite power availability.

"* Operating crews will be briefed on the DG work plan with consideration given to actions that would be required in the event of a loss of offsite power or station blackout.

(continued)

CLINTON B 3.8-9 Revision No. 7-1

AC Sources--Operating B 3.8.1 BASES ACTIONS B.4 (continued)

The third Completion Time for Required Action B.4 established a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently restored OPERABLE, the LCO may already have been not met for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This situation could lead to a total of 17 days, since initial failure to meet the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (for a total of 20 days) allowed prior to complete restoration of the LCO. The 17-day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently.

The "AND" connector between the Completion Times means that the three Completion Times apply simultaneously, and the most restrictive Completion Time must be met.

As in Required Action B.2, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This exception results in establishing the "time zero" at the time the LCO was initially not met, instead of the time Condition B was entered.

C.1 and C.2 Required Action C.1 addresses actions to be taken in the event of concurrent failure of redundant required features.

Required Action C.1 reduces the vulnerability to a loss of function. The rationale for the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that two complete safety divisions are OPERABLE.

When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are designed with redundant safety related divisions (i.e.,

single division systems are not included in the list, although, for this Required Action, Division 3 is considered redundant to Division 1 and 2 ECCS). Redundant required features failures consist of any of these features that are inoperable, because any inoperability is on a division redundant to a division with inoperable offsite circuits.

(continued)

CLINTON B 3.8-10 Revision No. 7-1

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 (continued)

REQUIREMENTS Note 1 modifies this Surveillance to indicate that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized.

Note 2 modifies this Surveillance by stating that momentary transients because of changing bus loads do not invalidate this test.

Note 3 indicates that this Surveillance shall be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.

Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.

With regard to DG loading values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 19).

SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank is at or above the low level alarm setpoint.

The level is expressed as an equivalent volume in gallons, and is selected to ensure adequate fuel oil for a minimum of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of DG operation at maximum expected post LOCA loads.

The 31 day Frequency is adequate to assure that a sufficient supply of fuel oil is available, since low level alarms are provided and facility operators would be aware of any large uses of fuel oil during this period.

With regard to fuel oil level values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit~is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 20).

(continued)

CLINTON B 3.8-15 Revision No. 7-7

AC Sources--Operating B 3.8.1 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.

2. USAR, Chapter 8.

3. Regulatory Guide 1.9, Revision 2.

4. USAR, Chapter 6.

5. USAR, Chapter 15.

6. Regulatory Guide 1.93.

7. Generic Letter 84-15, July 2, 1984.

8. 10 CFR 50, Appendix A, GDC 18.

9. Regulatory Guide 1.108.

10. Regulatory Guide 1.137.

11. ANSI C84.1, 1982.

12. NUMARC 87-00, Revision 1, August 1991.

13. IEEE Standard 308.

14. IP Calculation 19-AN-19.

15. Regulatory Guide 1.9, Revision 3.

16. Calculation IP-C-0050.

17. Calculation IP-C-0051.

18. Calculation IP-C-0054.

19. Calculation IP-0-0114.

20. Calculation IP-C-0111.

21. Calculation IP-0-0106.

22. Calculation IP-0-0143.

23. Calculation IP-0-0110.

24. Calculation IP-0-0116.

CLINTON B 3.8-32a Revision No. 7-7

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.1 (continued)

REQUIREMENTS The 31 day Frequency is adequate to ensure that a sufficient supply of fuel oil is available, since low level alarms are provided and unit operators would be aware of any large uses of fuel oil during this period.

With regard to lube oil inventory values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).

SR 3.8.3.2 This Surveillance ensures that sufficient lube oil inventory is available to support at least 7 days of maximum expected post LOCA load operation for each DG. This minimum volume requirement is based on the DG manufacturer's consumption values for the run time of the DG. Implicit in this SR is the requirement to verify the capability to transfer the lube oil from its storage location to the DG when the DG lube oil sump does not hold adequate inventory for 7 days of maximum expected post LOCA load operation without the level reaching the manufacturer's recommended minimum level.

A 31 day Frequency is adequate to ensure that a sufficient lube oil supply is onsite, since DG starts and run times are closely monitored by the plant staff.

With regard to lube oil inventory values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).

SR 3.8.3.3 The tests of fuel oil prior to addition to the storage tanks are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate detrimental impact on diesel engine combustion and operation. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between the sample (and corresponding results) of new fuel and addition of new fuel oil to the storage tanks to exceed 31 days. The limits and applicable ASTM Standards for the (continued)

CLINTON B 3.8-45 Revision No. 7-7

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQUIREMENTS tests listed in the Diesel Fuel Oil Testing Program of Specification 5.5.9 are as follows:

a. Sample the new fuel oil in accordance with ASTM D4057-95 (Ref. 6);

b. Verify in accordance with the tests specified in ASTM D1298-99 (Ref. 6) that the sample has an absolute specific gravity at 60/60°F of Ž 0.83 and

0.87 (or an API gravity at 60OF of Ž 300 and

400), and in accordance with the tests specified in ASTM D975-986 (Ref. 6) that the sample has a kinematic viscosity at 40 0 C of 2 1.9 centistokes and

4.1 centistokes; and

c. Verify that the new fuel oil has clear and bright appearance with proper color when tested in accordance with ASTM D4176-93 (Ref. 6), or a water and sediment content

0.05 v/o when tested in accordance with ASTM D975-986.

Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO since the fuel oil is not added to the storage tanks.

Following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-986 (Ref. 6) are met for new fuel oil when tested in accordance with ASTM D975-986 (Ref. 6).

These additional analyses are required by Specification 5.5.9, Diesel Fuel Oil Testing Program, to be performed within 31 days following sampling and addition. This 31 days is intended to assure: 1) that the sample taken is not more than 31 days old at the time of adding the fuel oil to the storage tank, and 2) that the results of a new fuel oil sample (sample obtained prior to addition but not more than 31 days prior to) are obtained within 31 days after addition. The 31 day period is acceptable because the fuel oil properties of interest, even if not within stated limits, would not have an immediate effect on DG operation.

This Surveillance ensures the availability of high quality fuel oil for the DGs.

(continued)

CLINTON B 3.8-46 Revision No. 7-8

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.6 REQUIREMENTS Draining of the fuel oil stored in the supply tanks, removal of accumulated sediment, and tank cleaning are required at 10 year intervals by Regulatory Guide 1.137 (Ref. 2),

paragraph 2.f. This SR is typically performed in conjunction with the ASME Boiler and Pressure Vessel Code, Section XI (Ref. 7), examinations of the tanks. To preclude the introduction of surfactants in the fuel oil system, the cleaning should be accomplished using sodium hypochlorite solutions, or their equivalent, rather than soap or detergents. This SR is for preventive maintenance. The presence of sediment does not necessarily represent a failure of this SR provided that accumulated sediment is removed during performance of the Surveillance.

REFERENCES 1. USAR, Section 9.5.4.

2. Regulatory Guide 1.137.

3. ANSI N195, Appendix B, 1976.

4. USAR, Chapter 6.

5. USAR, Chapter 15.

6. ASTM Standards: D4057-95; D1298-99; D975-986; D4176-93; D2276-88.

7. ASME, Boiler and Pressure Vessel Code, Section XI.

8. Calculation IP-0-0120.

9. Calculation IP-0-0121.

10. Calculation IP-0-0122.

11. Calculation IP-C-0111.

CLINTON B 3.8-48a Revision No. 7-8

DC Sources--Operating B 3.8.4 BASES BACKGROUND The DC power distribution system is described in more detail (continued) in Bases for LCO 3.8.9, "Distribution Systems--Operating,"

and LCO 3.8.10, "Distribution Systems--Shutdown."

Each Division 1, 2, 3, and 4 battery has adequate storage capacity to meet the duty cycle(s) discussed in the USAR, Section 8.3.2 (Ref. 4). The battery is designed with additional capacity above that required by the design duty cycle to allow for temperature variations and other factors.

Each DC battery subsystem is separately housed in a ventilated room apart from its charger and distribution centers. Each subsystem is located in an area separated physically and electrically from the other subsystems to ensure that a single failure in one subsystem does not cause a failure in a redundant subsystem. There is no sharing between redundant Class 1E subsystems such as batteries, battery chargers, or distribution panels.

The batteries for a DC electrical power subsystem are sized to produce required capacity at 80% of nameplate rating.

The minimum design voltage limit is 105/210 V. The battery cells are flooded lead acid construction with a nominal specific gravity of 1.215. This specific gravity corresponds to an open circuit battery voltage of approximately 120 V for a 58-cell battery (i.e., cell voltage of 2.065 volts per cell (Vpc)). The open circuit voltage is the voltage maintained when there is no charging or discharging. Once fully charged with its open circuit voltage > 2.065 Vpc, the battery cell will maintain its capacity for 30 days without further charging per manufacturer's instructions. Optimal long-term performance, however, is obtained by maintaining a float voltage of 2.20 to 2.25 Vpc. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge.

The nominal float voltage of 2.22 Vpc corresponds to a total float voltage output of 128.8 V for a 58 cell battery as discussed in USAR 8.3.2 (Ref. 4).

Each battery charger of Division 1, 2, 3, and 4 DC electrical power subsystems has ample power output capacity for the steady state operation of connected loads required during normal operation, while at the same time maintaining its battery bank fully charged. Each battery charger has sufficient excess capacity to restore the battery bank from the design minimum charge to its fully charged state within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months while supplying normal steady state loads (Ref. 4).

The battery charger is normally in the float charge mode.

Float charge is the condition in which the charger is supplying the connected loads and the battery cells are (continued)

CLINTON B 3.8-50 Revision No. 6-5

DC Sources--Operating B 3.8.4 BASES BACKGROUND receiving adequate current to optimally charge the battery.

(continued) This assures the internal losses of a battery are overcome and the battery is maintained in a fully charged state.

When desired, the charger can be placed in the equalize mode. The equalize mode is at a higher voltage than the float mode and charging current is correspondingly higher.

The battery charger is operated in the equalize mode after a battery discharge or for routine maintenance.A Following a battery discharge, the battery recharge characteristic accepts current at the current limit of the battery charger (if the discharge was significant, e.g., following a battery service test) until the battery terminal voltage approaches the charger voltage setpoint. Charging current then reduces exponentially during the remainder of the recharge cycle.

Lead-calcium batteries have recharge efficiencies of greater than 95%, so once at least 105% of the ampere-hours discharged have been returned, the battery capacity would be restored to the same condition as it was prior to the discharge. This can be monitored by direct observation of the exponentially decaying charging current or by evaluating the amp-hours discharged from the battery and amp-hours returned to the battery.

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in the USAR, Chapter 6 (Ref. 5) and Chapter 15 (Ref. 6), assume that ESF systems are OPERABLE.

The DC electrical power system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation.

The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. As described in Ref. 4, only Division 1, Division 2, and Division 3 DC electrical power subsystems are assumed to be available for the safe shutdown analysis of the plant. These requirements include maintaining DC sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite AC power or of all onsite AC power; and

b. A worst case single failure.

The DC sources satisfy Criterion 3 of the NRC Policy Statement.

(continued)

CLINTON B 3.8-51 Revision No. 6-5

DC Sources--Operating B 3.8.4 BASES LCO The DC electrical power subsystems, each subsystem consisting of one battery, one battery charger, and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the divisions, are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. Loss of any DC electrical power subsystem does not prevent the minimum safety function from being performed (Ref. 4).

APPLICABILITY The DC electrical power sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure safe unit operation and to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.

The DC electrical power requirements for MODES 4 and 5 are addressed in the Bases for LCO 3.8.5, "DC Sources Shutdown."

ACTIONS A.1, A.2 and A.3 Condition A represents one division with one battery charger inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period. Required Action A.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability.

(continued)

CLINTON B 3.8-52 Revision No. 6-5

DC Sources-Operating B 3.8.4 BASES ACTIONS A.1, A.2 and A.3 (continued)

(continued) A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus, there is good assurance of fully recharging the battery within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , avoiding a premature shutdown with its own attendant risk.

If established battery terminal float voltage cannot be restored to greater than or equal to the minimum established float voltage within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , and the charger is not operating in the current-limiting mode, a faulty charger is indicated. A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide assurance that it can revert to and operate properly in the current limit mode that is necessary during the recovery period following a battery discharge event that the DC system is designed for.

If the charger is operating in the current limit mode after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged conditions in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged with 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (Required Action A.2).

Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps. This indicates that, if the battery had been discharged as the result of the inoperable battery charger, it has now been fully recharged. If at the expiration of the initial 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period, the battery float current is not less than or equal to 2 amps, this indicates there may be additional battery problems and the battery must be declared inoperable.

Required Action A.3 limits the restoration time for the inoperable battery charger to 7 days. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The output of the swing charger will be capable of being connected to any one of the Class 1E DC buses for Division 1, 2 or 4 using a 400 Amp disconnect switch. The connection through this switch will be provided with padlocks on the switches which will be administratively controlled to allow connection to only on of the Class 1E divisions at any time. The 7 day completion time reflects a reasonable time to effect restoration of the qualified battery charger to operable status.

(continued CLINTON B 3.8-53 Revision No. 7-2

DC Sources--Operating B 3.8.4 BASES ACTIONS (continued) B.1 Condition B represents one division with one battery inoperable. With one battery inoperable, the DC bus is being supplied by the OPERABLE battery charger. Any event that results in a loss of the AC buss supporting the battery charger will also result in loss of DC to that division.

Recovery of the AC bus, especially if it is due to a loss of offsite power, will be hampered by the fact that many of the components necessary for the recovery (e.g., diesel generator control and field flash, AC load shed and diesel generator output circuit breakers, etc.) likely rely upon the battery.

In addition, the energization transients of any DC loads that are beyond the capability of the battery charger and normally require the assistance of the battery will not be able to be brought online. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit allows sufficient time to effect restoration of an inoperable battery given that the majority of the conditions that lead to battery inoperability (e.g., loss of battery charger, battery cell voltage less than 2.07 V, etc.) are identified in Specifications 3.8.4, 3.8.5, and 3.8.6 together with additional specific completion times.

C.1 Condition A represents one division with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected division. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with the allowed time for an inoperable DC distribution system division.

If one of the required Division 1 or 2 DC electrical power subsystems is inoperable for reasons other than Condition A or B (e.g., inoperable battery charger and associated inoperable battery), the remaining DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst case single failure could, however, result in the loss of minimum necessary DC electrical subsystems, continued power operation should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is based on Regulatory Guide 1.93 (Ref. 7) and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.

(continued)

CLINTON B 3.8-54 Revision No. 6-5

DC Sources--Operating B 3.8.4 BASES ACTIONS (continued) D.1 With one or more Division 3 or 4 DC electrical power subsystems inoperable, the HPCS System may be incapable of performing its intended functions and must be immediately declared inoperable. This declaration also requires entry into applicable Conditions and Required Actions of LCO 3.5.1, "ECCS--Operating.

E.1 and E.2 If the inoperable DC electrical power subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. The Completion Time to bring the unit to MODE 4 is consistent with the time required in Regulatory Guide 1.93 (Ref. 7).

SURVEILLANCE SR 3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge helps to ensure the effectiveness of the battery chargers, which support the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery (or battery cell) and maintain the battery in a fully charged state while supplying the continuous steady state loads of the associated DC subsystem. On float charge, battery cells will receive adequate current to continually charge the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum float voltage established by the battery manufacturer (2.20 Vpc or 127.6 V at the battery terminals).

This voltage maintains the battery plates in a condition that supports maintaining the grid life (expected to be approximately 20 years). The 7 day Frequency is consistent with manufacturer's recommendations and IEEE-450 (Ref. 8).

With regard to battery terminal voltage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 12).

(continued)

CLINTON B 3.8-55 Revision No. 6-5

DC Sources -Operating B 3.8.4 BASES SURVEILLANCE REQUIREMENTS (continued) SR 3.8.4.2 This SR verifies the design capacity of the battery chargers. According to Regulatory Guide 1.32 (Ref. 9), the battery charger supply is recommended to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, irrespective of the status of the unit during these demand occurrences. The minimum required amperes and duration ensure that these requirements can be satisfied. This SR provides two options. One option requires that each battery charger be capable of supplying 300 amps for Divisions 1 and 2 (100 amps for Divisions 3 and 4) at the minimum established float voltage for 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The ampere requirements are based on the output rating of the chargers.

The voltage requirements are based on the charger voltage level after a response to a loss of AC power. The time period is sufficient for the charger temperature to have stabilized and to have been maintained for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

The other option requires that each battery charger be capable of recharging the battery after a service test coincident with supplying the largest coincident demands of the various continuous-steady state loads (irrespective or the status of the plant during which these demands occur).

This level of loading may not normally be available following the battery service test and will need to be supplemented with additional loads. The duration for this test may be longer than the charger sizing criteria since the battery recharge is affected by float voltage, temperature, and the exponential decay in charging current.

The battery is recharged when the measured charging current is < 2 amps.

The Surveillance Frequency is acceptable, given the unit conditions required to perform the test and the other administrative controls existing to ensure adequate charger performance during these 18 month intervals. In addition, this Frequency is intended to be consistent with expected fuel cycle lengths.

With regard to minimum required amperes and duration values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 12).

(continued)

CLINTON B 3.8-56 Revision No. 6-5

DC Sources -Operating B 3.8.4 BASES SURVEILLANCE _SR 3.8.4.3 REQUIREMENTS (continued)

A battery service test is a special test of the battery's capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length are established with a dummy load that corresponds to the design duty cycle requirements as specified in Reference 4.

The Surveillance Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.32 (Ref. 9) and Regulatory Guide 1.129 (Ref. 10), which state that the battery service test should be performed during refueling operations or at some other outage, with intervals between tests not to exceed 18 months.

This SR is modified by two Notes. Note 1 allows the performance of a modified performance discharge test SR 3.8.6.6 in lieu of SR 3.8.4.3. This substitution is acceptable because SR 3.8.6.6 represents an equivalent test of battery capability as SR 3.8.4.3. The reason for Note 2 is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. Credit may be taken for unplanned events that satisfy the Surveillance. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and 2)- Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

With regard to battery capacity values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).

(continued)

CLINTON B 3.8-57 Revision No. 6-5

DC Sources--Operating B 3.8.4 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.

2. Regulatory Guide 1.6, March 10, 1971.

3. IEEE Standard 308, 1978.

4. USAR, Section 8.3.2.

5. USAR, Chapter 6.

6. USAR, Chapter 15.

7. Regulatory Guide 1.93, December 1974.

8. IEEE Standard 450, 1995.

9. Regulatory Guide 1.32, February 1977.

10. Regulatory Guide 1.129, December 1974.

11. Calculation IP-0-0123.

I CLINTON B 3.8-58 Revision No. 6-5

DC Sources--Shutdown B 3.8.5 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.5 DC Sources--Shutdown BASES BACKGROUND A description of the DC sources is provided in the Bases for LCO 3.8.4, "DC Sources--Operating."

APPLICABLE The initial conditions of Design Basis Accident and SAFETY ANALYSES transient analyses in the USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume that Engineered Safety Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation.

The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum DC electrical power sources during MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary or secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident.

The DC sources satisfy Criterion 3 of the NRC Policy Statement.

LCO One DC electrical power subsystem (consisting of one battery, one battery charger, and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the division) associated with the (continued)

CLINTON B 3.8-59 Revision No. 6-5

DC Sources--Shutdown B 3.8.5 BASES LCO Division 1 or Division 2 onsite Class 1E DC electrical power (continued) distribution subsystem(s) required OPERABLE by LCO 3.8.10, "Distribution Systems - Shutdown," is required to be OPERABLE. Similarly, when the High Pressure Core Spray (HPCS) System is required to be OPERABLE, the Division 3 and Division 4 DC electrical power subsystems associated with the Division 3 and Division 4 onsite Class IE DC electrical power distribution subsystems required OPERABLE by LCO 3.8.10 are required to be OPERABLE. In addition to the preceding subsystems required to be OPERABLE, a Class 1E battery or battery charger and the associated control equipment and interconnecting cabling capable of supplying power to the remaining Division 1 or Division 2 onsite Class 1E DC electrical power distribution subsystem(s), when portions of both Division 1 and Division 2 DC electrical power distribution subsystems are required to be OPERABLE by LCO 3.8.10. This ensures the availability of sufficient DC electrical power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents and inadvertent reactor vessel draindown).

APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary or secondary containment provide assurance that:

a. Required features to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core in case of an inadvertent draindown of the reactor vessel;

b. Required features needed to mitigate a fuel handling accident are available;

c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The DC electrical power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.4.

(continued)

CLINTON B 3.8-60 Revision No. 6-5

DC Sources--Shutdown B 3.8.5 BASES ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require reactor shutdown.

A.1, A.2, and A.3 Condition A represents one division with one battery charger inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period. Required Action A.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring the battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability. A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus, there is good assurance of fully recharging the battery within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , avoiding a premature shutdown with its own attendant risk.

If established battery terminal float voltage cannot be restored to greater than or equal to the minimum established float voltage within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , and the charger is not operating in the current-limiting mode, a faulty charger is indicated. A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide assurance that it can revert to and operate properly in the current limit mode that is necessary during the recovery period following a battery discharge event that the DC system is designed for.

If the charger is operating in the current limit mode after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition in (continued)

CLINTON B 3.8-61 Revision No. 6-5

DC Sources--Shutdown B 3.8.5 BASES ACTIONS A.1, A.2, and A.3 (continued)

(continued) this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (Required Action A.2).

Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps. This indicates that, if the battery and been discharged as the results of the inoperable battery charger, it has now been fully recharged. If, at the expiration of the initial 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period, the battery float current is not less than or equal to 2 amps, this indicates there may be additional battery problems and the battery must be declared inoperable.

Required Action A.3 limits the restoration time for the inoperable battery charger to 7 days. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The 7 day completion time reflects a reasonable time to effect restoration of the qualified battery charger to operable status.

B.1, B.2.1, B.2.2, B.2.3, and B.2.4 If more than one DC distribution subsystem is required according to LCO 3.8.10, the DC subsystems remaining OPERABLE with one or more DC power sources inoperable may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, fuel movement, and operations with a potential for draining the reactor vessel.

By allowing the option to declare required features inoperable with associated DC power source(s) inoperable, appropriate restrictions are implemented in accordance with the affected system LCOs' ACTIONS. In many instances this option may involve undesired administrative efforts.

Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and any activities that could result in inadvertent draining of the reactor vessel).

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.

These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystems and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the plant safety systems.

(continued)

CLINTON B3 3.8-62 Revision No. 6-5

DC Sources--Shutdown B 3.8.5 BASES ACTIONS The Completion Time of immediately is consistent with the (continued) required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystems should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power.

SURVEILLANCE SR 3.8.5.1 REQUIREMENTS SR 3.8.5.1 requires performance of all Surveillances required by SR 3.8.4.1 through SR 3.8.4.8. Therefore, see the corresponding Bases for LCO 3.8.4 for a discussion of each SR.

This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC sources from being discharged below their capability to provide the required power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that these SRs must still be capable of being met, but actual performance is not required.

REFERENCES 1. USAR, Chapter 6.

2. USAR, Chapter 15.

CLINTON B 3.8-63 Revision No. 6-5

Battery Parameters B 3.8.6 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.6 Battery Parameters BASES BACKGROUND This LCO delineates the limits on battery float current as well as electrolyte temperature, level and float voltage for the DC power source batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC Sources -Operating," and LCO 3.8.5, "DC Sources--Shutdown."

In addition to the limitations of this Specification, the "Battery Maintenance and Monitoring Program," specified in Specification 5.5.14, is a program that monitors various battery parameters based on the recommendations of IEEE Standard 450-1995, "IEEE Recommended Practice for Maintenance, Testing, and Replacement of Vented Lead-Acid Batteries for Stationary Applications" (Ref. 3).

The battery cells are of flooded lead acid construction with a nominal specific gravity of 1.215. This specific gravity corresponds to an open circuit battery voltage of approximately 120 V for a 58-cell battery (i.e., cell voltage of 2.065 Volts per cell (Vpc)). The open circuit voltage is the voltage maintained when there is no charging or discharging. Once fully charged with its open circuit voltage > 2.065 Vpc, the battery cell will maintain its capacity for 30 days without further charging per manufacturer's instructions. Optimal long-term performance however, is obtained by maintaining a float voltage 2.20 to 2.25 Vpc. This provides adequate overpotential which limits the formation of lead sulfate and self discharge. The nominal float voltage of 2.22 Vpc corresponds to a total float voltage output of 128.8 V for a 58-cell battery as discusses in the USAR, Section 8.3.2 (Ref. 6).

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE. The DC electrical power subsystems provide normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation.

The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining at least one division of DC sources OPERABLE during accident conditions, in the event of:

a. An assumed loss of all offsite AC power or all onsite AC power; and

b. A worst case single failure.

(continued)

CLINTON B 3.8-64 Revision No. 6-5

I Battery Parameters B 3.8.6 BASES APPLICABLE SAFETY Since battery parameters support the operation of the ANALYSES DC power sources, they satisfy Criterion 3 of the NRC (continued) Policy Statement.

LCO Battery parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA.

Battery parameter limits are conservatively established, allowing continued DC electrical system function even with limits not met.

Additional preventive maintenance, testing, and monitoring is performed in accordance with the 'Battery Maintenance and Monitoring Program" as specified in Specification 5.5.14.

APPLICABILITY The battery parameters are required solely for the support of the associated DC electrical power subsystem. Therefore, battery parameter limits are only required when the DC power source is required to be OPERABLE. Refer to the Applicability discussion in Bases for LCO 3.8.4 and LCO 3.8.5.

ACTIONS A.1, A.2, and A.3 With parameters of one or more cells in a battery in one division < 2.07 V, the battery cell is degraded. Within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage (SR 3.8.4.1) and of the overall battery state of charge by monitoring the battery float charge current (SR 3.8.6.1). This assures that there is still sufficient battery capacity to perform the intended function.

Therefore, the affected battery is not required to be considered inoperable solely as a result of one or more cells in one or more batteries < 2.07 V, and continued operation is permitted for a limited period up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Since the Required Actions only specify "perform," a failure of SR 3.8.4.1 or SR 3.8.6.1 acceptance criteria does not result in this Required Action not met. However, if one of the SRs is failed, the appropriate Condition(s), depending on the cause of the failures, is entered. If SR 3.8.6.1 is failed, then there is not assurance that there is still sufficient battery capacity to perform the intended function and the battery must be declared inoperable immediately.

(continued)

CLINTON B 3.8-65 Revision No. 6-5

Battery Parameters B 3.8.6 BASES ACTIONS B.l and B.2 (continued)

A battery in one division with float current > 2 amps indicates that a partial discharge of the battery capacity has occurred. This may be due to one or more battery cells in a low voltage condition reflecting some loss of capacity.

Within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage. If the terminal voltage is found to be less than the minimum established float voltage, there are two possibilities: the battery charger is inoperable, or is operating in the current limit mode. Condition A addressed charger inoperability. If the charger is operating in the current limit mode after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , that is an indication that the battery has been substantially discharged and likely cannot perform its required design functions. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (Required Action B.2). The battery must therefore be declared inoperable.

If the float voltage is found to be satisfactory but there are one or more battery cells with float voltage less than 2.07 V, the associated "OR" statement in Condition F is applicable and the battery must be declared inoperable immediately. Plant analysis has demonstrated that each battery charger has sufficient capacity to restore the battery bank from the design minimum charge to its fully charged state within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months while supplying normal steady state loads. Therefore, if float voltage is satisfactory and there are no cells less than 2.07 V, there is good assurance that, within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , the battery will be restored to its fully charged condition (Required Action B.2) from any discharge that might have occurred due to a temporary loss of the battery charger. A discharged battery with float voltage (the charger setpoint) across its terminals, indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus, there is good assurance of fully recharging the battery within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , avoiding a premature shutdown with its own attendant risk.

If the condition is due to one or more cells in a low voltage condition but is still greater than 2.07 V, and float voltage is found to be satisfactory, this is not (continued)

CLINTON B 3.8-66 Revision No. 6-5

Battery Parameters B 3.8.6 BASES ACTIONS B.1 and B.2 (continued)

(continued) indication of a substantially discharged battery and 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is a reasonable time prior to declaring the battery inoperable. Since Required Action B.1 only specifies "perform", a failure of SR 3.8.4.1 acceptance criteria does not result in the Required Action not met. However, if SR 3.8.4.1 is failed, the appropriate Condition(s), depending on the cause of the failure, is entered.

C.1, C.2 and C.3 With a battery in one division with one or more cells electrolyte level above the top of the plates, but below the minimum established design limits, the battery still retains sufficient capacity to perform the intended function. Therefore, the affected battery is not required to be considered inoperable solely as a result of electrolyte level not met. Within 31 days, the minimum established design limits for electrolyte level must be re established.

With electrolyte level below the top of the plates, there is a potential for dryout and plate degradation. Required Actions C.1 and C.2 address this potential (as well as provisions in Specification 5.5.14, Battery Monitoring and Maintenance Program). They are modified by a note that indicates they are only applicable if electrolyte level is below the top of the plates. Within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , level is required to be restored to above the top of the plates. The Required Action C.2 requirement to verify that there is no leakage by visual inspection and the Specification 5.5.14, Item b, to initiate action to equalize and test in accordance with manufacturer's recommendation are taken from Annex D of IEEE Standard 450-1995. They are performed following the restoration of the electrolyte level to above the top of the plates. Based on the results of the manufacturer's recommended testing, the battery may have to be declared inoperable and the affected cell(s) replaced.

D.1 With a battery in one division with pilot cell temperature less than the minimum established design limits, 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is Allowed to restore the temperature to within limits. A low Electrolyte temperature limits the current and power available. Since the battery is sized with margin, while battery capacity is degraded, sufficient capacity exists to perform the intended function and the affected battery is not required to be considered inoperable solely as result of the pilot cell temperature not met.

(continued)

CLINTON B 3.8-67 Revision No. 6-5

Battery Parameters B 3.8.6 BASES ACTIONS (continued) E.1 Batteries in redundant trains with battery parameters not within limits, there is not sufficient assurance that battery capacity has not been affected to the degree that the batteries can still perform their required function, given that redundant batteries are involved. With redundant batteries involved, this potential could result in a total loss of function on multiple systems that rely upon the batteries. The longer completion times specified for battery parameters on non-redundant batteries not within limits are therefore not appropriate, and the parameters must be restored to within limits on at least one train within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

F.1 When any battery parameter is outside the allowances of the Required Actions for Condition A, B, C, D, or E, sufficient capacity to supply the maximum expected load requirement is not assured and the corresponding battery must be declared inoperable. Additionally, discovering a battery in one train with one or more battery cells float voltage less than 2.07 V and float current greater tan 2 amps, indicates that the battery capacity may not be sufficient to perform the intended functions. The battery must therefore be declared inoperable immediately.

SURVEILLANCE SR 3.8.6.1 REQUIREMENTS Verifying battery float current while on float charge is used to determine the state of charge of the battery. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a charged state. The float current requirements are based on the float current indicative of a charged battery. Use of float current to determine the state of charge of the battery is consistent with IEEE Standard 450-1995 (Ref. 3). The 7 day frequency is consistent with IEEE Standard 450-1995.

This SR is modified by a Note that states the float current requirement is not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 3.8.4.1. When this float voltage is not maintained, the Required Actions of LCO 3.8.4, ACTION A, are being taken, which provide the necessary and appropriate verifications of the battery condition. Furthermore, the float current limit of 2 amps is established based on the nominal float voltage value and is not directly applicable when this voltage is not maintained.

(continued)

CLINTON B 3.8-G8 Revision No. 6-5

Battery Parameters B 3.8.6 BASES SURVEILLANCE SR 3.8.6.2 and 3.8.6.5 REQUIREMENTS (continued) Optimal long-term battery performance is obtained by maintaining a float voltage greater than or equal to the minimum established design limits provided by the battery manufacturer, which corresponds to 127.6 V at the battery terminals, or 2.20 Vpc. This provides adequate overpotential, which-limits the formation of lead sulfate and self discharge, which could eventually render the battery inoperable. Float voltage, in this range or less, but greater than 2.07 Vpc, are addressed in Specification 5.5.14. SRs 3.8.6.2 and 3.8.6.5 require verification that the cell float voltages are equal to or greater than the short-term absolute minimum voltage of 2.07 V. The Frequency for cell voltage verification every 31 days for pilot cell and 92 days for each connected cell is consistent with IEEE Standard 450-1995 (Ref. 3).

SR 3.8.6.3 The limit specified for electrolyte level ensures that the plates suffer no physical damage and maintains adequate electron transfer capability. The Frequency is consistent with IEEE 450-1995 (Ref. 3).

SR 3.8.6.4 This surveillance verifies that the pilot cell temperature is greater than or equal to the minimum established design limit (i.e., 65 degrees F). Pilot cell electrolyte temperature is maintained above this temperature to assure the battery can provide the required current and voltage to meet the design requirements. Temperatures lower than assumed in battery sizing calculations act to inhibit or reduce battery capacity. The Frequency is consistent with IEEE 450-1995 (Ref. 3).

SR 3.8.6.6 A battery performance test is a test of constant current capacity of a battery, normally done in the as-found condition, after having been in service, to detect any change in the capacity determined by the acceptance test.

The test is intended to determine overall battery degradation due to age and usage.

The acceptance criteria for this Surveillance is consistent with IEEE Standard 450-1995 (Ref. 3) and IEEE Standard 485 (Ref. 5). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even there is ample capacity to (meet the load requirements. Furthermore, the battery is (continued)

CLINTON B 3.8-68a Revision No. 6-5

II Battery Parameters B 3.8.6 BASES SURVEILLANCE SR 3.8.6.6 (continued)

REQUIREMENTS (continued) sized to meet the assumed duty cycle loads when the battery design capacity reaches this 80% limit.

The Surveillance Frequency for this test is normally 60 months. If the battery shows degradation, or if the battery has reached 85% of its expected life, the Surveillance Frequency is reduced to 18 months. Degradation is indicated, according to IEEE Standard 450 (Ref. 3), when the battery capacity drops by more than 10% relative to its capacity on the previously performance test or when it is

> 10% below the manufacturer's rating. These Frequencies are based on the recommendations in IEEE Standard 450 (Ref.

3).

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. Credit may be taken for unplanned events that satisfy the Surveillance. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

REFERENCES 1. USAR, Chapter 6.

2. USAR, Chapter 15.

3. IEEE Standard 450, 1995.

4. Calculation IP-0-0123.

5. IEEE Standard 485, 1983

6. USAR, Chapter 8.

CLINTON B 3.8-68b Revision No. 6-5

Refueling Equipment Interlocks B 3.9.1 BASES (continued)

APPLICABILITY In MODE 5, a prompt reactivity excursion could cause fuel damage and subsequent-release of radioactive material to the environment. The refueling equipment interlocks protect against prompt reactivity excursions during MODE 5. The interlocks are only required to be OPERABLE during in-vessel fuel movement with refueling equipment associated with the interlocks.

In MODES 1, 2, 3, and 4, the reactor pressure vessel head is on, and no fuel loading activities are possible. Therefore, the refueling interlocks are not required to be OPERABLE in these MODES.

ACTIONS A.1, A.2.1 and A.2.2 With one or more of the required refueling equipment interlocks inoperable, the unit must be placed in a condition in which the LCO does not apply (Required Action A.l), or the interlocks are not needed (Required Action A.2). Therefore, Required Action A.1 requires that in-vessel fuel movement with the affected refueling equipment must be immediately suspended. This action ensures that operations are not performed with equipment that would potentially not be blocked from unacceptable operations (e.g., loading fuel into a cell with a control rod withdrawn). Suspension of in-vessel fuel movement shall not preclude completion of movement of a component to a safe position.

Alternatively, Required Action A.2.1 and A.2.2 require a control rod withdrawal block to be inserted, and required verification that all control rods be fully inserted.

Required Action A.2.1 ensures no control rods can be withdrawn, because a block to control rod withdrawal is in place. The withdrawal block utilized must ensure that if it will remain inserted). Required Action A.2.2 is performed after placing the rod withdrawal block in effect, and provides verification that all control rods are fully inserted. This verification that all control rods are fully inserted is in addition to the periodic verifications required by SR 3.9.3.1. The preferred condition is to have the interlocks OPERABLE prior to use, and to rely on these alternative actions in the event of an emergent failure.

Like Required Action A.1, Required Actions A.2.1 and A.2.2 ensure unacceptable operations are blocked (e.g., loading fuel into a cell with the control rod withdrawn).

(continued)

CLINTON B 3.9-3 Revision No. 7-4

Refueling Equipment Interlocks B 3.9.1 BASES (continued)

SURVEILLANCE SR 3.9.1.1 REQUIREMENTS Performance of a CHANNEL FUNCTIONAL TEST demonstrates each required refueling equipment interlock will function properly when a simulated or actual signal indicative of a required condition-is injected into the logic. The test also verifies the relative accuracy of the instrumentation. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The CHANNEL FUNCTIONAL TEST may be performed by any series of sequential, overlapping, or total channel steps so that the entire channel is tested.

The 7 day Frequency is based on engineering judgment and is considered adequate in view of other indications of refueling interlocks and their associated input status that are available to unit operations personnel.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. USAR, Section 7.6.1.1.

3. USAR, Section 15.4.1.1.

CLINTON B 3.9-4 Revision No. 7-4

U-603588, Transmittal of Revision 7 to Clinton Power Station Technical Specification Bases

Text

Subject:

Navigation menu

U-603588, Transmittal of Revision 7 to Clinton Power Station Technical Specification Bases

Text

Subject:

Navigation menu

Search